Thanks for the quick response!, some follow up questions<div><br></div><div><ul><li>Just so I can explain to the security team => the UUID does not point to anything internal and so even if somebody were to generate 1 (that is valid) they will not be able to get access to any data or generate a SAMLAssertion without logging in?</li>
<li>I do see that for login => after the user logs in (after entering credentials) there is redirect to another endpoint to generate SAMLAssertion. Where is that state maintained? Since if I turn off session timeout (by setting a very low value for shibboleth.StorageService in internal.xml) the assertion generation fails. </li>
</ul><div>Thanks</div></div><div>Anand</div><div><br><div class="gmail_quote">On Tue, Dec 11, 2012 at 10:02 AM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">On 12/11/12 12:49 PM, "Anand Somani" <<a href="mailto:meatforums@gmail.com">meatforums@gmail.com</a>> wrote:<br>
><br>
>We are using shibboleth-idp (2.3.5) on jetty (7.5.4) with JAAS. Now our<br>
>intention is to keep the IDP stateless, but I think there is some session<br>
>data sharing between the login and assertion generation modules and so<br>
>requires the session to still be valid<br>
> for a small duration (abt a second).<br>
<br>
</div>There's a login context, yes.<br>
<div class="im"><br>
>Our security team did test around our setup and said that the session was<br>
>randomness was unacceptable (low entrophy) and was susceptible to<br>
>prediction attacks, so I wonder if there is something I am doing wrong, so<br>
<br>
</div>It's a UUID, because it's not associated with security state.<br>
<br>
>* Is this a known issue, is there a JIRA around this?<br>
<br>
No, it's not been a concern of anybody. I'm not intrinsically opposed to<br>
converting it to a pseudorandom, but it isn't a security issue.<br>
<br>
-- Scott<br>
<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div><br></div>