"Replay detected of message" causes

[Ullfig, Roberto Alfredo]

How about users who have configured their browser to re-open all previously opened tabs when the browser starts up?

---
Roberto Ullfig - rullfig at uic.edu
Systems Administrator
Enterprise Architecture and Development | ACCC
University of Illinois - Chicago


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Thursday, April 20, 2017 10:25 AM
To: Shib Users <users at shibboleth.net>
Subject: RE: "Replay detected of message" causes

> We don't see an steady stream of these. Only 310 Replays yesterday. I 
> just need to know what to tell the end user when he/she sees the 
> message "did not meet security requirements". Should "restart your 
> browser" or "don't use the back button" suffice?

Well, to be fair, that's one specific condition, and no, that's not a silly number, I checked my log and it's not out of line with that. The much more common ones are flow exceptions and message decoder failures.

If the user hits the back button, it will of course fail. I have numerous error conditions mapped to a message [1] that handles all the different common cases, including bookmarks and such. Among the conditions that are involved are things that would default-map to that message out of the box.

(Restarting a browser does nothing, so that's really never relevant advice.)

A replay would not typically be due to back button, but if you had the right sequence of steps and the back button was used quickly enough and probably a couple of times, sure. Which fits the "rare" argument. A bookmark would normally be a bit more common, but anecdotally I think bookmarks are typically not a thing anymore, not as much at least.

-- Scott

[1] https://webauth.service.ohio-state.edu/idp/profile/SAML2/Redirect/SSO

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net