Shibboleth Developers

[Scott Cantor <>]

André Cruz wrote:
> I looked at the shibboleth.xml.in config in the svn and found the 
> SessionCache (lots of contexts with small size) and ReplayCache (one big 
> context). Also I found the ArtifactMap which also seems to use a 
> StorageService. What is the behavior of this particular cache? Are there 
> any more caches I should me aware?

The ArtifactMap uses a single context, so it's about the same as the 
ReplayCache, I guess even more so. There's also an option to manage 
relay state using storage, and that's also one context, I believe.

I can't think of anything else offhand that is calling into the API, but 
you'd have to search the code.

Only the session cache is doing anything unusual with it, I was dead set 
on using the one API for everything but the session cache is the hardest 
to pull that off with.

> Also, from the ShibDevCPPSP and the commit logs of the rest of the 
> repositories I can see that the single logout functionality is not even 
> started yet so I guess it will not be present in the beta build released 
> this week.

My laptop is dead, and the VM host I was using for getting a Unix build 
ready is also out at the moment, so the chances of me getting a release 
out this week are fading rapidly. But no, I haven't started on it.

> In the wiki it is mentioned that strategies will be discussed 
> in Chicago F2F but searching for "Chicago F2F" yields some interesting 
> results, albeit not relevant to this discussion. :)

The notes aren't public that I know of, they're unreadable in their raw 
form. If there's something you want to know, you can ask. Chances are if 
you're thinking that some aspect of it will be hard and require 
applications to do a lot of work (which they will not), you'd be right.

> So... When can we expect this to be developed? I had to implement a 

I haven't made any secret of the fact that I think logout is generally 
unusable, so you can expect that it will be the last piece I write. I'm 
also hesitant to go very far with it until the IdP part is underway so I 
can make sure it fits together.

The part that I need to do quickly is figuring out how I'm going to 
implement cache lookup by NameID. My guess is that's not going to work 
well, so I need to find that out sooner rather than later.

-- Scott