login context vs session

[Paul Hethmon]

On 4/8/13 10:35 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:

>>
>>So perhaps a dev question, but we'll try here first. I'm seeing an
>>occasional situation where a user is going through login, has been
>>authenticated, and I've returned control back to the authentication
>>engine to create the SAML response. During that process,
>>Shib is loosing the user and I end up with a SAML response with out any
>>nameID or attributes. I can see in the logs where the attribute
>>resolution starts and the principal value is already "null". So no
>>mystery as to why the response is empty. I just can't
>>figure out why the principal is lost.
>
>I know, I've fixed it in 2.4.0 to properly halt with an error. The cause
>is very clear, but I don't think there's anything that can be done about
>it.
>
>Somehow the login process works and that cookie works, but not the session
>cookie. I have some second-hand evidence that there are cases where the
>client clearing cookies will fix it (meaning it keeps failing until that's
>done), which points to a cookie problem in the client.
>
>The problem at root is the use of the session as the back-end of the
>identity recovery step in the profile handler. Unfortunately that I can't
>fix in V2, it's baked in too deep.

Ok, good to know I'm not crazy. I do seem to have this particular customer
with a high rate of this happening. So far I haven't found anything
significantly different in the logs.

I can run this server with debug on, at least for a period of time, if you
think moving up to trace level might bring out something more useful.

thanks,

Paul


>