Occasional SAML exception during SP/IdP handshake

[Saimon Moore]

Thanks Scott,

I put on my thinking cap and realised that I had forceAuthn set to true in
shib2.xml config and this is why the existing session wasn't be reused.

So in reality I was asking the idp to reauthenticate while an existing
session already existed. It may be that the IdP has an issue with this when
the session cookies exist for the user retrying the authentication.

For us this solution is good enough.

I completely missed this attribute in my previous investigations.

Thanks and sorry for the noise.


On Wed, Jul 31, 2013 at 4:41 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 7/31/13 10:25 AM, "Saimon Moore" <saimonmoore at gmail.com> wrote:
>
> >I did some further debugging and this only happens if I reattempt auth
> >via shibboleth after a previous successfull login (via shibboleth).
> >
> >If I don't completely clear all my session cookies I always get the
> >exception above. If I do clear session cookies then I don't get the
> >exception.
>
> There is nothing like what you described under ordinary use.
>
> >I'm unsure wether this issue is due to the existing session in the SP or
> >in the IdP.
>
> The SP has nothing whatsoever to do with this.
>
> >If in the IdP is there a url IdP's have I can redirect users to
> >invalidate the IdP Session (for my SP only) there?
>
> That also has nothing to do with this.
>
> Request processing at the IdP is up to the IdP. If you send it requests
> that result in a protocol failure, that's that. What's causing the error
> is up to the IdP admin to look into and resolve if it's not caused by
> something the SP is sending it. AuthnFailed in general means that there's
> a login handler acting improperly or being used improperly and isn't able
> to handle the login process.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>



-- 
Saimon Moore
Web Developer @ Teambox.com
(http://teambox.com)

Skype: saimonmoore
Yahoo IM: saimonmoore
Google IM: saimonmoore
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130731/ea58e98a/attachment.html