intermitent looping redirect with blackboard

[caleb racey]

Thanks for the pointers Scott, we haven't pinpointed the actual root cause but we are only seeing it happen in very specific circumstances: 
It only happens when the browser is internet explorer, and then only when trying to access blackboard when it is behind an A10 load balancer.  

This suggests to me it isn't a shib issue but look more like an A10 load balancer interaction with Internet explorer issue, where  shibboleth just surfaces the the symptoms rather than being involved in the cause.  The A10s are setup to use cookie based affinity  so we may be hitting an issue with A10s like you saw with netscaler cookie based affinity.   I may be wrong, we will keep investigating until we get to the bottom of it.

Regards

Cal     




>-----Original Message-----
>From: users-bounces at shibboleth.net [mailto:users-
>bounces at shibboleth.net] On Behalf Of Cantor, Scott
>Sent: 18 October 2012 16:45
>To: Shib Users
>Subject: Re: intermitent looping redirect with blackboard
>
>On 10/18/12 11:38 AM, "caleb racey" <caleb.racey at newcastle.ac.uk> wrote:
>
>>Out of 6000 logins to the idp coming from  blackboard today the logs show
>>roughly 600 getting caught up in a looping redirects. Our blackboard
>>landscape is 5 front end servers behind a load balancer (A10), sessions
>>on the blackboard SPs  are being written  to and read from a shared
>>database so they should all have access to the same shib session
>>information, we have one live IDP.
>>
>>Has anyone experienced this kind of problem before and have tips of what
>>to look for to avoid the issue?
>
>I've not seen it with a shared cache, but there's not much you can do
>without reproducing the problem and identifying the log information that
>indicates why the session's not valid.
>
>Without a shared cache, it's been seen here with NetScalers because the
>cookie-based affinity option seems to not work for some clients.
>
>I assume by shared database you mean the SP cache, not Blackboard. My
>guess is the plugin's failing, but there should be something in the log
>about it when the loops occur. You could turn up logging and get the
>storage service category turned up to pick up the SQL and so forth.
>
>-- Scott
>
>
>--
>To unsubscribe from this list send an email to users-
>unsubscribe at shibboleth.net