iOS devices time out when redirected to Shibboleth

[Nick Myers]

Hello,

Please reject this message or don't reply if this is not an appropriate
question to ask here.  I'm trying to help someone that is using Shibboleth
in front of on Azure AD Enterprise App, and when using IOS devices on one
Wifi network, Redirect requests the browser makes to their Shibboleth host
time out.

I use Okta to provide our SAML Service Provider capabilities, with a Cirrus
Proxy to provide Federated SAML via the likes of Edugain, InCommon, etc.
This is working well for 1500+ customers.

We have a customer who explains that:

   - On iPad and iOS devices,
   - When connected to a specific Wifi network (doesn't happen on mobile
   network, or other Wifi networks)
   - When the Redirect request occurs from to their host (
   https://shib.name-of-college.ac.uk)
   - The request always times out (Safari and Chrome)

This does not happen on other networks, or on non-iOS devices on the
specific Wifi network experiencing the issue.

The customer's own IT folk are not accepting my conclusion that there must
be something about the connectivity to the Shib host, network, or DNS
resolution, affecting those devices, and are telling me that "all of our
other SAML SSO logins with other vendors work fine, it's just your service".

I wondered whether anyone had experienced this particular issue, perhaps
this is not an uncommon issue for iOS devices.

I have asked them to use their iOS devices, and go to
https://shib.name-of-college.ac.uk directly, which also times out (it
should display a 403 Forbidden).  I think this proves that these devices
are being prevented from connecting, but the customer IT folk are insistent
this is not the case and assigning responsibility to our service.

Thank you for taking the time to read, and again, my apologies if this is
off-topic for the group.

Best
Nick
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20231012/50fe330b/attachment.htm>