Webisoget not happy with our V4 IdP

[Wessel, Keith]

Figured it out.

FYI, it had nothing to do with JSESSIONID being appended; that cookie was fine. You were correct, Scott, that the load balancer cookie wasn't being preserved, and we were bouncing between running nodes.

I traced the issue down to incorrect cookie expiration time parsing in webisoget. Jim, I've submitted a PR to the Webisoget repo with the fix.

Because the SP and IdP cookies were session cookies with no expiration attribute, they were working fine. But the Amazon ALB cookies are valid for a week, and when Webisoget parsed them wrong, it concluded that they had already expired. So, it didn't send them on the next connection to the IdP.

Thanks, all, for the leads on this. And thanks, Jim, for giving me a chance to program in C for the first time in well over a decade. 😊

Keith


-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott
Sent: Thursday, February 11, 2021 7:20 AM
To: Shib Users <users at shibboleth.net>
Subject: Re: Webisoget not happy with our V4 IdP

On 2/10/21, 10:29 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:

>    Is the web.xml block responsible for not appending the JSESSIONID to the URL the <session-config> block?

Yes.

-- Scott


-- 
For Consortium Member technical support, see https://urldefense.com/v3/__https://wiki.shibboleth.net/confluence/x/coFAAg__;!!DZ3fjg!oQCHHdWgDtX3p6nIp6ZSPU-4HH5CRdtqnizkF7VTm7X3ID3G3G1StjaJbqE5Fyc6mQ$ 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net