<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0">
<base href="https://issues.shibboleth.net/jira">
<title>Message Title</title>
</head>
<body class="jira" style="color: #333333; font-family: Arial, sans-serif; font-size: 14px; line-height: 1.429">
<table id="background-table" cellpadding="0" cellspacing="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt; background-color: #f5f5f5; border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt" bgcolor="#f5f5f5">
<!-- header here -->
<tbody>
<tr>
<td id="header-pattern-container" style="padding: 0px; border-collapse: collapse; padding: 10px 20px">
<table id="header-pattern" cellspacing="0" cellpadding="0" border="0" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tbody>
<tr>
<td id="header-avatar-image-container" valign="top" style="padding: 0px; border-collapse: collapse; vertical-align: top; width: 32px; padding-right: 8px" width="32"> <img id="header-avatar-image" class="image_fix" src="cid:jira-generated-image-avatar-ee4655dd-e1d1-4fe1-a396-64fad49a029c" height="32" width="32" border="0" style="border-radius: 3px; vertical-align: top"> </td>
<td id="header-text-container" valign="middle" style="padding: 0px; border-collapse: collapse; vertical-align: middle; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 1px"> <a class="user-hover" rel="fangjin@utoronto.ca" id="email_fangjin@utoronto.ca" href="https://issues.shibboleth.net/jira/secure/ViewProfile.jspa?name=fangjin%40utoronto.ca" style="color:#3b73af;; color: #3b73af; text-decoration: none">fangjin@utoronto.ca</a> <strong>created</strong> an issue </td>
</tr>
</tbody>
</table> </td>
</tr>
<tr>
<td id="email-content-container" style="padding: 0px; border-collapse: collapse; padding: 0 20px">
<table id="email-content-table" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt; border-spacing: 0; border-collapse: separate">
<tbody>
<tr>
<!-- there needs to be content in the cell for it to render in some clients -->
<td class="email-content-rounded-top mobile-expand" style="padding: 0px; border-collapse: collapse; color: #ffffff; padding: 0 15px 0 16px; height: 15px; background-color: #ffffff; border-left: 1px solid #cccccc; border-top: 1px solid #cccccc; border-right: 1px solid #cccccc; border-bottom: 0; border-top-right-radius: 5px; border-top-left-radius: 5px; height: 10px; line-height: 10px; padding: 0 15px 0 16px; mso-line-height-rule: exactly" height="10" bgcolor="#ffffff"> </td>
</tr>
<tr>
<td class="email-content-main mobile-expand " style="padding: 0px; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff" bgcolor="#ffffff">
<table class="page-title-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tbody>
<tr>
<td class="page-title-pattern-first-line " style="padding: 0px; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; padding-top: 10px"> <a href="https://issues.shibboleth.net/jira/browse/IDP" style="color: #3b73af; text-decoration: none">Identity Provider</a> / <a href="https://issues.shibboleth.net/jira/browse/IDP-1251" style="color: #3b73af; text-decoration: none"><img src="cid:jira-generated-image-avatar-de78e190-9d5f-4895-a446-405a95aee508" height="16" width="16" border="0" align="absmiddle" alt="Bug" style="vertical-align: text-bottom"></a> <a href="https://issues.shibboleth.net/jira/browse/IDP-1251" style="color: #3b73af; text-decoration: none">IDP-1251</a> </td>
</tr>
<tr>
