Session and (WAYF or "IDP-Proxy")

[Ottenhus, Thomas]

Hi everyone,

we're using all our shib servers as "federation gateways", meaning the servers do not authenticate by themselves, but will use another SAML-IDP to authenticate the users.
On of them is "inbound" and thus registered as a SP to the federation with WAYF setup to let the user choose his home realm.
This works well if I configure load balancing for that user to be sticky.
As soon as I configure load balancing to the machines as something else and the server starts to hop around, I'll always get the message, that the request is expired and that I likely used the back button of my browser.
I explicitly configured ClientSessionStore in idp.properties

My observations so far:

  *   The UserAgent is sent to the IDP via POST
  *   The IDP issues a JSESSION Cookie (that's probably a token for some server stored session as it's only some 70 bytes big) and instantaneously redirects the UA to the WAYF (30x)
  *   Coming back from the WAYF, I'll get the "request too old" message - which is somewhat expected at this point.

Now - did I misconfigure something, misunderstand something or has the IDP a "code path", that's not stateless here?

Thanks in advance for any advice on the matter.

Thomas Ottenhus (geb. Glatzer)
Zentrum für Datenverarbeitung (ZDV)
Leiter Softwareentwicklung

Johannes Gutenberg-Universität Mainz
Anselm-Franz-von-Bentzel-Weg 12, 55128 Mainz

Tel: +49 6131 39 26487
ottenhus at uni-mainz.de<mailto:ottenhus at uni-mainz.de>
zdvdev at uni-mainz.de<mailto:zdvdev at uni-mainz.de>
https://www.zdv.uni-mainz.de<https://www.zdv.uni-mainz.de/>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240318/aabb4b4a/attachment.htm>