NoSuchFlowExecutionException on user's first attempt to log in to the IDP

[David E. Newswanger]

Hi All,


We recently upgraded our Shibboleth instance to a cluster of Shibboleth Docker containers. After the update, some users started receiving the error that you get when you hit the back button in the web browser:


    2017-11-15 16:05:13,213 - ERROR [org.springframework.webflow.execution.repository.NoSuchFlowExecutionException:76] -
    org.springframework.webflow.execution.repository.NoSuchFlowExecutionException: No flow execution could be found with key 'e1s1' -- perhaps this executing flow has ended or expired? This could happen if your users are relying on browser history (typically via the back button) that references ended flows.
    at org.springframework.webflow.execution.repository.support.AbstractFlowExecutionRepository.getConversation(AbstractFlowExecutionRepository.java:172)
    Caused by: org.springframework.webflow.conversation.NoSuchConversationException: No conversation could be found with id '1' -- perhaps this conversation has ended?
    at org.springframework.webflow.conversation.impl.ConversationContainer.getConversation(ConversationContainer.java:126)

We have had a hard time replicating this error because it only seems to happen the first time a user attempts to log in to one of our SPs from a new computer. All subsequent login attempts on their machine work. The user will:


  1.  Sign into a new computer
  2.  Attempt to log in to one of the SPs
  3.  The log in will fail with the error message above
  4.  The user generally will then try to access the SP again, get another prompt to log in and then successfully access the service
  5.  Any subsequent attempts to log in to Shibboleth on their machine work as intended


We've tried to replicate this by clearing the browser cache/cookies/history, but that doesn't replicate the issue. Is it possible that the failure has to do with a cookie which was set by the previous IDP configuration?


Some other notes about our cluster:

  *   We are using Traefik for load balancing the IDP containers, sticky sessions are enabled, and it appears as though failures are still occurring if we take one of the instances offline.
  *   All of our IDP containers share the same database for SLO and LDAP
  *   We haven't changed any of the credentials such as the cookie encryption key.
  *   This seems to be happening for all of our SPs.


Does anyone know what might be causing this? Any suggestions for replicating the problem without having to log in to a new computer would be greatly appreciated as well.


Thanks,

    David Newswanger
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20171117/4518b750/attachment.html>