SessionNotFound

[Martin Haase]

Hi Scott,


On 20.04.2017 16:52, Cantor, Scott wrote:
>> this Is IdP 3.3.0 and SP 2.6.0 on CentOS, openjdk version "1.8.0_121".
>> We are experiencing a lot of "SessionNotFound" errors from the IdP upon
>> SAML2 SLO. From what we can see, shortly after authentication, Front
>> Channel Logout initiated by the SP works, but approx 1 hour after
>> authentication, the IdP cannot find the SP's session anymore. We upped
>> all corresponding parameters in idp.properties, to no avail:
> Are you sure the SP in question is issuing correct requests? Is it all SPs, one SP? Shibboleth SP or something else?
shibboleth-2.6.0-2.1.x86_64, CentOS7. Always the same SP.

Here is the request that failed:

2017-04-20 10:28:24,667 - DEBUG [PROTOCOL_MESSAGE:127] -
<?xml version="1.0" encoding="UTF-8"?>
<samlp:LogoutRequest
    Destination="https://idp-dev.example.net/idp/profile/SAML2/Redirect/SLO"
    ID="_405c4fe5fd060d04f1c454e35565b0d1"
    IssueInstant="2017-04-20T08:28:23Z" Version="2.0"
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
    <saml:Issuer
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://portal-dev.example.net/shibboleth</saml:Issuer>
    <samlp:Extensions>
        <aslo:Asynchronous
xmlns:aslo="urn:oasis:names:tc:SAML:2.0:protocol:ext:async-slo"/>
    </samlp:Extensions>
    <saml:EncryptedID xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
        <xenc:EncryptedData
            Type="http://www.w3.org/2001/04/xmlenc#Element"
                xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
<xenc:EncryptionMethod
                Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc"/>
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
                <xenc:EncryptedKey
                        xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
<xenc:EncryptionMethod
                           
Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p">
<ds:DigestMethod
                           
Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"
xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
</xenc:EncryptionMethod>
<xenc:CipherData>
<xenc:CipherValue>p56Neb....==</xenc:CipherValue>
</xenc:CipherData>
</xenc:EncryptedKey>
            </ds:KeyInfo>
<xenc:CipherData>
<xenc:CipherValue>1IdBZ....bjsxA==</xenc:CipherValue>
</xenc:CipherData>
        </xenc:EncryptedData>
    </saml:EncryptedID>
   
<samlp:SessionIndex>_0963e526137f9e84beadf903b56a4a1b</samlp:SessionIndex>
</samlp:LogoutRequest>

The IdP logs then, later (:

2017-04-20 10:28:26,179 - DEBUG
[net.shibboleth.idp.session.impl.StorageBackedSessionManager:828] -
Performing secondary lookup on service ID
https://portal-dev.example.net/shibboleth and key
AAdzZWNyZXQxPdX6TgUaiobCnedA+4ui1MEc/gQrSGPv55HIpVs21LIqktF3f02sUju6cRU1JHtCWkfEGun4AsqBlPbNGaGacWSVeiifOef6AdA9WfAGp/FmWYcvw03jFk9nTCWN9unfo2OkxB+oG5noND2UZEep3Jdw/U++ywpU
2017-04-20 10:28:26,179 - DEBUG
[net.shibboleth.idp.session.impl.StorageBackedSessionManager:850] -
Secondary lookup failed on service ID
https://portal-dev.example.net/shibboleth and key
AAdzZWNyZXQxPdX6TgUaiobCnedA+4ui1MEc/gQrSGPv55HIpVs21LIqktF3f02sUju6cRU1JHtCWkfEGun4AsqBlPbNGaGacWSVeiifOef6AdA9WfAGp/FmWYcvw03jFk9nTCWN9unfo2OkxB+oG5noND2UZEep3Jdw/U++ywpU
2017-04-20 10:28:26,207 - WARN
[org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event
occurred while processing the request: SessionNotFound

... this key matches what has been issued 63 minutes before as a
transient NameID to that SP.

I am happy to provide the whole log file off-list if needed.

Regards,
Martin


>
>> Do you have a clue why this is?
> Offhand the only typical case is timeout or a situation where the user logs into the same SP a second time, but the logout refers to the original NameID (assuming transient IDs of course).
>
>> Would it help to move to server-side session storage?
> I couldn't say without knowing the cause but it shouldn't really make any difference.
>
> -- Scott
>
>

-- 
Dr. Martin Haase, Solutions Engineer

DAASI International GmbH        
Europaplatz 3                   
D-72072 Tübingen                
Germany                    

phone: +49 7071 407109-0
fax:   +49 7071 407109-9  
email: martin.haase at daasi.de
web:   www.daasi.de

Sitz der Gesellschaft: Tübingen
Registergericht: Amtsgericht Stuttgart, HRB 382175
Geschäftsleitung: Peter Gietz


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 2247 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://shibboleth.net/pipermail/users/attachments/20170420/225be1f7/attachment.p7s>