Clustering issue on v5

[Diego Figueroa]

Hi all,

After upgrading my clustered test instance to v5 I noticed a strange issue where either instance will work if the other one is stopped but I will get stale request errors if both are running.

I have set my IdP log levels to trace but I don't see any real indication as to what the issue is. When I have only one instance up, and everything works, the logs show:


DEBUG [net.shibboleth.idp.saml.profile.impl.ExtractSubjectFromRequest:137] - Profile Action ExtractSubjectFromRequest: No Subject NameID/NameIdentifier in message needs inbound processing
DEBUG [org.opensaml.saml.common.profile.impl.VerifyChannelBindings:149] - Profile Action VerifyChannelBindings: No channel bindings found to verify, nothing to do
DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.saml2.binding.impl.ExtractProxiedRequestersHandler' on INBOUND message context
DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:197] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
DEBUG [net.shibboleth.idp.saml.profile.impl.InitializeAuthenticationContext:226] - Profile Action InitializeAuthenticationContext: Created authentication context: AuthenticationContext{initiationInstant=2024-07-15T14:05:37.793495339Z, isPassive=false, forceAuthn=false, requiredName=null, hintedName=null, maxAge=null, potentialFlows=[], activeResults=[], attemptedFlow=null, signaledFlowId=null, authenticationStateMap={}, resultCacheable=true, authenticationResult=null, completionInstant=null}
DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.ProcessRequestedAuthnContext:162] - Profile Action ProcessRequestedAuthnContext: AuthnRequest did not contain a RequestedAuthnContext, nothing to do
DEBUG [net.shibboleth.idp.authn.impl.PopulateAuthenticationContext:203] - Profile Action PopulateAuthenticationContext: Installed 1 potential authentication flows into AuthenticationContext
DEBUG [net.shibboleth.idp.authn.impl.InitializeRequestedPrincipalContext:146] - Profile Action InitializeRequestedPrincipalContext: Profile configuration did not supply any default authentication methods
DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByForcedAuthn:54] - Profile Action FilterFlowsByForcedAuthn: Request does not have forced authentication requirement, nothing to do
DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByNonBrowserSupport:54] - Profile Action FilterFlowsByNonBrowserSupport: Request does not have non-browser requirement, nothing to do
DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:270] - Profile Action SelectAuthenticationFlow: No specific Principals requested
DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:309] - Profile Action SelectAuthenticationFlow: No usable active results available, selecting an inactive flow
DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:368] - Profile Action SelectAuthenticationFlow: Selecting inactive authentication flow authn/RemoteUser


But when I have both instances up, the logs stop at:


DEBUG [net.shibboleth.idp.saml.profile.impl.ExtractSubjectFromRequest:137] - Profile Action ExtractSubjectFromRequest: No Subject NameID/NameIdentifier in message needs inbound processing
DEBUG [org.opensaml.saml.common.profile.impl.VerifyChannelBindings:149] - Profile Action VerifyChannelBindings: No channel bindings found to verify, nothing to do
DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.saml2.binding.impl.ExtractProxiedRequestersHandler' on INBOUND message context
DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:197] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'


For more context I have these two instances running IdP 5.1.1 under Tomcat 10 behind Apache/mod_jk with sticky sessions and memcached as the storage service.

Any idea what could be causing this problem?



Diego Figueroa
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240715/12d463c7/attachment.htm>