Possible causes of NoSuchFlowExecutionException errors

[Paul Henson]

I am working with a client that has a service they are trying implement 
SAML authentication for that is accessible via both a regular web 
browser and a mobile app (which is effectively an embedded web browser).

They are having an issue where randomly the mobile app will display the 
typical "Stale Request" page after authentication with the usual error 
in the logs:

NoSuchFlowExecutionException: No flow execution could be found with key 
'e1s2'

My assumption was that the embedded web browser was doing something 
stupid occasionally and calling the wrong URL or not providing the right 
cookie. However, after setting up an intermediate proxy server to trace 
the connection (sadly, no samltracer support using the mobile app) it 
seems that is not the case. Comparing a successful transaction and a 
failed transaction, both of them seem to make all of the right calls and 
pass all of the right cookies.

The only difference is that in the success case after the authentication 
the client receives the shib_idp_session_ss and shib_idp_session cookies 
along with the assertion to be posted to the SP, and in the failure case 
they receive the stale request error along with a new JSESSIONID cookie 
different than the one that had been being used throughout the transaction.

It smells like a flaky idp cluster or a load balancer without the proper 
session affinity, but evidently this only happens with the mobile app 
embedded web browser, never with a normal web browser, and no other 
services utilizing the idp run into it.

Are there any other issues that might cause a stale request error such 
as this, other than the obvious cases of invalid cookies or broken idp 
side state? I'm not quite sure what to look at next…

Thanks much…


-- 
Signet - The Art of Access
https://www.signet.id/