IdP 3.3.1 - mac check in GCM failed

[Cantor, Scott]

On 6/12/17, 4:33 PM, "users on behalf of George Stoynev" <users-bounces at shibboleth.net on behalf of george.stoynev at mcgill.ca> wrote:

> So far, all services seem OK and nobody complains. I was just wondering 
> what the source of this error might be and how to mitigate it if possible.

Well, they're being forced to login again, possibly over and over if they're switching nodes because the sessions are flipping between keys. The secret key is out of sync on the node(s). It's finding a matching key number/version in the secret key file, but it's the wrong key.

If you're rolling the key daily, just recopy it from whatever source server is generating it. If not, you need to pick one and copy that node's files over to the other nodes to get it back in sync.

-- Scott