IdP 3 and Stale Requests

[Cantor, Scott]

On 11/9/15, 2:16 PM, "users on behalf of James Gross" <users-bounces at shibboleth.net on behalf of JamesGross at uncc.edu> wrote:



>I thought that as a potential cause previously as well but have verified that session persistence is set for 30 minutes on the load balancer.  I'm wondering if the way the Duo (v3) plugin is injecting itself as a subflow may be causing an issue.

Don't know what it's doing, so I couldn't say.

Note that if the node switch were a problem, you still wouldn't get the error mentioning the lack of a SAML query parameter. You'd get a flow execution problem because the URL would have the execution parameter from Spring WebFlow, and because the node switched it wouldn't be able to find the flow conversation to resume.

As far as I know, the only way you can get the message decoding failure is if there's neither a SAMLRequest or execution parameter, but I'll have to check into that.

> The odd thing to me is that this is affecting such a small number of users in a very intermittent way.

That more strongly implicates the load balancer. What is the stickiness based on?

-- Scott