Multi-tab login errors

[Russell Beall]

Thank you Scott.  That clears up the matter for me.

I had also noticed some behavior where a later tab loaded a page that was destined to be loaded in an earlier tab.  The changes you mention regarding timing of the cookie manipulation sounds just exactly like what is going on.

So since this will not affect the user population in general, then I can feel comfortable about releasing it.  I just can't run my tab-loading-test like I used to.  Oh well... ;-)

I have sporadic occurrences of the errors I mentioned currently in the logs for things like the back button of course, but the low frequency and lack of any complaint about it makes it a non-issue.  I just needed to make sure it wouldn't escalate.

Regards,
Russ.

On Aug 4, 2011, at 3:53 PM, Cantor, Scott E. wrote:

> On 8/4/11 5:01 PM, "Russell Beall" <beall at usc.edu> wrote:
>> 
>> I notice under my existing 2.1.5 environment, I can login to a site, and
>> then use the "Open in Tabs" option in Safari or Firefox to open 31
>> separate Shibb'ed endpoints with the PreviousSession handler.  All of
>> these sites load without errors.
> 
> I'm pretty sure that can't work anymore because of the use of cookies to
> track the login context, which is going away with V3 I think. I think some
> changes happened in that area in V2.2 or so.
> 
>> ERROR 
>> [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:555]
>> - Authentication failed with the error:
>> edu.internet2.middleware.shibboleth.idp.authn.AuthenticationException: No
>> user identified by login handler.
> 
> I'm looking into mine further, but after looking at the code, I think what
> this is (and in your case caused by the tabs), is a case where the client
> goes into the login handler, the login context gets marked as "login
> attempted", and then another request comes in with the cookie, and the
> Authn Engine treats the request as "completing login" and goes to look for
> a completed login. So your tab scenario will never work reliably.
> 
> In my case, I think users are getting the login page and then doing
> "weird" stuff causing the AuthnEngine page to get hit again in the same
> session without completing the login. Same cause, just no tabs involved.
> 
> HTH,
> -- Scott
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net