From a532fe2021e9f3858f00dfbc7cfb0eb445519c74 Mon Sep 17 00:00:00 2001
From: cantor <cantor@cb58f699-b61c-0410-a6fe-9272a202ed29>
Date: Sun, 25 Nov 2007 21:12:35 +0000
Subject: [PATCH] Merge session cache implementations. Move component
 configuration outside of property sets.

git-svn-id: https://svn.middleware.georgetown.edu/cpp-sp/trunk@2632 cb58f699-b61c-0410-a6fe-9272a202ed29
---
 configs/shibboleth2.xml.in                  | 117 ++--
 isapi_shib/isapi_shib.cpp                   |  21 +-
 schemas/shibboleth-2.0-native-sp-config.xsd |  52 +-
 shibsp/Makefile.am                          |   4 +-
 shibsp/SessionCache.cpp                     |  61 --
 shibsp/SessionCache.h                       |  31 +-
 shibsp/impl/StorageServiceSessionCache.cpp  | 919 ++++++++++++++++++++--------
 shibsp/impl/XMLServiceProvider.cpp          | 118 ++--
 shibsp/remoting/ListenerService.h           |   3 -
 shibsp/remoting/impl/ListenerService.cpp    |   2 -
 shibsp/shibsp-lite.vcproj                   |   6 +-
 shibsp/shibsp.vcproj                        |   4 -
 12 files changed, 808 insertions(+), 530 deletions(-)
 delete mode 100644 shibsp/SessionCache.cpp

diff --git a/configs/shibboleth2.xml.in b/configs/shibboleth2.xml.in
index 20afc4e..85e2a92 100644
--- a/configs/shibboleth2.xml.in
+++ b/configs/shibboleth2.xml.in
@@ -7,85 +7,78 @@
 	xsi:schemaLocation="urn:mace:shibboleth:2.0:native:sp:config @-PKGXMLDIR-@/shibboleth-2.0-native-sp-config.xsd"
 	logger="@-PKGSYSCONFDIR-@/syslog.logger" clockSkew="180">
 
-	<!-- The OutOfProcess section pertains to components that run in the shibd daemon. -->
+	<!-- The OutOfProcess section contains properties affecting the shibd daemon. -->
 	<OutOfProcess logger="@-PKGSYSCONFDIR-@/shibd.logger">
-		
 		<!--
 		<Extensions>
 			<Library path="@-PKGLIBDIR-@/adfs.so" fatal="true"/>
 			<Library path="@-PKGLIBDIR-@/odbc-store.so" fatal="true"/>
 		</Extensions>
 		-->
-    
-		<!-- Only one listener can be defined. -->
-		<UnixListener address="@-PKGRUNDIR-@/shibd.sock"/>
-		
-		<!-- <TCPListener address="127.0.0.1" port="12345" acl="127.0.0.1"/> -->
-		
-		<StorageService type="Memory" id="memory" cleanupInterval="900"/>
-		<SessionCache type="StorageService" StorageService="memory" cacheTimeout="3600"/>
-		<ReplayCache StorageService="memory"/>
-		<ArtifactMap artifactTTL="180"/>
-
-		<!--
-		<StorageService type="ODBC" id="db" cleanupInterval="900">
-			<ConnectionString>
-			DRIVER=drivername;SERVER=dbserver;UID=shibboleth;PWD=password;DATABASE=shibboleth;APP=Shibboleth
-			</ConnectionString>
-		</StorageService>
-		<SessionCache type="StorageService" StorageService="db" cacheTimeout="3600"/>
-		<ReplayCache StorageService="db"/>
-		<ArtifactMap StorageService="db" artifactTTL="180"/>
-		-->
 	</OutOfProcess>
     
-	<!-- The InProcess section pertains to components that run inside the web server. -->
+	<!-- The InProcess section conrains settings affecting web server modules/filters. -->
 	<InProcess logger="@-PKGSYSCONFDIR-@/native.logger">
-
 		<!--
 		<Extensions>
 			<Library path="@-PKGLIBDIR-@/adfs-lite.so" fatal="true"/>
 		</Extensions>
 		-->
-		
-		<SessionCache type="Remoted" cleanupInterval="900" cacheTimeout="900"/>
-	
-		<!--
-		To customize behavior, map hostnames and path components to applicationId and other settings.
-		-->
-		<RequestMapper type="Native">
-			<RequestMap applicationId="default">
-				<!--
-				The example requires a session for documents in /secure on the containing host with http and
-				https on the default ports. Note that the name and port in the <Host> elements MUST match
-				Apache's ServerName and Port directives or the IIS Site name in the <ISAPI> element
-				below.
-				-->
-				<Host name="sp.example.org">
-					<Path name="secure" authType="shibboleth" requireSession="true">
-						<!-- Example shows the folder "/secure/admin" assigned to a separate <Application> -->
-						<!--
-						<Path name="admin" applicationId="foo-admin"/>
-						-->
-					</Path>
-				</Host>
-			</RequestMap>
-		</RequestMapper>
-		
-		<Implementation>
-			<ISAPI normalizeRequest="true">
-				<!--
-				Maps IIS Instance ID values to the host scheme/name/port/sslport. The name is
-				required so that the proper <Host> in the request map above is found without
-				having to cover every possible DNS/IP combination the user might enter.
-				The port and scheme can	usually be omitted, so the HTTP request's port and
-				scheme will be used.
-				-->
-				<Site id="1" name="sp.example.org"/>
-			</ISAPI>
-		</Implementation>
+
+		<ISAPI normalizeRequest="true">
+			<!--
+			Maps IIS Instance ID values to the host scheme/name/port/sslport. The name is
+			required so that the proper <Host> in the request map above is found without
+			having to cover every possible DNS/IP combination the user might enter.
+			The port and scheme can	usually be omitted, so the HTTP request's port and
+			scheme will be used.
+			-->
+			<Site id="1" name="sp.example.org"/>
+		</ISAPI>
 	</InProcess>
 
+    <!-- Only one listener can be defined, to connect in process modules to shibd. -->
+    <UnixListener address="@-PKGRUNDIR-@/shibd.sock"/>
+    <!-- <TCPListener address="127.0.0.1" port="12345" acl="127.0.0.1"/> -->
+    
+    <!-- This set of components stores sessions and other persistent data in daemon memory. -->
+    <StorageService type="Memory" id="mem" cleanupInterval="900"/>
+    <SessionCache type="StorageService" StorageService="mem" cacheTimeout="3600" inprocTimeout="900" cleanupInterval="900"/>
+    <ReplayCache StorageService="mem"/>
+    <ArtifactMap artifactTTL="180"/>
+
+    <!-- This set of components stores sessions and other persistent data in an ODBC database. -->
+    <!--
+    <StorageService type="ODBC" id="db" cleanupInterval="900">
+        <ConnectionString>
+        DRIVER=drivername;SERVER=dbserver;UID=shibboleth;PWD=password;DATABASE=shibboleth;APP=Shibboleth
+        </ConnectionString>
+    </StorageService>
+    <SessionCache type="StorageService" StorageService="db" cacheTimeout="3600" inprocTimeout="900" cleanupInterval="900"/>
+    <ReplayCache StorageService="db"/>
+    <ArtifactMap StorageService="db" artifactTTL="180"/>
+    -->
+
+    <!-- To customize behavior, map hostnames and path components to applicationId and other settings. -->
+    <RequestMapper type="Native">
+        <RequestMap applicationId="default">
+            <!--
+            The example requires a session for documents in /secure on the containing host with http and
+            https on the default ports. Note that the name and port in the <Host> elements MUST match
+            Apache's ServerName and Port directives or the IIS Site name in the <ISAPI> element
+            below.
+            -->
+            <Host name="sp.example.org">
+                <Path name="secure" authType="shibboleth" requireSession="true">
+                    <!-- Example shows the folder "/secure/admin" assigned to a separate <Application> -->
+                    <!--
+                    <Path name="admin" applicationId="foo-admin"/>
+                    -->
+                </Path>
+            </Host>
+        </RequestMap>
+    </RequestMapper>
+
 	<!--
 	The Applications section is where most of Shibboleth's SAML bits are defined.
 	Resource requests are mapped in the Local section into an applicationId that
diff --git a/isapi_shib/isapi_shib.cpp b/isapi_shib/isapi_shib.cpp
index 25b0a44..f608c72 100644
--- a/isapi_shib/isapi_shib.cpp
+++ b/isapi_shib/isapi_shib.cpp
@@ -60,7 +60,6 @@ namespace {
     static const XMLCh sslport[] =          UNICODE_LITERAL_7(s,s,l,p,o,r,t);
     static const XMLCh scheme[] =           UNICODE_LITERAL_6(s,c,h,e,m,e);
     static const XMLCh id[] =               UNICODE_LITERAL_2(i,d);
-    static const XMLCh Implementation[] =   UNICODE_LITERAL_14(I,m,p,l,e,m,e,n,t,a,t,i,o,n);
     static const XMLCh ISAPI[] =            UNICODE_LITERAL_5(I,S,A,P,I);
     static const XMLCh Alias[] =            UNICODE_LITERAL_5(A,l,i,a,s);
     static const XMLCh normalizeRequest[] = UNICODE_LITERAL_16(n,o,r,m,a,l,i,z,e,R,e,q,u,e,s,t);
@@ -194,7 +193,7 @@ extern "C" BOOL WINAPI GetFilterVersion(PHTTP_FILTER_VERSION pVer)
         return FALSE;
     }
     
-    // Access the implementation-specifics for site mappings.
+    // Access implementation-specifics and site mappings.
     ServiceProvider* sp=g_Config->getServiceProvider();
     Locker locker(sp);
     const PropertySet* props=sp->getPropertySet("InProcess");
@@ -207,16 +206,16 @@ extern "C" BOOL WINAPI GetFilterVersion(PHTTP_FILTER_VERSION pVer)
         flag=props->getBool("catchAll");
         g_catchAll = flag.first && flag.second;
 
