<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<p>Hi Peter,</p>
<p><br>
</p>
<p>Thanks! I thought I had added the /favicon.ico to the list of resources which are supposed to ignore authentication, but it looks like I changed the the wrong config file. Removing /favicon.ico from the list of protected resources fixed the problem.<br>
</p>
<p><br>
</p>
<div id="Signature">
<div id="divtagdefaultwrapper" style="font-size: 12pt; color: rgb(0, 0, 0); font-family: Calibri,Arial,Helvetica,sans-serif,"EmojiFont","Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols;">
<p>Cheers,<br>
</p>
<p> David Newswanger</p>
<p><br>
<span style="font-size:10pt"></span></p>
</div>
</div>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Peter Schober <peter.schober@univie.ac.at><br>
<b>Sent:</b> Tuesday, November 14, 2017 2:07:54 AM<br>
<b>To:</b> users@shibboleth.net<br>
<b>Subject:</b> Re: Users Keep Getting Redirected to /favicon.ico</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:10pt;">
<div class="PlainText">* David E. Newswanger <David_Newswanger@berea.edu> [2017-11-13 20:32]:<br>
> We're having some really strange problems with our IdP. Occasionally<br>
> a user will go to one of our service providers to log in, get<br>
> redirected to the IdP, authenticate and then instead of getting sent<br>
> back to the SP, they get sent to login.domain.edu/favicon.ico.<br>
<br>
Well, it seems there's a SAML SP on login.domain.edu at play, too, so<br>
it's not some weird coincidence the browser ends upon the IDP web<br>
server (since that's an SP, too).<br>
Your IDP logs would also show you that the accessed SAML SP in those<br>
case is your SP-on-the-IDP, not the one people originally intended to<br>
access.<br>
<br>
The favicon.ico on that web server is protected by that SAML SP (and<br>
that's the main part of your configuration error, and one that makes<br>
no sense since a favicon should be nothing that needs access control).<br>
<br>
Meaning a browser accessing your IDP web server during authentication<br>
(to get a SAML assertion for some other random SP) would also request<br>
/favicon.ico from your IDP web server and that is protected by the<br>
SP-on-your-IDP and that other SP now will send another authn request<br>
to the IDP. The fact that this doesn't always happen points to a race<br>
condition of the resources as they're being requested by the browser:<br>
If favicon comes first the SAML redirects will end up at the IDP web<br>
server.<br>
<br>
-peter<br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg">
https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</span></font></div>
</body>
</html>