<td style="vertical-align: top;; padding: 0px; border-collapse: collapse; padding-right: 5px; font-size: 20px; line-height: 30px; mso-line-height-rule: exactly" class="page-title-pattern-header-container"> <span class="page-title-pattern-header" style="font-family: Arial, sans-serif; padding: 0; font-size: 20px; line-height: 30px; mso-text-raise: 2px; mso-line-height-rule: exactly; vertical-align: middle"> <a href="https://issues.shibboleth.net/jira/browse/IDP-1251" style="color: #3b73af; text-decoration: none">Shibboleth authentication issue with Chrome browser</a> </span> </td>
</tr>
</tbody>
</table> </td>
</tr>
<tr>
<td class="email-content-main mobile-expand wrapper-special-margin" style="padding: 0px; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff; padding-top: 10px; padding-bottom: 5px" bgcolor="#ffffff">
<table class="keyvalue-table" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tbody>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">Issue Type:</th>
<td class="has-icon" style="padding: 0px; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"> <img src="cid:jira-generated-image-avatar-de78e190-9d5f-4895-a446-405a95aee508" height="16" width="16" border="0" align="absmiddle" alt="Bug" style="vertical-align: text-bottom"> Bug </td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">Assignee:</th>
<td style="padding: 0px; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"> <a class="user-hover" rel="cantor.2@osu.edu" id="email_cantor.2@osu.edu" href="https://issues.shibboleth.net/jira/secure/ViewProfile.jspa?name=cantor.2%40osu.edu" style="color:#3b73af;; color: #3b73af; text-decoration: none">Scott Cantor</a> </td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">Components:</th>
<td style="padding: 0px; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"> Authentication </td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">Created:</th>
<td style="padding: 0px; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"> 30/Jan/18 4:03 PM </td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">Environment:</th>
<td style="padding: 0px; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0; margin-top: 0"> <br> </p> </td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">Priority:</th>
<td class="has-icon" style="padding: 0px; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"> <img src="cid:jira-generated-image-static-critical-824fbed9-539d-4350-8b2a-62786d1b49c0" height="16" width="16" border="0" align="absmiddle" alt="Critical" style="vertical-align: text-bottom"> Critical </td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">Reporter:</th>
<td style="padding: 0px; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"> <a class="user-hover" rel="fangjin@utoronto.ca" id="email_fangjin@utoronto.ca" href="https://issues.shibboleth.net/jira/secure/ViewProfile.jspa?name=fangjin%40utoronto.ca" style="color:#3b73af;; color: #3b73af; text-decoration: none">fangjin@utoronto.ca</a> </td>
</tr>
</tbody>
</table> </td>
</tr>
<tr>
<td class="email-content-main mobile-expand issue-description-container" style="padding: 0px; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff; padding-top: 5px; padding-bottom: 10px" bgcolor="#ffffff">
<table class="text-paragraph-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 2px">
<tbody>
<tr>
<td class="text-paragraph-pattern-container mobile-resize-text " style="padding: 0px; border-collapse: collapse; padding: 0 0 10px 0"> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0; margin-top: 0">Background:<br> A number of students have recently reported an increase in the frequency of shibboleth error when attempting access to ACORN, the major student web services in the University of Toronto. The editor report can be found at: <a href="https://thevarsity.ca/2018/01/22/u-of-t-investigating-shibboleth-error-page-says-solution-coming-soon/" class="external-link" rel="nofollow" style="color: #3b73af; text-decoration: none">https://thevarsity.ca/2018/01/22/u-of-t-investigating-shibboleth-error-page-says-solution-coming-soon/</a><br> System environments:<br> We currently run two production IdP servers. Their specifications are listed below:<br> v2.3.8 on RedHat 5.6, tomcat 6.0.32 <br> v3.3.0 on CentOS 7.2, tomcat 8.0.35 <br> ACORN is implemented by IBM Websphere datapower and it is currently registered with v2 IdP server and it has force authentication enabled.