<div dir="ltr">I've got an issue that a shibboleth protected website is pulling in javascript content from a second site both sites are protected with a shibboleth SP - all configured to only use the artifact profile and HTTP basic auth at the shibboleth IDP. The browser asks for multiple JavaScript include files all hosted on the second site simultaneously. Since the user doesn’t have any cookies for the second site - each requests triggers an authentication request against the shibboleth IDP. It seems to be a race condition which requests succeed and which fail (I would expect all of them to succeed). I the request fails it dies at <idp>/idp/profile/SAML2/Redirect/SSO or <idp>/idp/Authn/RemoteUser with a status 200 and content like below.<br>
<br> <br><html><br><br><body><br><br> <img src="/idp/images/logo.jpg" /><br><br> <h3>ERROR</h3><br><br> <p><br><br> An error occurred while processing your request. Please contact your helpdesk or<br>
<br> user ID office for assistance.<br><br> </p><br><br> <p><br><br> This service requires cookies. Please ensure that they are enabled and try your<br><br> going back to your desired resource and trying to login again.<br>
<br> </p><br><br> <p><br><br> Use of your browser's back button may cause specific errors that can be resolved by<br><br> going back to your desired resource and trying to login again.<br>
<br> </p><br><br> <p><br><br> If you think you were sent here in error,<br><br> please contact technical support<br><br> </p><br><br> <br><br> <strong>Error Message: Error decoding authentication request message</strong><br>
<br> <br><br></body><br><br></html><br><br> <br><br>and the IDP Process log contains.<br><br> <br><br>[edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:400] - Error decoding authentication request message org.opensaml.ws.message.decoder.MessageDecodingException: No SAMLRequest or SAMLResponse query path parameter, invalid SAML 2 HTTP Redirect message at org.opensaml.saml2.binding.decoding.HTTPRedirectDeflateDecoder.doDecode(HTTPRedirectDeflateDecoder.java:98) ~[opensaml-2.6.0.jar/:na] at org.opensaml.ws.message.decoder.BaseMessageDecoder.decode(BaseMessageDecoder.java:79) ~[openws-1.5.0.jar/:na] at org.opensaml.saml2.binding.decoding.BaseSAML2MessageDecoder.decode(BaseSAML2MessageDecoder.java:70) ~[opensaml-2.6.0.jar/:na] at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.decodeRequest(SSOProfileHandler.java:386) [shibboleth-identityprovider-2.4.0.jar/:na] at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.performAuthentication(SSOProfileHandler.java:211) [shibboleth-identityprovider-2.4.0.jar/:na] at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:189) [shibboleth-identityprovider-2.4.0.jar/:na] at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:90) [shibboleth-identityprovider-2.4.0.jar/:na] at edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet.service(ProfileRequestDispatcherServlet.java:83) [shibboleth-common-1.4.0.jar/:na] at javax.servlet.http.HttpServlet.service(HttpServlet.java:847) ....<br>
<br> <br>Or this<br><br>[edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:217] - No login context available, unable to proceed with authentication<br><br><br>I've got a python script which makes multiple simultaneous requests to shibboleth and triggers multiple errors every time if you want a copy.<br>
<br><br>-Christopher<br><br><br><br></div>