Shibboleth Developers

["Samuel Cochran" <>]

On 7/19/07, André Cruz 
<>
 wrote:
> I configured the SSO cookie setting and thought everything was
> working correctly but then I noticed that, even though browsers were
> being redirected to the protected SSO path, no cookie was being set
> for subsequent requests.
>
> I took a look at the code (src/edu/internet2/middleware/shibboleth/
> idp/provider/SSOHandler.java) and, if I'm not mistaken, the cookie
> will never be set.
>
> The cookie is only set if username is not null and we're on the
> protected path. The first time username will be null, and the next
> time we will not be in the protected path since we already have the
> username in the session... Unless we get to a different front-end in
> which case the auth is asked again since there is no username or cookie.

I thought cookie authentication was for use when you want to set a
cookie in an external authentication web application using strong
encryption which Shibboleth would read, validate, authorize and
look-up / release attributes. This was from reading the source code.

Sam.