-        const DOMElement* impl=XMLHelper::getFirstChildElement(props->getElement(),Implementation);
-        if (impl && (impl=XMLHelper::getFirstChildElement(impl,ISAPI))) {
-            const XMLCh* flag=impl->getAttributeNS(NULL,normalizeRequest);
-            g_bNormalizeRequest=(!flag || !*flag || *flag==chDigit_1 || *flag==chLatin_t);
-            impl=XMLHelper::getFirstChildElement(impl,Site);
-            while (impl) {
-                auto_ptr_char id(impl->getAttributeNS(NULL,id));
+        props = props->getPropertySet("ISAPI");
+        if (props) {
+            flag = props->getBool("normalizeRequest");
+            g_bNormalizeRequest = !flag.first || flag.second;
+            const DOMElement* child = XMLHelper::getFirstChildElement(props->getElement(),Site);
+            while (child) {
+                auto_ptr_char id(child->getAttributeNS(NULL,id));
                 if (id.get())
-                    g_Sites.insert(pair<string,site_t>(id.get(),site_t(impl)));
-                impl=XMLHelper::getNextSiblingElement(impl,Site);
+                    g_Sites.insert(pair<string,site_t>(id.get(),site_t(child)));
+                child=XMLHelper::getNextSiblingElement(child,Site);
             }
         }
     }
diff --git a/schemas/shibboleth-2.0-native-sp-config.xsd b/schemas/shibboleth-2.0-native-sp-config.xsd
index c187fd3..3f50b38 100644
--- a/schemas/shibboleth-2.0-native-sp-config.xsd
+++ b/schemas/shibboleth-2.0-native-sp-config.xsd
@@ -61,6 +61,26 @@
 				<element ref="conf:Extensions" minOccurs="0"/>
 				<element ref="conf:OutOfProcess"/>
 				<element ref="conf:InProcess"/>
+                <choice minOccurs="0">
+                    <element name="UnixListener">
+                        <complexType>
+                            <attribute name="address" type="conf:string" use="required"/>
+                        </complexType>
+                    </element>
+                    <element name="TCPListener">
+                        <complexType>
+                            <attribute name="address" type="conf:string" use="required"/>
+                            <attribute name="port" type="unsignedInt" use="required"/>
+                            <attribute name="acl" type="conf:listOfStrings" default="127.0.0.1"/>
+                        </complexType>
+                    </element>
+                    <element name="Listener" type="conf:PluggableType"/>
+                </choice>
+                <element ref="conf:StorageService" minOccurs="0" maxOccurs="unbounded"/>
+                <element ref="conf:SessionCache" minOccurs="0"/>
+                <element ref="conf:ReplayCache" minOccurs="0"/>
+                <element ref="conf:ArtifactMap" minOccurs="0"/>
+                <element name="RequestMapper" type="conf:PluggableType" minOccurs="0"/>
 				<element ref="conf:Applications"/>
 				<element ref="conf:SecurityPolicies"/>
 			</sequence>
@@ -151,30 +171,11 @@
 	
 	<element name="OutOfProcess">
 		<annotation>
-			<documentation>Container for shibd out-of-process configuration</documentation>
+			<documentation>Container for out-of-process (shibd) configuration</documentation>
 		</annotation>
 		<complexType>
 			<sequence>
 				<element ref="conf:Extensions" minOccurs="0"/>
-				<choice>
-					<element name="UnixListener">
-						<complexType>
-							<attribute name="address" type="conf:string" use="required"/>
-						</complexType>
-					</element>
-					<element name="TCPListener">
-						<complexType>
-							<attribute name="address" type="conf:string" use="required"/>
-							<attribute name="port" type="unsignedInt" use="required"/>
-							<attribute name="acl" type="conf:listOfStrings" default="127.0.0.1"/>
-						</complexType>
-					</element>
-					<element name="Listener" type="conf:PluggableType"/>
-				</choice>
-				<element ref="conf:StorageService" minOccurs="0" maxOccurs="unbounded"/>
-				<element ref="conf:SessionCache" minOccurs="0"/>
-				<element ref="conf:ReplayCache" minOccurs="0"/>
-				<element ref="conf:ArtifactMap" minOccurs="0"/>
 				<any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
 			</sequence>
 			<attribute name="logger" type="anyURI"/>
@@ -193,16 +194,7 @@
 		<complexType>
 			<sequence>
 				<element ref="conf:Extensions" minOccurs="0"/>
-				<element ref="conf:SessionCache" minOccurs="0"/>
-				<element name="RequestMapper" type="conf:PluggableType"/>
-				<element name="Implementation" minOccurs="0">
-					<complexType>
-						<sequence>
-							<element ref="conf:ISAPI" minOccurs="0"/>
-							<any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
-						</sequence>
-					</complexType>
-				</element>
+				<element ref="conf:ISAPI" minOccurs="0"/>
 				<any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
 			</sequence>
 			<attribute name="logger" type="anyURI"/>
diff --git a/shibsp/Makefile.am b/shibsp/Makefile.am
index 7a55bc8..57a8206 100644
--- a/shibsp/Makefile.am
+++ b/shibsp/Makefile.am
@@ -103,7 +103,6 @@ common_sources = \
 	AbstractSPRequest.cpp \
 	Application.cpp \
 	ServiceProvider.cpp \
-	SessionCache.cpp \
 	SPConfig.cpp \
 	attribute/Attribute.cpp \
 	handler/impl/AbstractHandler.cpp \
@@ -128,6 +127,7 @@ common_sources = \
 	handler/impl/SessionInitiator.cpp \
 	handler/impl/Shib1SessionInitiator.cpp \
 	handler/impl/WAYFSessionInitiator.cpp \
+    impl/StorageServiceSessionCache.cpp \
 	impl/XMLAccessControl.cpp \
 	impl/XMLRequestMapper.cpp \
 	impl/XMLServiceProvider.cpp \
@@ -143,7 +143,6 @@ common_sources = \
 
 libshibsp_lite_la_SOURCES = \
 	${common_sources} \
-	impl/RemotedSessionCache.cpp \
 	lite/CommonDomainCookie.cpp \
 	lite/SAMLConstants.cpp
 
@@ -179,7 +178,6 @@ libshibsp_la_SOURCES = \
 	attribute/resolver/impl/XMLAttributeExtractor.cpp \
 	binding/impl/ArtifactResolver.cpp \
 	binding/impl/SOAPClient.cpp \
-	impl/StorageServiceSessionCache.cpp \
 	metadata/MetadataExtImpl.cpp \
 	metadata/MetadataExtSchemaValidators.cpp \
 	security/PKIXTrustEngine.cpp \
diff --git a/shibsp/SessionCache.cpp b/shibsp/SessionCache.cpp
deleted file mode 100644
index 8ff5c00..0000000
--- a/shibsp/SessionCache.cpp
+++ /dev/null
@@ -1,61 +0,0 @@
-/*
- *  Copyright 2001-2007 Internet2
- * 
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * SessionCache.cpp
- * 
- * SessionCache base class and factory registration
- */
-
-#include "internal.h"
-#include "SessionCache.h"
-
-#include <xercesc/util/XMLUniDefs.hpp>
-
-using namespace shibsp;
-using namespace xmltooling;
-
-namespace shibsp {
-
-#ifndef SHIBSP_LITE
-    SHIBSP_DLLLOCAL PluginManager<SessionCache,std::string,const DOMElement*>::Factory StorageServiceCacheFactory;
-#else
-    SHIBSP_DLLLOCAL PluginManager<SessionCache,std::string,const DOMElement*>::Factory RemotedCacheFactory;
-#endif
-
-    static const XMLCh cacheTimeout[] =     UNICODE_LITERAL_12(c,a,c,h,e,T,i,m,e,o,u,t);
-}
-
-void SHIBSP_API shibsp::registerSessionCaches()
-{
-#ifndef SHIBSP_LITE
-    SPConfig::getConfig().SessionCacheManager.registerFactory(STORAGESERVICE_SESSION_CACHE, StorageServiceCacheFactory);
-#else
-    SPConfig::getConfig().SessionCacheManager.registerFactory(REMOTED_SESSION_CACHE, RemotedCacheFactory);
-#endif
-}
-
-SessionCache::SessionCache(const DOMElement* e, unsigned long defaultTimeout) : m_cacheTimeout(defaultTimeout)
-{
-    if (e) {
-        const XMLCh* tag=e->getAttributeNS(NULL,cacheTimeout);
-        if (tag && *tag) {
-            m_cacheTimeout = XMLString::parseInt(tag);
-            if (!m_cacheTimeout)
-                m_cacheTimeout=defaultTimeout;
-        }
-    }
-}
diff --git a/shibsp/SessionCache.h b/shibsp/SessionCache.h
index 49a334e..bb32ae7 100644
--- a/shibsp/SessionCache.h
+++ b/shibsp/SessionCache.h
@@ -51,6 +51,13 @@ namespace shibsp {
         virtual const char* getID() const=0;
 
         /**
+         * Returns the session's application ID.
+         *
+         * @return unique ID of application bound to session
+         */
+        virtual const char* getApplicationID() const=0;
+
+        /**
          * Returns the session expiration.
          *
          * @return  the session's expiration time or 0 for none
@@ -187,24 +194,7 @@ namespace shibsp {
     {
         MAKE_NONCOPYABLE(SessionCache);
     protected:
-    
-        /**
-         * Constructor
-         * 
-         * <p>The following XML content is supported to configure the cache:
-         * <dl>
-         *  <dt>cacheTimeout</dt>
-         *  <dd>attribute containing maximum lifetime in seconds for unused sessions to remain in cache</dd>
-         * </dl>
-         * 
-         * @param e                 root of DOM tree to configure the cache
-         * @param defaultTimeout    default cacheTimeout setting to use if none specified in DOM
-         */
-        SessionCache(const xercesc::DOMElement* e, unsigned long defaultTimeout=3600);
-        
-        /** Maximum lifetime in seconds for unused sessions to be cached. */
-        unsigned long m_cacheTimeout;
-        
+        SessionCache() {}
     public:
         virtual ~SessionCache() {}
         
@@ -319,13 +309,8 @@ namespace shibsp {
         virtual void remove(const char* key, const Application& application)=0;
     };
 
