Question on IDP session randomness (low entrophy)

[Anand Somani]

follow up question



On Tue, Dec 11, 2012 at 4:06 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 12/11/12 6:29 PM, "Anand Somani" <meatforums at gmail.com> wrote:
> >
> >If I have no clustering between my multiple IDP instances (want to treat
> >them as stateless), do I risk a login failure if the login happens on 1
> >instance and the SAMLAssertion generation happens on another (due to
> >redirect)?
>
> Yes. You cannot do this without a sticky load balancer. If you want
> something else, you need Terracotta or your own storage service.
>


   - thanks, that is good to know, saved me some headache.
   - But this means there is some state which is identified by something
   set in the cookie and I suppose this uses a more secure random key?
      - Cause in theory I login as "joe" and I get redirected for getting
      Assertion, but if somebody "tom" else guesses that key and is able to get
      (by injecting between this redirect, from another bot) the assertion and
      redirect and now the SP lets in "tom" as "joe" - is this not possible?

 Thanks
Anand
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20121212/df905c31/attachment.html