Variable client IP addresses and login

[Schwendner, Joanne]

I apologize ahead of time for another "stale request" question...

We have a user who is constantly getting "stale request" errors after
entering credentials on our login page.  Occasionally he does log in
successfully.  Since he does sometimes succeed, the problem must be local
to his workstation or environment.  After clearing cookies and cache and
switching browsers, I don't know what else to try.

This user's VPN software is constantly changing his client IP address.
>From what I've observed, when the user's login is successful (which is
seldom), the IdP log shows that the IP address was consistent throughout.

Our IdPs use an MFA flow that authenticates password and then routes to Duo
for 2-factor.  They are clustered behind a load balancer and are using
memcached.

Our load balancer appears to be working correctly and the stickiness sends
the requests to the same IdP/node.  But the client IPs keep switching.  My
question -- is a consistent IP address required, at least until a session
at the IdP is established?  Will changes of IP address during the login
flow cause this problem?  Would it cause the jsessionid to not be set, or
to be lost during login?

Joanne

---

Joanne Schwendner
Enterprise Application Services
Office of Information Technology
Brown University
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20231027/655aac8b/attachment.htm>