-#ifndef SHIBSP_LITE
     /** SessionCache implementation backed by a StorageService. */
     #define STORAGESERVICE_SESSION_CACHE    "StorageService"
-#endif
-
-    /** SessionCache implementation for lite builds that delegates to a remoted version. */
-    #define REMOTED_SESSION_CACHE    "Remoted"
 
     /**
      * Registers SessionCache classes into the runtime.
diff --git a/shibsp/impl/StorageServiceSessionCache.cpp b/shibsp/impl/StorageServiceSessionCache.cpp
index ffbea17..8c1d921 100644
--- a/shibsp/impl/StorageServiceSessionCache.cpp
+++ b/shibsp/impl/StorageServiceSessionCache.cpp
@@ -38,25 +38,120 @@
 #include "remoting/ListenerService.h"
 #include "util/SPConstants.h"
 
-#include <saml/SAMLConfig.h>
 #include <xmltooling/util/NDC.h>
-#include <xmltooling/util/StorageService.h>
 #include <xmltooling/util/XMLHelper.h>
 #include <xercesc/util/XMLUniDefs.hpp>
 
-using namespace shibsp;
+#ifndef SHIBSP_LITE
+# include <saml/SAMLConfig.h>
+# include <xmltooling/util/StorageService.h>
 using namespace opensaml::saml2md;
+#else
+# include <ctime>
+# include <xmltooling/util/DateTime.h>
+#endif
+
+using namespace shibsp;
 using namespace opensaml;
 using namespace xmltooling;
 using namespace std;
 
 namespace shibsp {
 
-    class SSCache;
+    class StoredSession;
+    class SSCache : public SessionCache
+#ifndef SHIBSP_LITE
+        ,public virtual Remoted
+#endif
+    {
+    public:
+        SSCache(const DOMElement* e);
+        ~SSCache();
+
+#ifndef SHIBSP_LITE
+        void receive(DDF& in, ostream& out);
+
+        string insert(
+            time_t expires,
+            const Application& application,
+            const char* client_addr=NULL,
+            const saml2md::EntityDescriptor* issuer=NULL,
+            const XMLCh* protocol=NULL,
+            const saml2::NameID* nameid=NULL,
+            const XMLCh* authn_instant=NULL,
+            const XMLCh* session_index=NULL,
+            const XMLCh* authncontext_class=NULL,
+            const XMLCh* authncontext_decl=NULL,
+            const vector<const Assertion*>* tokens=NULL,
+            const vector<Attribute*>* attributes=NULL
+            );
+        vector<string>::size_type logout(
+            const saml2md::EntityDescriptor* issuer,
+            const saml2::NameID& nameid,
+            const set<string>* indexes,
+            time_t expires,
+            const Application& application,
+            vector<string>& sessions
+            );
+        bool matches(
+            const char* key,
+            const saml2md::EntityDescriptor* issuer,
+            const saml2::NameID& nameid,
+            const set<string>* indexes,
+            const Application& application
+            );
+#endif
+        Session* find(const char* key, const Application& application, const char* client_addr=NULL, time_t* timeout=NULL);
+        void remove(const char* key, const Application& application);
+        void test();
+
+        void cleanup();
+
+        Category& m_log;
+        bool inproc;
+        unsigned long m_cacheTimeout;
+#ifndef SHIBSP_LITE
+        StorageService* m_storage;
+#endif
+
+    private:
+#ifndef SHIBSP_LITE
+        // maintain back-mappings of NameID/SessionIndex -> session key
+        void insert(const char* key, time_t expires, const char* name, const char* index);
+        bool stronglyMatches(const XMLCh* idp, const XMLCh* sp, const saml2::NameID& n1, const saml2::NameID& n2) const;
+#endif
+
+        const DOMElement* m_root;         // Only valid during initialization
+        unsigned long m_inprocTimeout;
+
+        // inproc means we buffer sessions in memory
+        RWLock* m_lock;
+        map<string,StoredSession*> m_hashtable;
+    
+        // management of buffered sessions
+        void dormant(const char* key);
+        static void* cleanup_fn(void*);
+        bool shutdown;
+        CondWait* shutdown_wait;
+        Thread* cleanup_thread;
+    };
+
     class StoredSession : public virtual Session
     {
     public:
-        StoredSession(SSCache* cache, DDF& obj) : m_obj(obj), m_nameid(NULL), m_cache(cache), m_lastAccess(time(NULL)) {
+        StoredSession(SSCache* cache, DDF& obj) : m_obj(obj),
+#ifndef SHIBSP_LITE
+                m_nameid(NULL),
+#endif
+                m_cache(cache), m_expires(0), m_lastAccess(time(NULL)), m_lock(NULL) {
+            auto_ptr_XMLCh exp(m_obj["expires"].string());
+            if (exp.get()) {
+                DateTime iso(exp.get());
+                iso.parseDateTime();
+                m_expires = iso.getEpoch();
+            }
+
+#ifndef SHIBSP_LITE
             const char* nameid = obj["nameid"].string();
             if (nameid) {
                 // Parse and bind the document into an XMLObject.
@@ -68,20 +163,39 @@ namespace shibsp {
                 janitor.release();
                 m_nameid = n.release();
             }
+#endif            
+            if (cache->inproc)
+                m_lock = Mutex::create();
         }
         
-        ~StoredSession();
+        ~StoredSession() {
+            delete m_lock;
+            m_obj.destroy();
+            for_each(m_attributes.begin(), m_attributes.end(), xmltooling::cleanup<Attribute>());
+#ifndef SHIBSP_LITE
+            delete m_nameid;
+            for_each(m_tokens.begin(), m_tokens.end(), cleanup_pair<string,Assertion>());
+#endif
+        }
         
         Lockable* lock() {
+            if (m_lock)
+                m_lock->lock();
             return this;
         }
         void unlock() {
-            delete this;
+            if (m_lock)
+                m_lock->unlock();
+            else
+                delete this;
         }
-        
+
         const char* getID() const {
             return m_obj.name();
         }
+        const char* getApplicationID() const {
+            return m_obj["application_id"].string();
+        }
         const char* getClientAddress() const {
             return m_obj["client_addr"].string();
         }
@@ -94,9 +208,11 @@ namespace shibsp {
         const char* getAuthnInstant() const {
             return m_obj["authn_instant"].string();
         }
-        const opensaml::saml2::NameID* getNameID() const {
+#ifndef SHIBSP_LITE
+        const saml2::NameID* getNameID() const {
             return m_nameid;
         }
+#endif
         const char* getSessionIndex() const {
             return m_obj["session_index"].string();
         }
@@ -135,102 +251,44 @@ namespace shibsp {
             return m_ids;
         }
         
+        void validate(const Application& application, const char* client_addr, time_t* timeout);
+
+#ifndef SHIBSP_LITE
         void addAttributes(const vector<Attribute*>& attributes);
         const Assertion* getAssertion(const char* id) const;
         void addAssertion(Assertion* assertion);
+#endif
 
-        time_t getExpiration() const {
-            auto_ptr_XMLCh exp(m_obj["expires"].string());
-            if (exp.get()) {
-                DateTime iso(exp.get());
-                iso.parseDateTime();
-                return iso.getEpoch();
-            }
-            return 0;
-        }
-        time_t getLastAccess() const {
-            return m_lastAccess;
-        }
+        time_t getExpiration() const { return m_expires; }
+        time_t getLastAccess() const { return m_lastAccess; }
 
     private:
         void unmarshallAttributes() const;
 
         DDF m_obj;
+#ifndef SHIBSP_LITE
         saml2::NameID* m_nameid;
+        mutable map<string,Assertion*> m_tokens;
+#endif
         mutable vector<Attribute*> m_attributes;
         mutable multimap<string,const Attribute*> m_attributeIndex;
         mutable vector<const char*> m_ids;
-        mutable map<string,Assertion*> m_tokens;
+
         SSCache* m_cache;
-        time_t m_lastAccess;
+        time_t m_expires,m_lastAccess;
+        Mutex* m_lock;
     };
     
-    class SSCache : public SessionCache, public virtual Remoted
-    {
-    public:
-        SSCache(const DOMElement* e);
-        ~SSCache();
-    
-        void receive(DDF& in, ostream& out);
-        
-        string insert(
-            time_t expires,
-            const Application& application,
-            const char* client_addr=NULL,
-            const saml2md::EntityDescriptor* issuer=NULL,
-            const XMLCh* protocol=NULL,
-            const saml2::NameID* nameid=NULL,
-            const XMLCh* authn_instant=NULL,
-            const XMLCh* session_index=NULL,
-            const XMLCh* authncontext_class=NULL,
-            const XMLCh* authncontext_decl=NULL,
-            const vector<const Assertion*>* tokens=NULL,
-            const vector<Attribute*>* attributes=NULL
-            );
-        Session* find(const char* key, const Application& application, const char* client_addr=NULL, time_t* timeout=NULL);
-        void remove(const char* key, const Application& application);
-        bool matches(
-            const char* key,
-            const saml2md::EntityDescriptor* issuer,
-            const saml2::NameID& nameid,
-            const set<string>* indexes,
-            const Application& application
-            );
-        vector<string>::size_type logout(
-            const saml2md::EntityDescriptor* issuer,
-            const saml2::NameID& nameid,
-            const set<string>* indexes,
-            time_t expires,
-            const Application& application,
-            vector<string>& sessions
-            );
-        void test();
-
-        Category& m_log;
-        StorageService* m_storage;
-
-    private:
-        // maintain back-mappings of NameID/SessionIndex -> session key
-        void insert(const char* key, time_t expires, const char* name, const char* index);
-
-        bool stronglyMatches(const XMLCh* idp, const XMLCh* sp, const saml2::NameID& n1, const saml2::NameID& n2) const;
-    };
-
     SessionCache* SHIBSP_DLLLOCAL StorageServiceCacheFactory(const DOMElement* const & e)
     {
         return new SSCache(e);
     }
-
-    static const XMLCh _StorageService[] =   UNICODE_LITERAL_14(S,t,o,r,a,g,e,S,e,r,v,i,c,e);
 }
 
