Shibboleth Developers

[Scott Cantor <>]

> As Jim mentions, we found with our WebISO (Bluestem) that we had to
> disable the IP check -- too often users were coming in from ISPs or from 
> corporate settings (doing internships) where their IP kept changing during
> a session.

Our WebISO is a sort of copy of Bluestem, more or less, but we've only had a
couple of applications where it became enough of a problem to justify
removing the check, mostly the more employee-oriented stuff, while most of
our apps tend to be student-oriented.

I get the serious willies turning it off, I know in the abstract it's harder
to steal cookies between domains, but it's not impossible.

-- Scott