incoming requests rejected as “replay”

[IAM David Bantz]

After a restart, our primary IdP node was rejecting SAML requests as
“replays”, e.g.,
>
> 16:59:30:069  WARN [IP]
> org.opensaml.saml.common.binding.security.impl.MessageReplaySecurityHandler:158
> >  Message Handler:  Replay detected of message
> 'a8caafa5jfeeaec390b0fhfi80h01c' from issuer 'https://...
>

or “Unable to decode”, e.g.,

> ERROR [IP] org.opensaml.profile.action.impl.DecodeMessage:73 >  Profile
> Action DecodeMessage: Unable to decode incoming request
>
> org.opensaml.messaging.decoder.MessageDecodingException: No SAMLRequest or
> SAMLResponse query path parameter, invalid SAML 2 HTTP Redirect message at
> org.opensaml.saml.saml2.binding.decoding.impl.HTTPRedirectDeflateDecoder.doDecode(HTTPRedirectDeflateDecoder.java:114)
>

Any suggestions welcome.

David
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20231221/b5fa6af8/attachment.htm>