Bad lastAccess check in SSCache::find
Jeroen De Ridder
voetsjoeba at gmail.com
Mon Jul 4 13:36:10 EDT 2016
Reporting here since logging in to JIRA via idp.protectnetwork.org is
currently broken (I get a FatalProfileException "Unable to establish
security of incoming assertion"; incidentally, the error says to write
to contact at shibboleth.net, but that address auto-responds saying you
should write to the dev or users mailing list instead).
Commit 92380630c4c151f5bf3205ed816a06ef018c52b2 to resolve SSPCPP-699
introduces a bad if-check on the lastAccess variable in the hunk
starting at line 1623:
+ if (lastAccess = 0) {
+ m_log.error("session (ID: %s) did not report time of
last access", key);
+ throw RetryableProfileException("Your session has
expired, and you must re-authenticate.");
+ }
This causes SSCache::find() to always report sessions as timed out if
called from the shibd side and if given a timeout to enforce. I couldn't
find any immediate cases that were affected, but custom handlers that
people write may be (as is the case for me).
More information about the dev
mailing list