Infinite looping of SP in load balanced production instance

[Cantor, Scott]

On 10/29/13, 3:16 PM, "Brian Reindel" <brian at reindel.com> wrote:

>As a matter of fact I can get all the way through
>the process, and at the very last step when I'm redirected to the
>original protected endpoint from the SP is when it responds with a
>redirect to the IdP.

No, that's not the case. It's happening before that step, which I think
means you've managed to get the SP to impose a protect rule on its own
handlers. That, as is sometimes the case with normal looping, means the
web server is misconfigured and does not know its virtualized identity,
and is somehow preventing the SP from figuring out that the POST is to a
handler inside the SP. Normally it detects that even if you accidentally
manage to apply a rule to that location. In particular, it means that it
isn't accurately computing the applicable handlerURL for a request to that
URL, or it would know that they are in fact the same. One possibility is
that you set handlerURL yourself, I suppose.

Normally a loop occurs during the redirect from the ACS POST to the target
resource. Here, there's no session because the POST that would produce the
session is itself being intercepted and resulting in a request for one.

-- Scott