Question on IDP session randomness (low entrophy)

[Cantor, Scott]

On 12/11/12 12:49 PM, "Anand Somani" <meatforums at gmail.com> wrote:
>
>We are using shibboleth-idp (2.3.5) on jetty (7.5.4) with JAAS. Now our
>intention is to keep the IDP stateless, but I think there is some session
>data sharing between the login and assertion generation modules and so
>requires the session to still be valid
> for a small duration (abt a second).

There's a login context, yes.

>Our security team did test around our setup and said that the session was
>randomness was unacceptable (low entrophy) and was susceptible to
>prediction attacks, so I wonder if there is something I am doing wrong, so

It's a UUID, because it's not associated with security state.

>* Is this a known issue, is there a JIRA around this?

No, it's not been a concern of anybody. I'm not intrinsically opposed to
converting it to a pseudorandom, but it isn't a security issue.

-- Scott