<div dir="ltr">I believe that the tomcat session cookie would be global to the two domains. That is basically how we handle it. I'm wondering if we really need Shibboleth. Maybe we simply need to use something like OpenSaml to open up a secure page within our app that Salesforce can post an AuthnRequest to. When the user has logged on then we would format a Response back to Salesforce. We don't need a large Federated SSO solution. This is admittedly very specialized and narrow.</div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Dec 31, 2014 at 1:47 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">> Does that work or am I off base? If I'm off base, can you give me any<br>
> suggestions.<br>
<br>
</span>It works at a high level, but you're glossing over the fact that passing control to some other system and back *is* SSO. You can't just do a redirect there. That requires a SSO protocol. Like, say, SAML. Or CAS. Or making the cookies on <a href="http://app.mysite.com" target="_blank">app.mysite.com</a> global to <a href="http://mysite.com" target="_blank">mysite.com</a> and then implementing a security mechanism within the cookie to prevent tampering. Etc.<br>
<div class="HOEnZb"><div class="h5"><br>
-- Scott<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div>