Help with faulty Facebook Workplace email links.

[O'Dowd, Josh]

Hi,

We have recently set up SSO for Facebook Workplace with our IdP, which as you all know, is a bit kludgy on the SAML front, anyway.

Our SSO is working nicely, but when FB sends an email notification to a user with links into the content, the SAML2 request that commences is causing the following error, which I do not really understand:

Profile Action WebFlowMessageHandlerAdaptor: Exception handling message|10.10.18.134
org.opensaml.messaging.handler.MessageHandlerException: Rejecting replayed message ID 'ONELOGIN_534c4fbe0b3531581ed428fe74bc29f9c8171cda' from issuer https://www.facebook.com/company/101880656976878

... this in turn lands our user on the IdP 'stale' request error page.

Any insight on this is much appreciated.
Thanks,

Josh O'Dowd
Software Systems Engineer / Identity Access Management
Central IT, University of Montana

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170717/52a90809/attachment.html>