Users Keep Getting Redirected to /favicon.ico

[David E. Newswanger]

Hi Peter,


Thanks! I thought I had added the /favicon.ico to the list of resources which are supposed to ignore authentication, but it looks like I changed the the wrong config file. Removing /favicon.ico from the list of protected resources fixed the problem.


Cheers,

    David Newswanger


________________________________
From: users <users-bounces at shibboleth.net> on behalf of Peter Schober <peter.schober at univie.ac.at>
Sent: Tuesday, November 14, 2017 2:07:54 AM
To: users at shibboleth.net
Subject: Re: Users Keep Getting Redirected to /favicon.ico

* David E. Newswanger <David_Newswanger at berea.edu> [2017-11-13 20:32]:
> We're having some really strange problems with our IdP. Occasionally
> a user will go to one of our service providers to log in, get
> redirected to the IdP, authenticate and then instead of getting sent
> back to the SP, they get sent to login.domain.edu/favicon.ico.

Well, it seems there's a SAML SP on login.domain.edu at play, too, so
it's not some weird coincidence the browser ends upon the IDP web
server (since that's an SP, too).
Your IDP logs would also show you that the accessed SAML SP in those
case is your SP-on-the-IDP, not the one people originally intended to
access.

The favicon.ico on that web server is protected by that SAML SP (and
that's the main part of your configuration error, and one that makes
no sense since a favicon should be nothing that needs access control).

Meaning a browser accessing your IDP web server during authentication
(to get a SAML assertion for some other random SP) would also request
/favicon.ico from your IDP web server and that is protected by the
SP-on-your-IDP and that other SP now will send another authn request
to the IDP. The fact that this doesn't always happen points to a race
condition of the resources as they're being requested by the browser:
If favicon comes first the SAML redirects will end up at the IDP web
server.

-peter
--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20171114/e3f7fd23/attachment.html>