IdP 3 and Stale Requests

[James Gross]

*>Don't know what it's doing, so I couldn't say.*

It looks similar to the custom flow I had previously before they had their
integration built. I don't see anything glaringly wrong with it.

*> Note that if the node switch were a problem, you still wouldn't get the
error mentioning the lack of a SAML query parameter. You'd get a flow
execution problem because the URL would have the execution parameter from
Spring *

I see a few of these scattered around but not matching up with the
reporting users. I believe the few instances of this particular error
message do involve a back button or invalid bookmark.

*> That more strongly implicates the load balancer. What is the stickiness
based on?*

Stickiness is based on source IP address.

------------------------------
*James Gross* | Enterprise Application and CMS Developer (Enterprise Web
Services)

UNC Charlotte | Information Technology Services

9201 University City Blvd. | Charlotte, NC 28223

Phone: 704-687-0298 | Office: Kennedy 301-C39

jgross15 at uncc.edu | http://www.uncc.edu
------------------------------

If you are not the intended recipient of this transmission or a person
responsible for delivering it to the intended recipient, any disclosure,
copying, distribution, or other use of any of the information in this
transmission is strictly prohibited. If you have received this transmission
in error, please notify me immediately by reply e-mail or by telephone at
704-687-0298. Thank you.



On Mon, Nov 9, 2015 at 2:29 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 11/9/15, 2:16 PM, "users on behalf of James Gross" <
> users-bounces at shibboleth.net on behalf of JamesGross at uncc.edu> wrote:
>
>
>
> >I thought that as a potential cause previously as well but have verified
> that session persistence is set for 30 minutes on the load balancer.  I'm
> wondering if the way the Duo (v3) plugin is injecting itself as a subflow
> may be causing an issue.
>
> Don't know what it's doing, so I couldn't say.
>
> Note that if the node switch were a problem, you still wouldn't get the
> error mentioning the lack of a SAML query parameter. You'd get a flow
> execution problem because the URL would have the execution parameter from
> Spring WebFlow, and because the node switched it wouldn't be able to find
> the flow conversation to resume.
>
> As far as I know, the only way you can get the message decoding failure is
> if there's neither a SAMLRequest or execution parameter, but I'll have to
> check into that.
>
> > The odd thing to me is that this is affecting such a small number of
> users in a very intermittent way.
>
> That more strongly implicates the load balancer. What is the stickiness
> based on?
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151109/03051f02/attachment.html>