Users intermittently land on WAYF page

[Mike Flynn]

In a fiddler trace I see them sending the assertion here on a successful attempt:

| # | Result | Protocol | Host | URL | Body | Caching | Content-Type | Process | Comments | Custom |
| 6 | 302 | HTTPS | shib.lynda.com | /Shibboleth.sso/InCommon?providerId=http://annalectu.com&target=https://shib.lynda.com/InCommon | 40 | private,no-store,no-cache; Expires: 01-Jan-1997 12:00:00 GMT | text/html | iexplore:2476 | [#6] |  |
| 7 | 200 | HTTP | annalectu.com | /applications/annalect/default.aspx?SAMLRequest=fZJfT4MwFMW%2FCuk7fwfomkGC24NLpi4DffDFlHInJKXF3qLbt5eBLvPBJX1p%0A7jnn9vzSBbJWdDTrTS138NEDGuvQCol0HCSk15Iqhg1SyVpAajjNs4cNDRyP%0AdloZxZUgVoYI2jRKLpXEvgWdg%2F5sODzvNgmpjemQui7WTemIo6yYw1Xr5sO1%0AVAJM7SAq95QauNunvCDWanhGI9kpcLIPbiYlE8BNP5pZ14mGjwo8j9wK9qwX%0AxmHYHYi1XiXkLY7BK%2BMIeBjNIeRhWbEq4t4%2BmN3EceWHgwyxh7VEw6RJSOD5%0Ake3NbD8o%2FDkdjnf7SqztT9O7RlaNfL%2BOpZxESO%2BLYmtPjV5A49hmEJB0cYJL%0Ax8X6Avf1WPbLmKT%2FEMUzURu7hXuxZNrY0cchdb3aqoHd0cqEUF9LDcxAQnzi%0AppPl729IvwE%3D%0A&RelayState=cookie%3Aa9249f5d | 4,979 | private | text/html; charset=utf-8 | iexplore:2476 | [#7] |  |
| 8 | 302 | HTTPS | shib.lynda.com | /Shibboleth.sso/SAML2/POST | 40 | private,no-store,no-cache; Expires: 01-Jan-1997 12:00:00 GMT | text/html | iexplore:2476 | [#8] |  |


A failed attempt looks like this:

| # | Result | Protocol | Host | URL | Body | Caching | Content-Type | Process | Comments | Custom |
| 6 | 302 | HTTPS | shib.lynda.com | /Shibboleth.sso/InCommon?providerId=http://annalectu.com&target=https://shib.lynda.com/InCommon | 40 | private,no-store,no-cache; Expires: 01-Jan-1997 12:00:00 GMT | text/html | iexplore:2476 | [#6] |  |
| 7 | 200 | HTTP | annalectu.com | /applications/annalect/default.aspx?SAMLRequest=fZJfT4MwFMW%2FCuk7fwfomkGC24NLpi4DffDFlHInJKXF3qLbt5eBLvPBJX1p%0A7jnn9vzSBbJWdDTrTS138NEDGuvQCol0HCSk15Iqhg1SyVpAajjNs4cNDRyP%0AdloZxZUgVoYI2jRKLpXEvgWdg%2F5sODzvNgmpjemQui7WTemIo6yYw1Xr5sO1%0AVAJM7SAq95QauNunvCDWanhGI9kpcLIPbiYlE8BNP5pZ14mGjwo8j9wK9qwX%0AxmHYHYi1XiXkLY7BK%2BMIeBjNIeRhWbEq4t4%2BmN3EceWHgwyxh7VEw6RJSOD5%0Ake3NbD8o%2FDkdjnf7SqztT9O7RlaNfL%2BOpZxESO%2BLYmtPjV5A49hmEJB0cYJL%0Ax8X6Avf1WPbLmKT%2FEMUzURu7hXuxZNrY0cchdb3aqoHd0cqEUF9LDcxAQnzi%0AppPl729IvwE%3D%0A&RelayState=cookie%3Aa9249f5d | 4,979 | private | text/html; charset=utf-8 | iexplore:2476 | [#7] |  |
| 8 | 302 | HTTPS | shib.lynda.com | /Shibboleth.sso/SAML2/POST | 40 | private,no-store,no-cache; Expires: 01-Jan-1997 12:00:00 GMT | text/html | iexplore:2476 | [#8] |  |
| 9 | 200 | HTTP | Tunnel to | t.urs.microsoft.com:443 | 686 |  |  | iexplore:2476 | [#9] |  |
| 10 | 302 | HTTPS | shib.lynda.com | /InCommon | 40 | private,no-store,no-cache; Expires: 01-Jan-1997 12:00:00 GMT | text/html | iexplore:2476 | [#10] |  |
| 11 | 200 | HTTP | Tunnel to | wayf.incommonfederation.org:443 | 736 |  |  | iexplore:2476 | [#11] |  |



Everything up to step 9 in this last one matches the successful one - No idea what that tunnel to that MS address is...


 

     On Thursday, March 12, 2015 12:55 PM, Peter Schober <peter.schober at univie.ac.at> wrote:
   

 * Mike Flynn <shibbolethlynda at yahoo.com> [2015-03-12 20:47]:
> ALL of my clients use an SP link with the entityID embedded so WAYF
> is not needed.  When a user manages to strip the entityID out of the
> URL, they land on the WAYF page as expected.
> This customer gets to the WAYF page after they send the assertion
> back to me.  What might be wrong in the assertion that would make
> Shib send them to WAYF like that?  The assertion is encrypted and I
> know the issue is on their side (as do they) - They are looking for
> some guidance as to where to look...

That sounds to me like the IDP sends the response to some protected
part of your site, instead of to your ACS URLs. You could verify that
(or rule it our) from your webserver's access logs.
-peter
-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

   
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150312/cd46500c/attachment.html