IIS Module Intermittently Failing to Query Daemon over a TCPListener for Session Information

[Nate Klingenstein]

To close the loop on this one(yuk yuk), Scott's right.

We finally contacted users in the midst of loops and actually got browser traces from them, because getting them from IIS would have been painful in this environment.

The module is attempting to set the cookie before redirecting the user.  After hitting:

url	"https://shib.redacted/Shibboleth.sso/SAML2/POST"

with a valid SAML response:

	"<samlp:Response ID=\"_4f…ertion></samlp:Response>"

That gets processed successfully and a shibsession Set-Cookie is sent back:

name	"Set-Cookie"
value	"_shibsession_64656661756…x.com; path=/; HttpOnly"

But the cookie never appears to be sent in the request back to the module until the successful login and termination of the loop.

Shibboleth gets flooded with novel sessions during this time.

Now, on to figure out why the cookie is not being returned, and thank you to Scott for suggesting this.  I'm baffled but en route to enlightenment.

--------
Signet, Inc.
The Art of Access ®

https://www.signet.id

-----Original message-----
From: Cantor, Scott
Sent: Wednesday, July 7 2021, 8:16 pm
To: Shib Users
Subject: Re: IIS Module Intermittently Failing to Query Daemon over a TCPListener for Session Information

There's almost certainly no session cookie provided. No cookie + the passive rule means nothing much happens. The session cache will try and find the cookie to locate a key to use to search for a session and if there's no cookie, there's no key and nothing more happens, it just returns no session and goes on with life. It's not "failing" to query the daemon, it just has no reason to since there's nothing to query against.

That's the normal reason for all loops. The only difference is the loop is self-inflicted and not the SP doing it itself.

-- Scott

-- 
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg <https://wiki.shibboleth.net/confluence/x/coFAAg>
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net <mailto:users-unsubscribe at shibboleth.net>