Premature Authn Result Expiration w/MFA

[Marvin Addison]

On Wed, Sep 21, 2016 at 7:05 AM Marvin Addison <marvin.addison at gmail.com>
wrote:

> my only explanation at this point is records are mysteriously disappearing
> from memcached.
>

We bottomed out on this, and I'm happy to report there is a cause and
effect relationship with MFA. Our memcached instance had reached capacity
and was evicting old entries to make room for new entries as memcached
wants to do; that explains the seemingly random disappearance of items from
storage we were seeing. The relationship to MFA is that the composition of
authentication results in DefaultResultMergingStrategy [1] apparently
increases storage record cost; rough estimate is double. That's probably
something to note in documentation. It would be relevant to cache-based
storage backends and possibly also client storage when it serializes to a
cookie value.

M

[1]
http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/FinalizeMultiFactorAuthentication.java,
line 248
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160921/048bfcf4/attachment.html>