"Replay detected of message" causes

[Klingenstein, Nate]

> But since the stored URL would involve the IdP, and not any host that anybody would actually want to visit, I can't imagine why somebody would happen into doing it. i.e. The URL you start typing is wiki.shibboleth.net, not the IdP it sent you to.


Failed HTTP requests and resorting to the back button if they get a "this page couldn't load" at some point.  It's specifically occurring only on devices using cellular networks, some mobile providers have spotty coverage here, and our users expect to be able to login without human interaction in most situations.  I think that confluence of factors to be why I hear this so much now.


Why do people apparently get stuck consistently on this particular check?  I can think of several reasons, but initial DNS resolution of the IdP combined with traffic prioritization by the mobile carriers smells very suspicious to me.


As you point out, that would equally torpedo most of the hops in the transaction, though, so I don't think there's a get-out-of-jail-free card here.  Telling users to start again is probably the best I can do.  I'll dust off the blink tag.

________________________________
From: users <users-bounces at shibboleth.net> on behalf of Cantor, Scott <cantor.2 at osu.edu>
Sent: Wednesday, April 19, 2017 5:43:58 PM
To: Shib Users
Subject: Re: "Replay detected of message" causes

On 4/19/17, 8:29 PM, "users on behalf of Nate Klingenstein" <users-bounces at shibboleth.net on behalf of ndk at sudonym.me> wrote:

> I have no idea what these people are doing or not doing, but I think
> this is totally plausible on a network with high latency, intermittent
> availability, mystery clients, and browsers that remember URLs.  It's
> sporadic, as mentioned, so I'll press the affected users for more
> details on exactly when they're experiencing this.

Clicking on stored URLs would be plausible and if it didn't involve latency issues, that probably would be fixable without the checks.

But since the stored URL would involve the IdP, and not any host that anybody would actually want to visit, I can't imagine why somebody would happen into doing it. i.e. The URL you start typing is wiki.shibboleth.net, not the IdP it sent you to.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170420/51a57334/attachment.html>