40k+ Requests

[Michael A Grady]

On Apr 10, 2015, at 3:12 PM, David Mansfield <shibboleth at dm.cobite.com> wrote:

> We've seen loops generated by bad client-side web proxy server selection 
> logic which basically keeps changing the client's IP address (usually 
> alternating between two) for each request, so it goes like:
> 
> Request page -> no session -> kick to IDP -> back to SP consumer service 
> -> establish session + cookie -> Redirect to original page
> Request page -> OK, but page requires some additional resource (image, 
> JS, CSS etc)
> Request JS, CSS or whatever comes from a different IP address, but with 
> existing cookie -> shibd chokes, kills session, kills cookie -> back to 
> step 1
> 
> This can loop pretty quickly.
> 
> Don't know how you get the 'root' authn though.
> 

I've also seen a case where someone had a content farm with badly-configured caching that was caching the SP's redirect to the IdP, the redirect containing the authentication request, as the "content" of the web page the user was trying to access. So the user successfully got thru the IdP, gets sent back to the SP, and the SP processes the response, sets up the session, and redirects the user to the content page they were trying to get to at the start. But instead of getting the actual content, the cache stepped in and returned that redirect containing the authn request to the user, so they got sent back to the IdP. Since the IdP (not Shib) didn't detect duplicate authn requests, it sent them back with another response to the SP, and ...

But as Scott indicated, any sort of looping like that would be evident in the IdP an/or SP logs.

--
Michael A. Grady
Senior IAM Consultant, Unicon, Inc.