IP address mismatch issues

Thu May 23 16:50:07 EDT 2013

Ok.  Below is a snippet from the native.log filtered by the thread ID 17160 where the problem is being reported.  The log message seems to be what you were referring to.  There is a relatively instant loop around, but there seems to be consistency of the address.

Does that reveal anything useful?

Thanks,
Russ.

On May 23, 2013, at 1:09 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:

> On 5/23/13 3:18 PM, "Russell Beall" <beall at usc.edu> wrote:
> 
>> Thanks for the pointers.  I looked into this and I was surprised to find
>> that the SP is using:
>> checkAddress="false" consistentAddress="true"
> 
> I don't know what error message you're actually referring to here, but
> there's nothing changed in 2.5 except for the happy eyeballs thing for
> mixed V4/V6 networks. Given only V4 or V6 addresses, the code should do
> exactly what it has done for years. There could be a bug, I suppose, but
> that seems unlikely.
> 
> When you switch addresses after the session is set up, that will certainly
> break it, but I don't believe you'll ever see a message in the client
> about it. You certainly should in the log, I would guess.
> 
>> It looks also like they upgraded the SP to 2.5.1 but left in the old
>> security
>> configuration:
> 
> That's not unusual, and it has nothing to do with IP checking.
> 
>> Perhaps just pulling in the security-policy.xml file will help with this?
>> (Don't really see anything in security-policy.xml that might helpŠ)
> 
> Totally unrelated.
> 
>> Why would the IP address mismatch even be showing in the native log in
>> this case?  Now this doesn't make senseŠ
> 
> I assume it's the switching after the session is established that's
> breaking it. That will probably log on that side.
> 
> But this isn't related to the upgrade, that's coincidence. Could even be
> that the "change" is that I fixed a missing log message.
> 
> -- Scott
> 
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> 

