<div dir="ltr">Thanks for the response. The Cookies path defaulting to path=/ is OK because that's where my application resides (in fact, I explicitly set the cookieProp in the shib config to path=/). However, I can't require Shibsession for / due to legacy constraints. I agree that Shib SP doesn't see the request to / because nothing tells the webserver to require SP for / which is exactly how I want it. However, by inpsection I determined that HTTP_COOKIE=_shibsession_randomstring=SHIB_SESSION_ID and so was hoping to use the SHIB_SESSION_ID to get attributes previously exported to the session cache during the initial access to /secure. Is that possible? </div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Apr 17, 2015 at 11:37 AM, Peter Schober <span dir="ltr"><<a href="mailto:peter.schober@univie.ac.at" target="_blank">peter.schober@univie.ac.at</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">* Guy Tadi <<a href="mailto:tadiguy812@gmail.com">tadiguy812@gmail.com</a>> [2015-04-17 17:12]:<br>
<span>> The approach I'm considering now is to force sessions that require Shib<br>
> authentication to /secure as defined in RequestMapper "<Path name="secure"<br>
> When the browser hits /secure it establishes a Shib session and I can<br>
> see all the Shib session attributes. One subsequent access to the<br>
> application path (which is not in /secure) I'd like to get access to the<br>
> Shib attributes but all I see is the session cookie which is<br>
> understandable.<br>
<br>
</span>cookieProps defaults to setting HTTP Cookies with a path=/ so it's not<br>
about the cookie, but that the Shib SP doesn't "see" the request when<br>
nothing tells the websever that it should involve the SP. E.g. for<br>
httpd adding this would do it. Check the docs for others:<br>
<Location /><br>
AuthType shibboleth<br>
Require shibboleth<br>
</Location><br>
<span><br>
> As expected the attributes are no longer in that particular session<br>
> environment since the access is not to /secure, but the<br>
> SHIB_SESSION_ID is.<br>
<br>
</span>That's not expected, only a slight misconfiguration of your system.<br>
<span class="HOEnZb"><font color="#888888">-peter<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</font></span></blockquote></div><br></div>