NativeSP, IDP-initiated, occasionally aborted flows.

[James Nurmi]

On Wed, Dec 10, 2014 at 7:36 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 12/11/14, 2:22 AM, "James Nurmi" <jdnurmi at qwe.cc> wrote:
> >2014-12-11 02:04:56 DEBUG XMLTooling.StorageService [12]: updated
> >expiration of valid records in context
> >(_8ffdfea62caae74a5c1d22260859a983) to (1418267096)
> >2014-12-11 02:04:56 DEBUG Shibboleth.Listener [12]: dispatching message
> >(remove::StorageService::SessionCache)
> >2014-12-11 02:04:56 INFO Shibboleth.SessionCache [12]: remove session::
> >(ID: _8ffdfea62caae74a5c1d22260859a983)
>
> That sequence there basically means the session just wasn't valid. The
> usual reason for that would be IP addresses changing.



Brilliant!

[For others who may eventually search and find this thread]:

While the client instance was consistent, and the SP instance was a
singleton, the deployment used an ELB from amazon (and a CDN), which tended
to permit demuxing through multiple machines (source-IP's) - which is why
it was only problematic across various connections counts in the logs - any
connection's that got re-used was invariably from the same source machine,
when it changed connections, it was usually a different one, so the session
got mostly silently invalidated.

Setting consistentAddress="false" fixed the immediate issue, while I
consider more effective solutions.

Appreciate the support, begrudged it may have been :-)

-James
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20141211/01f3002c/attachment.html