Infinite looping of SP in load balanced production instance

[Brian Reindel]

That's probably it. Would that happen if the port :443 were appended
to the host, but the handler was configured without it?

On Tue, Oct 29, 2013 at 3:26 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> On 10/29/13, 3:16 PM, "Brian Reindel" <brian at reindel.com> wrote:
>
>>As a matter of fact I can get all the way through
>>the process, and at the very last step when I'm redirected to the
>>original protected endpoint from the SP is when it responds with a
>>redirect to the IdP.
>
> No, that's not the case. It's happening before that step, which I think
> means you've managed to get the SP to impose a protect rule on its own
> handlers. That, as is sometimes the case with normal looping, means the
> web server is misconfigured and does not know its virtualized identity,
> and is somehow preventing the SP from figuring out that the POST is to a
> handler inside the SP. Normally it detects that even if you accidentally
> manage to apply a rule to that location. In particular, it means that it
> isn't accurately computing the applicable handlerURL for a request to that
> URL, or it would know that they are in fact the same. One possibility is
> that you set handlerURL yourself, I suppose.
>
> Normally a loop occurs during the redirect from the ACS POST to the target
> resource. Here, there's no session because the POST that would produce the
> session is itself being intercepted and resulting in a request for one.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net