Shibboleth Developers

[André Cruz <>]

Hello.

I configured the SSO cookie setting and thought everything was  
working correctly but then I noticed that, even though browsers were  
being redirected to the protected SSO path, no cookie was being set  
for subsequent requests.

I took a look at the code (src/edu/internet2/middleware/shibboleth/ 
idp/provider/SSOHandler.java) and, if I'm not mistaken, the cookie  
will never be set.

The cookie is only set if username is not null and we're on the  
protected path. The first time username will be null, and the next  
time we will not be in the protected path since we already have the  
username in the session... Unless we get to a different front-end in  
which case the auth is asked again since there is no username or cookie.

Am I doing something wrong?

Regards,
André