title: User authentication in browser extension (via Shibboleth)
body: <p>I am trying to create a browser extension that authenticates users via Shibboleth--and I am wondering how to get the Shibboleth session into my extension so it works across all tabs / windows. I have not seen much about Shib online, so appreciate any guidance. My question is similar to <a href="https://stackoverflow.com/questions/13681098/chrome-extension-devise-rails-app-making-authenticated-requests-from-exten">this</a>, but the authentication could occur in a separate tab (or should it occur in the extension window??).</p>
  
  <p>These <a href="https://stackoverflow.com/questions/1554344/firefox-extensions-best-practices">two</a> SO <a href="https://stackoverflow.com/questions/7217137/chrome-extension-login-best-practices">questions</a> point to some useful guidance on extensions in general, as well as some tips for handling security / login (for <a href="https://developer.mozilla.org/en-US/docs/XPCOM_Interface_Reference/nsILoginManager/Using_nsILoginManager?redirectlocale=en-US&amp;redirectslug=XPCOM_Interface_Reference/Using_nsILoginManager" rel="nofollow noreferrer">Firefox</a>, and for <a href="https://developer.chrome.com/extensions/tut_oauth.html" rel="nofollow noreferrer">Chrome</a>). However, they both reference using a built-in library (like OAuth or Firefox Login Manager), where the user presents username / password to the extension directly. Since I am using Shibboleth, my use case seems different and I am not sure how to handle the process. My initial thoughts are:</p>
  
  <ul>
  <li>User clicks a "Sign-in" button in the extension.</li>
  <li>User is redirected to a login-page in a full window, not in the extension (like the <a href="http://anywhere.ebay.com/browser/chrome/" rel="nofollow noreferrer">eBay</a> or <a href="https://chrome.google.com/webstore/detail/diigo-web-collector-captu/oojbgadfejifecebmdnhhkbhdjaphole" rel="nofollow noreferrer">Diigo</a> browser extensions)</li>
  <li>User logs in with Shibboleth credentials. </li>
  <li>Server-side Django app does stuff...sets a session cookie--but is this accessible to the extension? In my testing, this seems to not work (i.e. my app is still not authenticated against the server, even if I authenticated within the same tab)</li>
  <li>The extension looks for the session cookie, and if it finds it, treats the user as authenticated. ??</li>
  <li>The extension is supposed to be like a bookmarklet tool (like Diigo)--can the "secure session" extend to any tabs / windows that the user opens? My understanding is no (<a href="https://stackoverflow.com/questions/16163313/django-session-cookie-from-any-other-domain-check-if-user-is-logged-in">because it is domain specific</a>), but how do extensions (like eBay or Diigo) work across sites, then?</li>
  </ul>
  
  <p>A broader way to ask my question would be: How do extensions like eBay or Diigo handle the user session? Both direct you to a "full window" login page in order to log in instead of using browser-specific extension libraries, but the extensions work across all tabs...</p>
  
  <p>Also, would this process easily port across Safari / Firefox / Chrome? </p>
  
  <p>Thanks!</p>