Intermittent "None of the configured SessionInitiators handled the request"

[Wessel, Keith]

That was it, Scott. There was a validUntil attribute on the Banner IdP metadata of 1 hour for prod, but the Banner IdPs for dev  and QA were valid for two hours. The reload interval for the Banner IdP metadata was every two hours. So, it reloaded just in time on dev and QA but an hour after expiring on prod.

One question: you said we don’t' need an application override for this. I know we don't need it to override the IdP entity ID, but if we have multiple paths on the same host using different IdPs, they need different handler URLs on the SP. How does one configure that without overriding the <Sessions> element?

If we try to let them share the default handler URLs, then we're allowing users into application B who have a valid session, even if that session was generated by another IdP that's used for application A. I know that this would be cleaner if they could use hostnames instead of paths for the different applications, but that's not an option in this case.

Keith

-----Original Message-----
From: Cantor, Scott <cantor.2 at osu.edu> 
Sent: Friday, January 27, 2023 2:17 PM
To: Shib Users <users at shibboleth.net>
Cc: Wessel, Keith <kwessel at illinois.edu>
Subject: Re: Intermittent "None of the configured SessionInitiators handled the request"

You'd need logs, and they should already be there, they just aren't looking at them.

As for the cause, it's probably metadata expiring or something odd like that, perhaps restarting it is refreshing the metadata somehow.

You also don't need overrides to do this, the IdP can be overridden by path directly. But that's not the underlying issue, it can't handle the request because it can't issue a request to the IdP and that's not going to go away without knowing why.

-- Scott