Error: "No flow execution could be found with key '....'"

[Mark van Rossum]

Hello,

We've just updated to Shibboleth v.4.0, and this has included moving from CAS to Azure AD (using the SAML delegation feature).

This mostly works, but about 8% of logins randomly receive a "Stale Request" page when they return from AAD, with the error in the logs of:


net.shibboleth.idp.authn.ExternalAuthenticationException: Error retrieving flow conversation
        at net.shibboleth.idp.authn.ExternalAuthentication.getProfileRequestContext(ExternalAuthentication.java:227)
Caused by: org.springframework.webflow.execution.repository.NoSuchFlowExecutionException: No flow execution could be found with key 'e4s1' -- perhaps this executing flow has ended or expired? This could happen if your users are relying on browser history (typically via the back button) that references ended flows.
        at org.springframework.webflow.execution.repository.support.AbstractFlowExecutionRepository.getConversation(AbstractFlowExecutionRepository.java:172)
Caused by: org.springframework.webflow.conversation.NoSuchConversationException: No conversation could be found with id '4' -- perhaps this conversation has ended?
        at org.springframework.webflow.conversation.impl.ConversationContainer.getConversation(ConversationContainer.java:126)
2021-10-13 10:52:30,772 - 137.222.250.147 - ERROR [n.s.i.a.ExternalAuthenticationException:74] -
net.shibboleth.idp.authn.ExternalAuthenticationException: Error retrieving flow conversation
        at net.shibboleth.idp.authn.ExternalAuthentication.getProfileRequestContext(ExternalAuthentication.java:227)
Caused by: org.springframework.webflow.execution.repository.NoSuchFlowExecutionException: No flow execution could be found with key 'e2s1' -- perhaps this executing flow has ended or expired? This could happen if your users are relying on browser history (typically via the back button) that references ended flows.
        at org.springframework.webflow.execution.repository.support.AbstractFlowExecutionRepository.getConversation(AbstractFlowExecutionRepository.java:172)
Caused by: org.springframework.webflow.conversation.NoSuchConversationException: No conversation could be found with id '2' -- perhaps this conversation has ended?
        at org.springframework.webflow.conversation.impl.ConversationContainer.getConversation(ConversationContainer.java:126)


I can replicate this myself if I attempt to login to a service enough times.

This isn't a load balancing/cluster issue.  We normally have 2 VMs in an active/failover config, I've removed the failover entirely from the pool, and to be 100% sure have shut shibboleth down on the failover VM so it definitely isn't serving traffic.

This problem didn't appear in testing, I'm not sure if it is related to load or something else on the server clearing sessions to hastily?  Or what else could be causing this?

Thanks,
Mark van Rossum

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20211013/996c546c/attachment.htm>