shibd service not responding, sometimes ...

[Cantor, Scott]

The title here doesn't fit the description. Saying it doesn't respond implies you're getting a listener exception or something.

>I have two load-balanced apache servers; they both use the same shibd 
>service (on a third machine). All three machines are using identical 
>shibboleth2.xml files.

Presumably you don't expect any significant load, because once you get it, it will fail, that won't scale.

> Yes, I know, the default and the Override both contain the same SSO info.

Then why have the override?

> If my browser goes to a url that maps to the default processing, I see 
> this in the shibd log, and things work well:

There ought to be more evidence of it issuing an AuthnRequest if you're on DEBUG, though I assume that's what it's doing, the relay state processing is presumably from that step. Would be better to have more direct evidence of it though.

> If my browser goes to a url that maps to the override, I see this 
> shortened entry in the shibd log, I'mnot redirected anywhere, and access
> control fails (no IDP supplied attributes).

That would imply to me there's no rule anywhere requiring a session for that request. That doesn't suggest anything is behaving wrong, just that it's not configured in a way that fits the intended behavior.

If this is Apache, there should be no need to use the RequestMap anywhere, and eliminating that would likely prevent various sorts of risky overlaps and conflicts that might end up screwing up the effective rules it's using.

-- Scott