Session is recovered but then immediately removed

[Eric Tully]

Hello All,

Our goal is to have users log into the SP on the main server  https://foo.example.com
and then be able to use that same SAML session when they visit other servers on the site like:
https://server01.foo.example.com
https://server02.foo.example.com

The user is able to authenticate at the IdP and connect to the SP on the main server just fine.  The problem is that when they go to either of the secondary servers  (server01 or 02),  the session seems to be recovered but then it's immediately removed as you can see in the  shibd.log  entries below.  I've turned on debug for every log and I don't see any reason given for the session's removal.


All three servers have the same SP entity ID  and  same encryption (pem) files.
The shibboleth2.xml file is exactly the same on all three machines.
The sealed.keys file is also exactly the same on all three.
All three machines are set to the same time and timezone, UTC.
I made sure that the cookies are created for   .foo.example.com  so that they'd be visible in the subdomains (tested and working).


My main question is,  how do I determine why it decided to remove the session?
I'm watching every log in /var/log/shibboleth/   and I've checked  journalctl -xe


shibd.log shows the recovery and then removal of the session:

2023-05-22 21:54:15 DEBUG Shibboleth.SessionCache [1] [default]: checking for revocation of session (_b68e0b16601fc9d4f893502e467c4696)
2023-05-22 21:54:15 DEBUG Shibboleth.SessionCache [1] [default]: attempting recovery of session (_b68e0b16601fc9d4f893502e467c4696)
2023-05-22 21:54:15 DEBUG Shibboleth.SessionCache [1] [default]: storing recovered session (_b68e0b16601fc9d4f893502e467c4696)...
2023-05-22 21:54:15 DEBUG XMLTooling.StorageService [1] [default]: inserted record (session) in context (_b68e0b16601fc9d4f893502e467c4696) with expiration (1684799655)
2023-05-22 21:54:15 DEBUG XMLTooling.StorageService [1] [default]: inserted record (UtxmRnAuGzcFGeBvnD3bSLLubHw=) in context (NameID) with expiration (1684821248)
2023-05-22 21:54:15 INFO Shibboleth.SessionCache [1] [default]: session recovered: ID (_b68e0b16601fc9d4f893502e467c4696) IdP (https://inf01.example.com:8443/cas/idp) Protocol(urn:oasis:names:tc:SAML:2.0:protocol)
2023-05-22 21:54:15 DEBUG XMLTooling.StorageService [1] [default]: updated expiration of valid records in context (_b68e0b16601fc9d4f893502e467c4696) to (1684799655)
2023-05-22 21:54:15 DEBUG Shibboleth.Listener [1] [default]: dispatching message (remove::StorageService::SessionCache)
2023-05-22 21:54:15 INFO Shibboleth.SessionCache [1] [default]: removed session (_b68e0b16601fc9d4f893502e467c4696)
2023-05-22 21:54:15 DEBUG XMLTooling.StorageService [1] [default]: inserted record (_b68e0b16601fc9d4f893502e467c4696) in context (Revoked) with expiration (1684821255)
2023-05-22 21:54:15 INFO Shibboleth-TRANSACTION.AuthnRequest [1] [default]: ||https://inf01.example.com:8443/cas/idp||||||urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect||||||


Relevant sections of my  shibboleth2.xml file:

<DataSealer type="Versioned" path="sealer.keys" />
<SessionCache   type="StorageService"   StorageService="mem"  cacheAssertions="false"
      cacheAllowance="3600"   inprocTimeout="900"  cleanupInterval="900"
      persistedAttributes="clientName firstName geoLocation serverIpAddress username (snipped list of ten more)" />
<ReplayCache StorageService="mem"/>
<ApplicationDefaults entityID=https://foo.example.com/entry
        REMOTE_USER="eppn subject-id pairwise-id persistent-id"
    cipherSuites="DEFAULT:!EXP:!LOW:!aNULL:!eNULL:!DES:!IDEA:!SEED:!RC4:!3DES:!kRSA:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1">
<Sessions lifetime="28800" timeout="3600" relayState="ss:mem"  consistentAddress="false" exportLocation=https://foo.example.com/Shibboleth.sso/GetAssertion checkAddress="false" handlerSSL="true" cookieProps="; domain=.foo.example.com; path=/ ; secure ; HttpOnly" redirectLimit="none" >


Apache is setup like this:
AuthType shibboleth
ShibRequireSession On
require valid-user
Require shib-session

but I also tried   Require shib-session    instead of   valid-user   but that didn't fix the problem.



Thank you for any help or pointers,

Eric Tully
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230523/fd29359e/attachment.htm>