Client Authentication issue from NAT POOL

[Cantor, Scott]

On 1/13/16, 9:29 AM, "users on behalf of AdamhEdTech" <users-bounces at shibboleth.net on behalf of adam.henderson at nassau.k12.fl.us> wrote:



>Capturing packets from outside my firewall I see the client start a session
>with the server running shibboleth using a NAT'd IP from my pool lets just
>say 150.1.1.210, .002 seconds later ANOTHER session is started by my clients
>to the server running Shibboleth and my firewall dynamically assigns a NAT
>from the pool, lets say 150.1.1.211... Authentication will fail for these
>users every time with the error:
>
>Authentication failure, session missing during completion of profile handler

The only way it's going to fail is if a user's address changes, but I guess that's what you're saying is happening.

>I am confident from the trace files I captured this is my error but why are
>two sessions started?

I don't know what sessions you're referring to. I think you're confusing network connections and HTTP with cookie-based application sessions or something.

> How can I explain this to the college who is confident
>the issue is on my end?

Well, it is to some degree. NAT is fundamentally evil, and inconsistent NAT is just untenable.

Like with the comparable issue with the SP, there is a setting in the IdP's session filter that can be turned off to bypass address checking. But asking an IdP to turn that off is a pretty big deal.

-- Scott