SP v4 alpha2 sessions ?

[Jarno Huuskonen]

Hello,

First, thank you for the new
CredentialResolverService(https://shibboleth.atlassian.net/wiki/spaces/sphub1/pages/5539168277/CredentialResolverService
). Helps a lot in using different saml cert/keys in agents.

While testingSP 4alpha2 sessions, I noticed a missing format specifier
in a session-cache warning message
(https://codeberg.org/Shibboleth/cpp-
sp/src/branch/main/shibsp/session/impl/AbstractSessionCache.cpp#L966)
"session (%) missing in persistent store, invalidating locally",
getID());
should probably be: "session (%s)..."

Once a session is available in an agent’s memory/filesystem cache, does
the agent still query the hub for session data or validation on
subsequent requests? Or does it use the locally cached session until an
expiration, timeout, version change, or other invalidation condition
requires hub interaction?
(If hub is loadbalanced (using agents basic auth username as sticky
session), but if this hub server is down during reboot, then agent
traffic goes to second server during this time. Will agent send session
traffic to after initial login ? (Would need to use hub/storage for
sessions).

Also deleting session file from cache does seem to result in 500
internal server error:
shibboleth-sp[96735]: [Shibboleth.Apache] - unable to update access
time, session file (/var/cache/shibboleth-sp/sessions/....1) did not
exist
shibboleth-sp[96735]: [Shibboleth.Apache] - session (%) missing in
persistent store, invalidating locally
shibboleth-sp[96735]: [Shibboleth.Apache] - Unable to obtain session to
export to request [target=URL_removed]
(and in apache logs this was status_code=500 and I saw the default
apache interal error page).

Is this expected, I kind of expected this to behave like no session ->
make client login again (quick and dirty logout). (I think url had
require shibsession rule).

-Jarno

-- 
Jarno Huuskonen