Timeout or something?

[Jason Gauthier]

That makes sense, and I see that in the XML.  But what should it be?  My Idp or the resource protected by shib?

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Nate Klingenstein
Sent: Friday, July 19, 2013 1:16 PM
To: Shib Users
Subject: Re: Timeout or something?

SWAG:

It sounds like the SP is set to automatically protect a resource, and the session cookie for that resource is timing out.  The original invocation of Shibboleth included an entityID parameter of some sort somewhere.

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSessionCreationParameters

On session expiration(modulated by the Sessions element's "lifetime" and "timeout" timeouts)

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSessions

your SP is trying to restablish a new session for that user, but it doesn't have the entityID parameter supplied to it and there's some default in place somewhere that goes to idp.example.org, probably in your SSO element in shibboleth2.xml.

On Jul 19, 2013, at 16:53 , Jason Gauthier wrote:

> Open a resource protected by shib, authentication occurs, everything works great.
> When I leave the session unused for a period of time (unknown amount, but it has been around an hour) I come back and click a link I get the following:
>  
> opensaml::saml2md::MetadataException at (https://site.company.com/url) 
> Unable to locate metadata for identity provider 
> (https://idp.example.org/idp/shibboleth)
>  
> However, merely reloading the page, appears to execute another authenticate and then all is well.
> Nothing is logged by Shib directly, but apache reports this:
> opensaml::saml2md::MetadataException at (https://site.company.com/url) 
> Unable to locate metadata for identity provider 
> (https://idp.example.org/idp/shibboleth)
>  


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net