shibd service not responding, sometimes ...

[Steven Carmody]

Hi,

I have two load-balanced apache servers; they both use the same shibd 
service (on a third machine). All three machines are using identical 
shibboleth2.xml files.

The ApplicationDefaults section is configured with this:

         <SSO discoveryProtocol="SAMLDS" 
discoveryURL="https://wayf.brown.edu/choose/qa-bs-col">
             SAML2 SAML1
         </SSO>

and that works fine.

There is an entry in the RequestMap; a match takes processing to this 
ApplicationOverride:

	<ApplicationOverride id="discovery-brown" >
               <Sessions handlerURL="/academics/college/Shibboleth.sso" 
handlerSSL="true"
                         cookieProps="; path=/academics/college" >
             		<SSO discoveryProtocol="SAMLDS" 
discoveryURL="https://wayf.brown.edu/choose/qa-bs-col">
                         SAML2 SAML1
                     </SSO>
               </Sessions>
         </ApplicationOverride>

Yes, I know, the default and the Override both contain the same SSO info.

If my browser goes to a url that maps to the default processing, I see 
this in the shibd log, and things work well:

DEBUG Shibboleth.Listener [2]: dispatching message 
(default::getHeaders::Application)
DEBUG Shibboleth.Listener [2]: dispatching message (set::RelayState)
DEBUG XMLTooling.StorageService [2]: inserted record 
(db10e495f00f83cc0c04daed097b7ebf0205e617a49516cc7b63f7958b0fd667) in 
context (RelayState) with expiration (1474037445)

If my browser goes to a url that maps to the override, I see this 
shortened entry in the shibd log, I'mnot redirected anywhere, and access 
control fails (no IDP supplied attributes).

DEBUG Shibboleth.Listener [1]: dispatching message 
(discovery-brown::getHeaders::Application)

Any suggestions ? Both urls point tothe same DNS name.

Thanks !