-StoredSession::~StoredSession()
-{
-    m_obj.destroy();
-    delete m_nameid;
-    for_each(m_attributes.begin(), m_attributes.end(), xmltooling::cleanup<Attribute>());
-    for_each(m_tokens.begin(), m_tokens.end(), cleanup_pair<string,Assertion>());
-}
+void SHIBSP_API shibsp::registerSessionCaches()
+{
+    SPConfig::getConfig().SessionCacheManager.registerFactory(STORAGESERVICE_SESSION_CACHE, StorageServiceCacheFactory);
+}
 
 void StoredSession::unmarshallAttributes() const
 {
@@ -241,7 +299,6 @@ void StoredSession::unmarshallAttributes() const
         try {
             attribute = Attribute::unmarshall(attr);
             m_attributes.push_back(attribute);
-            m_attributeIndex.insert(multimap<string,const Attribute*>::value_type(attribute->getId(), attribute));
             if (m_cache->m_log.isDebugEnabled())
                 m_cache->m_log.debug("unmarshalled attribute (ID: %s) with %d value%s",
                     attribute->getId(), attr.first().integer(), attr.first().integer()!=1 ? "s" : "");
@@ -254,12 +311,132 @@ void StoredSession::unmarshallAttributes() const
     }
 }
 
+void StoredSession::validate(const Application& application, const char* client_addr, time_t* timeout)
+{
+    time_t now = time(NULL);
+
+    // Basic expiration?
+    if (m_expires > 0) {
+        if (now > m_expires) {
+            m_cache->m_log.info("session expired (ID: %s)", getID());
+            throw RetryableProfileException("Your session has expired, and you must re-authenticate.");
+        }
+    }
+
+    // Address check?
+    if (client_addr) {
+        if (m_cache->m_log.isDebugEnabled())
+            m_cache->m_log.debug("comparing client address %s against %s", client_addr, getClientAddress());
+        if (!XMLString::equals(getClientAddress(),client_addr)) {
+            m_cache->m_log.warn("client address mismatch");
+            throw RetryableProfileException(
+                "Your IP address ($1) does not match the address recorded at the time the session was established.",
+                params(1,client_addr)
+                );
+        }
+    }
+
+    if (!timeout)
+        return;
+    
+    if (!SPConfig::getConfig().isEnabled(SPConfig::OutOfProcess)) {
+        DDF in("touch::"STORAGESERVICE_SESSION_CACHE"::SessionCache"), out;
+        DDFJanitor jin(in);
+        in.structure();
+        in.addmember("key").string(getID());
+        in.addmember("version").integer(m_obj["version"].integer());
+        if (*timeout) {
+            // On 64-bit Windows, time_t doesn't fit in a long, so I'm using ISO timestamps.  
+#ifndef HAVE_GMTIME_R
+            struct tm* ptime=gmtime(timeout);
+#else
+            struct tm res;
+            struct tm* ptime=gmtime_r(timeout,&res);
+#endif
+            char timebuf[32];
+            strftime(timebuf,32,"%Y-%m-%dT%H:%M:%SZ",ptime);
+            in.addmember("timeout").string(timebuf);
+        }
+
+        try {
+            out=application.getServiceProvider().getListenerService()->send(in);
+        }
+        catch (...) {
+            out.destroy();
+            throw;
+        }
+
+        if (out.isstruct()) {
+            // We got an updated record back.
+            m_ids.clear();
+            for_each(m_attributes.begin(), m_attributes.end(), xmltooling::cleanup<Attribute>());
+            m_attributes.clear();
+            m_attributeIndex.clear();
+            m_obj.destroy();
+            m_obj = out;
+        }
+    }
+    else {
+#ifndef SHIBSP_LITE
+        if (!m_cache->m_storage)
+            throw ConfigurationException("Session touch requires a StorageService.");
+
+        // Do a versioned read.
+        string record;
+        time_t lastAccess;
+        int curver = m_obj["version"].integer();
+        int ver = m_cache->m_storage->readText(getID(), "session", &record, &lastAccess, curver);
+        if (ver == 0) {
+            m_cache->m_log.warn("unsuccessful versioned read of session (ID: %s), cache out of sync?", getID());
+            throw RetryableProfileException("Your session has expired, and you must re-authenticate.");
+        }
+
+        // Adjust for expiration to recover last access time and check timeout.
+        lastAccess -= m_cache->m_cacheTimeout;
+        if (*timeout > 0 && now - lastAccess >= *timeout) {
+            m_cache->m_log.info("session timed out (ID: %s)", getID());
+            throw RetryableProfileException("Your session has expired, and you must re-authenticate.");
+        } 
+
+        // Update storage expiration, if possible.
+        try {
+            m_cache->m_storage->updateContext(getID(), now + m_cache->m_cacheTimeout);
+        }
+        catch (exception& ex) {
+            m_cache->m_log.error("failed to update session expiration: %s", ex.what());
+        }
+            
+        if (ver > curver) {
+            // We got an updated record back.
+            DDF newobj;
+            istringstream in(record);
+            in >> newobj;
+            m_ids.clear();
+            for_each(m_attributes.begin(), m_attributes.end(), xmltooling::cleanup<Attribute>());
+            m_attributes.clear();
+            m_attributeIndex.clear();
+            m_obj.destroy();
+            m_obj = newobj;
+        }
+#else
+        throw ConfigurationException("Session touch requires a StorageService.");
+#endif
+    }
+
+    m_lastAccess = now;
+}
+
+#ifndef SHIBSP_LITE
+
 void StoredSession::addAttributes(const vector<Attribute*>& attributes)
 {
 #ifdef _DEBUG
     xmltooling::NDC ndc("addAttributes");
 #endif
 
+    if (!m_cache->m_storage)
+        throw ConfigurationException("Session modification requires a StorageService.");
+
     m_cache->m_log.debug("adding attributes to session (%s)", getID());
     
     int ver;
@@ -347,6 +524,9 @@ void StoredSession::addAttributes(const vector<Attribute*>& attributes)
 
 const Assertion* StoredSession::getAssertion(const char* id) const
 {
+    if (!m_cache->m_storage)
+        throw ConfigurationException("Assertion retrieval requires a StorageService.");
+
     map<string,Assertion*>::const_iterator i = m_tokens.find(id);
     if (i!=m_tokens.end())
         return i->second;
@@ -377,7 +557,10 @@ void StoredSession::addAssertion(Assertion* assertion)
 #ifdef _DEBUG
     xmltooling::NDC ndc("addAssertion");
 #endif
-    
+
+    if (!m_cache->m_storage)
+        throw ConfigurationException("Session modification requires a StorageService.");
+
     if (!assertion)
         throw FatalProfileException("Unknown object type passed to session for storage.");
 
@@ -464,50 +647,104 @@ void StoredSession::addAssertion(Assertion* assertion)
         );
 }
 
+#endif
+
 SSCache::SSCache(const DOMElement* e)
-    : SessionCache(e, 3600), m_log(Category::getInstance(SHIBSP_LOGCAT".SessionCache")), m_storage(NULL)
+    : m_log(Category::getInstance(SHIBSP_LOGCAT".SessionCache")), inproc(true), m_cacheTimeout(3600),
+#ifndef SHIBSP_LITE
+        m_storage(NULL),
+#endif
+        m_root(e), m_inprocTimeout(900), m_lock(NULL), shutdown(false), shutdown_wait(NULL), cleanup_thread(NULL)
 {
+    static const XMLCh cacheTimeout[] =     UNICODE_LITERAL_12(c,a,c,h,e,T,i,m,e,o,u,t);
+    static const XMLCh inprocTimeout[] =    UNICODE_LITERAL_13(i,n,p,r,o,c,T,i,m,e,o,u,t);
+    static const XMLCh _StorageService[] =  UNICODE_LITERAL_14(S,t,o,r,a,g,e,S,e,r,v,i,c,e);
+
     SPConfig& conf = SPConfig::getConfig();
-    const XMLCh* tag = e ? e->getAttributeNS(NULL,_StorageService) : NULL;
-    if (tag && *tag) {
-        auto_ptr_char ssid(tag);
-        m_storage = conf.getServiceProvider()->getStorageService(ssid.get());
-        if (m_storage)
-            m_log.info("bound to StorageService (%s)", ssid.get());
-        else
+    inproc = conf.isEnabled(SPConfig::InProcess);
+
+    if (e) {
+        const XMLCh* tag=e->getAttributeNS(NULL,cacheTimeout);
+        if (tag && *tag) {
+            m_cacheTimeout = XMLString::parseInt(tag);
+            if (!m_cacheTimeout)
+                m_cacheTimeout=3600;
+        }
+        if (inproc) {
+            const XMLCh* tag=e->getAttributeNS(NULL,inprocTimeout);
+            if (tag && *tag) {
+                m_inprocTimeout = XMLString::parseInt(tag);
+                if (!m_inprocTimeout)
+                    m_inprocTimeout=900;
+            }
+        }
+    }
+
+#ifndef SHIBSP_LITE
+    if (conf.isEnabled(SPConfig::OutOfProcess)) {
+        const XMLCh* tag = e ? e->getAttributeNS(NULL,_StorageService) : NULL;
+        if (tag && *tag) {
+            auto_ptr_char ssid(tag);
+            m_storage = conf.getServiceProvider()->getStorageService(ssid.get());
+            if (m_storage)
+                m_log.info("bound to StorageService (%s)", ssid.get());
+        }
+        if (!m_storage)
             throw ConfigurationException("SessionCache unable to locate StorageService, check configuration.");
     }
+#endif
 
