40k+ Requests

[David Mansfield]

On 04/10/2015 11:04 AM, Baptista, Paulo wrote:
> Hello-
>
> How is everyone doing?
>
> Looking for some help with an issue.  Every once in a while, we see 
> over 30-40k failed authn requests come through Shib.  When it hits 
> Kerberos, the username it tries to authn is root.  We checked with the 
> actual user where these requests are coming from.  They say they authn 
> to Shib, hit a shib protected page, leave the computer to go to class, 
> and when they come back, they say it's in some sort of weird loop.  
> Closing the browser and going back in clears it up. We haven't 
> reproduced the issue yet.
>
We've seen loops generated by bad client-side web proxy server selection 
logic which basically keeps changing the client's IP address (usually 
alternating between two) for each request, so it goes like:

Request page -> no session -> kick to IDP -> back to SP consumer service 
-> establish session + cookie -> Redirect to original page
Request page -> OK, but page requires some additional resource (image, 
JS, CSS etc)
Request JS, CSS or whatever comes from a different IP address, but with 
existing cookie -> shibd chokes, kills session, kills cookie -> back to 
step 1

This can loop pretty quickly.

Don't know how you get the 'root' authn though.

HTH,
David Mansfield
Cobite, INC.