Kubernetes and Shibboleth - Client IP Changing - Session Persistence not working

[Youssef GHORBAL]

Hey,

Maybe you need to turn idp.session.consistentAddress to false :
https://wiki.shibboleth.net/confluence/display/IDP30/AuthenticationConfiguration

Youssef
---------------------------
On 27 Mar 2019, at 00:54, Melvin Lasky <melvin.lasky at manhattan.edu<mailto:melvin.lasky at manhattan.edu>> wrote:

Hey everyone,
We are very close to launching our SHIBBOLETH authentication on Google Kubernetes Engine. We are having a slight problem. Our session persistence is not working as it should.

You can go to a few services, and then try again, and eventually the login page will come up and you’ll have to login again. This happens in < 1 minute generally of just bouncing around. I set my time-outs to 8 hours, and a 2hour idle…

That didn’t fix it. I noticed this in the logs:

shib-idp;idp-process.log;dev;nothing;2019-03-26 23:48:59,282 - WARN [net.shibboleth.idp.session.AbstractIdPSession:374] - Client address is 10.100.x.x but session fdfdf782f30382fa94db9927e745292eb15c039c816f312bebc484d5707181aa already bound to 10.12.1.1
shib-idp;idp-warn.log;dev;nothing;2019-03-26 23:48:59,282 - WARN [net.shibboleth.idp.session.AbstractIdPSession:374] - Client address is 10.100.x.x but session fdfdf782f30382fa94db9927e745292eb15c039c816f312bebc484d5707181aa already bound to 10.12.1.1
shib-idp;idp-process.log;dev;nothing;2019-03-26 23:48:59,291 - WARN [net.shibboleth.idp.session.AbstractIdPSession:374] - Client address is 10.100.x.x but session fdfdf782f30382fa94db9927e745292eb15c039c816f312bebc484d5707181aa already bound to 10.12.1.1
shib-idp;idp-warn.log;dev;nothing;2019-03-26 23:48:59,291 - WARN [net.shibboleth.idp.session.AbstractIdPSession:374] - Client address is 10.100.x.x but session fdfdf782f30382fa94db9927e745292eb15c039c816f312bebc484d5707181aa already bound to 10.12.1.1

Now as mentioned, we are using Google Kubernetes Engine. The 10.100.x.x is an internal google IP for the compute engine that’s running the cluster.

The 10.12.1.1 address must be coming from the pod, but the pod’s IP is 10.12.1.x (with x being a higher number than 1)

Anyhow, does anyone have any suggestions on how we can resolve this issue?

Thanks for all your help!

Melvin Lasky
Associate Director of Enterprise Architecture

<email_logo.jpg>



Riverdale, NY 10471
Phone: 718-862-7410
melvin.lasky at manhattan.edu<mailto:melvin.lasky at manhattan.edu>
www.manhattan.edu<http://www.manhattan.edu/>




--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190327/73a8a024/attachment.html>