     ListenerService* listener=conf.getServiceProvider()->getListenerService(false);
-    if (listener && conf.isEnabled(SPConfig::OutOfProcess)) {
-        listener->regListener("find::"REMOTED_SESSION_CACHE"::SessionCache",this);
-        listener->regListener("remove::"REMOTED_SESSION_CACHE"::SessionCache",this);
-        listener->regListener("touch::"REMOTED_SESSION_CACHE"::SessionCache",this);
-        listener->regListener("getAssertion::"REMOTED_SESSION_CACHE"::SessionCache",this);
+    if (inproc ) {
+        if (!conf.isEnabled(SPConfig::OutOfProcess) && !listener)
+            throw ConfigurationException("SessionCache requires a ListenerService, but none available.");
+        m_lock = RWLock::create();
+        shutdown_wait = CondWait::create();
+        cleanup_thread = Thread::create(&cleanup_fn, (void*)this);
     }
+#ifndef SHIBSP_LITE
     else {
-        m_log.info("no ListenerService available, cache remoting disabled");
+        if (listener && conf.isEnabled(SPConfig::OutOfProcess)) {
+            listener->regListener("find::"STORAGESERVICE_SESSION_CACHE"::SessionCache",this);
+            listener->regListener("remove::"STORAGESERVICE_SESSION_CACHE"::SessionCache",this);
+            listener->regListener("touch::"STORAGESERVICE_SESSION_CACHE"::SessionCache",this);
+        }
+        else {
+            m_log.info("no ListenerService available, cache remoting disabled");
+        }
     }
+#endif
 }
 
 SSCache::~SSCache()
 {
-    SPConfig& conf = SPConfig::getConfig();
-    ListenerService* listener=conf.getServiceProvider()->getListenerService(false);
-    if (listener && conf.isEnabled(SPConfig::OutOfProcess)) {
-        listener->unregListener("find::"REMOTED_SESSION_CACHE"::SessionCache",this);
-        listener->unregListener("remove::"REMOTED_SESSION_CACHE"::SessionCache",this);
-        listener->unregListener("touch::"REMOTED_SESSION_CACHE"::SessionCache",this);
-        listener->unregListener("getAssertion::"REMOTED_SESSION_CACHE"::SessionCache",this);
+    if (inproc) {
+        // Shut down the cleanup thread and let it know...
+        shutdown = true;
+        shutdown_wait->signal();
+        cleanup_thread->join(NULL);
+
+        for_each(m_hashtable.begin(),m_hashtable.end(),cleanup_pair<string,StoredSession>());
+        delete m_lock;
+        delete shutdown_wait;
     }
+#ifndef SHIBSP_LITE
+    else {
+        SPConfig& conf = SPConfig::getConfig();
+        ListenerService* listener=conf.getServiceProvider()->getListenerService(false);
+        if (listener && conf.isEnabled(SPConfig::OutOfProcess)) {
+            listener->unregListener("find::"STORAGESERVICE_SESSION_CACHE"::SessionCache",this);
+            listener->unregListener("remove::"STORAGESERVICE_SESSION_CACHE"::SessionCache",this);
+            listener->unregListener("touch::"STORAGESERVICE_SESSION_CACHE"::SessionCache",this);
+        }
+    }
+#endif
 }
 
+#ifndef SHIBSP_LITE
+
 void SSCache::test()
 {
-#ifdef _DEBUG
-    xmltooling::NDC ndc("test");
-#endif
-
     auto_ptr_char temp(SAMLConfig::getConfig().generateIdentifier());
     m_storage->createString("SessionCacheTest", temp.get(), "Test", time(NULL) + 60);
     m_storage->deleteString("SessionCacheTest", temp.get());
@@ -582,6 +819,8 @@ string SSCache::insert(
 #ifdef _DEBUG
     xmltooling::NDC ndc("insert");
 #endif
+    if (!m_storage)
+        throw ConfigurationException("SessionCache insertion requires a StorageService.");
 
     m_log.debug("creating new session");
 
@@ -747,129 +986,6 @@ string SSCache::insert(
     return key.get();
 }
 
-Session* SSCache::find(const char* key, const Application& application, const char* client_addr, time_t* timeout)
-{
-#ifdef _DEBUG
-    xmltooling::NDC ndc("find");
-#endif
-
-    m_log.debug("searching for session (%s)", key);
-    
-    time_t lastAccess;
-    string record;
-    int ver = m_storage->readText(key, "session", &record, &lastAccess);
-    if (!ver)
-        return NULL;
-    
-    m_log.debug("reconstituting session and checking validity");
-    
-    DDF obj;
-    istringstream in(record);
-    in >> obj;
-    
-    if (!XMLString::equals(obj["application_id"].string(), application.getId())) {
-        m_log.error("an application (%s) tried to access another application's session", application.getId());
-        obj.destroy();
-        return NULL;
-    }
-
-    if (client_addr) {
-        if (m_log.isDebugEnabled())
-            m_log.debug("comparing client address %s against %s", client_addr, obj["client_addr"].string());
-        if (strcmp(obj["client_addr"].string(),client_addr)) {
-            m_log.warn("client address mismatch");
-            remove(key, application);
-            RetryableProfileException ex(
-                "Your IP address ($1) does not match the address recorded at the time the session was established.",
-                params(1,client_addr)
-                );
-            const char* eid = obj["entity_id"].string();
-            if (!eid) {
-                obj.destroy();
-                throw ex;
-            }
-            string eid2(eid);
-            obj.destroy();
-            MetadataProvider* m=application.getMetadataProvider();
-            Locker locker(m);
-            annotateException(&ex,m->getEntityDescriptor(MetadataProvider::Criteria(eid2.c_str(),NULL,NULL,false)).first); // throws it
-        }
-    }
-
-    lastAccess -= m_cacheTimeout;   // adjusts it back to the last time the record's timestamp was touched
-    time_t now=time(NULL);
-    
-    if (timeout && *timeout > 0 && now - lastAccess >= *timeout) {
-        m_log.info("session timed out (ID: %s)", key);
-        remove(key, application);
-        RetryableProfileException ex("Your session has expired, and you must re-authenticate.");
-        const char* eid = obj["entity_id"].string();
-        if (!eid) {
-            obj.destroy();
-            throw ex;
-        }
-        string eid2(eid);
-        obj.destroy();
-        MetadataProvider* m=application.getMetadataProvider();
-        Locker locker(m);
-        annotateException(&ex,m->getEntityDescriptor(MetadataProvider::Criteria(eid2.c_str(),NULL,NULL,false)).first); // throws it
-    }
-    
-    auto_ptr_XMLCh exp(obj["expires"].string());
-    if (exp.get()) {
-        DateTime iso(exp.get());
-        iso.parseDateTime();
-        if (now > iso.getEpoch()) {
-            m_log.info("session expired (ID: %s)", key);
-            remove(key, application);
-            RetryableProfileException ex("Your session has expired, and you must re-authenticate.");
-            const char* eid = obj["entity_id"].string();
-            if (!eid) {
-                obj.destroy();
-                throw ex;
-            }
-            string eid2(eid);
-            obj.destroy();
-            MetadataProvider* m=application.getMetadataProvider();
-            Locker locker(m);
-            annotateException(&ex,m->getEntityDescriptor(MetadataProvider::Criteria(eid2.c_str(),NULL,NULL,false)).first); // throws it
-        }
-    }
-    
-    if (timeout) {
-        // Update storage expiration, if possible.
-        try {
-            m_storage->updateContext(key, now + m_cacheTimeout);
-        }
-        catch (exception& ex) {
-            m_log.error("failed to update session expiration: %s", ex.what());
-        }
-    }
-
-    // Finally build the Session object.
-    try {
-        return new StoredSession(this, obj);
-    }
-    catch (exception&) {
-        obj.destroy();
-        throw;
-    }
-}
-
-void SSCache::remove(const char* key, const Application& application)
-{
-#ifdef _DEBUG
-    xmltooling::NDC ndc("remove");
-#endif
-
-    m_storage->deleteContext(key);
-    m_log.info("removed session (%s)", key);
-
-    TransactionLog* xlog = application.getServiceProvider().getTransactionLog();
-    Locker locker(xlog);
-    xlog->log.info("Destroyed session (applicationId: %s) (ID: %s)", application.getId(), key);
-}
-
 bool SSCache::matches(
     const char* key,
     const saml2md::EntityDescriptor* issuer,
@@ -882,7 +998,7 @@ bool SSCache::matches(
     try {
         Session* session = find(key, application);
         if (session) {
-            Locker locker(session);
+            Locker locker(session, false);
             if (XMLString::equals(session->getEntityID(), entityID.get()) && session->getNameID() &&
                     stronglyMatches(issuer->getEntityID(), application.getXMLString("entityID").second, nameid, *session->getNameID())) {
                 return (!indexes || indexes->empty() || (session->getSessionIndex() ? (indexes->count(session->getSessionIndex())>0) : false));
@@ -908,6 +1024,9 @@ vector<string>::size_type SSCache::logout(
     xmltooling::NDC ndc("logout");
 #endif
 
+    if (!m_storage)
+        throw ConfigurationException("SessionCache insertion requires a StorageService.");
+
     auto_ptr_char entityID(issuer ? issuer->getEntityID() : NULL);
     auto_ptr_char name(nameid.getName());
 
@@ -1000,7 +1119,7 @@ vector<string>::size_type SSCache::logout(
                 }
 
                 if (session) {
-                    Locker locker(session);
+                    Locker locker(session, false);
                     // Same issuer?
                     if (XMLString::equals(session->getEntityID(), entityID.get())) {
                         // Same NameID?
@@ -1088,16 +1207,324 @@ bool SSCache::stronglyMatches(const XMLCh* idp, const XMLCh* sp, const saml2::Na
     return true;
 }
 
