<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p></p>
<div>
<p class="MsoNormal">Thank you for your help!</p>
<p class="MsoNormal">I want to set the cookie between the RP and the browser.<br style="mso-special-character:line-break">
<br style="mso-special-character:line-break">
</p>
<p class="MsoNormal">Your demo application follows the correct pattern (and I want to follow the same pattern):
</p>
<p class="MsoListParagraphCxSpFirst" style="text-indent:-.25in;mso-list:l0 level1 lfo1">
<span style="mso-bidi-font-family:Calibri;mso-bidi-theme-font:minor-latin"><span style="mso-list:Ignore">a)<span style="font:7.0pt "Times New Roman"">
</span></span></span><span dir="LTR"></span>- Use the ID token to establish the authentication</p>
<p class="MsoListParagraphCxSpMiddle" style="text-indent:-.25in;mso-list:l0 level1 lfo1">
<span style="mso-bidi-font-family:Calibri;mso-bidi-theme-font:minor-latin"><span style="mso-list:Ignore">b)<span style="font:7.0pt "Times New Roman"">
</span></span></span><span dir="LTR"></span>- Create the application session</p>
<p class="MsoListParagraphCxSpLast" style="text-indent:-.25in;mso-list:l0 level1 lfo1">
<span style="mso-bidi-font-family:Calibri;mso-bidi-theme-font:minor-latin"><span style="mso-list:Ignore">c)<span style="font:7.0pt "Times New Roman"">
</span></span></span><span dir="LTR"></span>- Add the browser cookie (JsessionID)</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">We want to use your application for our Java client but we have also CPP client and we want to use mod_auth_openidc client
<br>
<a id="LPlnk900372" href="https://github.com/pingidentity/mod_auth_openidc">https://github.com/pingidentity/mod_auth_openidc</a>
</p>
<p class="MsoNormal">The question if the pattern above is RP behavior defined in some RFC and therefore all RP will need to implement it or it is the application pattern and therefore I need to implement it in code by myself.</p>
<p class="MsoNormal">Best regards,</p>
<p class="MsoNormal"><span style="mso-spacerun:yes"> </span>Michael</p>
</div>
<br>
<p></p>
<br>
<br>
<div style="color: rgb(0, 0, 0);">
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" color="#000000" face="Calibri, sans-serif"><b>From:</b> mitreid-connect-bounces@mit.edu <mitreid-connect-bounces@mit.edu> on behalf of Justin Richer <jricher@mit.edu><br>
<b>Sent:</b> Thursday, August 25, 2016 5:33 PM<br>
<b>To:</b> mitreid-connect@mit.edu<br>
<b>Subject:</b> Re: [mitreid-connect] How is possible to put into a browser cookie the ID token?</font>
<div> </div>
</div>
<div>
<p>Don't do that. The browser cookie needs to be between the RP and the browser, not the IdP and the browser. The demo application follows the correct pattern: use the ID token to establish authentication, then create a session in the application itself.</p>
<p><br>
</p>
<p> -- Justin<br>
</p>
<br>
<div class="moz-cite-prefix">On 8/25/2016 10:06 AM, Michael Furman wrote:<br>
</div>
<blockquote type="cite">
<div id="divtagdefaultwrapper" style="font-size:12pt; color:#000000; background-color:#FFFFFF; font-family:Calibri,Arial,Helvetica,sans-serif">
<div>
<p class="MsoNormal">Hi all,</p>
<p class="MsoNormal">I want to put into a browser cookie the ID token after the OpenID Connect implicit flow.</p>
<p class="MsoNormal">I want to eliminate the redirects to IDP for each requests.</p>
<p class="MsoNormal">How to do it?<br>
Do we have any RFC that describes how to make RP stateful?</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">I do know that the demo simple-web-app adds Jsession cookie after the authentication.</p>
<p class="MsoNormal">My question if we have some RFC and therefore all RP may be stateful.<br>
Thank you in advance for your help.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Best regards,</p>
<p class="MsoNormal"><span style=""> </span>Michael</p>
</div>
<br>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset> <br>
<pre>_______________________________________________
mitreid-connect mailing list
<a class="moz-txt-link-abbreviated" href="mailto:mitreid-connect@mit.edu">mitreid-connect@mit.edu</a>
<a class="moz-txt-link-freetext" href="http://mailman.mit.edu/mailman/listinfo/mitreid-connect">http://mailman.mit.edu/mailman/listinfo/mitreid-connect</a>
</pre>
</blockquote>
<br>
</div>
</div>
</div>
</body>
</html>