<br> Symptoms:<br> Students go to ACORN site using Chrome. Sometimes it will redirect to the IdP login page while other times it just returns a shibboleth error page that tells user "Message did not meet security requirements".<br> This symptom can be reproduced by opening a Chrome browser and trying multiple access to Acorn from different tabs within same browser. First few attempts will succeed but eventually an attempt will fail and it return the same message. This may happen after 4 or 5 attempts.<br> This specific symptom is only reported to be related to Chrome browser.<br> Investigation:<br> After intensive troubleshooting, we were able to collect a few facts about this issue:<br> 1. On the browser side: There is a chrome setting may relate to the cause of the issue. This setting is called "Use a prediction service to load pages more quickly". We found that when this setting is turned on, the above mentioned symptom will happen. Otherwise the authentication page will always return.<br> 2. On the IdP server side, we noticed lots of replay attack error that generated for the traffic related to Acorn. A well examination of those messages tell us that a duplication of SAML request is generated right after a fresh new SAML request. Here is an example:<br> <br> IDP V2 log of the replay attack error<br> 11:23:51.034 - DEBUG <span class="error">[PROTOCOL_MESSAGE:113]</span> -<br> <?xml version="1.0" encoding="UTF-8"?><samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" AssertionConsumerServiceURL="https://acorn.utoronto.ca/spACS" Destination="https://idp.utorauth.utoronto.ca/idp/profile/SAML2/Redirect/SSO" ForceAuthn="1" ID="2054948278" IssueInstant="2018-01-29T11:23:51-05:00" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Version="2.0" xmlns:date="http://exslt.org/dates-and-times" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"><br> <saml:Issuer><a href="https://acorn.utoronto.ca" class="external-link" rel="nofollow" style="color: #3b73af; text-decoration: none">https://acorn.utoronto.ca</a></saml:Issuer><br> <samlp:NameIDPolicy AllowCreate="1"/><br> </samlp:AuthnRequest><br> 11:23:51.035 - DEBUG <span class="error">[org.opensaml.util.storage.ReplayCache:105]</span> - Message ID 2054948278 was not a replay<br> 11:23:51.035 - DEBUG <span class="error">[org.opensaml.util.storage.ReplayCache:132]</span> - Writing message ID <a href="https://acorn.utoronto.ca2054948278" class="external-link" rel="nofollow" style="color: #3b73af; text-decoration: none">https://acorn.utoronto.ca2054948278</a> to replay cache with expiration time 2018-01-29T11:28:51.035-05:00<br> 11:23:53.373 - DEBUG <span class="error">[PROTOCOL_MESSAGE:113]</span> -<br> <?xml version="1.0" encoding="UTF-8"?><samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" AssertionConsumerServiceURL="https://acorn.utoronto.ca/spACS" Destination="https://idp.utorauth.utoronto.ca/idp/profile/SAML2/Redirect/SSO" ForceAuthn="1" ID="2054948278" IssueInstant="2018-01-29T11:23:51-05:00" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Version="2.0" xmlns:date="http://exslt.org/dates-and-times" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"><br> <saml:Issuer><a href="https://acorn.utoronto.ca" class="external-link" rel="nofollow" style="color: #3b73af; text-decoration: none">https://acorn.utoronto.ca</a></saml:Issuer><br> <samlp:NameIDPolicy AllowCreate="1"/><br> </samlp:AuthnRequest><br> 11:23:53.374 - DEBUG <span class="error">[org.opensaml.util.storage.ReplayCache:115]</span> - Replay of message ID 2054948278 detected in replay cache, will expire at 2018-01-29T16:28:51.035Z</p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0">4. On the SP side, this issue is only reported from the students when accessing Acorn. In order to eliminate the issue for specific application, we tried to reproduce the symptom with another datapower application which is called degreeexplorer. This application is currently registered with v3 IdP server. The same test produced different error page - which is our customized error page. Meanwhile we were able to capture the logs on the v3 IdP server:<br> IDP V3 log of the replay attack error:<br> 2018-01-29 10:03:15,812 - DEBUG <span class="error">[org.opensaml.saml.common.binding.security.impl.MessageReplaySecurityHandler:152]</span> - Message Handler: Evaluating message replay for message ID '3452999433', issue instant '2018-01-29T15:03:14.000Z', entityID 'https://acorn.utoronto.ca<br> 2018-01-29 09:44:26,553 - WARN <span class="error">[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:182]</span> - Profile Action WebFlowMessageHandlerAdaptor: Exception handling message<br> org.opensaml.messaging.handler.MessageHandlerException: Rejecting replayed message ID '2966979975' from issuer <a href="https://acorn.utoronto.ca" class="external-link" rel="nofollow" style="color: #3b73af; text-decoration: none">https://acorn.utoronto.ca</a><br> at org.opensaml.saml.common.binding.security.impl.MessageReplaySecurityHandler.doInvoke(MessageReplaySecurityHandler.java:157)<br> 2018-01-29 09:44:26,555 - WARN <span class="error">[org.opensaml.profile.action.impl.LogEvent:105]</span> - A non-proceed event occurred while processing the request: MessageReplay<br> Here is <br> Apache logs<br> 138.51.12.110 - - <span class="error">[29/Jan/2018:11:23:51 -0500]</span> "GET /idp/profile/SAML2/Redirect/SSO?SAMLRequest=fJJRb4IwFIXf9ytI36HANNNGMUxjZuI2Irj3rtxpE2hZb3Hu36%2BiJPowH9uec%2B%2B53%2B1kdqwr7wAGpVZTEgUh8UAJXUq1m5JtsfRHZJY8TJDXVcPS1u7VBr5bQOuliGCss821wrYGk4M5SAHbzXpK9tY2yCjlQhsVtFYbrawOBKfYpPOceAtXQipuu7a9WpZNp%2BWuz43JPdDG6C9ZAc3T13VMN1BKA8LSPH8n3lIbAV06NwPxMqOtFrp6luo8SGsU0xwlMsVrQGYFO5VhcRCyz7MI2UtRZH72nhfEWy2mJA6Hg%2FFgFD%2BN3BmxhZVCy5U9vUQjP4z8eFxEEYsf2TDywyELHbuPnmR8IunYKmQdu%2FsZmkvga8t9B%2B%2Fp95aSWziTdCDhiJUNtNnR0zX6XJW%2Bla4GSbpVsm4gk%2Fy7pgm9ll3W%2F%2BZSrBaZrqT49dKq0j9zA13biNDkbLn9JMkfAAAA%2F%2F8DAA%3D%3D HTTP/1.1" <br> 302 -<br> 138.51.12.110 - - <span class="error">[29/Jan/2018:11:23:53 -0500]</span> "GET /idp/profile/SAML2/Redirect/SSO?SAMLRequest=fJJRb4IwFIXf9ytI36HANNNGMUxjZuI2Irj3rtxpE2hZb3Hu36%2BiJPowH9uec%2B%2B53%2B1kdqwr7wAGpVZTEgUh8UAJXUq1m5JtsfRHZJY8TJDXVcPS1u7VBr5bQOuliGCss821wrYGk4M5SAHbzXpK9tY2yCjlQhsVtFYbrawOBKfYpPOceAtXQipuu7a9WpZNp%2BWuz43JPdDG6C9ZAc3T13VMN1BKA8LSPH8n3lIbAV06NwPxMqOtFrp6luo8SGsU0xwlMsVrQGYFO5VhcRCyz7MI2UtRZH72nhfEWy2mJA6Hg%2FFgFD%2BN3BmxhZVCy5U9vUQjP4z8eFxEEYsf2TDywyELHbuPnmR8IunYKmQdu%2FsZmkvga8t9B%2B%2Fp95aSWziTdCDhiJUNtNnR0zX6XJW%2Bla4GSbpVsm4gk%2Fy7pgm9ll3W%2F%2BZSrBaZrqT49dKq0j9zA13biNDkbLn9JMkfAAAA%2F%2F8DAA%3D%3D HTTP/1.1" 200 758<br> <br> Based on the information we collected, we consider there is misbehavior between Chrome browser and data power and IdP server. The duplication of SAML requests are rejected by IdP server as replay attack. This duplication might be result of "prediction service" enabled in Chrome as default setting.<br> <br> We would like to request assistance from consortium support to help solve the issue.<br> <br> Thank you <br> Jin Fang</p> </td>
