<div dir="ltr"><div><i><span style="font-size:12.8px">></span><span style="font-size:12.8px">Don't know what it's doing, so I couldn't say.</span></i></div><div><br></div><div>It looks similar to the custom flow I had previously before they had their integration built. I don't see anything glaringly wrong with it. </div><div><i><br></i></div><span style="font-size:12.8px"><i>> Note that if the node switch were a problem, you still wouldn't get the error mentioning the lack of a SAML query parameter. You'd get a flow execution problem because the URL would have the execution parameter from Spring </i></span><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">I see a few of these scattered around but not matching up with the reporting users. I believe the few instances of this particular error message do involve a back button or invalid bookmark.</span></div><div><span style="font-size:12.8px"><br></span><span style="font-size:12.8px"><i>> That more strongly implicates the load balancer. What is the stickiness based on?</i></span><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">Stickiness is based on source IP address. </span></div></div></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature"><div dir="ltr"><div><div dir="ltr">
<div style="font-family:Tahoma;font-size:13px">
<div style="font-family:Tahoma;font-size:13px">
<div style="font-family:Tahoma;font-size:13px">
<div style="font-family:Tahoma;font-size:13px">
<div style="font-family:Tahoma;font-size:13px">
<div style="font-size:13px;font-family:Tahoma">
<div style="font-size:13px;font-family:Tahoma">
<div style="font-size:13px;font-family:Tahoma"><font face="Arial" size="1"><span></span></font>
<hr>
<font face="Arial" size="1"><span></span></font><b><span style="font-size:8pt;color:black;font-family:'Arial','sans-serif'">James Gross</span></b><span style="font-size:8pt;color:black;font-family:'Arial','sans-serif'">
<span>| Enterprise Application and </span>CMS Developer</span><span style="font-size:8pt;color:black;font-family:'Arial','sans-serif'"> (Enterprise Web Services)<br>
</span>
<p style="margin:0in 0in 0pt"><span style="font-size:8pt;color:black;font-family:'Arial','sans-serif'">UNC Charlotte
<span>| </span>Information Technology Services</span></p>
<div style="font-size:13px;font-family:Tahoma"><font face="Arial" size="1">
<p style="margin:0in 0in 0pt"><span style="font-size:8pt;color:black;font-family:'Arial','sans-serif'">9201 University City Blvd.
<span>| </span>Charlotte, NC 28223</span></p>
<p style="margin:0in 0in 0pt"><span style="font-size:8pt;color:black;font-family:'Arial','sans-serif'">Phone: 704-687-0298
<span>| Office: Kennedy 301-C39</span></span></p>
<p style="margin:0in 0in 0pt"><span style="font-size:8pt;color:blue;font-family:'Arial','sans-serif'"><a href="mailto:jgross15@uncc.edu" target="_blank">jgross15@uncc.edu</a>
</span><span style="font-size:8pt;color:black;font-family:'Arial','sans-serif'">|
</span><span style="font-size:8pt;color:blue;font-family:'Arial','sans-serif'"><a href="http://www.uncc.edu" target="_blank">http://www.uncc.edu</a></span></p>
<span style="color:black;font-family:'Arial','sans-serif'"></span></font>
<hr>
<font face="Arial" size="1"><span style="color:black;font-family:'Arial','sans-serif'">
<p style="margin:0in 0in 0pt"><span style="font-size:8pt;color:black;font-family:'Arial','sans-serif'">If
you are not the intended recipient of this transmission or a person
responsible for delivering it to the intended recipient, any disclosure,
copying, distribution, or other use of any of the information in this
transmission is strictly prohibited. If you have received this
transmission in error, please notify me immediately by reply e-mail or
by telephone at 704-687-0298. Thank you.</span></p>
</span></font>
<p> </p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div></div></div></div></div>
<br><div class="gmail_quote">On Mon, Nov 9, 2015 at 2:29 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On 11/9/15, 2:16 PM, "users on behalf of James Gross" <<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a> on behalf of <a href="mailto:JamesGross@uncc.edu">JamesGross@uncc.edu</a>> wrote:<br>
<br>
<br>
<br>
>I thought that as a potential cause previously as well but have verified that session persistence is set for 30 minutes on the load balancer. I'm wondering if the way the Duo (v3) plugin is injecting itself as a subflow may be causing an issue.<br>
<br>
</span>Don't know what it's doing, so I couldn't say.<br>
<br>
Note that if the node switch were a problem, you still wouldn't get the error mentioning the lack of a SAML query parameter. You'd get a flow execution problem because the URL would have the execution parameter from Spring WebFlow, and because the node switched it wouldn't be able to find the flow conversation to resume.<br>
<br>
As far as I know, the only way you can get the message decoding failure is if there's neither a SAMLRequest or execution parameter, but I'll have to check into that.<br>
<span class=""><br>
> The odd thing to me is that this is affecting such a small number of users in a very intermittent way.<br>
<br>
</span>That more strongly implicates the load balancer. What is the stickiness based on?<br>
<div class="HOEnZb"><div class="h5"><br>
-- Scott<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div>