Shibboleth Developers

["Scott Cantor" <>]

> Well, not quite.  First of all, correlation of sequential activities 
> can't be done with transaction IDs (unless you have access to the IdP 
> logs).

Yeah, but access to those logs and access to the history of IDs isn't that
different, since you'd need the logs anyway to know when a given ID was
used.

> What I'm concerned about WRT keeping histories of ePTIDs is 
> an SP coming back after I "wipe the slate clean" and asking the IdP 
> for the current ePTID associated with a former ePTID.  In other 
> words, making moot my feeble attempt at dissociation.

I think that's policy, but I don't know if I'd favor permanent retention
either. Whatever reason for knowing the history, there should be a point
where you don't need it.

-- Scott