Shibboleth SP 2.5.5 behind Akamai WAF

[James W. Anderson]

Thanks, Scott. I turned on logging for several functions and discovered this:

2016-12-05 20:54:26 WARN Shibboleth.SessionCache [2816] isapi_shib: client address mismatch, client (10.0.10.36), session (10.0.0.148)
2016-12-05 20:54:26 WARN Shibboleth.ServiceProvider [2816] isapi_shib: error during session lookup: Your IP address (10.0.10.36) does not match the address recorded at the time the session was established.
2016-12-05 20:54:34 WARN Shibboleth.SessionCache [2816] isapi_shib: client address mismatch, client (10.0.0.148), session (10.0.10.36)
2016-12-05 20:54:34 WARN Shibboleth.ServiceProvider [2816] isapi_shib: error during session lookup: Your IP address (10.0.0.148) does not match the address recorded at the time the session was established.
2016-12-05 20:54:40 WARN Shibboleth.SessionCache [2816] isapi_shib: client address mismatch, client (10.0.10.36), session (10.0.0.148)
2016-12-05 20:54:40 WARN Shibboleth.ServiceProvider [2816] isapi_shib: error during session lookup: Your IP address (10.0.10.36) does not match the address recorded at the time the session was established.

As it happens, the Shibboleth config file did NOT have the consistentAddress set to false. Once I put that in, this error went away and the app is now singing along behind Akamai.

Thanks!

-James

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Monday, December 05, 2016 1:50 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: Shibboleth SP 2.5.5 behind Akamai WAF

On 12/5/16, 1:28 PM, "users on behalf of James W. Anderson" <users-bounces at shibboleth.net on behalf of jamesanderson at coca-cola.com> wrote:

> Has anyone else experienced this, and do you have any ideas as to why Akamai could be causing this behavior?
> We’ve used Akamai to edge cache for thousands of sites without issue,
> and this behavior is definitely some kind of strange interplay between Akamai and Shibboleth.

The logs will document why a session is invalidated. If it was never created to begin with, then whether it logs would depend on why it didn't get created, all it can do is process what it gets and the cookies it gets. If the cookie drops, it drops.

Without logs, you need traces, and without either you have nothing.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

________________________________

CONFIDENTIALITY NOTICE
NOTICE: This message is intended for the use of the individual or entity to which it is addressed and may contain information that is confidential, privileged and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, you are hereby notified that any printing, copying, dissemination, distribution, disclosure or forwarding of this communication is strictly prohibited. If you have received this communication in error, please contact the sender immediately and delete it from your system. Thank You.

________________________________