40k+ Requests

[Baptista, Paulo]

Hello-

How is everyone doing?

Looking for some help with an issue.  Every once in a while, we see over
30-40k failed authn requests come through Shib.  When it hits Kerberos, the
username it tries to authn is root.  We checked with the actual user where
these requests are coming from.  They say they authn to Shib, hit a shib
protected page, leave the computer to go to class, and when they come back,
they say it's in some sort of weird loop.  Closing the browser and going
back in clears it up.  We haven't reproduced the issue yet.

Here are some sample entries from the IDP Process Log:

14:34:43.486 - INFO [Shibboleth-Access:73] -
20150409T183443Z|10.38.26.21|sso.brown.edu:443|/profile/SAML2/Redirect/SSO|
- [] - [] - [10.38.26.21]
14:34:43.487 - INFO
[org.opensaml.common.binding.security.SAMLProtocolMessageXMLSignatureSecurityPolicyRule:100]
- SAML protocol message was not signe
d, skipping XML signature processing - [] - [] - [10.38.26.21]
14:34:43.759 - INFO [Shibboleth-Access:73] -
20150409T183443Z|10.38.26.21|sso.brown.edu:443|/profile/SAML2/Redirect/SSO|
- [] - [] - [10.38.26.21]
14:34:43.761 - INFO
[org.opensaml.common.binding.security.SAMLProtocolMessageXMLSignatureSecurityPolicyRule:100]
- SAML protocol message was not signe
d, skipping XML signature processing - [] - [] - [10.38.26.21]
14:34:43.963 - INFO [Shibboleth-Access:73] -
20150409T183443Z|10.38.26.21|sso.brown.edu:443|/profile/SAML2/Redirect/SSO|
- [] - [] - [10.38.26.21]
14:34:43.965 - INFO
[org.opensaml.common.binding.security.SAMLProtocolMessageXMLSignatureSecurityPolicyRule:100]
- SAML protocol message was not signe
d, skipping XML signature processing - [] - [] - [10.38.26.21]
14:34:44.895 - ERROR
[edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:618] -
No user identified by login handler. - [] - [] - [10.3
8.26.21]
14:34:44.896 - ERROR
[edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:563] -
Authentication failed with the error: - [] - [] - [10.
38.26.21]
14:34:44.914 - ERROR
[edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:618] -
No user identified by login handler. - [] - [] - [10.3
8.26.21]
14:34:44.915 - ERROR
[edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:563] -
Authentication failed with the error: - [] - [] - [10.
38.26.21]
14:34:45.091 - INFO [Shibboleth-Access:73] -
20150409T183445Z|10.38.26.21|sso.brown.edu:443|/profile/SAML2/Redirect/SSO|
- [] - [] - [10.38.26.21]
14:34:45.111 - INFO [Shibboleth-Audit:1028] -
20150409T183445Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_491d7cd6233bf948246026685e57d1fb|ht
tps://
library.brown.edu/shibboleth-sp|urn:mace:shibboleth:2.0:profiles:saml2:sso|https://sso.brown.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bind
ings:HTTP-POST|_426f330e53d141607efd0eb0910feb8e|||||| - [] - [] -
[10.38.26.21]
14:34:45.113 - INFO [Shibboleth-Access:73] -
20150409T183445Z|10.38.26.21|sso.brown.edu:443|/profile/SAML2/Redirect/SSO|
- [] - [] - [10.38.26.21]
14:34:45.113 - WARN
[edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:400]
- Error decoding authentication request message - []
 - [] - [10.38.26.21]
14

Only thing I see in the SP logs when the flood of authn started is:

2015-04-09 14:33:52 INFO Shibboleth.Listener [16491]: detected socket
closure, shutting down worker thread
2015-04-09 14:34:08 INFO Shibboleth.Listener [16471]: detected socket
closure, shutting down worker thread2015-04-09 14:34:09 INFO
Shibboleth.Listener [16505]: detected socket closure, shutting down worker
thread
2015-04-09 14:34:10 INFO Shibboleth.Listener [16504]: detected socket
closure, shutting down worker thread2015-04-09 14:34:13 INFO
Shibboleth.Listener [16482]: detected socket closure, shutting down worker
thread

The htaccess file is

AuthType shibboleth
ShibRequireSession on
require Shibboleth-isMemberOf Community

Has anyone seen this sort of behavior?  The shib protected resource is just
a PDF file.

Thanks,

Paulo
Brown University
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150410/56a3389f/attachment.html