Client Authentication issue from NAT POOL

[AdamhEdTech]

Good Morning All, 
Let me briefly explain what I am facing here. I am the network manager for a
K12 district in Florida and we have a few teachers taking a class at a local
university here. The users are unable to access the application and receive
this error 

"Authentication failure, session missing during completion of profile
handler"

I have researched this error here as well as a few others places and I think
I have a clear picture of what is going on but since I am unfamiliar with
Shibboleth I feel I am unable to really explain what is going on. 

The issue is occurring because my clients behind my firewall are dynamically
NAT'd from my pool of external IP addresses. 

Capturing packets from outside my firewall I see the client start a session
with the server running shibboleth using a NAT'd IP from my pool lets just
say 150.1.1.210, .002 seconds later ANOTHER session is started by my clients
to the server running Shibboleth and my firewall dynamically assigns a NAT
from the pool, lets say 150.1.1.211... Authentication will fail for these
users every time with the error:

Authentication failure, session missing during completion of profile handler

IF I assign a static NAT to the client...say 150.1.1.200 the user can
authenticate and access the application without fail every time. The
wireshark trace file behavior is the same as described above. I still see
two sessions open, with different source ports assigned but the source IP is
the same for both sessions. 

In my research I found this from an MIT website 


*Q: The Touchstone Identity Provider encountered the following error while
processing your request - Authentication failure, session missing during
completion of profile handler.

This error shows up with the IP address of the client changes midway through
Touchstone authentication.*

I am confident from the trace files I captured this is my error but why are
two sessions started? How can I explain this to the college who is confident
the issue is on my end? 

Of course I could be wrong all together! 

Thanks! 

Adam




--
View this message in context: http://shibboleth.1660669.n2.nabble.com/Client-Authentication-issue-from-NAT-POOL-tp7621769.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.