Shibboleth session are dropped after upgrading to version SP 2.5.4

[nr673 .]

I did some more debugging. Looks like JSESSIONID is not the issue. In our
environment, the Apache server talks to a tomcat server and a mongrel
server. When the request goes to mongrel server, the JSESSIONID is not
passed which is correct.

But, we still see the shibsession expiry issue. Appreciate any feedbacks on
this issue.

Thanks

Nara

On Wed, Jul 1, 2015 at 10:08 AM, nr673 . <nara.rama.us at gmail.com> wrote:

> Hi:
>
> We have upgraded to shibboleth SP from 2.5.3 to 2.5.4 recently (Apache
> 2.2). The session settings in the shibboleth2.xml looks as follows.
>
> <Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
>       checkAddress="false" handlerURL="/Shibboleth.sso" handlerSSL="true"
> cookieProps="https">
> When working on the application, the user is redirected to home page
> suddenly. I have traced the server calls using Live Http Headers. When a
> regular server side call is made, the browser properly sends the JSESSIONID
> and shibsession in the cookie.
>
> https://qa2.aaa.com/users/index
>
> GET /users/index HTTP/1.1
> User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:38.0)
> Gecko/20100101 Firefox/38.0
> Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
> Accept-Language: en-US,en;q=0.5
> Accept-Encoding: gzip, deflate
> Referer: https://awsqa2.pfoperations.com/dashboard/admin
> Cookie: JSESSIONID=C1F938183C2AD0878D2714336ACC171F; __utma=169413937.
> 2058668447.1435710020.1435716657.1435719877.3;
> __utmz=169413937.1435710020.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);
> search_criteria=3600; __utmb=169413937.36.10.1435719877;
> _shibsession_64656661756c7468747470733a2f2f6177737161322e70666f7065726174696f6e732e636f6d=_28948b88755e3c225164558f3f434a85;
> language=en; __utmc=169413937; __utmt=1
> Connection: keep-alive
>
> HTTP/1.1 200 OK
> Content-Language: en-US
> Content-Type: text/html;charset=UTF-8
> Date: Wed, 01 Jul 2015 03:35:06 GMT
> Server: Apache-Coyote/1.1
> Content-Length: 13053
> Connection: keep-alive
>
> When a JQuery Ajax call is made to the same server domain, the JSESSIONID
> is dropped from the cookie. As a result, the Sihbboleth is invalidating the
> shibsession cookie and redirecting the call to the IdP.
>
> https://qa2.aaa.com/zip_services/show
>
> GET /zip_services/show HTTP/1.1
> User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:38.0)
> Gecko/20100101 Firefox/38.0
> Accept: text/html, */*
> Accept-Language: en-US,en;q=0.5
> Accept-Encoding: gzip, deflate
> X-Requested-With: XMLHttpRequest
> Cookie: __utma=169413937.2058668447.1435710020.1435716657.1435719877.3;
> __utmz=169413937.1435710020.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);
> search_criteria=3600; __utmb=169413937.36.10.1435719877;
> _shibsession_64656661756c7468747470733a2f2f6177737161322e70666f7065726174696f6e732e636f6d=_28948b88755e3c225164558f3f434a85;
> language=en; __utmc=169413937; __utmt=1
> Connection: keep-alive
> If-None-Match: "2b484978b064b7f435ef88807593c93f"
>
> HTTP/1.1 302 Found
> Cache-Control: private,no-store,no-cache,max-age=0
> Content-Type: text/html; charset=iso-8859-1
> Date: Wed, 01 Jul 2015 03:35:06 GMT
> Expires: Wed, 01 Jan 1997 12:00:00 GMT
> Location: https://...okta.com/app/template_saml_2_0/
> Set-Cookie:
> _shibsession_64656661756c7468747470733a2f2f6177737161322e70666f7065726174696f6e732e636f6d=;
> path=/; secure; HttpOnly; expires=Mon, 01 Jan 2001 00:00:00 GMT
> Content-Length: 848
> Connection: keep-alive
>
> Are there way to fix this behavior through shibboleth config settings? We
> did not see this behavior in shibboleth 2.5.3.
>
> Thanks
>
> Nara
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150701/32c27795/attachment.html>