Help with faulty Facebook Workplace email links.

[O'Dowd, Josh]

Sorry guys,

I just found that this has to do with our internal routing.  While I am still confused about the error, I respectfully rescind my support request.

Thanks.

Josh

From: users [mailto:users-bounces at shibboleth.net] On Behalf Of O'Dowd, Josh
Sent: Monday, July 17, 2017 10:43 AM
To: users at shibboleth.net
Subject: Help with faulty Facebook Workplace email links.

Hi,

We have recently set up SSO for Facebook Workplace with our IdP, which as you all know, is a bit kludgy on the SAML front, anyway.

Our SSO is working nicely, but when FB sends an email notification to a user with links into the content, the SAML2 request that commences is causing the following error, which I do not really understand:

Profile Action WebFlowMessageHandlerAdaptor: Exception handling message|10.10.18.134
org.opensaml.messaging.handler.MessageHandlerException: Rejecting replayed message ID 'ONELOGIN_534c4fbe0b3531581ed428fe74bc29f9c8171cda' from issuer https://www.facebook.com/company/101880656976878

... this in turn lands our user on the IdP 'stale' request error page.

Any insight on this is much appreciated.
Thanks,

Josh O'Dowd
Software Systems Engineer / Identity Access Management
Central IT, University of Montana

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170717/80ae4137/attachment.html>