Detection of replay attack in clustered environment

[Cantor, Scott]

On 2/26/14, 3:47 AM, "KajoKrtko" <acojakochces at gmail.com> wrote:

>I don't see the answer how to implement replay cache in clustered
>environment
>and without sql database.

The only part of that with any relevance to Shibboleth is what you would
have to do to get the information that would be required. The original
message already addressed that; the only way to get at the assertion ID is
with the export function.

If you wanted to get the response ID also, that's more difficult. About
the only way would be to pick it up from the transaction log after
customizing the log format to include it.

> 
>You have said: I can't imagine somebody not clustering the SP but manually
>trying to cluster the replay cache. -- Which I don't understand what that
>means.

It means you shouldn't do this. The benefit is vastly outweighed by the
effort involved. The risk of a stolen message is not that high of TLS is
in place, and the window of attack is only a few minutes (and you could
shrink that down if you wanted, just modify the freshness window in the
security-policy.xml file, in the rule that checks the message issue time.

-- Scott