skills.rest
hirokazu-kobayashi-koba-hiro
hirokazu-kobayashi-koba-hiroCOMMUNITY
Explore all skills by this author →
GitHub

session-management

Manage OPSession and ClientSession authentication state across multi-tenant IdP deployments.

7|1|Updated Feb 12, 2023
Search Tags:#session-management#sso#oidc#cookie#logout#acr
One-click install
npx skills add https://github.com/hirokazu-kobayashi-koba-hiro/idp-server --skill session-management-hirokazu-kobayashi-koba-hiro
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: session-management
Source: https://github.com/hirokazu-kobayashi-koba-hiro/idp-server/tree/main/.claude/skills/session-management
Command: npx skills add https://github.com/hirokazu-kobayashi-koba-hiro/idp-server --skill session-management-hirokazu-kobayashi-koba-hiro

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Maintains and coordinates user authentication state across multi-tenant IdP deployments, enabling reliable single sign-on (SSO) experiences and consistent logout behavior.

Core Features & Use Cases

  • Two-tier session model: OPSession for SSO and ClientSession per application
  • Session reuse to enable seamless SSO across multiple apps
  • Flexible session switching policies: STRICT, SWITCH_ALLOWED, MULTI_SESSION
  • ACR downgrade protection to prevent weak re-authentication
  • Comprehensive logout support: RP-Initiated, Back-Channel, and Front-Channel logout
  • Cookie handling and session state APIs for integration with the gateway and tenants

Quick Start

Start the IdP server with session-management enabled and verify OPSession and ClientSession flows across a test tenant.

Frequently Asked Questions about session-management

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I manage SSO sessions across multiple applications in a multi-tenant IdP deployment?▼

SSO session management across multi-tenant IdP deployments uses a two-tier session model with an OPSession for SSO and a ClientSession per application. This enables seamless session reuse and consistent logout behavior across multiple apps.

What is the best way to handle OIDC logout across different applications?▼

OIDC logout across different applications is handled through comprehensive RP-Initiated, Back-Channel, and Front-Channel logout workflows. This ensures consistent user authentication state termination across all connected applications.

Can I configure session switching policies to allow concurrent user logins?▼

Yes, session switching policies can be configured to manage concurrent logins using STRICT, SWITCH_ALLOWED, and MULTI_SESSION modes. These policies control how user authentication state transitions occur across applications.

How does ACR downgrade protection work during SSO re-authentication?▼

ACR downgrade protection works by preventing weak re-authentication during SSO session reuse. It ensures that subsequent authentication attempts meet the original Authentication Context Class Reference requirements.

Does this session management approach support secure cookie handling for tenant integration?▼

Yes, secure cookie handling is supported alongside session state APIs specifically designed for integration with the gateway and tenants. This ensures reliable user authentication state coordination across multi-tenant deployments.

Related Skills

Explore More Software Engineering Skills→
nguyenvanlinh1902nguyenvanlinh1902

better-auth

Configure authentication and authorization for TypeScript applications with plugins and session management.

Community
Advanced
JhabbigJhabbig

auth-implementation-patterns

Design secure authentication and authorization systems for web applications.

Community
Advanced
ChwistopheChwistophe

rails-37-style-backend-multi-tenancy

Implement path-based multi-tenancy in Ruby on Rails with middleware and ActiveSupport::CurrentAttributes.

Community
Advanced
mjunaidcamjunaidca
27

better-auth-sso

Implement PKCE-based Better Auth SSO integration for Next.js applications.

Community
Advanced