"Replay detected of message" causes

[Klingenstein, Nate]

> Right, so they're literally failing logging in, as opposed to a back button thing.


They're getting stopped at the IdP and I can associate that with replays and expirations by identifying authenticated users in the web server's logs and response sizes(this being the ugly aspect of our current implementation).  It's totally plausible that something environment-specific is involved here, particularly given the network already being implicated.


> But...I also don't think that will fix it. Pretty sure webflow will just break anyway, but it would depend on exactly what's going on.


That was my hunch based on prior responses and conversations.  This is much more at the "try it and see what happens" phase than anywhere else.  I already understand that I barely understand Webflow.


I'll see if I can reasonably test something, realizing full well that this is likely to result in incidental unexpected behavior by Webflow that would otherwise get trapped and caught.


At most I would ask for a flag like idp.encryption.optional, so if Webflow doesn't careen off the rails, I'll file an RFE for a boolean and a prayer.  This isn't a top priority when I can't reliably reproduce it myself.

________________________________
From: users <users-bounces at shibboleth.net> on behalf of Cantor, Scott <cantor.2 at osu.edu>
Sent: Wednesday, April 19, 2017 4:08:27 PM
To: Shib Users
Subject: Re: "Replay detected of message" causes

On 4/19/17, 7:00 PM, "users on behalf of Nate Klingenstein" <users-bounces at shibboleth.net on behalf of ndk at sudonym.me> wrote:

> It is squelched right now, but we hear the complaints from users, and
> they're much harder to squelch.

I can tell you from experience that turning an error page you can entirely control the text on into a fence they can't back up over will not improve the general run of the mill complaints, but I think there are two issues conflated, and now I understand what we're talking about.

The vast majority of these are nothing, but the complaints are coming from, I guess, people on broken systems.

> We only get complaints from users
> on devices that are not on campus networks, but that's the only common
> factor that I could observe, and I can't reasonably restrict that.

Right, so they're literally failing logging in, as opposed to a back button thing.

Well...I don't get these reports so I'm not aware that this is a thing. If it is, then I guess you would need to disable the check, but the only safe way to do that is by crafting a custom flow that omits only those steps or by asking for a RFE to actually implement that.

But...I also don't think that will fix it. Pretty sure webflow will just break anyway, but it would depend on exactly what's going on.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170419/1f112949/attachment-0001.html>