Client Authentication issue from NAT POOL

[Youssef GHORBAL]

Hello,

	Just some questions to clarify some points :
	- What do you mean exactly by "the server running shibboleth” ? Are you talking about shibboleth IdP or the application server hosting some ressorces protected by Shibboleth SP ?
	- Does this message occur after the user comes back from the IdP ?
	- Do you have access to the application server (Shibboleth SP) and the native.log file (inside a log directory like /var/log/shibboleth-www)

	I came across such an issue and we had to disable the “consistentAddress” property (consistentAddress=“false”) in shibboleth2.xml (Shibboleth SP)

	https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSessions

Youssef Ghorbal
Institut Pasteur
---------------------------
> On 13 Jan 2016, at 15:29, AdamhEdTech <adam.henderson at nassau.k12.fl.us> wrote:
> 
> Good Morning All, 
> Let me briefly explain what I am facing here. I am the network manager for a
> K12 district in Florida and we have a few teachers taking a class at a local
> university here. The users are unable to access the application and receive
> this error 
> 
> "Authentication failure, session missing during completion of profile
> handler"
> 
> I have researched this error here as well as a few others places and I think
> I have a clear picture of what is going on but since I am unfamiliar with
> Shibboleth I feel I am unable to really explain what is going on. 
> 
> The issue is occurring because my clients behind my firewall are dynamically
> NAT'd from my pool of external IP addresses. 
> 
> Capturing packets from outside my firewall I see the client start a session
> with the server running shibboleth using a NAT'd IP from my pool lets just
> say 150.1.1.210, .002 seconds later ANOTHER session is started by my clients
> to the server running Shibboleth and my firewall dynamically assigns a NAT
> from the pool, lets say 150.1.1.211... Authentication will fail for these
> users every time with the error:
> 
> Authentication failure, session missing during completion of profile handler
> 
> IF I assign a static NAT to the client...say 150.1.1.200 the user can
> authenticate and access the application without fail every time. The
> wireshark trace file behavior is the same as described above. I still see
> two sessions open, with different source ports assigned but the source IP is
> the same for both sessions. 
> 
> In my research I found this from an MIT website 
> 
> 
> *Q: The Touchstone Identity Provider encountered the following error while
> processing your request - Authentication failure, session missing during
> completion of profile handler.
> 
> This error shows up with the IP address of the client changes midway through
> Touchstone authentication.*
> 
> I am confident from the trace files I captured this is my error but why are
> two sessions started? How can I explain this to the college who is confident
> the issue is on my end? 
> 
> Of course I could be wrong all together! 
> 
> Thanks! 
> 
> Adam