sessions maybe dropped / how to view session count

[Peter Murray]

If your Shib is fronted by a load balancer, you will probably need to
ignore the connecting IP address (which comes from the load balancer) and
have Shib look at the forwarded IP address. An Apache config like this is
useful:

# Process X-Forwarded-For from the load balancer
RemoteIPHeader X-Forwarded-For
RemoteIPTrustedProxy 10.0.0.0/8
RemoteIPTrustedProxy 172.16.0.0/12
RemoteIPTrustedProxy 192.168.0.0/16

Of course, be careful what you trust as `RemoteIPTrustedProxy`.
These RFC1918 private network addresses are probably safe, but know your
local environment.


Peter



On Wed, Jul 8, 2026 at 5:26 PM Simon Leary via users <users at shibboleth.net>
wrote:

> Hello shibboleth users,
>
> I am trying to troubleshoot an issue where users are forced to sign in
> again with SSO, long before the session lifespan or timeout could be
> reached. Based on user feedback, it seems that this might be happening only
> when the SP is under heavy load. Is it possible that shibd has an upper
> limit on the number of sessions, which could cause older sessions to end
> early?
>
> I would like to find out the number of sessions that are currently open. I
> discovered that there is a `https://localhost/Shibboleth.sso/Status`
> <https://localhost/Shibboleth.sso/Status> page, but it doesn't have much
> of any useful information. `shibd -h` doesn't show any relevant options. I
> also haven't been able to find any sign of sessions on the filesystem. I
> see in SAML Tracer that my session's "relay state" is prefixed with
> "ss:mem:", which tells me that my shibd is using the "memory storage
> service", so it makes sense that I didn't find anything. Am I missing
> something? Does anyone have tips or tricks that could help with this?
>
> Thanks,
> Simon
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>


-- 
Peter Murray
Open Source Community Advocate
Index Data, LLC
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20260709/b93dade4/attachment.htm>