Shibboleth SP: Data loss when a POST triggers a redirect to re-authenticate

[Scott Koranda]

> Good morning:
> 
> We're experiencing a pain point with the SP and I wanted to see if there is
> some advice on how to mitigate it.  We're using the Shibboleth SP with
> Apache as a transparent authenticating proxy in front of our app, and our
> app which allows data entry via HTTP POST requests.  We're seeing issues
> where the user submits data via a HTTP post, but their session with the SP
> has expired so the SP redirects to the IdP to re-authenticate.  When the
> reauthentication happens the POST data is lost.  We do have our session
> timeout values turned up but that is only reducing the probability of this
> error, not fully preventing against it.
> 
> My understanding is that this is a protocol level problem, and that it
> isn't possible to maintain the POST data through the redirect.  Is that
> correct?  Are there any quick wins to defend against this we can
> implement?

Please see the options 'postData' and 'postTemplate' at

https://wiki.shibboleth.net/confluence/display/SP3/Sessions

You may also want to investigate 'postExpire' and 'postLimit'.

Please note that using 'postData' is limited to Content-Type
application/x-www-form-urlencoded.

Scott K