Shibboleth Developers

[Petra Berg <>]

Hi,

Mr. Mark Martin posted the problem 'Oddness when logging in from
multiple browser tabs (IE and Firefox)' into the user group (Sept.,
17th), we had to resolve the same problem.

Since the passing from one IdP module to the other is done by HTTP
redirect and the loginContextKey is stored in a cookie, for all requests
in the same session the cookie will be overwritten. One solution for
this problem could be passing the loginContextKey as parameter through
the modules including the login jsp page.
If done this way every login page, displayed in it's own browser tab has
it's own loginContextKey.

Next thing is refreshing a login-page, where the authentication finished
already in an other browser tab. In this case the loginContext need to
be reseted and the 'PreviousSession'- Handler need to be uses instead.

I have done this on the IdP project (java-idp tags/2.2.0) with the
UsernamePasswordLoginHandler and made a patch (see attachment).

By the way I inserted code in the HttpServletHelper:bindLoginContext to
catch existing loginContext and remove or reuse it in the Storage,
because there is a case where an existing loginContext with ContextKey
is ignored and a new one is created and stored in the storage and
cookie. Than the old one need to be removed by the garbage collector of
storage module, because the key is unknown.

Kind regards,
Petra

-- 
___________________________________________________________________

Petra Berg                          Humboldt-Universitaet zu Berlin
Tel.: +49 (0)30-2093 70155          ZE Computer- und Medienservice
Fax:  +49 (0)30-2093 2704           Unter den Linden 6

         D-10099 Berlin
___________________________________________________________________

Attachment: idp-2.2.0-multi_tab-patch.diff.zip
Description: Zip archive

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature