[JIRA] Commented: (SSPCPP-507) Insert record failed Violation of PRIMARY KEY constraint with ODBC plugin

[Scott Cantor (JIRA)]

    [ https://issues.shibboleth.net/jira/browse/SSPCPP-507?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14446#comment-14446 ] 

Scott Cantor commented on SSPCPP-507:
-------------------------------------

One point about the IdP is that if you don't set the TTL on the transient ID generator quite low, you'll get it generating the same transient for a given principal and SP. If your logout from the IdP isn't taking, that would explain the duplicate IDs.

The error message about the insert violation is actually not a problem per se, I checked the code and it just doesn't handle that error condition with knowledge of the surrounding context. Since the calling code knows that inserts might fail, it handles that in the calling code and does a fetch of the existing record to update it. But the error in the log comes from the initial attempt to insert one.

I'll see if I can do anything about that logging, it's somewhat tricky. For now, it's just unfortunate but isn't really an error.

Your earlier comment said something about it "killing shibd". Are you saying it crashed? That would be a bug, obviously, but isn't how the code is laid out. I would expect that it would log that error, but then continue on and do the update of the reverse index list of sessions. You're right about the wrapping, so I'm leaving the bug open regardless while I look at that.

But in general, it is not meant to handle huge numbers of updates to a single NameID in the index. Again, that's not really something you get outside of load testing and/or that transient ID bug in the IdP.

Are you getting a problem with this under normal usage, and if so, what is that problem beyond this error in the log? Your actual bug report here in 507 just mentions the log message.

> Insert record failed Violation of PRIMARY KEY constraint with ODBC plugin
> -------------------------------------------------------------------------
>
>                 Key: SSPCPP-507
>                 URL: https://issues.shibboleth.net/jira/browse/SSPCPP-507
>             Project: Shibboleth SP - C++
>          Issue Type: Bug
>      Security Level: Standard(Standard bug, may impact functionality but does not represent a security vulnerability ) 
>          Components: Session Cache
>    Affects Versions: 2.5.0
>         Environment: Windows 2008 R2 on Azure.
>            Reporter: pbrears at idp.protectnetwork.org
>            Assignee: Scott Cantor
>              Labels: Session
>         Attachments: shiblogs.zip
>
>
> Using two servers with the odbc connection plugin for the storage service you can occasionally get 'insert record failed' 'Violation of PRIMARY KEY constraint' logged
> We're using "SQL Server Native Client 10.0" driver to access SQL azure for the db
> There are two servers in the non sticky load balancer. It's likely that /SAML/POST and /Secure are landing on different boxes.

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira