[java-shib-idp2 COMMIT] in /branches/REL_2: doc/RELEASE-NOTES.txt src/main/java/edu/internet2/middleware/shibboleth/i...

[noreply at shibboleth.net]

Author: scantor
Date: Mon Feb 18 12:07:51 2013
New Revision: 3137

URL: http://svn.shibboleth.net/view/java-shib-idp2?rev=3137&view=rev
Log:
SIDP-567 - Login Context key entropy can be improved

Modified:
    branches/REL_2/doc/RELEASE-NOTES.txt
    branches/REL_2/src/main/java/edu/internet2/middleware/shibboleth/idp/util/HttpServletHelper.java

Modified: branches/REL_2/doc/RELEASE-NOTES.txt
URL: http://svn.shibboleth.net/view/java-shib-idp2/branches/REL_2/doc/RELEASE-NOTES.txt?rev=3137&r1=3136&r2=3137&view=diff
==============================================================================
--- branches/REL_2/doc/RELEASE-NOTES.txt (original)
+++ branches/REL_2/doc/RELEASE-NOTES.txt Mon Feb 18 12:07:51 2013
@@ -7,6 +7,8 @@
 [SIDP-562] - SSO profile handlers don't check for missing session 
 [SIDP-563] - IdP-only SAML logout profile handler
 [SIDP-564] - Happy Eyeballs support for IdP session cookie address checking
+[SIDP-567] - Login Context key entropy can be improved
+[SIDP-572] - Test on Red Hat's openjdk 1.7
 
 Changes in Release 2.3.8
 =============================================

Modified: branches/REL_2/src/main/java/edu/internet2/middleware/shibboleth/idp/util/HttpServletHelper.java
URL: http://svn.shibboleth.net/view/java-shib-idp2/branches/REL_2/src/main/java/edu/internet2/middleware/shibboleth/idp/util/HttpServletHelper.java?rev=3137&r1=3136&r2=3137&view=diff
==============================================================================
--- branches/REL_2/src/main/java/edu/internet2/middleware/shibboleth/idp/util/HttpServletHelper.java (original)
+++ branches/REL_2/src/main/java/edu/internet2/middleware/shibboleth/idp/util/HttpServletHelper.java Mon Feb 18 12:07:51 2013
@@ -17,6 +17,7 @@
 
 package edu.internet2.middleware.shibboleth.idp.util;
 
+import java.security.SecureRandom;
 import java.util.UUID;
 
 import javax.servlet.ServletContext;
@@ -24,6 +25,7 @@
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
+import org.apache.commons.ssl.util.Hex;
 import org.opensaml.saml2.metadata.EntityDescriptor;
 import org.opensaml.saml2.metadata.provider.MetadataProviderException;
 import org.opensaml.util.URLBuilder;
@@ -116,6 +118,12 @@
     /** Default ID by which the {@link StorageService} is know within the Servlet context: {@value} . */
     public static final String DEFAULT_STORAGE_SERVICE_SID = "shibboleth.StorageService";
 
+    /** A {@link SecureRandom} PRNG to generate session IDs. */
+    private static final SecureRandom prng = new SecureRandom();
+    
+    /** Size of login context keys. */
+    private static final int loginContextSize = 32;
+    
     /** Class logger. */
     private static final Logger log = LoggerFactory.getLogger(HttpServletHelper.class);
 
@@ -158,9 +166,15 @@
 
         String parition = getContextParam(context, LOGIN_CTX_PARTITION_CTX_PARAM, DEFAULT_LOGIN_CTX_PARITION);
 
-        String contextKey = UUID.randomUUID().toString();
+        // generate a random session ID
+        byte[] sid = new byte[loginContextSize];
+        prng.nextBytes(sid);
+        String contextKey = Hex.encode(sid);
+
         while (storageService.contains(parition, contextKey)) {
-            contextKey = UUID.randomUUID().toString();
+            sid = new byte[loginContextSize];
+            prng.nextBytes(sid);
+            contextKey = Hex.encode(sid);
         }
 
         LoginContextEntry entry = new LoginContextEntry(loginContext, 1800000);