40k+ Requests

[Cantor, Scott]

On 4/10/15, 11:04 AM, "Baptista, Paulo" <paulo_baptista at brown.edu> wrote:
>
>Looking for some help with an issue.  Every once in a while, we see over 30-40k failed authn requests come through Shib.  When it hits Kerberos, the username it tries to authn is root.

Hits Kerberos through what mechanism? A form? Basic-auth? Seems like there has to be something going on here that's probably not really connected to the IdP per se, because it doesn't automatically do anything to attempt logins.

>Here are some sample entries from the IDP Process Log:

Those entries don't fit anything you described.

>14:34:44.895 - ERROR [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:618] - No user
> identified by login handler. - [] - [] - [10.3

Which is what login handler?

The rest all looks like a client talking to the IdP with nothing rational. Not handling cookies, basically breaking everything the IdP tries to do, but that would just lead to error pages. Whatever's looping, it's not the IdP causing it.

>Only thing I see in the SP logs when the flood of authn started is:

Those are nothing.

-- Scott