Error obtaining persistent identifier (ORA-08177: can't serialize access for this transaction)

[Chris Reeves]

Hi all,

We migrated our production IdPs to v3.2.1 yesterday and the switchover has
been pretty smooth from a Shibboleth point of view. We had a couple of issues
with SPs who required custom NameID formats and weren't specifying such in
either their AuthnRequest or metadata, but they were resolved fairly quickly
by RelyingPartyOverrides (fixing metadata would have been an option too, of
course). Thanks to Scott and the rest of the team for all their efforts.


We're seeing a couple of errors in our logs at the moment. The first of these
looks like this:
--------
2016-09-06T18:03:56.454+01:00 - ERROR [org.opensaml.profile.action.impl.DecodeMessage:73] - Profile Action DecodeMessage: Unable to decode incoming request
org.opensaml.messaging.decoder.MessageDecodingException: No SAMLRequest or SAMLResponse query path parameter, invalid SAML 2 HTTP Redirect message
        at org.opensaml.saml.saml2.binding.decoding.impl.HTTPRedirectDeflateDecoder.doDecode(HTTPRedirectDeflateDecoder.java:73)
2016-09-06T18:03:56.456+01:00 - WARN [org.opensaml.profile.action.impl.LogEvent:76] - An error event occurred while processing the request: UnableToDecode
--------
I can reproduce this by using the browser's 'back' button, or hitting the
login page directly (such as a user would if they had 'bookmarked' the login
page). The error-messages.properties maps this error to the 'stale' error
message, so my feeling is that this isn't an error to worry about - but it
would be great if someone could confirm.


The second error is a little more concerning and relates to the StoredId data
connector:
--------
ERROR [net.shibboleth.idp.profile.impl.ResolveAttributes:257] - Profile Action ResolveAttributes: Error resolving attributes
net.shibboleth.idp.attribute.resolver.ResolutionException: org.opensaml.saml.common.SAMLException: ID storage error obtaining persistent identifier
        at net.shibboleth.idp.saml.attribute.resolver.impl.StoredIDDataConnector.doDataConnectorResolve(StoredIDDataConnector.java:233)
Caused by: org.opensaml.saml.common.SAMLException: ID storage error obtaining persistent identifier
        at net.shibboleth.idp.saml.nameid.impl.StoredPersistentIdGenerationStrategy.generate(StoredPersistentIdGenerationStrategy.java:178)
Caused by: java.io.IOException: java.sql.SQLException: ORA-08177: can't serialize access for this transaction
        at net.shibboleth.idp.saml.nameid.impl.JDBCPersistentIdStoreEx.getBySourceValue(JDBCPersistentIdStoreEx.java:629)
Caused by: java.sql.SQLException: ORA-08177: can't serialize access for this transaction
        at oracle.jdbc.driver.T4CTTIoer.processError(T4CTTIoer.java:447)
--------
We've configured a StoredId data connector in attribute-resolver.xml (we also
need the StoredId for eduPersonTargetedID) which is connecting to an Oracle
database via an ApplicationManagedConnection. There's no funky transaction
isolation configured on the connector - we're just taking whatever the
defaults are.

When a user hits this error no attributes are resolved and their login to the
SP fails (at least in the cases that we've investigated in detail). This is a
transient error though, and a subsequent login attempt will often succeed. We
believe that once the user has successfully authenticated to an SP and a row
has been added to the shibpid table this error can't occur again for that SP.

We only have one active server at a time (the other is a hot standby which our
load balancer will fail over to if necessary) so there shouldn't be any
conflict between the two servers. I should also note that this is not
something we saw on v2.

Has anyone seen this error before, or have any advice as to how to fix this or
investigate further? At the moment my next step is likely to be to switch to
using BeanManagedConnections instead of ApplicationManagedConnections to see
if that helps, but it would be good to understand why this is happening if at
all possible.


Thanks in advance for any suggestions,
    Chris