Users intermittently land on WAYF page

[Cantor, Scott]

On 3/12/15, 3:55 PM, "Peter Schober" <peter.schober at univie.ac.at> wrote:

>* Mike Flynn <shibbolethlynda at yahoo.com> [2015-03-12 20:47]:
>> ALL of my clients use an SP link with the entityID embedded so WAYF
>> is not needed.  When a user manages to strip the entityID out of the
>> URL, they land on the WAYF page as expected.
>> This customer gets to the WAYF page after they send the assertion
>> back to me.  What might be wrong in the assertion that would make
>> Shib send them to WAYF like that?  The assertion is encrypted and I
>> know the issue is on their side (as do they) - They are looking for
>> some guidance as to where to look...
>
>That sounds to me like the IDP sends the response to some protected
>part of your site, instead of to your ACS URLs. You could verify that
>(or rule it our) from your webserver's access logs.

There'd have to a resource protected with requireSession, I think, no matter what the cause is, so that's kind of a starting point. If not, I don't know how that's going to happen, it's only going to send you to the discovery URL if it has to trigger SSO itself.

Often when you have this scenario, what's really happening is a loop, it's just that it's short-circuited by the discovery page if it doesn't remember your choice and auto-submit that choice. So it's usually the looping causes, cookie/hostname/SSL etc. issues.

But that only happens when there's a protected resource involved, and your trace in the second email doesn't seem to show that.

-- Scott