maintaining SP shib state in cookie

[Cantor, Scott]

On 5/14/15, 9:02 PM, "Jeremy Shapiro" <jnshapiro at gmail.com> wrote:

>My organization is planning on using clustered SP's.  Our DNS ttl's are high enough that using different SP's for the original request and the authenticated request is not a concern.  What we do see in testing is that Ajax requests from long-lived browser sessions can cause problems with redirects when the resolved IP changes.  

How are you clustering the application itself in the first place? Normally the way to deal with an application that has managed to solve a problem that complex is to dump the SP session after it starts, just gateway it into the app session and forget about it.

>The proposed solutions in the wiki (using private subnets for replications, shared database) won't work for us for various reasons.  How feasible would it be for us to enhance mod_shibboleth to store the session state in a cookie (a la pubcookie), instead of a local cache.  Is this just a development effort (albeit a large one) or are there security concerns with this approach?

The security concerns are that the data has to be tamper-proof and encrypted, same as the IdP's code does, which means secret key management also. More to the point the data is arbitrarily large, which is why it wasn't done to begin with. It will only be possible when the attribute set doesn't exceed a few kilobytes, which is admittedly the norm, but there's no apriori way for the SP to know that ahead of time and nothing it can do about it if it's not true.

Another option is cross-node lookup of the data to move the state around in memory.

It's on the discussion list for the next stage of work [1] (SP Session Cache Alternatives), to which there has little feedback.

Of course, if you're offering to work on it, I'm happy to advise. ;-)

The session cache is, however, the worst code I've ever written (second only to the code it replaced) and is more complex than all the rest of the SP combined at this point, maybe excepting the logout code.

-- Scott

[1] https://wiki.shibboleth.net/confluence/display/DEV/Project+Roadmap