+#endif
+
+Session* SSCache::find(const char* key, const Application& application, const char* client_addr, time_t* timeout)
+{
+#ifdef _DEBUG
+    xmltooling::NDC ndc("find");
+#endif
+    StoredSession* session=NULL;
+
+    if (inproc) {
+        m_log.debug("searching local cache for session (%s)", key);
+        m_lock->rdlock();
+        map<string,StoredSession*>::const_iterator i=m_hashtable.find(key);
+        if (i!=m_hashtable.end()) {
+            // Save off and lock the session.
+            session = i->second;
+            session->lock();
+            m_lock->unlock();
+            m_log.debug("session found locally, validating it for use");
+        }
+        else {
+            m_lock->unlock();
+        }
+    }
+
+    if (!session) {
+        if (!SPConfig::getConfig().isEnabled(SPConfig::OutOfProcess)) {
+            m_log.debug("session not found locally, remoting the search");
+            // Remote the request.
+            DDF in("find::"STORAGESERVICE_SESSION_CACHE"::SessionCache"), out;
+            DDFJanitor jin(in);
+            in.structure();
+            in.addmember("key").string(key);
+            in.addmember("application_id").string(application.getId());
+            if (timeout && *timeout) {
+                // On 64-bit Windows, time_t doesn't fit in a long, so I'm using ISO timestamps.  
+#ifndef HAVE_GMTIME_R
+                struct tm* ptime=gmtime(timeout);
+#else
+                struct tm res;
+                struct tm* ptime=gmtime_r(timeout,&res);
+#endif
+                char timebuf[32];
+                strftime(timebuf,32,"%Y-%m-%dT%H:%M:%SZ",ptime);
+                in.addmember("timeout").string(timebuf);
+            }
+            
+            try {
+                out=application.getServiceProvider().getListenerService()->send(in);
+                if (!out.isstruct()) {
+                    out.destroy();
+                    m_log.debug("session not found in remote cache");
+                    return NULL;
+                }
+                
+                // Wrap the results in a local entry and save it.
+                session = new StoredSession(this, out);
+                // The remote end has handled timeout issues, we handle address and expiration checks.
+                timeout = NULL;
+            }
+            catch (...) {
+                out.destroy();
+                throw;
+            }
+        }
+        else {
+            // We're out of process, so we can search the storage service directly.
+#ifndef SHIBSP_LITE
+            if (!m_storage)
+                throw ConfigurationException("SessionCache lookup requires a StorageService.");
+
+            m_log.debug("searching for session (%s)", key);
+            
+            DDF obj;
+            time_t lastAccess;
+            string record;
+            int ver = m_storage->readText(key, "session", &record, &lastAccess);
+            if (!ver)
+                return NULL;
+            
+            m_log.debug("reconstituting session and checking validity");
+            
+            istringstream in(record);
+            in >> obj;
+            
+            lastAccess -= m_cacheTimeout;   // adjusts it back to the last time the record's timestamp was touched
+            time_t now=time(NULL);
+            
+            if (timeout && *timeout > 0 && now - lastAccess >= *timeout) {
+                m_log.info("session timed out (ID: %s)", key);
+                remove(key, application);
+                RetryableProfileException ex("Your session has expired, and you must re-authenticate.");
+                const char* eid = obj["entity_id"].string();
+                if (!eid) {
+                    obj.destroy();
+                    throw ex;
+                }
+                string eid2(eid);
+                obj.destroy();
+                MetadataProvider* m=application.getMetadataProvider();
+                Locker locker(m);
+                annotateException(&ex,m->getEntityDescriptor(MetadataProvider::Criteria(eid2.c_str(),NULL,NULL,false)).first); // throws it
+            }
+            
+            if (timeout) {
+                // Update storage expiration, if possible.
+                try {
+                    m_storage->updateContext(key, now + m_cacheTimeout);
+                }
+                catch (exception& ex) {
+                    m_log.error("failed to update session expiration: %s", ex.what());
+                }
+            }
+
+            // Wrap the results in a local entry and save it.
+            session = new StoredSession(this, obj);
+            // We handled timeout issues, still need to handle address and expiration checks.
+            timeout = NULL;
+#else
+            throw ConfigurationException("SessionCache search requires a StorageService.");
+#endif
+        }
+
+        if (inproc) {
+            // Lock for writing and repeat the search to avoid duplication.
+            m_lock->wrlock();
+            SharedLock shared(m_lock, false);
+            if (m_hashtable.count(key)) {
+                // We're using an existing session entry.
+                delete session;
+                session = m_hashtable[key];
+                session->lock();
+            }
+            else {
+                m_hashtable[key]=session;
+                session->lock();
+            }
+        }
+    }
+
+    if (!XMLString::equals(session->getApplicationID(), application.getId())) {
+        m_log.error("an application (%s) tried to access another application's session", application.getId());
+        session->unlock();
+        return NULL;
+    }
+
+    // Verify currency and update the timestamp if indicated by caller.
+    try {
+        session->validate(application, client_addr, timeout);
+    }
+    catch (...) {
+        session->unlock();
+        remove(key, application);
+        throw;
+    }
+    
+    return session;
+}
+
+void SSCache::remove(const char* key, const Application& application)
+{
+#ifdef _DEBUG
+    xmltooling::NDC ndc("remove");
+#endif
+    // Take care of local copy.
+    if (inproc)
+        dormant(key);
+    
+    if (SPConfig::getConfig().isEnabled(SPConfig::OutOfProcess)) {
+        // Remove the session from storage directly.
+#ifndef SHIBSP_LITE
+        m_storage->deleteContext(key);
+        m_log.info("removed session (%s)", key);
+
+        TransactionLog* xlog = application.getServiceProvider().getTransactionLog();
+        Locker locker(xlog);
+        xlog->log.info("Destroyed session (applicationId: %s) (ID: %s)", application.getId(), key);
+#else
+        throw ConfigurationException("SessionCache removal requires a StorageService.");
+#endif
+    }
+    else {
+        // Remote the request.
+        DDF in("remove::"STORAGESERVICE_SESSION_CACHE"::SessionCache");
+        DDFJanitor jin(in);
+        in.structure();
+        in.addmember("key").string(key);
+        in.addmember("application_id").string(application.getId());
+        
+        DDF out = application.getServiceProvider().getListenerService()->send(in);
+        out.destroy();
+    }
+}
+
+void SSCache::dormant(const char* key)
+{
+#ifdef _DEBUG
+    xmltooling::NDC ndc("dormant");
+#endif
+
+    m_log.debug("deleting local copy of session (%s)", key);
+
+    // lock the cache for writing, which means we know nobody is sitting in find()
+    m_lock->wrlock();
+
+    // grab the entry from the table
+    map<string,StoredSession*>::const_iterator i=m_hashtable.find(key);
+    if (i==m_hashtable.end()) {
+        m_lock->unlock();
+        return;
+    }
+
+    // ok, remove the entry and lock it
+    StoredSession* entry=i->second;
+    m_hashtable.erase(key);
+    entry->lock();
+    
+    // unlock the cache
+    m_lock->unlock();
+
+    // we can release the cache entry lock because we know we're not in the cache anymore
+    entry->unlock();
+
+    delete entry;
+}
+
+void SSCache::cleanup()
+{
+#ifdef _DEBUG
+    xmltooling::NDC ndc("cleanup");
+#endif
+
+    Mutex* mutex = Mutex::create();
+  
+    // Load our configuration details...
+    static const XMLCh cleanupInterval[] = UNICODE_LITERAL_15(c,l,e,a,n,u,p,I,n,t,e,r,v,a,l);
+    const XMLCh* tag=m_root ? m_root->getAttributeNS(NULL,cleanupInterval) : NULL;
+    int rerun_timer = 900;
+    if (tag && *tag)
+        rerun_timer = XMLString::parseInt(tag);
+    if (rerun_timer <= 0)
+        rerun_timer = 900;
+
+    mutex->lock();
+
+    m_log.info("cleanup thread started...run every %d secs; timeout after %d secs", rerun_timer, m_inprocTimeout);
+
+    while (!shutdown) {
+        shutdown_wait->timedwait(mutex,rerun_timer);
+        if (shutdown)
+            break;
+
+        // Ok, let's run through the cleanup process and clean out
+        // really old sessions.  This is a two-pass process.  The
+        // first pass is done holding a read-lock while we iterate over
+        // the cache.  The second pass doesn't need a lock because
+        // the 'deletes' will lock the cache.
+    
+        // Pass 1: iterate over the map and find all entries that have not been
+        // used in the allotted timeout.
+        vector<string> stale_keys;
+        time_t stale = time(NULL) - m_inprocTimeout;
+    
+        m_log.debug("cleanup thread running");
+
+        m_lock->rdlock();
+        for (map<string,StoredSession*>::const_iterator i=m_hashtable.begin(); i!=m_hashtable.end(); ++i) {
+            // If the last access was BEFORE the stale timeout...
+            i->second->lock();
+            time_t last=i->second->getLastAccess();
+            i->second->unlock();
+            if (last < stale)
+                stale_keys.push_back(i->first);
+        }
+        m_lock->unlock();
+    
+        if (!stale_keys.empty()) {
+            m_log.info("purging %d old sessions", stale_keys.size());
+    
+            // Pass 2: walk through the list of stale entries and remove them from the cache
+            for (vector<string>::const_iterator j = stale_keys.begin(); j != stale_keys.end(); ++j)
+                dormant(j->c_str());
+        }
+
+        m_log.debug("cleanup thread completed");
+    }
+
+    m_log.info("cleanup thread exiting");
+
+    mutex->unlock();
+    delete mutex;
+    Thread::exit(NULL);
+}
+
+void* SSCache::cleanup_fn(void* cache_p)
+{
+#ifndef WIN32
+    // First, let's block all signals 
+    Thread::mask_all_signals();
+#endif
+
+    // Now run the cleanup process.
+    reinterpret_cast<SSCache*>(cache_p)->cleanup();
+    return NULL;
+}
+
+#ifndef SHIBSP_LITE
+
 void SSCache::receive(DDF& in, ostream& out)
 {
 #ifdef _DEBUG
     xmltooling::NDC ndc("receive");
 #endif
 
