Shibboleth 2.5.3 SP looping after successful POST

[James W. Anderson]

FYI, the looping was caused by our load balancer. It wasn't enforcing sticky sessions and was instead round-robin'ing requests between two app server instances, so that the very next request after posting the assertion went to the other instance, which didn't recognize the _shib_session ID (since it was on the other instance), and would start the whole authentication process over again.

Thanks for your help; it got us looking in the right places, and helped us find the problem.

-James

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Peter Schober
Sent: Friday, October 21, 2016 4:01 PM
To: users at shibboleth.net
Subject: Re: Shibboleth 2.5.3 SP looping after successful POST

* Peter Schober <peter.schober at univie.ac.at> [2016-10-21 21:56]:
> * Cantor, Scott <cantor.2 at osu.edu> [2016-10-21 21:52]:
> > Setting handlerSSL to false implies not using TLS, so setting
> > cookieProps to https and then using http to access a site is a
> > guaranteed loop. Session created, cookie set for https, resource
> > access with http, no cookie, no session, loop.
>
> Unless there's a redirect from http to https in there somewhere.

Ah, I see. Even without metadata errors at the IDP the SAML exchange could always happen over HTTPS at the SP (depending on how sessions are initiated and how the plain http and SSL vhosts are configured) but site access could be over plain http, hence a loop with the "secure" flag on session cookies.

We sometimes disable plain http access for services completely (and often enough are asked to turn them back on again, later). A redirect from http to https is then the only thing you get on http. STS headers might help there, too.
-peter
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

________________________________

CONFIDENTIALITY NOTICE
NOTICE: This message is intended for the use of the individual or entity to which it is addressed and may contain information that is confidential, privileged and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, you are hereby notified that any printing, copying, dissemination, distribution, disclosure or forwarding of this communication is strictly prohibited. If you have received this communication in error, please contact the sender immediately and delete it from your system. Thank You.

________________________________