<br><br><div class="gmail_quote">On Tue, Dec 11, 2012 at 11:52 AM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
On 12/11/12 2:38 PM, "Anand Somani" <<a href="mailto:meatforums@gmail.com">meatforums@gmail.com</a>> wrote:<br>
><br>
>* Just so I can explain to the security team => the UUID does not point<br>
<div class="im">>to anything internal and so even if somebody were to generate 1 (that is<br>
>valid) they will not be able to get access to any data or generate a<br>
>SAMLAssertion without logging in?<br>
<br>
</div>No. It points to message request state. If you hijacked it, in<br>
authenticating you would be causing it to respond to the SP that made the<br>
request but the assertion would be you, not the original "owner".<br>
<br>
I still think it should be improved, just file a bug.<br></blockquote><div>created => <a href="https://issues.shibboleth.net/jira/browse/IDP-261">https://issues.shibboleth.net/jira/browse/IDP-261</a> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
>* I do see that for login => after the user logs in (after entering<br>
<div class="im">>credentials) there is redirect to another endpoint to generate<br>
>SAMLAssertion. Where is that state maintained?<br>
<br>
</div>That depends on the login handler, and there are multiple steps involved.<br>
Some of it is the IdP session, and some of it is servlet attributes set<br>
during a forward inside the container.<br></blockquote><div><br></div><div>If I have no clustering between my multiple IDP instances (want to treat them as stateless), do I risk a login failure if the login happens on 1 instance and the SAMLAssertion generation happens on another (due to redirect)? </div>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im"><br>
> Since if I turn off session timeout (by setting a very low value for<br>
>shibboleth.StorageService in internal.xml) the assertion generation<br>
>fails.<br>
<br>
</div>That would have to be extraordinarily short but not impossible.<br>
<div class="HOEnZb"><div class="h5"><br>
-- Scott<br>
<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br>