-    if (!strcmp(in.name(),"find::"REMOTED_SESSION_CACHE"::SessionCache")) {
+    if (!strcmp(in.name(),"find::"STORAGESERVICE_SESSION_CACHE"::SessionCache")) {
         const char* key=in["key"].string();
         if (!key)
-            throw ListenerException("Required parameters missing for session removal.");
+            throw ListenerException("Required parameters missing for session lookup.");
 
         const Application* app = SPConfig::getConfig().getServiceProvider()->getApplication(in["application_id"].string());
         if (!app)
@@ -1143,7 +1570,7 @@ void SSCache::receive(DDF& in, ostream& out)
         // Send the record back.
         out << record;
     }
-    else if (!strcmp(in.name(),"touch::"REMOTED_SESSION_CACHE"::SessionCache")) {
+    else if (!strcmp(in.name(),"touch::"STORAGESERVICE_SESSION_CACHE"::SessionCache")) {
         const char* key=in["key"].string();
         if (!key)
             throw ListenerException("Required parameters missing for session check.");
@@ -1194,28 +1621,20 @@ void SSCache::receive(DDF& in, ostream& out)
             out << ret;
         }
     }
-    else if (!strcmp(in.name(),"remove::"REMOTED_SESSION_CACHE"::SessionCache")) {
+    else if (!strcmp(in.name(),"remove::"STORAGESERVICE_SESSION_CACHE"::SessionCache")) {
         const char* key=in["key"].string();
         if (!key)
             throw ListenerException("Required parameter missing for session removal.");
 
         const Application* app = SPConfig::getConfig().getServiceProvider()->getApplication(in["application_id"].string());
         if (!app)
-            throw ListenerException("Application not found, check configuration?");
+            throw ConfigurationException("Application not found, check configuration?");
 
         remove(key,*app);
         DDF ret(NULL);
         DDFJanitor jan(ret);
         out << ret;
     }
-    else if (!strcmp(in.name(),"getAssertion::"REMOTED_SESSION_CACHE"::SessionCache")) {
-        const char* key=in["key"].string();
-        const char* id=in["id"].string();
-        if (!key || !id)
-            throw ListenerException("Required parameters missing for assertion retrieval.");
-        string token;
-        if (!m_storage->readText(key, id, &token, NULL))
-            throw FatalProfileException("Assertion not found in cache.");
-        out << token;
-    }
 }
+
+#endif
diff --git a/shibsp/impl/XMLServiceProvider.cpp b/shibsp/impl/XMLServiceProvider.cpp
index 8002859..822ca76 100644
--- a/shibsp/impl/XMLServiceProvider.cpp
+++ b/shibsp/impl/XMLServiceProvider.cpp
@@ -247,7 +247,10 @@ namespace {
         DOMDocument* m_document;
     };
 
-    class SHIBSP_DLLLOCAL XMLConfig : public ServiceProvider, public ReloadableXMLFile, public Remoted
+    class SHIBSP_DLLLOCAL XMLConfig : public ServiceProvider, public ReloadableXMLFile
+#ifndef SHIBSP_LITE
+        ,public Remoted
+#endif
     {
     public:
         XMLConfig(const DOMElement* e) : ReloadableXMLFile(e, Category::getInstance(SHIBSP_LOGCAT".Config")),
@@ -286,11 +289,11 @@ namespace {
         const PropertySet* getPropertySet(const char* name, const char* ns="urn:mace:shibboleth:2.0:native:sp:config") const {return m_impl->getPropertySet(name,ns);}
         const DOMElement* getElement() const {return m_impl->getElement();}
 
+        // ServiceProvider
+#ifndef SHIBSP_LITE
         // Remoted
         void receive(DDF& in, ostream& out);
 
-        // ServiceProvider
-#ifndef SHIBSP_LITE
         TransactionLog* getTransactionLog() const {
             if (m_tranLog)
                 return m_tranLog;
@@ -397,7 +400,6 @@ namespace {
     static const XMLCh _fatal[] =               UNICODE_LITERAL_5(f,a,t,a,l);
     static const XMLCh _Handler[] =             UNICODE_LITERAL_7(H,a,n,d,l,e,r);
     static const XMLCh _id[] =                  UNICODE_LITERAL_2(i,d);
-    static const XMLCh Implementation[] =       UNICODE_LITERAL_14(I,m,p,l,e,m,e,n,t,a,t,i,o,n);
     static const XMLCh InProcess[] =            UNICODE_LITERAL_9(I,n,P,r,o,c,e,s,s);
     static const XMLCh Library[] =              UNICODE_LITERAL_7(L,i,b,r,a,r,y);
     static const XMLCh Listener[] =             UNICODE_LITERAL_8(L,i,s,t,e,n,e,r);
@@ -405,7 +407,6 @@ namespace {
     static const XMLCh logger[] =               UNICODE_LITERAL_6(l,o,g,g,e,r);
     static const XMLCh _LogoutInitiator[] =     UNICODE_LITERAL_15(L,o,g,o,u,t,I,n,i,t,i,a,t,o,r);
     static const XMLCh _ManageNameIDService[] = UNICODE_LITERAL_19(M,a,n,a,g,e,N,a,m,e,I,D,S,e,r,v,i,c,e);
-    static const XMLCh MemoryListener[] =       UNICODE_LITERAL_14(M,e,m,o,r,y,L,i,s,t,e,n,e,r);
     static const XMLCh _MetadataProvider[] =    UNICODE_LITERAL_16(M,e,t,a,d,a,t,a,P,r,o,v,i,d,e,r);
     static const XMLCh Notify[] =               UNICODE_LITERAL_6(N,o,t,i,f,y);
     static const XMLCh _option[] =              UNICODE_LITERAL_6(o,p,t,i,o,n);
@@ -421,6 +422,7 @@ namespace {
     static const XMLCh _SessionCache[] =        UNICODE_LITERAL_12(S,e,s,s,i,o,n,C,a,c,h,e);
     static const XMLCh _SessionInitiator[] =    UNICODE_LITERAL_16(S,e,s,s,i,o,n,I,n,i,t,i,a,t,o,r);
     static const XMLCh _SingleLogoutService[] = UNICODE_LITERAL_19(S,i,n,g,l,e,L,o,g,o,u,t,S,e,r,v,i,c,e);
+    static const XMLCh Site[] =                 UNICODE_LITERAL_4(S,i,t,e);
     static const XMLCh _StorageService[] =      UNICODE_LITERAL_14(S,t,o,r,a,g,e,S,e,r,v,i,c,e);
     static const XMLCh TCPListener[] =          UNICODE_LITERAL_11(T,C,P,L,i,s,t,e,n,e,r);
     static const XMLCh TransportOption[] =      UNICODE_LITERAL_15(T,r,a,n,s,p,o,r,t,O,p,t,i,o,n);
@@ -1137,13 +1139,12 @@ short XMLConfigImpl::acceptNode(const DOMNode* node) const
     if (XMLString::equals(name,Applications) ||
         XMLString::equals(name,_ArtifactMap) ||
         XMLString::equals(name,_Extensions) ||
-        XMLString::equals(name,Implementation) ||
         XMLString::equals(name,Listener) ||
-        XMLString::equals(name,MemoryListener) ||
         XMLString::equals(name,Policy) ||
         XMLString::equals(name,_RequestMapper) ||
         XMLString::equals(name,_ReplayCache) ||
         XMLString::equals(name,_SessionCache) ||
+        XMLString::equals(name,Site) ||
         XMLString::equals(name,_StorageService) ||
         XMLString::equals(name,TCPListener) ||
         XMLString::equals(name,UnixListener))
@@ -1240,30 +1241,25 @@ XMLConfigImpl::XMLConfigImpl(const DOMElement* e, bool first, const XMLConfig* o
             
             // Instantiate the ListenerService and SessionCache objects.
             if (conf.isEnabled(SPConfig::Listener)) {
-                child=XMLHelper::getFirstChildElement(SHAR,UnixListener);
+                child=XMLHelper::getFirstChildElement(e,UnixListener);
                 if (child)
                     plugtype=UNIX_LISTENER_SERVICE;
                 else {
-                    child=XMLHelper::getFirstChildElement(SHAR,TCPListener);
+                    child=XMLHelper::getFirstChildElement(e,TCPListener);
                     if (child)
                         plugtype=TCP_LISTENER_SERVICE;
                     else {
-                        child=XMLHelper::getFirstChildElement(SHAR,MemoryListener);
-                        if (child)
-                            plugtype=MEMORY_LISTENER_SERVICE;
-                        else {
-                            child=XMLHelper::getFirstChildElement(SHAR,Listener);
-                            if (child) {
-                                auto_ptr_char type(child->getAttributeNS(NULL,_type));
-                                if (type.get())
-                                    plugtype=type.get();
-                            }
+                        child=XMLHelper::getFirstChildElement(e,Listener);
+                        if (child) {
+                            auto_ptr_char type(child->getAttributeNS(NULL,_type));
+                            if (type.get())
+                                plugtype=type.get();
                         }
                     }
                 }
                 if (child) {
                     log.info("building ListenerService of type %s...", plugtype.c_str());
-                    m_outer->m_listener = conf.ListenerServiceManager.newPlugin(plugtype.c_str(),child);
+                    m_outer->m_listener = conf.ListenerServiceManager.newPlugin(plugtype.c_str(), child);
                 }
                 else {
                     log.fatal("can't build ListenerService, missing conf:Listener element?");
@@ -1271,54 +1267,34 @@ XMLConfigImpl::XMLConfigImpl(const DOMElement* e, bool first, const XMLConfig* o
                 }
             }
 
