Using Azure Application Gateway in front of IDPv4 - Stale Request error

[Jarno Huuskonen]

Hi,

On Tue, 2023-04-25 at 14:30 +0000, Timothy Enders via users wrote:
> Hi all:
> 
> We are trying to put our (Windows) Shibboleth IDP servers in Azure, behind
> an Azure Application Gateway v2.
> 
> We have the Application Gateway configured, and it properly passes traffic
> to the Shibboleth nodes, has session stickiness, etc. If you
> visithttps://idpurlgoeshere/idp/shibboleth you get the metadata page as
> expected.
> 
> However, when we try to test an auth flow (using samltest.id) Shibboleth
> immediately returns a Stale Request error, before it tries to process an
> auth flow or do anything else.
> 

Does auth flow from samltest.id work w/out azure appl. gateway ?
(Have you tested appl. gateway with only on IdP backend server (so no chance
of requests going to different seervers).

> My suspicion is that there's something that the App Gateway is doing when
> it passes the request from the user to Shibboleth that's causing
> Shibboleth to think the request is invalid and so it's throwing the Stale
> Request, but I don't know what.
> 
> Has anyone else here done this config before? Any thoughts?
> 

I'd try to log requests (at least cookies / headers) in IdP and compare
those to what you see with browsers developer tools(network tab).
(Or if it's possible to log these from appl. gateway).

Anything in IdP logs about stale request after this log line:
"2023-04-25 14:41:50,657 - DEBUG
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:190] - Profile
Action WebFlowMessageHandlerAdaptor: Invoking message handler on message
context containing a message of type
'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'"

-Jarno

-- 
Jarno Huuskonen