Question on IDP session randomness (low entrophy)

[Cantor, Scott]

On 12/11/12 2:38 PM, "Anand Somani" <meatforums at gmail.com> wrote:
>
>* Just so I can explain to the security team => the UUID does not point
>to anything internal and so even if somebody were to generate 1 (that is
>valid) they will not be able to get access to any data or generate a
>SAMLAssertion without logging in?

No. It points to message request state. If you hijacked it, in
authenticating you would be causing it to respond to the SP that made the
request but the assertion would be you, not the original "owner".

I still think it should be improved, just file a bug.

>* I do see that for login => after the user logs in (after entering
>credentials) there is redirect to another endpoint to generate
>SAMLAssertion. Where is that state maintained?

That depends on the login handler, and there are multiple steps involved.
Some of it is the IdP session, and some of it is servlet attributes set
during a forward inside the container.

> Since if I turn off session timeout (by setting a very low value for
>shibboleth.StorageService in internal.xml) the assertion generation
>fails.  

That would have to be extraordinarily short but not impossible.

-- Scott