[IdPv3] State Management and Clustering

[Cantor, Scott]

On 10/27/11 9:40 AM, "Paul Hethmon" <paul.hethmon at clareitysecurity.com>
wrote:
>
>I would tend to lean towards the back end solution myself. Users,
>browsers, and cookies can't be trusted.

No, but you're trusting one regardless. Even if you put the state on the
server, you have a cookie to look it up. Those are always easier to forge
than a full-blown signed and encrypted token. Just saying.

As long as the browser's not given a key, security will be bad. Nothing
can really change that.

> It's the old saying about software
>developers versus the universe creating better idiots. The idiots always
>win. That doesn't even consider those with actual malice.

What would be nice is if the web development environment didn't actually
cater to them both.

>I did not find plugging in Infinispan very difficult for Shib 2. I've got
>permission to release what I've done there, but just haven't got it to a
>state where I feel I can deploy it myself much less release it. Should be
>soon though.

My problem with server side state is that I don't trust asynch replication
for most things, and synch isn't reliable enough.

-- Scott