"Rejecting replayed message ID" for iOS Native Application when using webview element

[Nate Klingenstein]

Mattzard,

For whatever reason, your application is apparently playing the SAML response twice.  Why, I couldn't guess, but I would check your code.  It may also have something to do with the asynchronous nature of Webview, but I know very little about Webview, and hopefully someone else on the list will know more.

Unless the AuthnRequest is signed, there really is no security-related information in the AuthnRequest and the unique message ID is mostly to catch users who like that back button and would trap themselves in a loop or other error condition otherwise.  It is possible to turn off the rule that checks for duplicates in production using configuration, but know that the GUI impact would be significant.  I'd only use this as a last resort if nobody else has a better idea.

https://wiki.shibboleth.net/confluence/display/SP3/MessageFlow+Rule

Take care,
Nate.

-----Original message-----
> From: mattzard
> Sent: Wednesday, June 12 2019, 9:41 am
> To: users at shibboleth.net
> Subject: "Rejecting replayed message ID" for iOS Native Application when using webview element
> 
> I have an issue with an iOS Native Application using a webview element. My 
> SAML URL has been placed into the webview element, but it is raising the 
> following errors: 
> 
>         2019-06-12 10:10:43 INFO Shibboleth.SessionCache [5] [default]: new
> session 
> created: ID (x) IdP (x) Protocol(urn:oasis:names:tc:SAML:2.0:protocol) 
> Address (x) 
>         2019-06-12 10:10:43 ERROR OpenSAML.SecurityPolicyRule.MessageFlow
> [6] 
> [default]: replay detected of message ID (x) 
>         2019-06-12 10:10:43 WARN Shibboleth.SSO.SAML2 [6] [default]: error 
> processing incoming assertion: Rejecting replayed message ID (x). 
> 
> If I use the same SAML URL within an external browser on the same device, 
> the errors are not raised and my authentication process completes without 
> issue. 
> 
> I found on the Shibboleth Wiki regarding this error: "/You should ask your
> SP to issue a fresh one/", if this could be my solution, how do I issue a
> "fresh one" if this error is experienced?
> 
> Is there a known issue in regards to the webview elements for iOS Native 
> Applications? Is there anything that I can do to get this working? The issue 
> appears to be 100% replicable.
> 
> 
> 
> --
> Sent from: http://shibboleth.1660669.n2.nabble.com/Shibboleth-Users-f1660767.html
> -- 
> For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>