Users Keep Getting Redirected to /favicon.ico

[Peter Schober]

* David E. Newswanger <David_Newswanger at berea.edu> [2017-11-13 20:32]:
> We're having some really strange problems with our IdP. Occasionally
> a user will go to one of our service providers to log in, get
> redirected to the IdP, authenticate and then instead of getting sent
> back to the SP, they get sent to login.domain.edu/favicon.ico.

Well, it seems there's a SAML SP on login.domain.edu at play, too, so
it's not some weird coincidence the browser ends upon the IDP web
server (since that's an SP, too).
Your IDP logs would also show you that the accessed SAML SP in those
case is your SP-on-the-IDP, not the one people originally intended to
access.

The favicon.ico on that web server is protected by that SAML SP (and
that's the main part of your configuration error, and one that makes
no sense since a favicon should be nothing that needs access control).

Meaning a browser accessing your IDP web server during authentication
(to get a SAML assertion for some other random SP) would also request
/favicon.ico from your IDP web server and that is protected by the
SP-on-your-IDP and that other SP now will send another authn request
to the IDP. The fact that this doesn't always happen points to a race
condition of the resources as they're being requested by the browser:
If favicon comes first the SAML redirects will end up at the IDP web
server.

-peter