IdP custom handling for throttling misbehaving looping SPs

[Cantor, Scott E.]

On 8/9/11 3:00 PM, "Russell Beall" <beall at usc.edu> wrote:
>
>Actually, it is two legacy SPs which are the primary culprits.  I haven't
>seen these be shortcircuited.  The replay detection doesn't catch it
>because it appears to be a new request each time.

If it's really looping, it wouldn't. The time parameter will end up
overlapping itself, and the replay detection is based on the SP identity
and the time. So maybe you don't have the replay rule on, which would be
the case in an older config.

>>Yes, it is definitely misconfiguration that causes this, and I would
>>like to have the error page indicate the site responsible so the user
>>can complain appropriately.

I use error message testing, there's not much else you can do right now.

>Is there a record of logins in the sessionStore object which might have a
>history of logins processed, with timestamps?  It might be simple enough
>to check the history, perhaps simply with a bit of JSP code, and if there
>have been so many for a given entityID and principal within the last so
>many minutes, I could toss up an error page (no cookie processing needed
>for this...).

Don't know.

-- Scott