Session destruction relative to loadbalancer setting?

[Russell Beall]

On Jan 15, 2013, at 10:25 AM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:

> It makes any cookie theft an instant session hijack. I guess it all
> depends whose resources. If it were me, I'd tell the networking people to
> fix it, but I'm like that.

Guess I better push for it then :-)

> 
>> Anyone know of a good reliable way to map X-Forwarded-For in IIS7?
> 
> If the header is being set, it would be there, nothing's going to
> overwrite it that I know of.

I expect the header is there.  The problem I think is in the mapping.  IIS7, or some plugin, seems to be unreliably mapping this header into REMOTE_ADDR, so shib is sometimes getting the LB IP address and sometimes getting the direct client IP address.

> 
> Are you sure the address is changing mid-session and isn't just different
> from the assertion's client address initially? checkAddress is much safer
> to turn off than consistentAddress.

They already have checkAddress set to false.

In the shibd.log, the session is created with this line:
2013-01-11 16:52:25 INFO Shibboleth.SessionCache [1]: new session created: ID (_ca50f3cbb83b695fc4949c428f6e635e) IdP (https://shibboleth.usc.edu/shibboleth-idp) Protocol(urn:oasis:names:tc:SAML:2.0:protocol) Address (128.125.92.159)

In this case, with Source IP persistence, the session is tagged with the LB IP address, even though the SubjectLocality and SubjectConfirmationData Address fields show the workstation IP address.

With Active Cookie persistence, this session is created with the same log entry as above except for showing the workstation IP address, but then later when the session is looked up for use, the native.log indicates that it now sees the LB IP address for this client and proceeds to delete the session.

Strange…

Regards,
Russ.

> 
> -- Scott
> 
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net