IDP 5 - NoSuchConversationException when clicking URL link from email and _saml_idp cookie set.

[Dan McLaughlin]

In the past, we've seen the error discussed below when users would
bookmark the login page for the IDP, but that's not the case here.

We are using IDP 5.0 with the session cookies now prefixed with
__Host-.  This includes the JSESSIONID and the -shib_idp_session.

The problem only occurs if the user has successfully authenticated and
the _saml_idp cookie is set.  If the _saml_idp cookie is not set, then
both a link in an email and a direct request from the browser work as
expected.

Here is the situation that causes the problem.  Once the user has a
_saml_idp cookie, then any attempts to access an SP-protected
application (ex. https://www.foo.com/secure/myapp) via a link in an
email (or even from a local html with a href link) will result in the
SP redirecting the request directly to the IDP (bypassing the
discovery service) and the IDP logs the error below, but if you take
the same URL https://www.foo.com/secure/myapp and paste it directly in
the browser, you will get to the IDP login page as expected.

2023-11-20 19:08:27,964 - DEBUG
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:197] -
Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler
on message context containing a message of type
'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2023-11-20 19:08:28,043 - 10.180.49.65 - ERROR
[org.springframework.webflow.execution.repository.NoSuchFlowExecutionException:88]
-
org.springframework.webflow.execution.repository.NoSuchFlowExecutionException:
No flow execution could be found with key 'e1s1' -- perhaps this
executing flow has ended or expired? This could happen if your users
are relying on browser history (typically via the back button) that
references ended flows.
at org.springframework.webflow.execution.repository.support.AbstractFlowExecutionRepository.getConversation(AbstractFlowExecutionRepository.java:172)
Caused by: or g.springframework.webflow.conversation.NoSuchConversationException:
No conversation could be found with id '1' -- perhaps this
conversation has ended?

I attempted to connect with a debugger and step through the IDP code;
unfortunately, I'm familiar enough with the code to know where to set
a breakpoint to track down the issue.

In summary, once the _saml_idp cookie has been set, then pasting the
URL directly in the browser or launching a URL from the command line
will work, but a link to the same URL from either an email or from
local static html with an href to the same URL will fail with the
error shown above.

Any thoughts?   I suspect this is related to CORS, or CSRF, except I
don't see any CORS or CSRF errors or warnings in the browser or any of
the Tomcat or IDP logs, and normally, if it's CORS related, you'll see
a message in the browser console.

Thanks,

Dan