2013-05-23 10:06:53 DEBUG Shibboleth.Listener [17160] isapi_shib: send completed, reading response message
2013-05-23 10:06:53 WARN Shibboleth.SessionCache [17160] isapi_shib: client address mismatch, client (198.228.216.156), session (198.228.213.83)
2013-05-23 10:06:53 DEBUG Shibboleth.SessionCache [17160] isapi_shib: deleting local copy of session (_6141fb0795a318c17215f3eb2c80e9c8)
2013-05-23 10:06:53 DEBUG Shibboleth.Listener [17160] isapi_shib: sending message (remove::StorageService::SessionCache)
2013-05-23 10:06:53 DEBUG Shibboleth.Listener [17160] isapi_shib: send completed, reading response message
2013-05-23 10:06:53 WARN Shibboleth.ServiceProvider [17160] isapi_shib: error during session lookup: Your IP address (198.228.216.156) does not match the address recorded 
at the time the session was established.
2013-05-23 10:06:53 DEBUG Shibboleth.SessionInitiator.SAML2 [17160] isapi_shib: attempting to initiate session using SAML 2.0 with provider (https://shibboleth.usc.edu/shi
bboleth-idp)
2013-05-23 10:06:53 DEBUG Shibboleth.Listener [17160] isapi_shib: sending message (default/Login::run::SAML2SI)
2013-05-23 10:06:53 DEBUG Shibboleth.Listener [17160] isapi_shib: send completed, reading response message
2013-05-23 10:06:54 DEBUG Shibboleth.ISAPI [17160] isapi_shib: mapped https://sait.usc.edu/orientation/secure/Shibboleth.sso/SAML2/POST to orientation
2013-05-23 10:06:54 DEBUG Shibboleth.ISAPI [17160] isapi_shib_extension: mapped https://sait.usc.edu/orientation/secure/Shibboleth.sso/SAML2/POST to orientation
2013-05-23 10:06:54 DEBUG Shibboleth.Listener [17160] isapi_shib_extension: sending message (default/SAML2/POST)
2013-05-23 10:06:54 DEBUG Shibboleth.Listener [17160] isapi_shib_extension: send completed, reading response message
2013-05-23 10:06:54 DEBUG Shibboleth.ISAPI [17160] isapi_shib: mapped http://sait.usc.edu/orientation/secure to orientation
2013-05-23 10:06:54 DEBUG Shibboleth.SessionCache [17160] isapi_shib: searching local cache for session (_13267880004e31c6c0bdbc62aacaa1a0)
2013-05-23 10:06:54 DEBUG Shibboleth.SessionCache [17160] isapi_shib: session not found locally, remoting the search
2013-05-23 10:06:54 DEBUG Shibboleth.Listener [17160] isapi_shib: sending message (find::StorageService::SessionCache)
2013-05-23 10:06:54 DEBUG Shibboleth.Listener [17160] isapi_shib: send completed, reading response message
2013-05-23 10:06:54 WARN Shibboleth.SessionCache [17160] isapi_shib: client address mismatch, client (198.228.216.156), session (198.228.213.83)
2013-05-23 10:06:54 DEBUG Shibboleth.SessionCache [17160] isapi_shib: deleting local copy of session (_13267880004e31c6c0bdbc62aacaa1a0)
2013-05-23 10:06:54 DEBUG Shibboleth.Listener [17160] isapi_shib: sending message (remove::StorageService::SessionCache)
2013-05-23 10:06:54 DEBUG Shibboleth.Listener [17160] isapi_shib: send completed, reading response message
2013-05-23 10:06:54 WARN Shibboleth.ServiceProvider [17160] isapi_shib: error during session lookup: Your IP address (198.228.216.156) does not match the address recorded 
at the time the session was established.
2013-05-23 10:06:54 DEBUG Shibboleth.SessionInitiator.SAML2 [17160] isapi_shib: attempting to initiate session using SAML 2.0 with provider (https://shibboleth.usc.edu/shi
bboleth-idp)
2013-05-23 10:06:54 DEBUG Shibboleth.Listener [17160] isapi_shib: sending message (default/Login::run::SAML2SI)
2013-05-23 10:06:54 DEBUG Shibboleth.Listener [17160] isapi_shib: send completed, reading response message
2013-05-23 10:06:55 DEBUG Shibboleth.ISAPI [17160] isapi_shib: mapped https://sait.usc.edu/orientation/secure/Shibboleth.sso/SAML2/POST to orientation
2013-05-23 10:06:56 DEBUG Shibboleth.ISAPI [17160] isapi_shib_extension: mapped https://sait.usc.edu/orientation/secure/Shibboleth.sso/SAML2/POST to orientation
2013-05-23 10:06:56 DEBUG Shibboleth.Listener [17160] isapi_shib_extension: sending message (default/SAML2/POST)
2013-05-23 10:06:56 DEBUG Shibboleth.Listener [17160] isapi_shib_extension: send completed, reading response message
2013-05-23 10:06:56 DEBUG Shibboleth.ISAPI [17160] isapi_shib: mapped http://sait.usc.edu/orientation/secure to orientation
2013-05-23 10:06:56 DEBUG Shibboleth.SessionCache [17160] isapi_shib: searching local cache for session (_aac1b0fecee2155ba91c6b2824d72ad3)
2013-05-23 10:06:56 DEBUG Shibboleth.SessionCache [17160] isapi_shib: session not found locally, remoting the search
2013-05-23 10:06:56 DEBUG Shibboleth.Listener [17160] isapi_shib: sending message (find::StorageService::SessionCache)
2013-05-23 10:06:56 DEBUG Shibboleth.Listener [17160] isapi_shib: send completed, reading response message
2013-05-23 10:06:56 WARN Shibboleth.SessionCache [17160] isapi_shib: client address mismatch, client (198.228.216.156), session (198.228.213.83)
2013-05-23 10:06:56 DEBUG Shibboleth.SessionCache [17160] isapi_shib: deleting local copy of session (_aac1b0fecee2155ba91c6b2824d72ad3)
2013-05-23 10:06:56 DEBUG Shibboleth.Listener [17160] isapi_shib: sending message (remove::StorageService::SessionCache)
2013-05-23 10:06:56 DEBUG Shibboleth.Listener [17160] isapi_shib: send completed, reading response message
2013-05-23 10:06:56 WARN Shibboleth.ServiceProvider [17160] isapi_shib: error during session lookup: Your IP address (198.228.216.156) does not match the address recorded 
at the time the session was established.
2013-05-23 10:06:56 DEBUG Shibboleth.SessionInitiator.SAML2 [17160] isapi_shib: attempting to initiate session using SAML 2.0 with provider (https://shibboleth.usc.edu/shi
bboleth-idp)
2013-05-23 10:06:56 DEBUG Shibboleth.Listener [17160] isapi_shib: sending message (default/Login::run::SAML2SI)