SP v4 alpha2 sessions ?

[Jarno Huuskonen]

Hi,

On Wed, 2026-09-16 at 09:03 -0400, Scott Cantor via users wrote:
> 
> > Once a session is available in an agent’s memory/filesystem cache,
> > does
> > the agent still query the hub for session data or validation on
> > subsequent requests?
> 
> The Hub never tracks sessions in any way. It can function optionally
> as a passthrough to handle the storage steps but it doesn't retain
> any information about them apart from that, and the Agent only
> contacts the Hub for sessions if that cache "type" is used, which is
> not the default at the moment. Using the filesystem is an alternative
> (the only one at the moment).
> 

Thanks, is hub "stickiness" needed during login (between agent calls to
hub session-initiator and token-consumer) (similar to IdP where
login/flow needs to go to same server)

> > Or does it use the locally cached session until an
> > expiration, timeout, version change, or other invalidation
> > condition
> > requires hub interaction?
> 
> If the filesystem is used, there is *no* access to the Hub again for
> that session unless logout happens. The filesystem is checked and
> updated based on the storageAccessInterval setting or if a new
> process has to check for the session. With the storage type, it does
> have to contact the Hub at time-based intervals you control.

Does hub get called on local logout(localOnly = true) or only with
SAML/SLO logout ?

There could be a logic error in
attribute/impl/DefaultAttributeConfiguration.cpp:L363-365

            DDF v = vals.first();
            set<string>& targetSet = valueMap[*headerNameToUse];
            while (vals.isnull()) {
Is the while vals.isnull() correct ?

session/impl/FilesystemSessionCache.cpp:L213:
if (f > 0) {
0 is valid filedescriptor, so this should be if (f >= 0) ?

I think there's TOCTOU race in
session/impl/FilesystemSessionCache.cpp:L211-220 and L422-448
session file is created with open O_CREAT | O_EXCL and then fd is
closed and then reopended with ofstream os(path);

Using (gnu extension) something like:
#include <ext/stdio_filebuf.h>
int f = open(path.c_str(), O_WRONLY | O_CREAT | O_EXCL | O_NOFOLLOW |
O_CLOEXEC, S_IRUSR | S_IWUSR);
__gnu_cxx::stdio_filebuf<char> filebuf(f, std::ios::out);
ostream os(&filebuf);

and removing close(f) after open() could fix the open/use race.

For utime (L397,L508,L609) lutimes shouldn't follow symlink.

Looks like cookie value could be used as is for filesystem ops:
shibsp/session/impl/AbstractSessionCache.cpp:L425-427 and L691-695
pair<string,unsigned int> keyver = parseCookieValue(cookieval); could
check that keyver.first is only hexdigits(isxdigit) and correct/sane
length.

-Jarno

-- 
Jarno Huuskonen