Shibboleth Developers

[Velpi <>]

> http://svn.middleware.georgetown.edu/view/trunk/src/edu/internet2/middleware/shibboleth/idp/authn/AuthenticationHandler.java?root=java-idp&view=markup 

> Comments/Questions?

----
AuthentcationHandlers <strong>MUST NOT</strong> change or add any data 
to the user's {@link HttpSession} that persists past the process of 
authenticating the user, that is no additional session data may be added 
and no existing session data may be changed when the handler redirects 
back to the return location.
----

This may a problem in some cases where deep integration is required. Is 
there a special reason why modifying the session is prohibited or is it 
just a precaution? ("you have been warned"?)


-- Velpi