Problems with OIDC authentication response must contain a state parameter when using oidc-rp-plugin for shibboleth.

[Tomas Liljebergh]

Hi.
We have the following setup:
Shibboleth IdP v5 (5.1.3) <--------> Gluu Server/OIDC-OP (Passport)
Everything works fine except for sometimes, when many students are logging in at the same time to the same SP. Then we get following in the idp-process.log:
2024-12-07 09:07:20,936 - 127.0.0.1 - ERROR [net.shibboleth.idp.authn.ExternalAuthenticationException:144] -
net.shibboleth.idp.authn.ExternalAuthenticationException: OIDC authentication response must contain a 'state' parameter
        at net.shibboleth.idp.plugin.authn.oidc.rp.impl.AuthorizationController.authorizationCallback(AuthorizationController.java:223)
Users also get the message about "Web Login Service - Stale Request" on the login page and never get a chance to log in.
We are using these plugins for OIDC.
Plugin: net.shibboleth.idp.plugin.authn.oidc.rp  Current Version: 2.1.2
Plugin: net.shibboleth.idp.plugin.oidc.config  Current Version: 2.1.0
The error goes away after a while or after restarting everything on both servers, we think but are not sure.
During the problem time no logging in is possible to any SP.
We cannot see any other errors in any other log, not on the IdP or on the OIDC-OP.
Does anyone have any hint on where to look for further error investigation.



Tomas Liljebergh

Tomas.liljebergh at oru.se

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20241210/de3865a4/attachment.htm>