Intermittent "None of the configured SessionInitiators handled the request"

[Wessel, Keith]

Hi, all,

Trying to help an application admin solve a problem that only seems to happen under load, and that they haven't been able to artificially reproduce in their test environment. Things start out fine, but after a while, the server starts throwing Shibboleth error pages in the browser, and the log records: None of the configured SessionInitiators handled the request. Restarting shibd fixes the problem for a while, then it breaks again.

This is an IIS server running SP 3.2.3. I've already encouraged the admin to upgrade his SP to the latest version.

The site that's throwing the error uses an application override:

<Path name="AVSL" authType="shibboleth" requireSession="true" applicationId="saml" entityID="alternate_idp"/>

The only purpose of the override is to change the handler URL since there are multiple paths on the same host in the request map. The particular path needs to use a different IdP than the default one and also an alternate Shibboleth handler URL.

<ApplicationOverride id="saml">
<Sessions lifetime="28800" timeout="3600" relayState="ss:mem" checkAddress="false" handlerSSL="true" cookieProps="https" handlerURL="/saml/Shibboleth.sso"/>
</ApplicationOverride>

I've already suggested to the admin, if he's going to use the override, that he just add the <SSO> block to it and override the IdP entity ID there rather than doing it in the request map to improve readability, but I can't see that being the cause of this problem.

Can anyone suggest other things we might look at to find the cause of this issue? I'd like to avoid having him turn up production logging to debug then wait for the problem to happen again, but if it comes to that, we will. Right now, he's turned off this method and moved the impacted site back to another authentication system to keep things running until we can figure out the problem.

Thanks,
Keith