[EXTERNAL] Re: Logon is looping after apparent successful authentication.

[O'Quinn, Dennis]

Hi Scott, thank you for your continued (and fast) responses.

Sorry, I did not get what you were...  no clustering...  I am only saying that as I look in the chrome dev tools network trace data, I am seeing 'cookies' represented on the 3 network trace 'entry names' I mentioned... That is all that is in the network trace due to the looping.

The setup is:
-> A corporate network where the PingIdentity IdP is hosted.
-> There is a Google Cloud Load Balancer with a front end facing this corporate network listening on port 443.
-> The DNS name for this LB front end is sascloud.homedepot.com (note: the LB reference is not significant, it is only serving as the gateway into the cloud and has only 1 node in its 'pool' (i.e., the SAS Web Server)).
-> The LB back end (i.e., inside GCP) points to the SAS Web Server (Linux/Apache 2.4/Shibboleth 2.6.1) where the SP function is hosted.  The host name of the SAS Web Server in GCP is sas-mao-midtier.<GCP Domain> and it is listening on port 8343.
-> Both the front-end and the backend connections for the LB are HTTPS .
-> The URLs in the SP Metadata provided to the IdP are all prefixed as "https://sascloud.homedepot.com/".
-> The ServerName directive in the httpd-ssl.conf file on the SAS Web Server is set to sascloud.homedepot.com and a ServerAlias is defined for sas-mao-midtier.<GCP Domain>:8343

The login seems to be working fine.

One possible complication here is that we are doing 2 factor authentication at the IdP, so, the user is first prompted to authenticate using an ID/RSA Token, and then the user is prompted to authenticate again using an ID/PSW that is authenticated via LDAPS.

I do not believe the 2FA is a problem though since we were also looping when doing the RSA token only.  I only mention it to be complete.


Questions:
Would I find the information I need to debug this in the shibd_warm.log or the shibd.log or the native(or native_warn).log?

NOTE: I believe I have all of the debug settings enabled in the shibboleth log config files in /etc/shibboleth, so, I am getting a copious amount of information in my logs.

I apologize if I am missing something obvious, but, I am still getting my head around Shibboleth and SAML, so, there are (apparently) quite a few things that I don't know or completely understand yet.


Thanks much, Dennis








-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott
Sent: Friday, June 1, 2018 6:10 PM
To: Shib Users <users at shibboleth.net>
Subject: RE: [EXTERNAL] Re: Logon is looping after apparent successful authentication.

> I can ‘view’ the cookies in Chrome, and am using the dev tools in
> chrome plus a SAML tracer, but, that doesn’t tell me what is ‘bad’
> about the cookies.  I see that on the POST, my app URL, and the
> SSO.saml2?SAMLRequest named entries in the Network Trace data all have the same cookie.

That’s impossible so you're not looking at the right cookies. Two different servers don't share cookies in these exchanges.

POST -> Set-Cookie header from the SP with shibsession in the name.
Redirect -> Get -> send Cookie header back to the SP

There is no way that's happening. Or you have logs somewhere indicating it invalidated the session because even if it did happen the IP address flipped or something else is wrong.

Perhaps you have clustered this across servers with no regard for the fact that that simply doesn't work, the cache is in memory.

-- Scott

--
For Consortium Member technical support, see https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_x_coFAAg&d=DwIGaQ&c=MtgQEAMQGqekjTjiAhkudQ&r=mn6DeBt1nj8Oqx06pdIK0_n5EfK6FeVHgdjBNpchyro&m=QUTg05SvLnheWFas8BBmp-im0nlIxm8CO4FpoRgGd9Y&s=seSyKO6fX0rdUgjZnWPmmOCycuM6a8whlHJFejOd9K0&e=
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

________________________________

The information in this Internet Email is confidential and may be legally privileged. It is intended solely for the addressee. Access to this Email by anyone else is unauthorized. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. When addressed to our clients any opinions or advice contained in this Email are subject to the terms and conditions expressed in any applicable governing The Home Depot terms of business or client engagement letter. The Home Depot disclaims all responsibility and liability for the accuracy and content of this attachment and for any damages or losses arising from any inaccuracies, errors, viruses, e.g., worms, trojan horses, etc., or other items of a destructive nature, which may be contained in this attachment and shall not be liable for direct, indirect, consequential or special damages in connection with this e-mail message or its attachment.