Question on IDP session randomness (low entrophy)

[Anand Somani]

On Tue, Dec 11, 2012 at 11:52 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 12/11/12 2:38 PM, "Anand Somani" <meatforums at gmail.com> wrote:
> >
> >* Just so I can explain to the security team => the UUID does not point
> >to anything internal and so even if somebody were to generate 1 (that is
> >valid) they will not be able to get access to any data or generate a
> >SAMLAssertion without logging in?
>
> No. It points to message request state. If you hijacked it, in
> authenticating you would be causing it to respond to the SP that made the
> request but the assertion would be you, not the original "owner".
>
> I still think it should be improved, just file a bug.
>
created => https://issues.shibboleth.net/jira/browse/IDP-261

>
> >* I do see that for login => after the user logs in (after entering
> >credentials) there is redirect to another endpoint to generate
> >SAMLAssertion. Where is that state maintained?
>
> That depends on the login handler, and there are multiple steps involved.
> Some of it is the IdP session, and some of it is servlet attributes set
> during a forward inside the container.
>

If I have no clustering between my multiple IDP instances (want to treat
them as stateless), do I risk a login failure if the login happens on 1
instance and the SAMLAssertion generation happens on another (due to
redirect)?

>
> > Since if I turn off session timeout (by setting a very low value for
> >shibboleth.StorageService in internal.xml) the assertion generation
> >fails.
>
> That would have to be extraordinarily short but not impossible.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20121211/ef7b75ae/attachment-0001.html