IdP with MCB Redirecting to SP on failed login!

[Paul Hethmon]

There's an option for max fails in the MCB config. Set it to a higher value or disable it. I think there was a bug in some versions where the disabled option was not honored but setting it to 999 would definitely work.

Paul


(Please enjoy the autocorrect features if this phone)

On Apr 3, 2015, at 2:21 PM, IAM David Bantz <dabantz at alaska.edu<mailto:dabantz at alaska.edu>> wrote:

If a user fails authN at the IdP three times, our IdP is redirecting the browser to the SP.

That's generally not helpful, leaving the user on a generic SP error page.

Shibboleth IdP 2.4 with MCB.

I'm seeing the following suspicious entries in the IdP log:


10:10:57.478 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBLoginServlet:207] - submodule process login returned [false]

10:10:57.478 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBLoginServlet:312] - Current failed login count = [3]

10:10:57.478 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBLoginServlet:156] - Authentication result = [true]

10:10:57.520 - INFO [Shibboleth-Access:73] - 20150403T181057Z|172.20.233.117|idp.alaska.edu<http://idp.alaska.edu>:443|/profile/SAML2/Redirect/SSO|

What's going on??

David Bantz

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150403/19e751ab/attachment.html