Question on IDP session randomness (low entrophy)

[Anand Somani]

Thanks for the quick response!, some follow up questions


   - Just so I can explain to the security team => the UUID does not point
   to anything internal and so even if somebody were to generate 1 (that is
   valid) they will not be able to get access to any data or generate a
   SAMLAssertion without logging in?
   - I do see that for login => after the user logs in (after entering
   credentials) there is redirect to another endpoint to generate
   SAMLAssertion. Where is that state maintained? Since if I turn off session
   timeout (by setting a very low value for shibboleth.StorageService in
   internal.xml) the assertion generation fails.

Thanks
Anand

On Tue, Dec 11, 2012 at 10:02 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 12/11/12 12:49 PM, "Anand Somani" <meatforums at gmail.com> wrote:
> >
> >We are using shibboleth-idp (2.3.5) on jetty (7.5.4) with JAAS. Now our
> >intention is to keep the IDP stateless, but I think there is some session
> >data sharing between the login and assertion generation modules and so
> >requires the session to still be valid
> > for a small duration (abt a second).
>
> There's a login context, yes.
>
> >Our security team did test around our setup and said that the session was
> >randomness was unacceptable (low entrophy) and was susceptible to
> >prediction attacks, so I wonder if there is something I am doing wrong, so
>
> It's a UUID, because it's not associated with security state.
>
> >* Is this a known issue, is there a JIRA around this?
>
> No, it's not been a concern of anybody. I'm not intrinsically opposed to
> converting it to a pseudorandom, but it isn't a security issue.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20121211/2af79cb5/attachment-0001.html