Multiple removals of Shibd session

[Wang, John]

We are using Shibboleth to authenticate Java Web application users in our environment. React is used to program the front end and SpringBoot-based Java applications service requests.
An Apache Web server plus Shibboleth Service Provide version 3.4.1. are in front of Java applications.  The data path is as follows:

User -> Amazon Application Load Balancer (ALB) ->Apache Web server +Shibboleth Service Provider -> SpringBoot-Based Java applcations.

The timeout of session in Shibboleth service provider is 1800 seconds, The IDP timeout is 8 hours.  Sticky session is set on ALB and timeout is set to 3600 seconds.

The problem is that users reported their session of Shibd timeout within minutes and the issue repeated when it happened. In transaction.log of Shibd I found the same session was removed 5 times.

2024-10-03 17:31:51 INFO Shibboleth.SessionCache [72] [shib-erp]: removed session (_f4555676a9d68271898dd1d39568afda)
2024-10-03 17:31:51 INFO Shibboleth.SessionCache [50] [shib-erp]: removed session (_f4555676a9d68271898dd1d39568afda)
2024-10-03 17:31:51 INFO Shibboleth.SessionCache [51] [shib-erp]: removed session (_f4555676a9d68271898dd1d39568afda)
2024-10-03 17:31:51 INFO Shibboleth.SessionCache [73] [shib-erp]: removed session (_f4555676a9d68271898dd1d39568afda)
2024-10-03 17:31:51 INFO Shibboleth.SessionCache [58] [shib-erp]: removed session (_f4555676a9d68271898dd1d39568afda)

although the user did not click Logout button at all.  I wonder why the Shibboleth Service Provider removed the session 5 times. Did it do that way or the front end ALB sent a single to the Shibboleth Service Provider so that it removed the session 5 times? If a session is removed for the first time, the following removals should have thrown errors because the session did not exist at all.

Any thoughts are appreciated.

John W.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20241007/a88c6e70/attachment.htm>