IdP 3 and Stale Requests

[James Gross]

Here is an example from the logs (scrubbed for user data). It actually
looks like the entire process completes and then the user is returned
either by the IdP or the SP immediately without the proper SAMLRequest.

*idp-process.log:2015-11-09 10:35:26,375 - INFO -- 152.15.162.2XX --
[net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:179] -
Profile Action ValidateUsernamePasswordAgainstLDAP: Login by 'XXXX'
succeeded*
*idp-process.log:2015-11-09 10:35:26,584 - INFO -- 152.15.162.2XX --
[com.duosecurity.integrations.DuoShibboleth:91] - Duo 2FA bypass for user:*
* XXXX*
*idp-process.log:2015-11-09 10:35:29,646 - INFO -- 152.15.162.2XX --
[Shibboleth-Audit.SSO:241] -
20151109T153529Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|keoccnolaclopbfdoclilbplignnafdfoonmboco|google.com
<http://google.com>|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://webauth.uncc.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_37294fb2e14a65046b73869461946741|jleak|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|uid,eduPersonPrincipalName,mail,commonName,ninernet,logoutURL,eduPersonScopedAffiliation,surname,givenName,displayName,campusPermanentId,eduPersonTargetedID|
<http://shibboleth.net/ns/profiles/saml2/sso/browser|https://webauth.uncc.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_37294fb2e14a65046b73869461946741|jleak|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|uid,eduPersonPrincipalName,mail,commonName,ninernet,logoutURL,eduPersonScopedAffiliation,surname,givenName,displayName,campusPermanentId,eduPersonTargetedID|>*
*XXXX**|_0edde304221f3e40d95d72032e118026*
*idp-process.log:2015-11-09 10:35:29,657 - ERROR -- 152.15.162.2XX --
[org.opensaml.profile.action.impl.DecodeMessage:73] - Profile Action
DecodeMessage: Unable to decode incoming request*

------------------------------
*James Gross* | Enterprise Application and CMS Developer (Enterprise Web
Services)

UNC Charlotte | Information Technology Services

9201 University City Blvd. | Charlotte, NC 28223

Phone: 704-687-0298 | Office: Kennedy 301-C39

jgross15 at uncc.edu | http://www.uncc.edu
------------------------------

If you are not the intended recipient of this transmission or a person
responsible for delivering it to the intended recipient, any disclosure,
copying, distribution, or other use of any of the information in this
transmission is strictly prohibited. If you have received this transmission
in error, please notify me immediately by reply e-mail or by telephone at
704-687-0298. Thank you.



On Mon, Nov 9, 2015 at 2:43 PM, James Gross <JamesGross at uncc.edu> wrote:

> *>Don't know what it's doing, so I couldn't say.*
>
> It looks similar to the custom flow I had previously before they had their
> integration built. I don't see anything glaringly wrong with it.
>
> *> Note that if the node switch were a problem, you still wouldn't get the
> error mentioning the lack of a SAML query parameter. You'd get a flow
> execution problem because the URL would have the execution parameter from
> Spring *
>
> I see a few of these scattered around but not matching up with the
> reporting users. I believe the few instances of this particular error
> message do involve a back button or invalid bookmark.
>
> *> That more strongly implicates the load balancer. What is the stickiness
> based on?*
>
> Stickiness is based on source IP address.
>
> ------------------------------
> *James Gross* | Enterprise Application and CMS Developer (Enterprise Web
> Services)
>
> UNC Charlotte | Information Technology Services
>
> 9201 University City Blvd. | Charlotte, NC 28223
>
> Phone: 704-687-0298 | Office: Kennedy 301-C39
>
> jgross15 at uncc.edu | http://www.uncc.edu
> ------------------------------
>
> If you are not the intended recipient of this transmission or a person
> responsible for delivering it to the intended recipient, any disclosure,
> copying, distribution, or other use of any of the information in this
> transmission is strictly prohibited. If you have received this transmission
> in error, please notify me immediately by reply e-mail or by telephone at
> 704-687-0298. Thank you.
>
>
>
> On Mon, Nov 9, 2015 at 2:29 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
>
>> On 11/9/15, 2:16 PM, "users on behalf of James Gross" <
>> users-bounces at shibboleth.net on behalf of JamesGross at uncc.edu> wrote:
>>
>>
>>
>> >I thought that as a potential cause previously as well but have verified
>> that session persistence is set for 30 minutes on the load balancer.  I'm
>> wondering if the way the Duo (v3) plugin is injecting itself as a subflow
>> may be causing an issue.
>>
>> Don't know what it's doing, so I couldn't say.
>>
>> Note that if the node switch were a problem, you still wouldn't get the
>> error mentioning the lack of a SAML query parameter. You'd get a flow
>> execution problem because the URL would have the execution parameter from
>> Spring WebFlow, and because the node switched it wouldn't be able to find
>> the flow conversation to resume.
>>
>> As far as I know, the only way you can get the message decoding failure
>> is if there's neither a SAMLRequest or execution parameter, but I'll have
>> to check into that.
>>
>> > The odd thing to me is that this is affecting such a small number of
>> users in a very intermittent way.
>>
>> That more strongly implicates the load balancer. What is the stickiness
>> based on?
>>
>> -- Scott
>>
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151109/b7fc2f8f/attachment-0001.html>