Tracking down intermittent stale request errors from the IdP

[Andrew Morgan]

On Fri, 1 Jun 2018, Wessel, Keith wrote:

> All,
>
> Hoping someone can point me in the right direction. We have a technical 
> user here on campus who has been getting intermittent stale request 
> messages from the IdP. He'll sign into a service behind Shib then, when 
> he signs into another, he'll be prompted to re-enter his password even 
> though forced reauth wasn't requested and he still has a valid IdP 
> session. After clicking the login button on that page, he'll get a stale 
> request message in his browser instead of being prompted for 2FA.
>
> When this happens, he can go back to the same starting point for logging 
> into the service several times in a row and get the same results until, 
> after a few tries, it randomly works. He can even try in a private 
> browsing window and get the same results while it's still happening.
>
> So far, this has all been in Chrome and hasn't been happening to other 
> customers, or at least they're not reporting it. But he's been putting 
> up with it every couple days for the last couple months. It happens to a 
> variety of SPs, but he's never had it happen when logging into AWS 
> (which he does frequently) which uses IDP-initiated SSO.
>
> He's tried the obvious clearing his cache and disabling browser 
> extensions.
>
> All that the IdP reports in the log is a no such flow exception.
>
> I suspect his browser is doing some funny caching that it shouldn't be. 
> I'm tempted to have him re-install Chrome or spend a few days in another 
> browser. Before I do, wondered if anyone had suggestions of other things 
> I might try to help troubleshoot this.

Keith,

Is your IDP load balanced with multiple nodes?  This sounds like the 
JSESSION is being lost, which can happen if his requests go to different 
(un-replicated) nodes as part of the login process.

We ran into this problem when we moved some nodes into AWS behind the 
Network Load Balancer.  The NLB does not support sticky sessions, so the 
JSESSION and web flow would be lost when a client switched nodes between 
the steps of the login flow.

Thanks,
 	Andy