Troubleshooting the "Unable to decode" (IdP 3.3)

[O'Dowd, Josh]

> And you don't think they're just bookmarks or back buttons? Normally you can track them back to web access log entries. If there's really a "not valid" message in the request, which I doubt, you'd see it there for GETs at least.

No, because this just started 2 days ago on a large scale and they are all coming from a handful of IP addresses in the same subnet.  It feels robotic, as well because we are getting them all day long and throughout the night.

The subnet is Facebook owned and the only service provider we work with that is associated with FB is Workplace, which we are/were test-driving.  We had configured that for SAML SSO, but when this occurred, I stripped that integration out of the IdP, and turned it off on the FB end.  Those actions did not stop or mitigate the requests we are seeing from that subnet.

Josh

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Friday, August 25, 2017 9:42 AM
To: Shib Users <users at shibboleth.net>
Subject: Re: Troubleshooting the "Unable to decode" (IdP 3.3)

On 8/25/17, 11:33 AM, "users on behalf of O'Dowd, Josh" <users-bounces at shibboleth.net on behalf of Josh.O'Dowd at mso.umt.edu> wrote:

> We are getting a regular stream of bad requests, from a specific IP 
> subnet range, which are logging the “Unable to decode” and “Cannot Unmarshall XML” errors.

And you don't think they're just bookmarks or back buttons? Normally you can track them back to web access log entries. If there's really a "not valid" message in the request, which I doubt, you'd see it there for GETs at least.

-- Scott



--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net