Strange behavior: lots of logins by one user

[Jim Fox]

> We are reducing the suspects to Google Suite (which is the SP that's causing the logins), an specific browser or a combination of both. About your
> "Force Authentication" suggestion, we are running 3,1 and this is a production environment and will affect a lot of users, so I don't think it's
> possible.  We're now trying to identify the browser of the users with huge number of logins, but as you said it's clear the problem it's on the
> SP.

We have had this issue for many years and never did figure out what the 
cause is.  I suspect phone apps, for no really good reason.

We mitigate the problem by temporarily denying access to clients that hit 
the IdP at too rapid a rate.  First we used mod_evasive, now we use 
scripts on our F5 traffic manager.  Essentually any client that makes, 
say, 20 requests in 10 seconds gets blocked for a minute. (Not the exact 
numbers.)  Sometimes this stops the offender.  Sometime they come back in 
a minute.

Jim