Client persistent storage not remembering user

[Thomas Colin de Verdière]

Hello,

I reinstalled shibboleth idp 3.3.2. I tried different configuration :
Tomcat 8.5 + JDK8, Tomcat 8.5 + JRE,  Tomcat 8.5 + JRE7.
The problem is still here. So i don't think it comes from application
server or Java version.

I am new to SAML so i don't understand it very much. The only warning in
the log is :
MetadataNameIdentifierFormatStrategy:75] - Ignoring NameIDFormat metadata
that includes the 'unspecified' format

Is my SP not configured properly ? I am using Spring Boot + spring saml for
the SP. May the problem comes from this ?

And i don't understand really well the expected behaviour. I edit
idp.properties and activate :
idp.storage.htmlLocalStorage = true
idp.session.enabled = true
idp.session.StorageService = shibboleth.ClientPersistentStorageService

Now i expected :
1. I cleared the browser cookies and local storage
2. I set the address of my sp. (https://localhost:8443/app)
3. I enter my credentials on shibboleth (https://localhost/idp)
4. The browser display the SP home page.
5. I close the browser
6. I open the browser
7. I set the address of my sp.
8. => I am already logged. (that is what i expected)

But this last point failed. I am redirected to 3.

Also the "Don't Remember Me" is making me a bit confused. Does it have an
impact when shibboleth.ClientPersistentStorageService is *not* set.
And also, if the cookie max age property is not used for the html
localstorage what is the timeout of this token ? Does it have a time out ?

Thanks,
Thomas

2018-04-18 22:47 GMT+02:00 Cantor, Scott <cantor.2 at osu.edu>:

> > Can you tell me what is the JRE or JDK and Apllication server you use to
> test
> > this ?
>
> I use many different Java versions and Jetty 9.3 generally, usually Java 8
> these days.
>
> > Also is the property idp.cookie.maxAge also used for html storage ?
>
> Not unless it backs off to a cookie for the data.
>
> The only real explanation for this is a client IP address floating and
> invalidating the session, and that would have to happen every time and
> would be clearly logged. There is nothing else short of simply not sending
> the cookie at all, which would point to a proxy or load balancer
> interfering.
>
> -- Scott
>
> --
> For Consortium Member technical support, see https://wiki.shibboleth.net/
> confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180419/daa841f2/attachment.html>