Strange behavior: lots of logins by one user

[Manolo Garcia Alvarez]

Hi,

we are using Shibboleth as an IdP with a lot of SP's for a community of
about 50.000 active users, without problems so far. Nevertheless, our
idp-audit shows a strange behavior of some users: a few number of users are
registering successful logins in a short period of time (1 hour typically):

This is one of them:

[image: image.png]

The bump on the graph shows just one user (login amartingil) who has more
than 1800 logins in one hour according to the idp-login.log, so it's clear
that's not possible for one real user. In this example, the SP is Google
and all the logins are registered in one of three the servers that are
running Shibboleth. That's just one case, but we find this everyday with
another set of users and another period of time. I can attach the relevant
parts of the logs if it's useful.

I have done some research in the list and internet but I can't find anybody
with the same problem. Is there someone with the same problem or
information about this issue?

Thanks a lot !

------------------------------
Manolo García
Arquitectura i Sistemes
Universitat Oberta de Catalunya

93 326 (3451) | 689 88 30 93 | mgarciaal at uoc.edu
Parc Mediterrani de la Tecnologia (edifici B3)
Av. Carl Friedrich Gauss, 5.
08860 Castelldefels
[image: Universitat Oberta de Catalunya]
Aquest missatge s'adreça exclusivament a qui va destinat i pot contenir
informació privilegiada o confidencial i dades de caràcter personal, la
difusió de les quals és regulada per la Llei orgànica de protecció de dades
i la Llei de serveis de la societat de la informació. Si no sou la persona
destinatària indicada (o la responsable de lliurar-lo a qui va destinat),
no heu de copiar aquest missatge ni lliurar-lo a tercers per cap concepte.
Si heu rebut aquest missatge per error o l'heu aconseguit per altres
mitjans, us demanem que ens ho comuniqueu immediatament per aquesta mateixa
via i l'elimineu irreversiblement.

Abans d'imprimir aquest missatge electrònic penseu en el medi ambient.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190130/2e8697fa/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image.png
Type: image/png
Size: 6895 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20190130/2e8697fa/attachment.png>