login context vs session

[Cantor, Scott]

On 4/8/13 10:20 PM, "Paul Hethmon" <paul.hethmon at clareitysecurity.com>
wrote:

>So perhaps a dev question, but we'll try here first. I'm seeing an
>occasional situation where a user is going through login, has been
>authenticated, and I've returned control back to the authentication
>engine to create the SAML response. During that process,
> Shib is loosing the user and I end up with a SAML response with out any
>nameID or attributes. I can see in the logs where the attribute
>resolution starts and the principal value is already "null". So no
>mystery as to why the response is empty. I just can't
> figure out why the principal is lost.

I know, I've fixed it in 2.4.0 to properly halt with an error. The cause
is very clear, but I don't think there's anything that can be done about
it.

Somehow the login process works and that cookie works, but not the session
cookie. I have some second-hand evidence that there are cases where the
client clearing cookies will fix it (meaning it keeps failing until that's
done), which points to a cookie problem in the client.

The problem at root is the use of the session as the back-end of the
identity recovery step in the profile handler. Unfortunately that I can't
fix in V2, it's baked in too deep.

>It's been sanitized to protect my guilt. For this customer, I am not
>keeping sessions. So I have the session time in internal.xml set to a
>very low value, 2500 ms. My theory is that the storage sweeper comes
>through occasionally timing with my login process
> and kills the session and I lose the principal.

I don't think so, but that is a pretty low timeout. Maybe your specific
case is different from mine. Your log seems to show it sending a cookie
but not finding a session, which I don't think is the case when I've
observed it, but I can't run on DEBUG to tell.

>So, do I need to keep a session for a longer minimum period of time? Say
>on the order of 4 or 5 minutes? Previous session handling is turned off
>and I've turned down the session timer just to prevent re-use of the
>browser session by different users (shared
> computer model).

I would think a minute or two would be safer, but I don't think it will
fix this.

-- Scott