Error message: Client address x.x.x.x invalid for session ... bound to y.y.y.y

[Mark van Rossum]

Hello,

I'm trying to run Shibboleth 4 behind a pair of load balancers, and am investigating an issue when users sometimes receive a "Stale Sessions" error when attempting to login.

The logs contain the following WARN messages:
WARN [n.s.i.s.i.StorageBackedIdPSession:115] - Client address x.x.x.x invalid for session 03e...102d bound to y.y.y.y

x.x.x.x and y.y.y.y are the IP addresses of the load balancers.

Firstly, is this the likely cause of the "Stale Session" error?  The message is "WARN" level so I'm not clear if this is just a warning, or causing an actual error for the user and I'm looking in the wrong place entirely?

Is there any way to disable this IP check on the sessions?  Even without the load balancers, with users moving between WiFi networks etc their IP address could change easily so I'd prefer to disable this check.

If this can't be disabled (I can't see a setting for it in the source code StorageBackedIdPSession.java or parents but might have missed something), what other options are there?

I've read the Clustering (https://wiki.shibboleth.net/confluence/display/IDP4/Clustering) page, but it doesn't mention anything about this.  Our backend IdP servers run active/passive so I'm not trying to share state between the IdP instances.

Thankyou!
Mark van Rossum

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210316/23ca69b7/attachment.htm>