IDP 2.4 finding session that should not exist

[Ted Fisher]

Thanks for the feedback Scott.  Can I ask for some more clarity.  Where the IDP normally hits the authentication engine it redirects to /idp/Authn/RemoteUser which then redirects to our CAS server since that is how we have it configured.  In this case it is not redirecting but somehow knows the user even though the session it had was expired.  
/idp/Authn/RemoteUser logged that it knew the user immediately (3 milliseconds):
    16:58:43.279 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.provider.RemoteUserLoginHandler:66] - Redirecting to https://webapp.bgsu.edu:443/idp/Authn/RemoteUser
    16:58:43.367 - TRACE [edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter:117] - Attempting to retrieve IdP  session cookie.
    16:58:43.368 - TRACE [edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter:123] - Found IdP session cookie.
    16:58:43.369 - DEBUG [edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter:180] - No session associated with session ID 139a474841e05229ccab46e45507cdc2e1e440a61bd45acd9a1c1dd27ecf4e46 - session must have timed out
    16:58:43.370 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.provider.RemoteUserAuthServlet:73] - Remote user identified as tffishe returning control back to authentication engine

When we have it configured to go to CAS for remote_user how is it getting user info without having gone to CAS?

Thanks.

Ted F. Fisher
Information Technology Services


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Friday, February 17, 2017 9:33 AM
To: Shib Users <users at shibboleth.net>
Subject: RE: IDP 2.4 finding session that should not exist

> Can anyone suggest how it is determining a user without engaging the 
> authentication handler?

In that log, it is engaging the handler. The IdP has no control over whether REMOTE_USER is set, obviously.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net