Datasealer key rotation and CAS

[Paul B. Henson]

So as far as I can tell there is no way (short of restarting the idp) to make it reload the datasealer key at a specific time or absolute time interval. The idp.sealer.updateInterval configuration parameter lets you control how often it checks for an updated key, but that interval is relative to the start time, so unless two instances of the idp were started at the exact same time they will be checking at different absolute times.

For SAML authentication, this isn't really a big deal. A sticky load balancer is likely in use, and a client will probably be hitting the same server which will rotate when it rotates without much concern for when the other instances rotate. In the worst case, even if a client ends up hitting an IDP that has not yet rotated with a session encrypted by the new key, they will just have to re-authenticate, and move on.

However, with the CAS protocol, there are two different systems interacting with the idp, the client, which acquires a service ticket, and the server, which validates it. It is quite possible and perhaps likely that these two systems will talk to different instances of the idp, and if the service ticket happens to be encrypted with a key that the idp doing the validation does not have, it will fail. And, again given sticky load balancers, will continue to fail until that instance has rotated to the new key, which could take up to until the entire idp.sealer.updateInterval has passed.

It seems it would be advantageous to be able to make the idp transparently reload the datasealer key on demand, as well as on a relative schedule, similar to other things like metadata configuration or attribute filters that can both check for updates on a regular basis and also be triggered to update immediately. This would allow one to have all instances of the idp reload a new key at the same time and avoid any windows that might cause breakage.

Is this something that would be relatively easy to implement, or very difficult within the existing framework?

Thanks...

--
Paul B. Henson  |  (909) 979-6361  |  http://www.cpp.edu/~henson/
Operating Systems and Network Analyst  |  henson at cpp.edu
California State Polytechnic University  |  Pomona CA 91768