Upgrade to IDP 2.4.0 - Can not login

[Yusuf Tran]

To confirm, I can test both versions side by side using the same browser and tools, I clear session and domain cookies each time.
All I do is amend my hosts file to point to the relevant IDP to test, so can confirm things work fine with IDP v 2.3.8, but if I change my hosts file with the upgraded IDP and check again than I get the error mentioned (after loggin in).
I'm actually testing by taking one of two nodes out of a load balanced pool.

Over the last few days I've diff'ed the setup folders and caught all changes and customisations, really it's just the SLO entries, updated packages, updated relying-party etc, meticulous care was taken to get the setup files ready!

This new cookie feature, is there a way we can make it behave like previous versions?

Regards
Yusuf

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: 17 October 2013 18:10
To: Shib Users
Subject: Re: Upgrade to IDP 2.4.0 - Can not login

On 10/17/13 1:03 PM, "Yusuf Tran" <Yusuf.Tran at kaplan.com> wrote:

>Hi Guys,
> 
>I¹m working on upgrading our IDP from version 2.3.8 to 2.4.0, I¹ve 
>taken great care to merge in the customisations (ldap, memcache, custom 
>login pages etc) but after installation I keep getting the warning 
>mentioned on this page:
> 
> 
>https://wiki.shibboleth.net/confluence/display/SHIB2/IdPConfigurationCh
>ang
>es
>ŒCookie-Related Error Handling Change¹
> 
>This is after I hit the login page and attempt a login.
> 
>Can someone help point me in the right direction?

Only you can diagnose your own cookie environment. The error is extremely explicit to the case described. Your client isn't saving and returning the IdP session cookie. That's it.

All that's changed is what it does in that case. Your old environment either would have been sending out empty assertions, or you have a new cookie-related problem in your new one. Probably something hostname related perhaps.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net