[EXTERNAL] Re: Logon is looping after apparent successful authentication.

Sun Jun 3 19:47:43 EDT 2018

Hi Scott, Thank you very much for the weekend response...

RE: my comments;  I was noting that the IP Addr of the IdP (devsaml....) was different for each of those sessions.  I have no idea why the SP (?) is having a problem and attempting to open those sessions.  I do not see anything of interest in the shibd/shibd_warn logs and nothing is being posted to the native SP logs in /var/log/shibboleth-www...

I have seen your comment below (in several forms)....
It remains the case that your cookies are at fault. That is always the
cause of a loop. Session issued, cookie set, cookie not returned, loop.

But, I have no idea how to detect or diagnose my cookie issue if that is what it is...

I have full debug enabled, so, I have a ton of data being produced, but, nothing jumps out as the 'problem' other than it goes into the looping behavior once the authentication is successful....

In the transaction log (see below), I see the posted msgs start to roll after the 2nd authentication (again, we are prompted by the IdP for 1. RSA, and then 2. LDAP)...

In the below, see the session ID changing, I see the IP Addr for the IdP changing....  But I don't know what is causing that or if it is anything more than just an indicator that there's a problem...

One thing of interest I see in the transaction log is that it is 'caching the following attributes with session (ID:...) for( applicationId: default)'...  but, it does not list any attributes...

I'm sorry, but, this is our *first* shibboleth/SAML implementation, so, we have no experience nor other systems to compare this with.  I can only say that I got a session going with testshib.org I think.  It did not get his far because it could not resolve the final URL back into our network, so, I do not know if it would have looped or not.

Again, any guidance would be greatly appreciated...

Transaction Log excerpt:
2018-06-03 19:15:05 INFO Shibboleth-TRANSACTION [2]: New session (ID: _7613e484b3a0f2561b7c5a3799d88c0f) with (applicationId: default) for principal from (IdP: https://devsaml.homedepot.com) at (ClientAddress: 130.211.3.141) with (NameIdentifier: dxo5ic1) using (Protocol: urn:oasis:names:tc:SAML:2.0:protocol) from (AssertionID: dRuZt6OKjpXBTsMCTG5mvwNtgLR)
2018-06-03 19:15:05 INFO Shibboleth-TRANSACTION [2]: Cached the following attributes with session (ID: _7613e484b3a0f2561b7c5a3799d88c0f) for (applicationId: default) {
2018-06-03 19:15:05 INFO Shibboleth-TRANSACTION [2]: }
2018-06-03 19:15:06 INFO Shibboleth-TRANSACTION [4]: New session (ID: _39b36dd19f021e007d2340ef001bce7c) with (applicationId: default) for principal from (IdP: https://devsaml.homedepot.com) at (ClientAddress: 130.211.1.52) with (NameIdentifier: dxo5ic1) using (Protocol: urn:oasis:names:tc:SAML:2.0:protocol) from (AssertionID: RUPoIRJ0xAOCO__WF0NU3g0yQ9.)
2018-06-03 19:15:06 INFO Shibboleth-TRANSACTION [4]: Cached the following attributes with session (ID: _39b36dd19f021e007d2340ef001bce7c) for (applicationId: default) {
2018-06-03 19:15:06 INFO Shibboleth-TRANSACTION [4]: }
2018-06-03 19:15:07 INFO Shibboleth-TRANSACTION [2]: New session (ID: _6930a2a65f4a30128a915443e160aaa5) with (applicationId: default) for principal from (IdP: https://devsaml.homedepot.com) at (ClientAddress: 130.211.1.97) with (NameIdentifier: dxo5ic1) using (Protocol: urn:oasis:names:tc:SAML:2.0:protocol) from (AssertionID: sB4_V-2cXgHcCd.KXZrlve3T_vK)
2018-06-03 19:15:07 INFO Shibboleth-TRANSACTION [2]: Cached the following attributes with session (ID: _6930a2a65f4a30128a915443e160aaa5) for (applicationId: default) {
2018-06-03 19:15:07 INFO Shibboleth-TRANSACTION [2]: }
2018-06-03 19:15:08 INFO Shibboleth-TRANSACTION [4]: New session (ID: _a1740b275ae1bba6ed079f1cc4103038) with (applicationId: default) for principal from (IdP: https://devsaml.homedepot.com) at (ClientAddress: 130.211.1.64) with (NameIdentifier: dxo5ic1) using (Protocol: urn:oasis:names:tc:SAML:2.0:protocol) from (AssertionID: VA1.Q_O5BUjnV8WYEpVGfThk9qv)
2018-06-03 19:15:08 INFO Shibboleth-TRANSACTION [4]: Cached the following attributes with session (ID: _a1740b275ae1bba6ed079f1cc4103038) for (applicationId: default) {
2018-06-03 19:15:08 INFO Shibboleth-TRANSACTION [4]: }

-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott
Sent: Sunday, June 3, 2018 1:26 PM
To: Shib Users <users at shibboleth.net>
Subject: RE: [EXTERNAL] Re: Logon is looping after apparent successful authentication.

> Interesting, I believe they are load balancing multiple IdP servers
> behind a LB, are you saying the IdP changed an IP address?

If you re-read my previous response you'll see that I stipulated it is impossible for the IdP to have anything to do with a loop.

  Note the IP addresses and
> timestamps below...  Those within the same minute are, of course, the
> same login attempt....

And why are they different? That's almost certainly your issue.

-- Scott

--
For Consortium Member technical support, see https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_x_coFAAg&d=DwICAg&c=MtgQEAMQGqekjTjiAhkudQ&r=mn6DeBt1nj8Oqx06pdIK0_n5EfK6FeVHgdjBNpchyro&m=mQuhUeUbX03ES2CuY4A2fWtzzRbHOvm0Ldx5VN35L0w&s=_3NDOSR5bew7RiXgIf_DPy-Jtr_boBGH4k07zpnw4mc&e=
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

________________________________

The information in this Internet Email is confidential and may be legally privileged. It is intended solely for the addressee. Access to this Email by anyone else is unauthorized. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. When addressed to our clients any opinions or advice contained in this Email are subject to the terms and conditions expressed in any applicable governing The Home Depot terms of business or client engagement letter. The Home Depot disclaims all responsibility and liability for the accuracy and content of this attachment and for any damages or losses arising from any inaccuracies, errors, viruses, e.g., worms, trojan horses, etc., or other items of a destructive nature, which may be contained in this attachment and shall not be liable for direct, indirect, consequential or special damages in connection with this e-mail message or its attachment.