[EXTERNAL] Re: Logon is looping after apparent successful authentication.

[Cantor, Scott]

> Sorry, I did not get what you were...  no clustering... 

Sessions live in memory inside the shibd process, so deploy two servers, client switches servers, you're done. Basic stuff. When it happens predictably and repeatedly you get looping. It's not typical since client affinity even without stickiness is rarely that repeatably consistent alternating servers.

> I am only saying that as I
> look in the chrome dev tools network trace data, I am seeing 'cookies'
> represented on the 3 network trace 'entry names' I mentioned... That is all that
> is in the network trace due to the looping.

There are cookies everywhere, from everything, in every request. That doesn't matter. The only cookie that matters is the one issued by the SP for the session from the SAML response submission and whether it's returned afterward and whether it's honored if it is. It has shibsession in the name, as I said already.

> The login seems to be working fine.
> One possible complication here is that we are doing 2 factor authentication at

The IdP has nothing to do with a loop.

> Would I find the information I need to debug this in the shibd_warm.log or the
> shibd.log or the native(or native_warn).log?

native.log probably if it's a session invalidation issue because of IP address float or if there's proof it can't find the corresponding session from the cookie for some reason, but if the cookie's just not sent, then the log won't say much of anything since it doesn't believe the client has a session at all.

Most important information is in shibd.log but simple session cookie failures are too shallow to make a dent that far into the system.

> I apologize if I am missing something obvious, but, I am still getting my head
> around Shibboleth and SAML, so, there are (apparently) quite a few things that
> I don't know or completely understand yet.

Nobody but you or somebody else with access can easily diagnose a loop, so you are going to be stuck until you develop the understanding needed to debug it, or hit up somebody who does. That's just the fact of the matter. It's trivial for anybody with experience in SSO loop to diagnose them in virtually every case and everybody else tends to have no idea what to do.

-- Scott