Webisoget not happy with our V4 IdP

[Jim Fox]

And thanks for the fix.

Jim

On Fri, 12 Feb 2021, Jim Fox wrote:

> Date: Thu, 11 Feb 2021 16:07:47
> From: Jim Fox <fox at uw.edu>
> To: Shib Users <users at shibboleth.net>
> Reply-To: Shib Users <users at shibboleth.net>
> Subject: Re: Webisoget not happy with our V4 IdP
> 
> Everyone ought to get a c refresher once in a while.
>
> Jim
>
>> On Feb 11, 2021, at 3:09 PM, Wessel, Keith <kwessel at illinois.edu> wrote:
>>
>> Figured it out.
>>
>> FYI, it had nothing to do with JSESSIONID being appended; that cookie was fine. You were correct, Scott, that the load balancer cookie wasn't being preserved, and we were bouncing between running nodes.
>>
>> I traced the issue down to incorrect cookie expiration time parsing in webisoget. Jim, I've submitted a PR to the Webisoget repo with the fix.
>>
>> Because the SP and IdP cookies were session cookies with no expiration attribute, they were working fine. But the Amazon ALB cookies are valid for a week, and when Webisoget parsed them wrong, it concluded that they had already expired. So, it didn't send them on the next connection to the IdP.
>>
>> Thanks, all, for the leads on this. And thanks, Jim, for giving me a chance to program in C for the first time in well over a decade. 😊
>>
>> Keith
>>
>>
>> -----Original Message-----
>> From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott
>> Sent: Thursday, February 11, 2021 7:20 AM
>> To: Shib Users <users at shibboleth.net>
>> Subject: Re: Webisoget not happy with our V4 IdP
>>
>> On 2/10/21, 10:29 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:
>>
>>>   Is the web.xml block responsible for not appending the JSESSIONID to the URL the <session-config> block?
>>
>> Yes.
>>
>> -- Scott
>>
>>
>> --
>> For Consortium Member technical support, see https://urldefense.com/v3/__https://wiki.shibboleth.net/confluence/x/coFAAg__;!!DZ3fjg!oQCHHdWgDtX3p6nIp6ZSPU-4HH5CRdtqnizkF7VTm7X3ID3G3G1StjaJbqE5Fyc6mQ$
>> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>> --
>> For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
>> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>
> -- 
> For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net