fixed warning when Warning: session_create_id(): Failed to create ID (#1291)

* fixed warning when Warning: session_create_id(): Failed to create new ID in /var/ssosp/lib/SimpleSAML/SessionHandlerPHP.php

* Use session_create_id() unconditionally

In master, we require PHP 7.2, which is guaranteed to provide `session_create_id()`. Therefore, we don't need the if clause any longer. Add also a warning when `session_create_id()` fails, and fall back gracefully to our old way to create session IDs.

Co-authored-by: Jaime Pérez Crespo <jaime.perez@uninett.no>

lib/SimpleSAML/SessionHandlerPHP.php

@@ -166,15 +166,16 @@ class SessionHandlerPHP extends SessionHandler
     public function newSessionId(): string
     {
         // generate new (secure) session id
-        if (function_exists('session_create_id')) {
-            $sid_length = (int) ini_get('session.sid_length');
-            $sid_bits_per_char = (int) ini_get('session.sid_bits_per_character');
+        $sid_length = (int) ini_get('session.sid_length');
+        $sid_bits_per_char = (int) ini_get('session.sid_bits_per_character');
 
-            if (($sid_length * $sid_bits_per_char) < 128) {
-                Logger::warning("Unsafe defaults used for sessionId generation!");
-            }
-            $sessionId = session_create_id();
-        } else {
+        if (($sid_length * $sid_bits_per_char) < 128) {
+            Logger::warning("Unsafe defaults used for sessionId generation!");
+        }
+        $sessionId = session_create_id();
+
+        if (!$sessionId) {
+            Logger::warning("Secure session ID generation failed, falling back to custom ID generation.");
             $sessionId = bin2hex(openssl_random_pseudo_bytes(16));
         }
         Session::createSession($sessionId);