Ex: Re: Record "disappears" from client side storage?

[Paul B. Henson]

> From: Cantor, Scott <cantor.2 at osu.edu>
> Sent: Tuesday, September 17, 2024 5:48 AM
>
> What I can't explain is the rest of the behavior. I don't see how it's possible that
> it immediately prompted the user to login again immediately after a login
> unless you have policies that would explain it.

Not that I'm aware of. I do have a reuse condition on the overall MFA flow, but it just makes you do duo if you hadn't done duo before, it would reuse the password flow.

I was able to reproduce the "user has to login again even though they apparently just logged in" part of it. If I access a service in one browser tab, put in my username/password, then go open a different browser tab and access another service, the second browser tab asks for username/password while the first tab is trying to do duo,  then if I finish duo in the first tab and supply username/password and duo in the second tab, the logs show logins one right after the other on the same session.

So theoretically if a user reopens a browser that is trying to reload multiple services, and bounces between the tabs authenticating, that would happen. I wasn't able to reproduce the session missing in transit issue though.