Shibboleth Developers

[André Cruz <>]

On 2007/07/19, at 16:03, Scott Cantor wrote:

> > The cookie is only set if username is not null and we're on the
> > protected path. The first time username will be null, and the next
> > time we will not be in the protected path since we already have the
> > username in the session... Unless we get to a different front-end in
> > which case the auth is asked again since there is no username or  
> > cookie.
>
> I'm not following you here. The cookie can't be set until  
> REMOTE_USER is,
> obviously. The first time, yes, it's null, but you do go to the  
> protected
> path because if you're on the naked path, REMOTE_USER won't be set...

The problem on my side is that:

ServletPath = /AuthSSO
ProtectedPath = /shibboleth-idp/AuthSSO

So this condition is never true:

 if (request.getServletPath().endsWith(support.getIdPConfig 
().getProtectedPath())) {

Shouldn't it be the other way arround? ProtectedPath endsWith  
ServletPath ?

Regards,
André