Premature Authn Result Expiration w/MFA

[Marvin Addison]

On Mon, Sep 19, 2016 at 1:31 PM Marvin Addison <marvin.addison at gmail.com>
wrote:

> On Mon, Sep 19, 2016 at 11:57 AM Cantor, Scott <cantor.2 at osu.edu> wrote:
>
>> Or just up the
>> net.shibboleth.idp.session.impl.ExtractActiveAuthenticationResults category
>> for now to DEBUG, I don't think that would be so noisy in production that
>> it would cause trouble.
>>
>
> I'll keep you posted on what I find out.
>

I see only two kinds of events from that logger:

1. No active authentication results, SSO will not be possible
2. Authentication result {} is active, copying from session

Presumably the first corresponds to what we're seeing as premature
reauthentication. So it looks like the session is returning an empty
collection for IdPSession#getAuthenticationResults(), which is what you'd
expect if the results had expired prematurely and were purged from
persistent storage.

M
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160919/8c12c208/attachment.html>