sp4a1, SubjectConfirmationData/@InResponseTo did not match the valid value: null

[Scott Cantor]

> Mar  9 19:29:44 sp4 shibboleth-sp[17509]: [Shibboleth.Apache] - token validation error: SubjectConfirmationData/@InResponseTo for assertion '_531f28e333e42baf0d905ccb1f094747' did not match the valid value: null

I think the Hub wasn't able to pull out a stored value to check InResponseTo against. Handled with a separate cookie at the moment, similar those V3 opensaml_req... cookies.

Would have to be traced to see why the cookie isn't getting passed back up, but it shouldn't be a SameSite problem, we default to handling that.

The default property:
#sp.correlation.cookiePrefix = __Host-shibsp_req_

Per-host cookies have special rules but as long as TLS is used and nothing else is changed about the cookies, they should be ok.

On DEBUG, the action that extracts the value includes logging either way:

log.debug("{} No correlation cookie found for state token '{}'", getLogPrefix(), stateToken);

log.debug("{} Extracted request ID '{}' for state token '{}'", getLogPrefix(), decoded, stateToken);

> None of the issues I see in
> https://shibboleth.atlassian.net/jira/software/c/projects/JSHIBD/issues
> seem to match that and
> https://codeberg.org/Shibboleth/java-plugin-shibd is not being used
> for issues. I may still be looking in the wrong place?

We have no current plans to use Codeberg for issues. There's nothing much in Jira bug-wise yet, only functional tasks yet to be finished.

-- Scott