Multi-tab login errors

[Cantor, Scott E.]

On 8/4/11 5:01 PM, "Russell Beall" <beall at usc.edu> wrote:
>
>I notice under my existing 2.1.5 environment, I can login to a site, and
>then use the "Open in Tabs" option in Safari or Firefox to open 31
>separate Shibb'ed endpoints with the PreviousSession handler.  All of
>these sites load without errors.

I'm pretty sure that can't work anymore because of the use of cookies to
track the login context, which is going away with V3 I think. I think some
changes happened in that area in V2.2 or so.

>ERROR 
>[edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:555]
>- Authentication failed with the error:
>edu.internet2.middleware.shibboleth.idp.authn.AuthenticationException: No
>user identified by login handler.

I'm looking into mine further, but after looking at the code, I think what
this is (and in your case caused by the tabs), is a case where the client
goes into the login handler, the login context gets marked as "login
attempted", and then another request comes in with the cookie, and the
Authn Engine treats the request as "completing login" and goes to look for
a completed login. So your tab scenario will never work reliably.

In my case, I think users are getting the login page and then doing
"weird" stuff causing the AuthnEngine page to get hit again in the same
session without completing the login. Same cause, just no tabs involved.

HTH,
-- Scott