Shibboleth Developers

["Scott Cantor" <>]

> Now, that said, I'm not sure why a developer would need to touch the 
> *IdP* session in order to integrate with another AuthN system.  I can 
> understand them needing to touch the session from the something like 
> another SSO system, but that's not what I'm talking about here.  I'm 
> only referring to the HttpSession maintained by the IdP.

In other words, this restriction doesn't preclude the handler dropping
cookies on its own, but it can't manipulate any state associated with the
IdP's cookie?

Also, correct me if I'm wrong, but I think the IdP session you're talking
about is using its own session mechanism (to make sure clustering is
handled) and not the servlet session.

-- Scott