Variable client IP addresses and login

[Dave Perry]

Apologies for the bluntness, but sounds like a rubbish vpn that needs reconfiguration

Sent from Outlook for iOS<https://aka.ms/o0ukef>
________________________________
From: users <users-bounces at shibboleth.net> on behalf of Schwendner, Joanne via users <users at shibboleth.net>
Sent: Friday, October 27, 2023 9:08:52 PM
To: users at shibboleth.net <users at shibboleth.net>
Cc: Schwendner, Joanne <joanne_schwendner at brown.edu>
Subject: Variable client IP addresses and login

Caution: Please take care when clicking on links or opening attachments in emails that originate from outside of the university. When in doubt, contact the ITS service desk.

I apologize ahead of time for another "stale request" question...

We have a user who is constantly getting "stale request" errors after entering credentials on our login page.  Occasionally he does log in successfully.  Since he does sometimes succeed, the problem must be local to his workstation or environment.  After clearing cookies and cache and switching browsers, I don't know what else to try.

This user's VPN software is constantly changing his client IP address.  From what I've observed, when the user's login is successful (which is seldom), the IdP log shows that the IP address was consistent throughout.

Our IdPs use an MFA flow that authenticates password and then routes to Duo for 2-factor.  They are clustered behind a load balancer and are using memcached.

Our load balancer appears to be working correctly and the stickiness sends the requests to the same IdP/node.  But the client IPs keep switching.  My question -- is a consistent IP address required, at least until a session at the IdP is established?  Will changes of IP address during the login flow cause this problem?  Would it cause the jsessionid to not be set, or to be lost during login?

Joanne

---

Joanne Schwendner
Enterprise Application Services
Office of Information Technology
Brown University


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20231028/1789815a/attachment.htm>