SP knocking on /profile/SAML2/Redirect/SSO periodically

[Peter Schober]

* Mark Cairney <Mark.Cairney at ed.ac.uk> [2013-03-14 10:34]:
> A particular SP seems to be generating connection attempts every 5 
> seconds. What I think has happened is that their Cosign session has 
> expired and the Web Application associated with it is attempting to 
> reauthenticate or refresh itself.

Of course its not the SP itself generating those connections, it's the
SP protecting an application which is causing the user agent to
generate requests to itself, which causes the SP to make the user
agent create those connections to the IdP ;)

I somehow suspect Javascript (or some other active component, not
behaving fully like a browser) to be involved at the SP, because
missing sessions would usually just strand the browser on the login
page, no?

If your analysis is correct you'll also see those requests on CoSign's
weblogin server, right? Assuming the Shib IdP's PreviousSession
handler is disabled and all requests go through CoSign (which seems to
be the recommended approach). Otherwise the HTTP User Agent would have
a session with the Shib IdP itself and never cycle through to CoSign
in which case your analysis was (only slightly) off in that the
missing CoSign session wouldn't be involved in this -- I think.

Anyway, to find out what actually happens you'd need access to the
application protected by that SP, or get its admin to provide you with
access logs, or get one if its users to provide you with logs from the
user agent (e.g. FF's Live HTTP Headers). Or all of it :)
Not sure the user agent logs would help, as Javascript (or whatever)
doing stuff in the browser won't be seen there.

HTH,
-peter