Does RH SSO SAML Client adapter implement session fixation prevention post authentication?
Issue
The rh sso saml client adapter 7.6 does not seem to change the client's session id post authentication.
There seems to be "turnOffChangeSessionIdOnLogin=false" which suggests that the session id should change post authentication by default.
[a] https://docs.redhat.com/en/documentation/red_hat_single_sign-on/7.6/html/securing_applications_and_services_guide/using_saml_to_secure_applications_and_services#sp_element
turnOffChangeSessionIdOnLogin
The session ID is changed by default on a successful login on some platforms to plug a security attack vector. Change this to true to disable this. It is recommended you do not turn it off. Default value is false.
Based on testing, the session id does not change after authentication.
Environment
- Openshift 4.12
- EAP7.4 openjdk17
- RH SAML Client Adapter 7.6
- MS ADFS SAML IDP
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.