[External] Re: Multiple removals of Shibd session

[Wang, John]

Scott,
Thank you for your response. In a log file of Apache Web server, I found the IP addresses of Amazon Load Balancers through which the user’s requests went. Here is the summery:

                                                 User’s requests went
                Time stamp                   through a node of ALB
————————————     ————— —
[04/Oct/2024:11:39:36 10.60.5.40
[04/Oct/2024:11:39:37 10.60.5.40
[04/Oct/2024:11:39:38 10.60.5.40
[04/Oct/2024:11:39:47 10.60.5.40
[04/Oct/2024:11:39:51 10.60.5.40
[04/Oct/2024:11:40:49 10.60.6.37
[04/Oct/2024:11:40:50 10.60.6.37
[04/Oct/2024:11:40:51 10.60.6.37
[04/Oct/2024:11:40:53 10.60.6.37
[04/Oct/2024:11:40:54 10.60.6.37
[04/Oct/2024:11:40:55 10.60.6.37
[04/Oct/2024:11:40:58 10.60.6.37
[04/Oct/2024:11:41:01 10.60.6.37
[04/Oct/2024:11:41:07 10.60.6.37
[04/Oct/2024:11:41:09 10.60.6.37
[04/Oct/2024:11:41:19 10.60.6.37
[04/Oct/2024:11:41:20 10.60.6.37
[04/Oct/2024:11:41:25 10.60.6.37
[04/Oct/2024:11:41:26 10.60.6.37
[04/Oct/2024:11:46:05 10.60.5.40
[04/Oct/2024:11:46:07 10.60.5.40
[04/Oct/2024:11:48:40 10.60.5.40
[04/Oct/2024:11:48:43 10.60.5.40
[04/Oct/2024:11:48:45 10.60.5.40
[04/Oct/2024:11:48:46 10.60.5.40
[04/Oct/2024:11:48:48 10.60.5.40
[04/Oct/2024:11:48:49 10.60.5.40
[04/Oct/2024:11:48:51 10.60.5.40
[04/Oct/2024:11:48:52 10.60.5.40
[04/Oct/2024:11:48:56 10.60.5.40
[04/Oct/2024:11:50:45 10.60.6.37
[04/Oct/2024:11:50:46 10.60.6.37
[04/Oct/2024:11:50:47 10.60.6.37

[04/Oct/2024:13:46:55 10.60.5.40
[04/Oct/2024:13:46:56 10.60.5.40
[04/Oct/2024:13:46:57 10.60.5.40
[04/Oct/2024:13:47:30 10.60.5.40
[04/Oct/2024:13:47:33 10.60.5.40
[04/Oct/2024:13:47:36 10.60.5.40
[04/Oct/2024:13:47:43 10.60.5.40
[04/Oct/2024:13:47:44 10.60.5.40
[04/Oct/2024:13:47:45 10.60.5.40
[04/Oct/2024:13:49:20 10.60.5.40
[04/Oct/2024:13:50:57 10.60.5.40
[04/Oct/2024:13:51:06 10.60.5.40
[04/Oct/2024:13:51:08 10.60.5.40
[04/Oct/2024:13:51:48 10.60.5.40
[04/Oct/2024:13:51:50 10.60.5.40
[04/Oct/2024:13:51:51 10.60.5.40
[04/Oct/2024:13:51:55 10.60.5.40

[04/Oct/2024:13:52:01 10.60.5.40
[04/Oct/2024:13:52:03 10.60.5.40
[04/Oct/2024:13:52:06 10.60.5.40
[04/Oct/2024:13:52:12 10.60.5.40
[04/Oct/2024:13:52:16 10.60.5.40
[04/Oct/2024:13:52:27 10.60.5.40
[04/Oct/2024:13:52:38 10.60.5.40
[04/Oct/2024:13:53:10 10.60.6.37
[04/Oct/2024:13:53:11 10.60.6.37
[04/Oct/2024:13:53:12 10.60.6.37
[04/Oct/2024:13:53:51 10.60.6.37
[04/Oct/2024:13:53:53 10.60.6.37
[04/Oct/2024:13:53:56 10.60.6.37
[04/Oct/2024:13:54:08 10.60.6.37
[04/Oct/2024:13:54:09 10.60.6.37
[04/Oct/2024:13:55:09 10.60.6.37
[04/Oct/2024:13:55:11 10.60.6.37
[04/Oct/2024:13:55:12 10.60.6.37
[04/Oct/2024:13:55:24 10.60.6.37

The Amazon Load balancer had two nodes: 10.60.6.37 and 10.60.5.40.  During the process of user’s operation, the user’s requests from the same web browser went through two nodes alternatively. When the switch happened, I can see the “removed session” message in transaction.log. Do you think the “removed session” by Shibd was caused by the switching nodes of ALB?

Thanks,

John Wang


From: Cantor, Scott <cantor.2 at osu.edu>
Date: Monday, October 7, 2024 at 12:58 PM
To: Wang, John <john.wang at emory.edu>, Shib Users <users at shibboleth.net>
Subject: Re: [External] Re: Multiple removals of Shibd session
> Did you refer the IP address to the IP address of AWS Load
> Balancer in front of Apache Web server and Shibd or the IP
> address of the user’s web browser?

The client, but if you botch the setup, the SP may only see the former (or even worse, see a changing address based on instances of the load balancer).

https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.atlassian.net%2Fwiki%2Fspaces%2FSP3%2Fpages%2F2110390365%2FAddressChecking&data=05%7C02%7Cjohn.wang%40emory.edu%7C6ab1f11da40b4ad79a4d08dce6f13256%7Ce004fb9cb0a4424fbcd0322606d5df38%7C0%7C0%7C638639170824093425%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=GnUeLtcmNtnaefOJeNbBoRKSylqFUSxL4fD0qaRXU2k%3D&reserved=0<https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2110390365/AddressChecking>

-- Scott

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20241007/01d4871f/attachment.htm>