Premature Authn Result Expiration w/MFA

[Cantor, Scott]

On 9/21/16, 9:53 AM, "users on behalf of Marvin Addison" <users-bounces at shibboleth.net on behalf of marvin.addison at gmail.com> wrote:

> We bottomed out on this, and I'm happy to report there is a cause and effect relationship
> with MFA. Our memcached instance had reached capacity and was evicting old entries to make
> room for new entries as memcached wants to do; that explains the seemingly
> random disappearance of items from storage we were seeing. The relationship to MFA is that
> the composition of authentication results in DefaultResultMergingStrategy [1] apparently
> increases storage record cost; rough estimate is double. That's probably something
> to note in documentation. It would be relevant to cache-based storage backends and
> possibly also client storage when it serializes to a cookie value.

That seems to violate the storage contract, but I'll add something. The cookie margin is generally substantial because it's not tracking service logins, so the doubling or tripling isn't likely to matter much. There's also only ever a single MFA result tracked.

-- Scott