<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<meta content="text/html; charset=UTF-8">
<style type="text/css" style="">
<!--
p
{margin-top:0;
margin-bottom:0}
-->
</style>
<div dir="ltr">
<div id="x_divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:#000000; font-family:Calibri,Arial,Helvetica,sans-serif">
<p>> <span style="color:rgb(33,33,33); font-size:13.3333px">It's far worse to "trap" people without a way to back up</span></p>
<p><span style="color:rgb(33,33,33); font-size:13.3333px"><br>
</span></p>
<p><span style="color:rgb(33,33,33); font-size:13.3333px">Known and acknowledged but not a primary concern in this specific deployment because of SPNEGO and users that are quite willing to sit on the back button until they get... somewhere.</span></p>
<p><span style="color:rgb(33,33,33); font-size:13.3333px"><span style="color:rgb(33,33,33); font-family:Calibri,Arial,Helvetica,sans-serif,EmojiFont,"Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols; font-size:13.3333px"><br>
</span></span></p>
<p><span style="color:rgb(33,33,33); font-size:13.3333px"><span style="color:rgb(33,33,33); font-family:Calibri,Arial,Helvetica,sans-serif,EmojiFont,"Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols; font-size:13.3333px">> <span style="color:rgb(33,33,33); font-size:13.3333px">What
you want to do is remove the rules, and anybody is free to use any inbound interceptor flow they like or none at all.</span></span></span></p>
<p><span style="color:rgb(33,33,33); font-size:13.3333px"><span style="color:rgb(33,33,33); font-family:Calibri,Arial,Helvetica,sans-serif,EmojiFont,"Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols; font-size:13.3333px"><span style="color:rgb(33,33,33); font-size:13.3333px"><br>
</span></span></span></p>
<p><span style="color:rgb(33,33,33); font-size:13.3333px"><span style="color:rgb(33,33,33); font-family:Calibri,Arial,Helvetica,sans-serif,EmojiFont,"Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols; font-size:13.3333px"><span style="color:rgb(33,33,33); font-size:13.3333px">Thank
you. This is just the splice point he needed.</span></span></span></p>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Cantor, Scott <cantor.2@osu.edu><br>
<b>Sent:</b> Wednesday, April 19, 2017 2:45:05 PM<br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> Re: "Replay detected of message" causes</font>
<div> </div>
</div>
</div>
<font size="2"><span style="font-size:10pt;">
<div class="PlainText">On 4/19/17, 5:32 PM, "users on behalf of Nate Klingenstein" <users-bounces@shibboleth.net on behalf of ndk@sudonym.me> wrote:<br>
<br>
> I know it's forbidden by specification to not check and it will void<br>
> his warranty, but is it intended that the<br>
> OptionalMessageReplaySecurityHandler and<br>
> OptionalMessageLifetimeSecurityHandler beans declared in<br>
> system\flows\saml\security-beans.xml be usable in production?<br>
<br>
It's far worse to "trap" people without a way to back up, or artifically inflate login counts and traffic. The main purpose of the check is in fact to make sure the back button causes a defined error since it *can't* do anything useful.<br>
<br>
Also, they don't do what you think they do anyway. Optional means "if it's not possible to check, don't fail". It doesn't mean "if it fails, don't care".<br>
<br>
What you want to do is remove the rules, and anybody is free to use any inbound interceptor flow they like or none at all.<br>
<br>
-- Scott<br>
<br>
<br>
-- <br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</span></font>
</body>
</html>