I'm asking for it because I think it will permit this use case in a SSO scenario:
1. the app session expires
2. spring security session management redirects a IDACall to the SSO login page
3. SSO ticket (which has a longer life than the app session) maybe isn't expired, so:
4. it responds with a loginSuccess marker.
if I could recognize this login success where user hasn't re-submitted his username/pwd, I would re-initialize its session.
isn't it a better approach (in a SSO scenario) than requesting user/pwd every time that the app session timeouts?
1. the app session expires
2. spring security session management redirects a IDACall to the SSO login page
3. SSO ticket (which has a longer life than the app session) maybe isn't expired, so:
4. it responds with a loginSuccess marker.
if I could recognize this login success where user hasn't re-submitted his username/pwd, I would re-initialize its session.
isn't it a better approach (in a SSO scenario) than requesting user/pwd every time that the app session timeouts?
Comment