Using Azure Application Gateway in front of IDPv4 - Stale Request error

[Timothy Enders]

Hi all:

We are trying to put our (Windows) Shibboleth IDP servers in Azure, behind an Azure Application Gateway v2.

We have the Application Gateway configured, and it properly passes traffic to the Shibboleth nodes, has session stickiness, etc. If you visit https://idpurlgoeshere/idp/shibboleth you get the metadata page as expected.

However, when we try to test an auth flow (using samltest.id) Shibboleth immediately returns a Stale Request error, before it tries to process an auth flow or do anything else.

My suspicion is that there's something that the App Gateway is doing when it passes the request from the user to Shibboleth that's causing Shibboleth to think the request is invalid and so it's throwing the Stale Request, but I don't know what.

Has anyone else here done this config before? Any thoughts?

Thank you!

Tim Enders
Associate Director, IT Infrastructure
Servers and Storage
[1518788691975_Loyola.jpg]
4501 N. Charles Street
Baltimore, MD  21210
tenders at loyola.edu<mailto:tenders at loyola.edu>
Office- 410-617-2542
www.loyola.edu
<http://www.twitter.com/LoyolaMaryland>

<http://www.twitter.com/LoyolaMaryland>


Loyola University Maryland Internal Use Only
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230425/5aa2fa8e/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Outlook-1518788691.jpg
Type: image/jpeg
Size: 8726 bytes
Desc: Outlook-1518788691.jpg
URL: <http://shibboleth.net/pipermail/users/attachments/20230425/5aa2fa8e/attachment.jpg>