[EXTERNAL] Re: Logon is looping after apparent successful authentication.

[Cantor, Scott]

> I can ‘view’ the cookies in Chrome, and am using the dev tools in chrome plus a
> SAML tracer, but, that doesn’t tell me what is ‘bad’ about the cookies.  I see
> that on the POST, my app URL, and the SSO.saml2?SAMLRequest named entries
> in the Network Trace data all have the same cookie.

That’s impossible so you're not looking at the right cookies. Two different servers don't share cookies in these exchanges.

POST -> Set-Cookie header from the SP with shibsession in the name.
Redirect -> Get -> send Cookie header back to the SP

There is no way that's happening. Or you have logs somewhere indicating it invalidated the session because even if it did happen the IP address flipped or something else is wrong.

Perhaps you have clustered this across servers with no regard for the fact that that simply doesn't work, the cache is in memory.

-- Scott