Shibboleth SP getting repeated SAML Post requests

[Chris Glaubig]

I have Shibboleth SP setup in IIS protecting a website that connects to an
InCommon IDP

 

I keep getting requests for the same page every second or so from the same
client IP.

Here is an example from the IIS log:

2015-08-04 15:50:40 IP_ADDRESS_REMOVED POST /Shibboleth.sso/SAML2/POST - 443
- IP_ADDRESS_REMOVED
Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+6.1;+WOW64;+Trident/4.0;+SLCC2
;+.NET+CLR+2.0.50727;+.NET+CLR+3.5.30729;+.NET+CLR+3.0.30729;+Media+Center+P
C+6.0;+InfoPath.3;+.NET4.0C;+BRI/2;+.NET4.0E;+MS-RTC+LM+8) 200 0 0 224

 

This will happen about once every 10 days or so and the same request will
repeat every second for a couple of hours.  This happens with different IP
addresses and on different servers protected by Shibboleth SP.  All of the
servers are connecting to the same IDP however.

Today, the IP that this request came from was not accessing this server
besides for this request.  Last time this happened, I was seeing traffic
from a different IP with both the repeated request and standard application
usage.  I talked to the user and the stated that everything seemed normal
and they didn't seem to hit any errors.

 

In the shibd.log file it looks like a new session is successfully being
create every time:

2015-08-04 16:37:48 INFO Shibboleth.SessionCache [48]: new session created:
ID (_896939343b981b2c1b73d00638a34604) IdP (urn:mace:incommon:ucsf.edu)
Protocol(urn:oasis:names:tc:SAML:2.0:protocol) Address (IP_ADDRESS_REMOVED)

2015-08-04 16:37:49 INFO Shibboleth.AttributeExtractor.XML [48]: skipping
unmapped SAML 2.0 Attribute with Name: urn:oid:1.3.6.1.4.1.5923.1.1.1.5

2015-08-04 16:37:49 INFO Shibboleth.AttributeExtractor.XML [48]: skipping
unmapped SAML 2.0 Attribute with Name: urn:oid:2.5.4.4

2015-08-04 16:37:49 INFO Shibboleth.AttributeExtractor.XML [48]: skipping
unmapped SAML 2.0 Attribute with Name: urn:oid:2.5.4.42

2015-08-04 16:37:49 INFO Shibboleth.AttributeExtractor.XML [48]: skipping
unmapped SAML 2.0 Attribute with Name: urn:oid:0.9.2342.19200300.100.1.3

 

I ran Wireshark while it was happening, and there was the following error:

Source: Client's desktop

Destination: Shibboleth SP Server

Protocol: TCP

Length: 804 

Info: [TCP Retransmission] 59913 -> 443 {PSH, ACK] Seq=118559 Ack=3325
Win=501 Len=750[Reassembly error, protocol TCP: New fragment overlaps old
data (retransmission?)]

 

Has anybody else hit something like this?  I contacted the IDP team, but I
was told that I misconfigured the Shibboleth SP and caused looping, however,
I don't understand if that's valid or not, since this doesn't always happen.

 

Thanks,

-Chris

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150804/9e6b8ceb/attachment.html>