Client Authentication issue from NAT POOL

[AdamhEdTech]

The only way it's going to fail is if a user's address changes, but I guess
that's what you're saying is happening. 



I don't know what sessions you're referring to. I think you're confusing
network connections and HTTP with cookie-based application sessions or
something. 

Well, it is to some degree. NAT is fundamentally evil, and inconsistent NAT
is just untenable. 

Like with the comparable issue with the SP, there is a setting in the IdP's
session filter that can be turned off to bypass address checking. But asking
an IdP to turn that off is a pretty big deal. 

Cantor, Scott E. wrote
> On 1/13/16, 9:29 AM, "users on behalf of AdamhEdTech" <

> users-bounces@

>  on behalf of 

> adam.henderson at .fl

> > wrote:
> 
> 
> 
>>Capturing packets from outside my firewall I see the client start a
session
>>with the server running shibboleth using a NAT'd IP from my pool lets just
>>say 150.1.1.210, .002 seconds later ANOTHER session is started by my
clients
>>to the server running Shibboleth and my firewall dynamically assigns a NAT
>>from the pool, lets say 150.1.1.211... Authentication will fail for these
>>users every time with the error:
>>
>>Authentication failure, session missing during completion of profile
handler
> 
> The only way it's going to fail is if a user's address changes, but I
> guess that's what you're saying is happening.
> 
>>I am confident from the trace files I captured this is my error but why
are
>>two sessions started?
> 
> I don't know what sessions you're referring to. I think you're confusing
> network connections and HTTP with cookie-based application sessions or
> something.
> 
>> How can I explain this to the college who is confident
>>the issue is on my end?
> 
> Well, it is to some degree. NAT is fundamentally evil, and inconsistent
> NAT is just untenable.
> 
> Like with the comparable issue with the SP, there is a setting in the
> IdP's session filter that can be turned off to bypass address checking.
> But asking an IdP to turn that off is a pretty big deal.
> 
> -- Scott
> 
> -- 
> To unsubscribe from this list send an email to 

> users-unsubscribe@


Well you are right, I cant see layer 7 in wireshark but I see a SYN, SYN ACK
and an ACK so I assume a session is started. 

NAT may be evil but pretty hard to avoid with 13k daily users and over 100k
connections made at any given time. 

Thanks for the responses!




--
View this message in context: http://shibboleth.1660669.n2.nabble.com/Client-Authentication-issue-from-NAT-POOL-tp7621769p7621778.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.