SP knocking on /profile/SAML2/Redirect/SSO periodically

[Mark Cairney]

On 14/03/13 10:36, Peter Schober wrote:
> * Mark Cairney <Mark.Cairney at ed.ac.uk> [2013-03-14 10:34]:
>> A particular SP seems to be generating connection attempts every 5
>> seconds. What I think has happened is that their Cosign session has
>> expired and the Web Application associated with it is attempting to
>> reauthenticate or refresh itself.
>
> Of course its not the SP itself generating those connections, it's the
> SP protecting an application which is causing the user agent to
> generate requests to itself, which causes the SP to make the user
> agent create those connections to the IdP ;)
>
> I somehow suspect Javascript (or some other active component, not
> behaving fully like a browser) to be involved at the SP, because
> missing sessions would usually just strand the browser on the login
> page, no?

Yep that's what I'd expect and if the user does a browser refresh or 
logs back into Cosign the problem goes away.

>
> If your analysis is correct you'll also see those requests on CoSign's
> weblogin server, right?

Yes- it was on the Cosign server where we spotted the behaviour first 
actually!

  Assuming the Shib IdP's PreviousSession
> handler is disabled and all requests go through CoSign (which seems to
> be the recommended approach). Otherwise the HTTP User Agent would have
> a session with the Shib IdP itself and never cycle through to CoSign
> in which case your analysis was (only slightly) off in that the
> missing CoSign session wouldn't be involved in this -- I think.
>

Actually looking at our config the PreviousSession LoginHandler in 
handler.xml is enabled. Should we disable it?

> Anyway, to find out what actually happens you'd need access to the
> application protected by that SP, or get its admin to provide you with
> access logs, or get one if its users to provide you with logs from the
> user agent (e.g. FF's Live HTTP Headers). Or all of it :)
> Not sure the user agent logs would help, as Javascript (or whatever)
> doing stuff in the browser won't be seen there.
>
> HTH,
> -peter
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>

-- 
/****************************

Mark Cairney
ITI UNIX Section
Information Services
University of Edinburgh

Tel: 0131 650 6565
Email: Mark.Cairney at ed.ac.uk

*******************************/

The University of Edinburgh is a charitable body, registered in
Scotland, with registration number SC005336.