</tr>
</tbody>
</table> </td>
</tr>
<tr>
<td class="email-content-main mobile-expand " style="padding: 0px; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff" bgcolor="#ffffff">
<table id="actions-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 1px">
<tbody>
<tr>
<td id="actions-pattern-container" valign="middle" style="padding: 0px; border-collapse: collapse; padding: 10px 0 10px 24px; vertical-align: middle; padding-left: 0">
<table align="left" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tbody>
<tr>
<td class="actions-pattern-action-icon-container" style="padding: 0px; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 0; vertical-align: middle"> <a href="https://issues.shibboleth.net/jira/browse/IDP-1251#add-comment" target="_blank" title="Add Comment" style="color: #3b73af; text-decoration: none"> <img class="actions-pattern-action-icon-image" src="cid:jira-generated-image-static-comment-icon-eac951d3-8636-4f4a-98c7-31b109d03ab9" alt="Add Comment" title="Add Comment" height="16" width="16" border="0" style="vertical-align: middle"> </a> </td>
<td class="actions-pattern-action-text-container" style="padding: 0px; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 4px; padding-left: 5px"> <a href="https://issues.shibboleth.net/jira/browse/IDP-1251#add-comment" target="_blank" title="Add Comment" style="color: #3b73af; text-decoration: none">Add Comment</a> </td>
</tr>
</tbody>
</table> </td>
</tr>
</tbody>
</table> </td>
</tr>
<!-- there needs to be content in the cell for it to render in some clients -->
<tr>
<td class="email-content-rounded-bottom mobile-expand" style="padding: 0px; border-collapse: collapse; color: #ffffff; padding: 0 15px 0 16px; height: 5px; line-height: 5px; background-color: #ffffff; border-top: 0; border-left: 1px solid #cccccc; border-bottom: 1px solid #cccccc; border-right: 1px solid #cccccc; border-bottom-right-radius: 5px; border-bottom-left-radius: 5px; mso-line-height-rule: exactly" height="5" bgcolor="#ffffff"> </td>
</tr>
</tbody>
</table> </td>
</tr>
<tr>
<td id="footer-pattern" style="padding: 0px; border-collapse: collapse; padding: 12px 20px">
<table id="footer-pattern-container" cellspacing="0" cellpadding="0" border="0" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tbody>
<tr>
<td id="footer-pattern-text" class="mobile-resize-text" width="100%" style="padding: 0px; border-collapse: collapse; color: #999999; font-size: 12px; line-height: 18px; font-family: Arial, sans-serif; mso-line-height-rule: exactly; mso-text-raise: 2px"> This message was sent by Atlassian JIRA <span id="footer-build-information">(v7.4.2#74004-<span title="586975da6d5c632f4f0de24a42c40182e6b9ead0" data-commit-id="586975da6d5c632f4f0de24a42c40182e6b9ead0}">sha1:586975d</span>)</span> </td>
<td id="footer-pattern-logo-desktop-container" valign="top" style="padding: 0px; border-collapse: collapse; padding-left: 20px; vertical-align: top">
<table style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tbody>
<tr>
<td id="footer-pattern-logo-desktop-padding" style="padding: 0px; border-collapse: collapse; padding-top: 3px"> <img id="footer-pattern-logo-desktop" src="cid:jira-generated-image-static-footer-desktop-logo-20127e6a-d2b0-4944-9279-33d0415eb30c" alt="Atlassian logo" title="Atlassian logo" width="169" height="36" class="image_fix"> </td>
</tr>
</tbody>
</table> </td>
</tr>
</tbody>
</table> </td>
</tr>
</tbody>
</table>
</body>
</html>