<div dir="ltr">Hmmm, right I see. I was under the impression, somehow, that the cookie contained some verifiable information from the idP/SP required to setup the session. Is there no way to accomplish this without a shared SP or session storage? I would think that if the second, physically separate, SP sends me back to the idP it would be able to see that I was already authenticated and just send me back with an assertion to the second ACS URL without prompting for credentials. Otherwise I may look into the tcp/ODBC options.<div>
<br></div><div>Unfortunately I don't have control over the idP, but I will certainly enquire into multi-factor authentication on that end.</div><div><br></div><div>-Greg</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">
On Fri, Jun 13, 2014 at 12:11 PM, Peter Schober <span dir="ltr"><<a href="mailto:peter.schober@univie.ac.at" target="_blank">peter.schober@univie.ac.at</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
* Greg Zapp <<a href="mailto:greg.zapp@gmail.com">greg.zapp@gmail.com</a>> [2014-06-13 01:58]:<br>
<div class="">> I read that setting "Domain=.<a href="http://domain.com" target="_blank">domain.com</a>;" as a cookie property may get what<br>
> I want as these share a common top-level domain? Then I might just need to<br>
> associate multiple ACS endpoints with my relying party?<br>
<br>
</div>If there's more than one server involved, though, and you don't intend<br>
to share the Shib SPs' sessions across those (e.g. via a shared shibd<br>
process or via ODBC) merely scoping the SP's session cookie to the<br>
common domain will not get you anywhere.<br>
The cookie is just a reference to a session in of of the SP's storage<br>
services, i.e. without a session at the server sharing the cookie<br>
across servers achieves nothing.<br>
<div class=""><br>
> One particular site(the IIS) site uses multi-factor authentication<br>
> as well.. We may be able to modify this though to just accept the<br>
> shibboleth authenticated connection and then prompt for the token<br>
> before the application session is initiated.<br>
<br>
</div>That's one way. The other would be to MFA-enable the IDP and let any<br>
SPs that care check the authnContextClass used.<br>
<div class="HOEnZb"><div class="h5">-peter<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div>