Error on IdP v4 after cutover

[Bobby Lawrence]

Check to see if you are running into a SameSite cookie issue.

https://wiki.shibboleth.net/confluence/display/IDP4/SameSite

From: users <users-bounces at shibboleth.net> On Behalf Of Hucker, Taylor
Sent: Monday, March 01, 2021 2:58 PM
To: Shib Users <users at shibboleth.net>
Subject: [EXTERNAL] Re: Error on IdP v4 after cutover

I can replicate the issue by starting a clean browser everytime.
If I modify my host file to go to specific back-end nodes I see no issue.

When the error occurs this is my last line in idp-process.log
2021-03-01 12:57:49,927 - 65.36.72.77 - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:369] - Profile Action SelectAuthenticationFlow: Selecting inactive authentication flow authn/External
When I get past the error I see the same line then the following.
2021-03-01 13:47:25,577 - 10.254.0.2 - INFO [net.unicon.idp.externalauth.AuthenticatedNameTranslator:61] - Created an IdP subject instance with principals containing attributes for thucker
2021-03-01 13:47:25,634 - 10.254.0.2 - INFO [net.shibboleth.idp.authn.impl.ValidateExternalAuthentication:176] - Profile Action ValidateExternalAuthentication: External authentication succeeded for Subject

Could it be an issue with the plugin?

Thanks,
Taylor

--------------------------------
Taylor Hucker
Applications System Administrator
Texas A&M University - Corpus Christi
Taylor.Hucker at tamucc.edu<mailto:Taylor.Hucker at tamucc.edu>


From: users <users-bounces at shibboleth.net<mailto:users-bounces at shibboleth.net>> on behalf of Hucker, Taylor <taylor.hucker at tamucc.edu<mailto:taylor.hucker at tamucc.edu>>
Date: Monday, March 1, 2021 at 12:24 PM
To: Shib Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Subject: Error on IdP v4 after cutover
2/25 we moved our IdP v4 environment into production.

It was noticed today when going to an SP this error page appears, "Sorry, it looks like there is a problem finding your session. This can happen if you waited too long on the login page, or if you were redirected to a different server that issued the original request. This error usually goes away if you try accessing your desired application again."

It appears that if we access any resource (same or different) then the authentication occurs.

I am seeing this in the logs
2021-03-01 12:05:56,299 - 151.80.19.216 - ERROR [org.springframework.webflow.execution.repository.NoSuchFlowExecutionException:74] -
org.springframework.webflow.execution.repository.NoSuchFlowExecutionException: No flow execution could be found with key 'e1s1' -- perhaps this executing flow has ended or expired? This could happen if your users are relying on browser history (typically via the back button) that references ended flows.
        at org.springframework.webflow.execution.repository.support.AbstractFlowExecutionRepository.getConversation(AbstractFlowExecutionRepository.java:172)
Caused by: org.springframework.webflow.conversation.NoSuchConversationException: No conversation could be found with id '1' -- perhaps this conversation has ended?
        at org.springframework.webflow.conversation.impl.ConversationContainer.getConversation(ConversationContainer.java:126)

The issue is repeatable in every clean browser sessions on the first auth attempt.

Our environemnt contains 2 nodes sitting behind F5. Currently have one node offline. We also use Unicons https://github.com/Unicon/shib-cas-authn<https://urldefense.proofpoint.com/v2/url?u=https-3A__nam12.safelinks.protection.outlook.com_-3Furl-3Dhttps-253A-252F-252Fgithub.com-252FUnicon-252Fshib-2Dcas-2Dauthn-26data-3D04-257C01-257Ctaylor.hucker-2540tamucc.edu-257Caf89ac934b694f32b2c808d8dcdf4abc-257C34cbfaf167a64781a9ca514eb2550b66-257C0-257C0-257C637502198883850863-257CUnknown-257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0-253D-257C1000-26sdata-3D6zIilOmXo67hCooULSjQst152Q-252BZ3ti6LpBi4KFYPi8-253D-26reserved-3D0&d=DwMF-g&c=CJqEzB1piLOyyvZjb8YUQw&r=YbL7Tj_EqBW9abl6xEy1bg&m=KvbPlqUF7lq0uhLqKgGbUV-xwgKarLVJKzPL0l-NixA&s=1iGuL4BCxjH2rRHWZOg950yESfb_vkDThwUywBVNT9w&e=> plugin to delegate auth to CAS.

Any suggestions?

Thanks,
Taylor

--------------------------------
Taylor Hucker
Applications System Administrator
Texas A&M University - Corpus Christi
Taylor.Hucker at tamucc.edu<mailto:Taylor.Hucker at tamucc.edu>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210301/1a35b356/attachment.htm>