Bad lastAccess check in SSCache::find

Jeroen De Ridder voetsjoeba at gmail.com
Mon Jul 4 13:36:10 EDT 2016


Reporting here since logging in to JIRA via idp.protectnetwork.org is 
currently broken (I get a FatalProfileException "Unable to establish 
security of incoming assertion"; incidentally, the error says to write 
to contact at shibboleth.net, but that address auto-responds saying you 
should write to the dev or users mailing list instead).

Commit 92380630c4c151f5bf3205ed816a06ef018c52b2 to resolve SSPCPP-699 
introduces a bad if-check on the lastAccess variable in the hunk 
starting at line 1623:

+            if (lastAccess = 0) {
+                m_log.error("session (ID: %s) did not report time of 
last access", key);
+                throw RetryableProfileException("Your session has 
expired, and you must re-authenticate.");
+            }

This causes SSCache::find() to always report sessions as timed out if 
called from the shibd side and if given a timeout to enforce. I couldn't 
find any immediate cases that were affected, but custom handlers that 
people write may be (as is the case for me).



More information about the dev mailing list