Premature Authn Result Expiration w/MFA

[Marvin Addison]

On Mon, Sep 19, 2016 at 11:55 AM Cantor, Scott <cantor.2 at osu.edu> wrote:

> I would tend to think this is more likely a session storage issue


Agree, but my present hunch is that it's a storage issue caused by
AuthenticationResults timing out in some unexpected way. If I'm reading the
code right, a logging statement
in net.shibboleth.idp.session.impl.StorageBackedIdPSession#getAuthenticationResults
that logs when loadAuthenticationResultFromStorage returns null would help
identify that case:

Index:
idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/StorageBackedIdPSession.java
===================================================================
---
idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/StorageBackedIdPSession.java
(revision
8403)
+++
idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/StorageBackedIdPSession.java
(working
copy)
@@ -164,7 +164,7 @@
                     if (result != null) {
                         entry.setValue(Optional.of(result));
                     } else {
-                        // A null here means the reference to the record
should be removed.
+                        log.debug("Value for {} not found in storage and
will be removed", entry.getKey());
                         entries.remove();
                     }
                 } catch (final IOException e) {


> There's also no logging in the isResultActive() method it's calling and
> that could be added to determine what criteria is failing.
>

That may be helpful as well.


> I assume there's no chance the client's losing its cookie.
>

There's no evidence for that, but we have evidence of the converse. We had
a report of a case that could only happen with a valid IdPSession object
with no valid authentication results.

M <users-unsubscribe at shibboleth.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160919/d4d11759/attachment.html>