IdP 3 and Stale Requests

[James Gross]

We have been receiving reports of a small but not insignificant number of
users who are receiving the "stale request" error. This seems to be
happening mostly in Chrome, but occurrences in the other major browsers
have also been reported. This is not happening for the overwhelming
majority of users.

We have confirmed that the typical causes of this error do not apply as no
bookmark has been used, the back button has not been hit and that the
browser cache was cleared, along with a browser and system restart. This
was verified by our service desk by remotely logging into their
workstations and the steps performed and the error reproduced. In most
cases, they are able to get past the issue by using "incognito mode."

In the logs, we only see the errors "No SAMLRequest or SAMLResponse query
path parameter, invalid SAML 2 HTTP Redirect message".  We have confirmed
by capture and decoding of the request that the SAMLRequest parameter was
indeed present and valid.

We are using a standard IdP 3.1.2 install and the manual installation of
the Duo plugin outlined at https://www.duosecurity.com/docs/shibboleth.

Has anybody else ran into this issue or have any insight as to what could
be causing this? Any information or direction is of course greatly
appreciated.

------------------------------
*James Gross* | Enterprise Application and CMS Developer (Enterprise Web
Services)

UNC Charlotte | Information Technology Services

9201 University City Blvd. | Charlotte, NC 28223

Phone: 704-687-0298 | Office: Kennedy 301-C39

jgross15 at uncc.edu | http://www.uncc.edu
------------------------------

If you are not the intended recipient of this transmission or a person
responsible for delivering it to the intended recipient, any disclosure,
copying, distribution, or other use of any of the information in this
transmission is strictly prohibited. If you have received this transmission
in error, please notify me immediately by reply e-mail or by telephone at
704-687-0298. Thank you.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151109/68a72194/attachment.html>