Trouble with SameSite settings ?
Marius Fuchs
marius.fuchs at uni-wuerzburg.de
Thu Jun 26 16:01:02 UTC 2025
Dear all,
we have recently encountered an outage of our IDP systems, which reads as
2025-06-24 07:15:08,876 - ERROR
[org.apache.catalina.connector.ClientAbortException:144] -
org.apache.catalina.connector.ClientAbortException: java.io.IOException:
Broken pipe
at
org.apache.catalina.connector.OutputBuffer.realWriteBytes(OutputBuffer.java:
342)
Caused by: java.io.IOException: Broken pipe
at java.base/sun.nio.ch.FileDispatcherImpl.write0(Native Method)”
in idp-warn.log.
This is likely related to these exceptions logged in tomcat’s localhost.log:
24-Jun-2025 07:15:08.876 SEVERE [ajp-nio-127.0.0.1-8009-exec-323]
org.apache.catalina.core.StandardWrapperValve.invoke Servlet.service() for
servlet [idp] in context with path [/idp] threw exception [Request
processing failed: java.lang.IllegalStateException: getOutputStream() has
already been called for this response] with root cause
java.lang.IllegalStateException: getOutputStream() has already been
called for this response
at
org.apache.catalina.connector.Response.getWriter(Response.java:526)
at
org.apache.catalina.connector.ResponseFacade.getWriter(ResponseFacade.java:1
88)
at
jakarta.servlet.ServletResponseWrapper.getWriter(ServletResponseWrapper.java
:108)
at
net.shibboleth.shared.spring.servlet.impl.CookieBufferingFilter$CookieBuffer
ingHttpServletResponseProxy.getWriter(CookieBufferingFilter.java:120)
at
jakarta.servlet.ServletResponseWrapper.getWriter(ServletResponseWrapper.java
:108)
at
net.shibboleth.shared.spring.servlet.impl.DynamicResponseHeaderFilter$Respon
seProxy.getWriter(DynamicResponseHeaderFilter.java:163)
at
net.shibboleth.shared.spring.velocity.VelocityView.mergeTemplate(VelocityVie
w.java:367)
at
net.shibboleth.shared.spring.velocity.VelocityView.doRender(VelocityView.jav
a:305)
at
net.shibboleth.shared.spring.velocity.VelocityView.renderMergedTemplateModel
(VelocityView.java:235)
at
org.springframework.web.servlet.view.AbstractTemplateView.renderMergedOutput
Model(AbstractTemplateView.java:181)
at
org.springframework.web.servlet.view.AbstractView.render(AbstractView.java:3
14)
at
org.springframework.web.servlet.DispatcherServlet.render(DispatcherServlet.j
ava:1432)
at
org.springframework.web.servlet.DispatcherServlet.processDispatchResult(Disp
atcherServlet.java:1168)
at
org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServl
et.java:1106)
at
org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServle
t.java:979)
at
org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkSer
vlet.java:1014)
at
org.springframework.web.servlet.FrameworkServlet.doOptions(FrameworkServlet.
