SP always redirect to IdP

[Per Jørgen Vigdal]

I cannot find out on what grounds the SP are doing a "re sending" of  AuthnRequest.
>From the log it appears to be related to this line
INFO Shibboleth.SessionCache [6]: removed session (_f7761c9408141f6e4c2d74e57f0f0245)
I am using default values on SP for all timeout values, and it seems that a new AuthnRequest is sent every 30 seconds. I would like to make this period longer. How can I achieve that? Thank you.


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Per Jørgen Vigdal
Sent: 3. november 2015 10:19
To: Shib Users
Subject: RE: SP always redirect to IdP

Thanks.

I do not think I have  trouble with NativeSPLooping.
But I have now tried to change the default SessionCache configuration.
And that seems to influence when the session is removed.

But now I have to figure out how to actually remove the session when the user logs out, and the webApp redirects to  /Shibboleth.sso/Logout At present the session is not removed, and the user is able to continue accessing the resource after logout.
Any idea ?


Here is my config :

<SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config" xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config" 
	xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
	 xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" clockSkew="180">
	

    <StorageService type="Memory" id="mem" cleanupInterval="900"/>
    <SessionCache type="StorageService" StorageService="mem" cacheAssertions="false"
                  cacheAllowance="900" inprocTimeout="900" cleanupInterval="900"/>
    <ReplayCache StorageService="mem"/>
	

	<ApplicationDefaults entityID="https://www.myapp.no" 
		homeURL="https://www.myapp.no/Test/home.jsp" 
		signing="true" encryption="false" requireSignedAssertions="true"  id="default">

		<Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
                  checkAddress="false" handlerSSL="false" cookieProps="; path=/; Secure; HttpOnly">

			<SSO entityID="myidp.com">                 
              SAML2 SAML
            </SSO>
			<SessionInitiator 
				type="SAML2" 
				entityID="myidp.com" 
				Location="/Login" 
				relayState="cookie" 
				template="bindingTemplate.html" 
				isDefault="true"
				authnContextClassRef="urn:oasis:names:tc:SAML:2.0:ac:classes:SmartcardPKI"
				authnContextComparison="minimum"
				>

			</SessionInitiator>

			<LogoutInitiator type="Chaining" Location="/Logout" relayState="cookie">
				<LogoutInitiator type="SAML2" template="bindingTemplate.html" outgointBindings="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"/>
				<LogoutInitiator type="Local"/>
			</LogoutInitiator>


			<md:SingleLogoutService Location="/SLO/Redirect" conf:template="bindingTemplate.html" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"/>

			<Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>
	
			<Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>

			<Handler type="Session" Location="/Session" showAttributeValues="false"/>

		</Sessions>

		<Errors supportContact="root at localhost" helpLocation="/about.html" styleSheet="/shibboleth-sp/main.css"/>

		<MetadataProvider type="XML" validate="true" file="myidp.com_meta_signed.xml"/>

		<AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/>

		<AttributeResolver type="Query" subjectMatch="true"/>

		<AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>

		<CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>
       
	</ApplicationDefaults>
	<SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/>
	<ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/> </SPConfig>


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Peter Schober
Sent: 3. november 2015 09:21
To: users at shibboleth.net
Subject: Re: SP always redirect to IdP

* Per Jørgen Vigdal <Per.Jorgen.Vigdal at evry.com> [2015-11-03 08:56]:
> My SP continues to redirect the user to the Idp. How do I configure 
> the shibboleth Resource monitor to check whether the user has a valid 
> session and then redirect directly to the protected resource.

You'll need to supply more detail about your configuration.
Other than that, try
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPLooping
(via Documentation home -> Troubleshooting -> SP Common Errors) -peter
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net