Shibboleth Developers

["Cantor, Scott E." <>]

> > Don't focus on sessionid, in SSL3 and later. Work with the channel binding
> > that cues off the finished messages (not the endpoint certs).
> 
> Even if we understood how that would work, Java doesn't expose that
> message.

Actually, thinking about this, AFAIK, the server end of a bound TLS channel 
has to be relying on the session ID to know that it's the same client anyway. 
The Finished message is only there at the time the channel is bound, and 
subsequent traffic has to be recognized as coming from the same client for it 
to be useful. I don't think there's any other way to do that but the session 
ID across separate TCP connections.

-- Scott