Flow Execution Errors when using SAML authentication and AJP

[Nate Klingenstein]

All,

I'm using the SAML authentication flow.  I've needed to place Tomcat behind Apache and I'm using mod_proxy_ajp and ajp to forward requests on to Tomcat.  The initial redirect to the upstream IdP works fine, the inbound assertion is processed fine, but then when it goes to build the outbound assertion, I'm encountering flow execution errors.  This displays as a stale request in the browser.  The same configuration had no flow execution errors prior to placing Apache in front of Tomcat.

2020-10-13 17:49:19,543 - 172.31.15.48 - INFO [Shibboleth-Audit.SSO:282] - 172.31.15.48||2020-10-13T17:49:19.543233Z||https://samltest.id/saml/idp||||||||false||POST||||||Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36
2020-10-13 17:49:19,697 - 172.31.15.48 - DEBUG [net.shibboleth.idp.saml.profile.impl.SpringAwareMessageEncoderFactory:78] - Looking up message encoder based on binding URI: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST
2020-10-13 17:49:29,147 - 172.31.15.48 - ERROR [net.shibboleth.idp.authn.ExternalAuthenticationException:74] -
net.shibboleth.idp.authn.ExternalAuthenticationException: Error retrieving flow conversation
        at net.shibboleth.idp.authn.ExternalAuthentication.getProfileRequestContext(ExternalAuthentication.java:227)
Caused by: org.springframework.webflow.execution.repository.NoSuchFlowExecutionException: No flow execution could be found with key 'e2s1' -- perhaps this executing flow has ended or expired? This could happen if your users are relying on browser history (typically via the back button) that references ended flows.
        at org.springframework.webflow.execution.repository.support.AbstractFlowExecutionRepository.getConversation(AbstractFlowExecutionRepository.java:172)
Caused by: org.springframework.webflow.conversation.NoSuchConversationException: No conversation could be found with id '2' -- perhaps this conversation has ended?
        at org.springframework.webflow.conversation.impl.ConversationContainer.getConversation(ConversationContainer.java:126)

Any guesses as to what I'm doing wrong here?  Something in my proxy configuration?  It's fairly vanilla with no rewriting.

ServerName incommonsamlproxy.redacted.com:443
UseCanonicalName On
ProxyPass /idp/ ajp://localhost:8009/idp/

Thanks in advance,
Nate.

--------
Signet, Inc.
The Art of Access ®

https://www.signet.id