<div dir="ltr">I did some more debugging. Looks like JSESSIONID is not the issue. In our environment, the Apache server talks to a tomcat server and a mongrel server. When the request goes to mongrel server, the JSESSIONID is not passed which is correct.<div><br></div><div>But, we still see the shibsession expiry issue. Appreciate any feedbacks on this issue.</div><div><br></div><div>Thanks</div><div><br></div><div>Nara</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Jul 1, 2015 at 10:08 AM, nr673 . <span dir="ltr"><<a href="mailto:nara.rama.us@gmail.com" target="_blank">nara.rama.us@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hi:<div><br></div><div>We have upgraded to shibboleth SP from 2.5.3 to 2.5.4 recently (Apache 2.2). The session settings in the shibboleth2.xml looks as follows.</div><div>
<p><span><</span><span>Sess</span><span>ions </span>lifetime<span>=</span><span>"28800"</span><span> </span>timeout<span>=</span><span>"3600"</span><span> </span>relayState<span>=</span><span>"ss:mem"</span><span> </span><span> </span>checkAddress<span>=</span><span>"false"</span><span> </span>handlerURL<span>=</span><span>"/Shibboleth.sso"</span><span> </span>handlerSSL<span>=</span><span>"true"</span><span> </span>cookieProps<span>=</span><span>"https"</span><span>></span></p></div><div>When working on the application, the user is redirected to home page suddenly. I have traced the server calls using Live Http Headers. When a regular server side call is made, the browser properly sends the JSESSIONID and shibsession in the cookie.</div><div><br></div><div><div><a href="https://qa2.aaa.com/users/index" target="_blank">https://qa2.aaa.com/users/index</a></div><div><br></div><div>GET /users/index HTTP/1.1</div><div>User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:38.0) Gecko/20100101 Firefox/38.0<br></div><div>Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8</div><div>Accept-Language: en-US,en;q=0.5</div><div>Accept-Encoding: gzip, deflate</div><div>Referer: <a href="https://awsqa2.pfoperations.com/dashboard/admin" target="_blank">https://awsqa2.pfoperations.com/dashboard/admin</a></div><div>Cookie: JSESSIONID=C1F938183C2AD0878D2714336ACC171F; __utma=169413937.<a href="tel:2058668447" value="+12058668447" target="_blank">2058668447</a>.1435710020.1435716657.1435719877.3; __utmz=169413937.1435710020.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); search_criteria=3600; __utmb=169413937.36.10.1435719877; _shibsession_64656661756c7468747470733a2f2f6177737161322e70666f7065726174696f6e732e636f6d=_28948b88755e3c225164558f3f434a85; language=en; __utmc=169413937; __utmt=1</div><div>Connection: keep-alive</div><div><br></div><div>HTTP/1.1 200 OK</div><div>Content-Language: en-US</div><div>Content-Type: text/html;charset=UTF-8</div><div>Date: Wed, 01 Jul 2015 03:35:06 GMT</div><div>Server: Apache-Coyote/1.1</div><div>Content-Length: 13053</div><div>Connection: keep-alive</div></div><div><br></div><div>When a JQuery Ajax call is made to the same server domain, the JSESSIONID is dropped from the cookie. As a result, the Sihbboleth is invalidating the shibsession cookie and redirecting the call to the IdP.</div><div><br></div><div><div><a href="https://qa2.aaa.com/zip_services/show" target="_blank">https://qa2.aaa.com/zip_services/show</a></div><div><br></div><div>GET /zip_services/show HTTP/1.1</div><div>User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:38.0) Gecko/20100101 Firefox/38.0<br></div><div>Accept: text/html, */*</div><div>Accept-Language: en-US,en;q=0.5</div><div>Accept-Encoding: gzip, deflate</div><div>X-Requested-With: XMLHttpRequest</div><div>Cookie: __utma=169413937.<a href="tel:2058668447" value="+12058668447" target="_blank">2058668447</a>.1435710020.1435716657.1435719877.3; __utmz=169413937.1435710020.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); search_criteria=3600; __utmb=169413937.36.10.1435719877; _shibsession_64656661756c7468747470733a2f2f6177737161322e70666f7065726174696f6e732e636f6d=_28948b88755e3c225164558f3f434a85; language=en; __utmc=169413937; __utmt=1<br></div><div>Connection: keep-alive</div><div>If-None-Match: "2b484978b064b7f435ef88807593c93f"</div><div><br></div><div>HTTP/1.1 302 Found</div><div>Cache-Control: private,no-store,no-cache,max-age=0</div><div>Content-Type: text/html; charset=iso-8859-1</div><div>Date: Wed, 01 Jul 2015 03:35:06 GMT</div><div>Expires: Wed, 01 Jan 1997 12:00:00 GMT</div><div>Location: https://...<a href="http://okta.com/app/template_saml_2_0/" target="_blank">okta.com/app/template_saml_2_0/</a></div><div>Set-Cookie: _shibsession_64656661756c7468747470733a2f2f6177737161322e70666f7065726174696f6e732e636f6d=; path=/; secure; HttpOnly; expires=Mon, 01 Jan 2001 00:00:00 GMT</div><div>Content-Length: 848</div><div>Connection: keep-alive</div></div><div><br></div><div>Are there way to fix this behavior through shibboleth config settings? We did not see this behavior in shibboleth 2.5.3.</div><div><br></div><div>Thanks</div><div><br></div><div>Nara</div></div>
</blockquote></div><br></div>