native SP logger enhancement: include applicationId

[Guillaume Rousse]

Le 18/04/2018 à 18:11, Cantor, Scott a écrit :
>> Well, I'm not in the shibboleth business for enough time to find anything self-
>> evident here :)
> 
> Not a Shibboleth issue. SSO systems either preserve POST or they don't. If they don't, SSO interrupts break a POST. Shibboleth happens to allow limited POST preservation in certain cases if it's enabled, and it's not enabled, so it logs an INFO message, and while that probably should just be DEBUG I'm likely to leave it alone and just move the default level to WARN.
> 
>> More seriously, it doesn't explain why they are so many of those messages,
>> if the cause is on my side, and if I can do something to make the world better
>> someway: 4000 interrupted POST requests/hour means 6% of the total
>> number of HTTP requests serviced by this proxy during the same time
>> period. Hence the need to pinpoint the issue more precisely.
> 
> Timeouts are the usual reason for SSO in the middle of a POST, but misconfigured systems that cause sessions to invalidate would be another. Given your earlier note, it would seem that perhaps address mismatches might be a cause.
Unfortunatly not, as I have disabled client address checking since 
yesterday.

I did use PID and timestamp information to correlate those mod_shib 
messages to actual HTTP request, it turns out they all related to a 
single application, which apparently heavily uses POST requests (10-15 
requests/minute) to maintain some kind of interactive session with the 
server over HTTP.

We already identified this application as badly adapted to our 
federation setup, as it keep sending those requests even after the end 
of Shibboleth session, triggering the whole authentication process each 
time. As some users don't close their browser, but just lock their 
session out of working hours, we keep receiving thousands of those 
requests, uselessly stressing our discovery service. Those mod_shibd 
messages are just another similar annoyance.

We already asked the editor to review its application behavior, to 
detect session expiration on client side, and stop harassing the server 
with useless requests. Is there anything else we could do on Shibboleth 
side to limit the problem, beyond raising the logger threshold, before 
it get fixed ?

Regards.
-- 
Guillaume Rousse
Pôle SSI

Tel: +33 1 53 94 20 45
www.renater.fr

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3637 bytes
Desc: Signature cryptographique S/MIME
URL: <http://shibboleth.net/pipermail/users/attachments/20180419/d6780631/attachment.p7s>