IDP 2.3.6 Stops Sending SAML Responses.

[Paul Hethmon]

So what do your Shibboleth logs say? If nothing, what do your Tomcat (or whatever container you use) logs say? Are you using Terracotta clustering? It can block under certain scenarios.

Paul


From: <Montoya>, Jose T <jtmontoya at mdanderson.org<mailto:jtmontoya at mdanderson.org>>
Reply-To: Shibboleth Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Date: Tuesday, May 1, 2012 11:43 AM
To: Shibboleth Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Subject: IDP 2.3.6 Stops Sending SAML Responses.

I’m updating the thread name since it applies to all response from the IDP.

The scenario:
The shibboleth IDP starts and runs for a while but eventually stops sending responses. It continues to receive and process incoming requests.

The browser waits for a redirect from the shibboleth IDP after successful login (I have confirmed this using fiddler and IE).
The log shows that the SAML response was successfully encoded and the shibboleth Audit Logger does not show a confirmation of what was sent (using saml1 as a reference).

>From my old days, it looks like a blocked thread or socket. The browser will eventually receive the response, especially when I shut down the idp (indicating some sort of resource release).

The issue occurs under heavy load. Last night it ran fine for 12 hours. It was until this morning about 8:00am when usage increases that the symptom shows up.

I did not see this behavior in idp v 2.1.5.
There are no indications of insufficient threads, memory or disk space. I don’t see reaching connection limits as well.
Ideas?


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120501/49a7f35a/attachment.html