java:950)
at
jakarta.servlet.http.HttpServlet.service(HttpServlet.java:599)
at
org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet..ja
va:885)
at
jakarta.servlet.http.HttpServlet.service(HttpServlet.java:658)
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Application
FilterChain.java:195)
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterCh
ain.java:140)
at
org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:51)
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Application
FilterChain.java:164)
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterCh
ain.java:140)
at
net.shibboleth.shared.spring.servlet.impl.ChainingFilter$Chain.doFilter(Chai
ningFilter.java:116)
at
net.shibboleth.shared.spring.servlet.impl.RequestResponseContextFilter.runFi
lter(RequestResponseContextFilter.java:69)
at
net.shibboleth.shared.servlet.AbstractConditionalFilter.doFilter(AbstractCon
ditionalFilter.java:83)
at
net.shibboleth.shared.spring.servlet.impl.ChainingFilter$Chain.doFilter(Chai
ningFilter.java:114)
at
net.shibboleth.shared.spring.servlet.impl.DynamicResponseHeaderFilter.runFil
ter(DynamicResponseHeaderFilter.java:129)
at
net.shibboleth.shared.servlet.AbstractConditionalFilter.doFilter(AbstractCon
ditionalFilter.java:83)
at
net.shibboleth.shared.spring.servlet.impl.ChainingFilter$Chain.doFilter(Chai
ningFilter.java:114)
at
net.shibboleth.shared.spring.servlet.impl.CookieBufferingFilter.runFilter(Co
okieBufferingFilter.java:71)
at
net.shibboleth.shared.servlet.AbstractConditionalFilter.doFilter(AbstractCon
ditionalFilter.java:83)
at
net.shibboleth.shared.spring.servlet.impl.ChainingFilter$Chain.doFilter(Chai
ningFilter.java:114)
at
net.shibboleth.idp.conf.impl.SLF4JMDCServletFilter.runFilter(SLF4JMDCServlet
Filter.java:115)
at
net.shibboleth.shared.servlet.AbstractConditionalFilter.doFilter(AbstractCon
ditionalFilter.java:83)
at
net.shibboleth.shared.spring.servlet.impl.ChainingFilter$Chain.doFilter(Chai
ningFilter.java:114)
at
org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(Char
acterEncodingFilter.java:201)
at
net.shibboleth.shared.spring.servlet.impl.CharacterEncodingFilter.doFilterIn
ternal(CharacterEncodingFilter.java:80)
at
org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestF
ilter.java:116)
at
net.shibboleth.shared.spring.servlet.impl.ChainingFilter$Chain.doFilter(Chai
ningFilter.java:114)
at
net.shibboleth.shared.spring.servlet.impl.ChainingFilter$Chain.doFilter(Chai
ningFilter.java:110)
at
net.shibboleth.shared.spring.servlet.impl.ChainingFilter.doFilter(ChainingFi
lter.java:76)
at
org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(Delegati
ngFilterProxy.java:362)
at
org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilt
erProxy.java:278)
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Application
FilterChain.java:164)
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterCh
ain.java:140)
at
org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve..ja
va:155)
at
org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve..ja
va:90)
at
org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase
..java:598)
at
org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:116
)
at
org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:93)
at
org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogVa
lve.java:666)
at
org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java
:74)
at
org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:344)
at
org.apache.coyote.ajp.AjpProcessor.service(AjpProcessor.java:419)
at
org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java
:63)
at
org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtoco
l.java:903)
at
org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.jav
a:1740)
at
org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:
52)
at
org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecut
or.java:1189)
at
org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecu
tor.java:658)
at
org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread..ja
va:63)
at java.base/java.lang.Thread.run(Thread.java:840)
We have encountered these exceptions occasionally since at least 2023,
however only a few per day. During the outage, we accumulated many more.
Our IDP is set up to redirect users to Entra for authorization using MFA,
while attribute release is handled locally afterwards.
To accommodate certain SPs, we had to adjust the sameSite settings recently,
i.e., about 6 days before our outage:
idp.cookie.sameSite=None
idp.cookie.sameSiteCondition=shibboleth.SameSiteCondition
(with SameSiteCondition hopefully being benign.)
Unfortunately, I have not been able to identify the reason triggering our
outage nor has the IllegalStateException ever occurred in the dedicated
system, used to develop the configuration. (The problem might be linked to
load?). Currently our IDPs are running fine using this configuration.
Am I correct in assuming the IllegalStateExceptions are causing the outage
(or is vice versa) ?
What is causing these IllegalStateExceptions ?
If necessary, I will gladly provide more details/configuration settings.
Thank you.
Best wishes
Marius Fuchs, MSc
Rechenzentrum
Universität Würzburg
Am Hubland
97074 Würzburg
Germany
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250626/7113e0d9/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 7316 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20250626/7113e0d9/attachment.p7s>
More information about the users
mailing list