+#ifndef SHIBSP_LITE
             if (m_outer->m_listener && conf.isEnabled(SPConfig::OutOfProcess) && !conf.isEnabled(SPConfig::InProcess)) {
-                m_outer->m_listener->regListener("set::RelayState",m_outer->m_listener);
-                m_outer->m_listener->regListener("get::RelayState",m_outer->m_listener);
+                m_outer->m_listener->regListener("set::RelayState", m_outer->m_listener);
+                m_outer->m_listener->regListener("get::RelayState", m_outer->m_listener);
             }
+#endif
 
             if (conf.isEnabled(SPConfig::Caching)) {
                 if (conf.isEnabled(SPConfig::OutOfProcess)) {
 #ifndef SHIBSP_LITE
                     // First build any StorageServices.
-                    string inmemID;
-                    child=XMLHelper::getFirstChildElement(SHAR,_StorageService);
+                    child=XMLHelper::getFirstChildElement(e,_StorageService);
                     while (child) {
                         auto_ptr_char id(child->getAttributeNS(NULL,_id));
                         auto_ptr_char type(child->getAttributeNS(NULL,_type));
                         try {
                             log.info("building StorageService (%s) of type %s...", id.get(), type.get());
                             m_outer->m_storage[id.get()] = xmlConf.StorageServiceManager.newPlugin(type.get(),child);
-                            if (!strcmp(type.get(),MEMORY_STORAGE_SERVICE))
-                                inmemID = id.get();
                         }
                         catch (exception& ex) {
                             log.crit("failed to instantiate StorageService (%s): %s", id.get(), ex.what());
                         }
                         child=XMLHelper::getNextSiblingElement(child,_StorageService);
                     }
-                
-                    child=XMLHelper::getFirstChildElement(SHAR,_SessionCache);
-                    if (child) {
-                        auto_ptr_char type(child->getAttributeNS(NULL,_type));
-                        log.info("building SessionCache of type %s...",type.get());
-                        m_outer->m_sessionCache=conf.SessionCacheManager.newPlugin(type.get(),child);
-                    }
-                    else {
-                        log.warn("SessionCache unspecified, building SessionCache of type %s...",STORAGESERVICE_SESSION_CACHE);
-                        if (inmemID.empty()) {
-                            inmemID = "memory";
-                            log.info("no StorageServices configured, providing in-memory version for session cache");
-                            m_outer->m_storage[inmemID] = xmlConf.StorageServiceManager.newPlugin(MEMORY_STORAGE_SERVICE,NULL);
-                        }
-                        child = e->getOwnerDocument()->createElementNS(NULL,_SessionCache);
-                        auto_ptr_XMLCh ssid(inmemID.c_str());
-                        const_cast<DOMElement*>(child)->setAttributeNS(NULL,_StorageService,ssid.get());
-                        m_outer->m_sessionCache=conf.SessionCacheManager.newPlugin(STORAGESERVICE_SESSION_CACHE,child);
-                    }
 
                     // Replay cache.
                     StorageService* replaySS=NULL;
-                    child=XMLHelper::getFirstChildElement(SHAR,_ReplayCache);
+                    child=XMLHelper::getFirstChildElement(e,_ReplayCache);
                     if (child) {
                         auto_ptr_char ssid(child->getAttributeNS(NULL,_StorageService));
                         if (ssid.get() && *ssid.get()) {
@@ -1327,22 +1303,16 @@ XMLConfigImpl::XMLConfigImpl(const DOMElement* e, bool first, const XMLConfig* o
                             if (replaySS)
                                 log.info("building ReplayCache on top of StorageService (%s)...", ssid.get());
                             else
-                                log.crit("unable to locate StorageService (%s) in configuration", ssid.get());
+                                log.warn("unable to locate StorageService (%s) for ReplayCache, using dedicated in-memory instance", ssid.get());
                         }
+                        xmlConf.setReplayCache(new ReplayCache(replaySS));
                     }
-                    if (!replaySS) {
-                        log.info("building ReplayCache using in-memory StorageService...");
-                        if (inmemID.empty()) {
-                            inmemID = "memory";
-                            log.info("no StorageServices configured, providing in-memory version for legacy config");
-                            m_outer->m_storage[inmemID] = xmlConf.StorageServiceManager.newPlugin(MEMORY_STORAGE_SERVICE,NULL);
-                        }
-                        replaySS = m_outer->m_storage[inmemID];
+                    else {
+                        log.warn("no ReplayCache built, missing conf:ReplayCache element?");
                     }
-                    xmlConf.setReplayCache(new ReplayCache(replaySS));
                     
                     // ArtifactMap
-                    child=XMLHelper::getFirstChildElement(SHAR,_ArtifactMap);
+                    child=XMLHelper::getFirstChildElement(e,_ArtifactMap);
                     if (child) {
                         auto_ptr_char ssid(child->getAttributeNS(NULL,_StorageService));
                         if (ssid.get() && *ssid.get() && m_outer->m_storage.count(ssid.get())) {
@@ -1356,29 +1326,31 @@ XMLConfigImpl::XMLConfigImpl(const DOMElement* e, bool first, const XMLConfig* o
                     }
 #endif
                 }
+                child=XMLHelper::getFirstChildElement(e,_SessionCache);
+                if (child) {
+                    auto_ptr_char type(child->getAttributeNS(NULL,_type));
+                    log.info("building SessionCache of type %s...",type.get());
+                    m_outer->m_sessionCache=conf.SessionCacheManager.newPlugin(type.get(), child);
+                }
                 else {
-                    child=XMLHelper::getFirstChildElement(SHIRE,_SessionCache);
-                    if (child) {
-                        auto_ptr_char type(child->getAttributeNS(NULL,_type));
-                        log.info("building SessionCache of type %s...",type.get());
-                        m_outer->m_sessionCache=conf.SessionCacheManager.newPlugin(type.get(),child);
-                    }
-                    else {
-                        log.warn("SessionCache unspecified, building SessionCache of type %s...",REMOTED_SESSION_CACHE);
-                        m_outer->m_sessionCache=conf.SessionCacheManager.newPlugin(REMOTED_SESSION_CACHE,child);
-                    }
+                    log.fatal("can't build SessionCache, missing conf:SessionCache element?");
+                    throw ConfigurationException("Can't build SessionCache, missing conf:SessionCache element?");
                 }
             }
         } // end of first-time-only stuff
         
         // Back to the fully dynamic stuff...next up is the RequestMapper.
         if (conf.isEnabled(SPConfig::RequestMapping)) {
-            child=XMLHelper::getFirstChildElement(SHIRE,_RequestMapper);
+            child=XMLHelper::getFirstChildElement(e,_RequestMapper);
             if (child) {
                 auto_ptr_char type(child->getAttributeNS(NULL,_type));
                 log.info("building RequestMapper of type %s...",type.get());
                 m_requestMapper=conf.RequestMapperManager.newPlugin(type.get(),child);
             }
+            else {
+                log.fatal("can't build RequestMapper, missing conf:RequestMapper element?");
+                throw ConfigurationException("Can't build RequestMapper, missing conf:RequestMapper element?");
+            }
         }
         
 #ifndef SHIBSP_LITE
@@ -1454,12 +1426,6 @@ XMLConfigImpl::XMLConfigImpl(const DOMElement* e, bool first, const XMLConfig* o
         cleanup();
         throw;
     }
-#ifndef _DEBUG
-    catch (...) {
-        cleanup();
-        throw;
-    }
-#endif
 }
 
 XMLConfigImpl::~XMLConfigImpl()
@@ -1485,9 +1451,9 @@ void XMLConfigImpl::cleanup()
     m_document = NULL;
 }
 
+#ifndef SHIBSP_LITE
 void XMLConfig::receive(DDF& in, ostream& out)
 {
-#ifndef SHIBSP_LITE
     if (!strcmp(in.name(), "get::RelayState")) {
         const char* id = in["id"].string();
         const char* key = in["key"].string();
@@ -1537,8 +1503,8 @@ void XMLConfig::receive(DDF& in, ostream& out)
         DDFJanitor jret(ret);
         out << ret;
     }
-#endif
 }
+#endif
 
 pair<bool,DOMElement*> XMLConfig::load()
 {
diff --git a/shibsp/remoting/ListenerService.h b/shibsp/remoting/ListenerService.h
index f3cf95d..3e8c6b3 100644
--- a/shibsp/remoting/ListenerService.h
+++ b/shibsp/remoting/ListenerService.h
@@ -137,9 +137,6 @@ namespace shibsp {
      */
     void SHIBSP_API registerListenerServices();
 
-    /** Listener based on in-memory simulated remoting. */
-    #define MEMORY_LISTENER_SERVICE "MemoryListener"
-
     /** Listener based on TCP socket remoting. */
     #define TCP_LISTENER_SERVICE "TCPListener"
 
diff --git a/shibsp/remoting/impl/ListenerService.cpp b/shibsp/remoting/impl/ListenerService.cpp
index 20ab9b5..600c87f 100644
--- a/shibsp/remoting/impl/ListenerService.cpp
+++ b/shibsp/remoting/impl/ListenerService.cpp
@@ -33,7 +33,6 @@ using namespace xercesc;
 using namespace std;
 
 namespace shibsp {
-    //SHIBSP_DLLLOCAL PluginManager<ListenerService,const DOMElement*>::Factory MemoryListenerServiceFactory;
     SHIBSP_DLLLOCAL PluginManager<ListenerService,string,const DOMElement*>::Factory TCPListenerServiceFactory;
 #ifndef WIN32
     SHIBSP_DLLLOCAL PluginManager<ListenerService,string,const DOMElement*>::Factory UnixListenerServiceFactory;
@@ -43,7 +42,6 @@ namespace shibsp {
 void SHIBSP_API shibsp::registerListenerServices()
 {
     SPConfig& conf=SPConfig::getConfig();
-    //conf.ListenerServiceManager.registerFactory(MEMORY_LISTENER_SERVICE, MemoryListenerServiceFactory);
     conf.ListenerServiceManager.registerFactory(TCP_LISTENER_SERVICE, TCPListenerServiceFactory);
 #ifndef WIN32
     conf.ListenerServiceManager.registerFactory(UNIX_LISTENER_SERVICE, UnixListenerServiceFactory);
diff --git a/shibsp/shibsp-lite.vcproj b/shibsp/shibsp-lite.vcproj
index cddba7b..c6b35c1 100644
--- a/shibsp/shibsp-lite.vcproj
+++ b/shibsp/shibsp-lite.vcproj
@@ -198,10 +198,6 @@
 				>
 			</File>
 			<File
-				RelativePath=".\SessionCache.cpp"
-				>
-			</File>
-			<File
 				RelativePath=".\SPConfig.cpp"
 				>
 			</File>
@@ -257,7 +253,7 @@
 				Name="impl"
 				>
 				<File
-					RelativePath=".\impl\RemotedSessionCache.cpp"
+					RelativePath=".\impl\StorageServiceSessionCache.cpp"
 					>
 				</File>
 				<File
diff --git a/shibsp/shibsp.vcproj b/shibsp/shibsp.vcproj
index fecc513..cd3ce30 100644
--- a/shibsp/shibsp.vcproj
+++ b/shibsp/shibsp.vcproj
@@ -197,10 +197,6 @@
 				>
 			</File>
 			<File
-				RelativePath=".\SessionCache.cpp"
-				>
-			</File>
-			<File
 				RelativePath=".\SPConfig.cpp"
 				>
 			</File>
-- 
2.1.4