40k+ Requests

[Jim Fox]

We were plagued with clients, I think phone browsers, that got into loops 
of one sort or another.  I installed mod_evasive and that stops the 
looping pretty well.

Jim


On Fri, 10 Apr 2015, David Mansfield wrote:

> Date: Fri, 10 Apr 2015 13:12:18
> From: David Mansfield <shibboleth at dm.cobite.com>
> To: users at shibboleth.net
> Reply-To: Shib Users <users at shibboleth.net>
> Subject: Re: 40k+ Requests
> 
>
>
> On 04/10/2015 11:04 AM, Baptista, Paulo wrote:
>> Hello-
>>
>> How is everyone doing?
>>
>> Looking for some help with an issue.  Every once in a while, we see
>> over 30-40k failed authn requests come through Shib.  When it hits
>> Kerberos, the username it tries to authn is root.  We checked with the
>> actual user where these requests are coming from.  They say they authn
>> to Shib, hit a shib protected page, leave the computer to go to class,
>> and when they come back, they say it's in some sort of weird loop.
>> Closing the browser and going back in clears it up. We haven't
>> reproduced the issue yet.
>>
> We've seen loops generated by bad client-side web proxy server selection
> logic which basically keeps changing the client's IP address (usually
> alternating between two) for each request, so it goes like:
>
> Request page -> no session -> kick to IDP -> back to SP consumer service
> -> establish session + cookie -> Redirect to original page
> Request page -> OK, but page requires some additional resource (image,
> JS, CSS etc)
> Request JS, CSS or whatever comes from a different IP address, but with
> existing cookie -> shibd chokes, kills session, kills cookie -> back to
> step 1
>
> This can loop pretty quickly.
>
> Don't know how you get the 'root' authn though.
>
> HTH,
> David Mansfield
> Cobite, INC.
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>