"Replay detected of message" causes

[Klingenstein, Nate]

> If you get through a replay error, but a subsequent exchange with the IdP does the same thing, you'll at least sometimes end up with a flow execution error because the second request will hit after the first one has advanced the flow state past the point that the second one would work. It's not a replay exactly but the effect is the same.


I think we get more expirations than replays by an order of magnitude, but I'll have to turn the logging back on to know.


The concerns I'm reading seem to apply almost exclusively to replays.  Do you have reason to believe that disabling expiration checking alone would incur death by Webflow?


I don't think that addresses Paul's satellite users, but it would address at least some of my cell phone users.

________________________________
From: users <users-bounces at shibboleth.net> on behalf of Cantor, Scott <cantor.2 at osu.edu>
Sent: Wednesday, April 19, 2017 4:52:13 PM
To: Shib Users
Subject: Re: "Replay detected of message" causes

On 4/19/17, 7:19 PM, "users on behalf of Klingenstein, Nate" <users-bounces at shibboleth.net on behalf of nklingenstein at calstate.edu> wrote:

> That was my hunch based on prior responses and conversations.  This is much more at the "try it and see what happens" phase
> than anywhere else.

Testing it is probably fine, but yeah, I basically after a few minutes thinking can assure you that it probably won't work. If you get through a replay error, but a subsequent exchange with the IdP does the same thing, you'll at least sometimes end up with a flow execution error because the second request will hit after the first one has advanced the flow state past the point that the second one would work. It's not a replay exactly but the effect is the same.

> I'll see if I can reasonably test something, realizing full well that this is likely to result in incidental unexpected behavior by
> Webflow that would otherwise get trapped and caught.

It's not about making it work badly. It just fails, albeit with a different error at a different point.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170419/df98197e/attachment-0001.html>