Re: [saml-dev] SessionIndex confusion

["Cantor, Scott" <cantor.2@osu.edu>]

On 4/4/14, 9:56 AM, "Phalguni Mukherjee" <phalgunimukherjee1007@gmail.com>
wrote:

>What is the criteria of creating sessionIndex, what is the possiblity of
>sessionIndex duplication in case my service provider is referring more
>than one ID provider?

SessionIndex is not required to be globally unique, and is only relevant
when accompanied by the original NameID it came with. It's functional
requirements are to be unique across all sessions from a given subject at
a given time from a given IdP, but to avoid creating an additional
correlation handle in the event that privacy is an issue.

-- Scott