<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Hi Manolo,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">The problem is more likely the user than the browser. The browser is simply following redirects, as it should. Try the aacli.sh command to see what attributes
the IDP releases for that user and that SP. Also run aacli.sh for a user that logs in successfully. Compare what attributes are released and their values. It is possible that attribute(s) are missing (or have unacceptable values) for the looping user.
For example, if Google wants a “mail” attribute, but the attribute is missing in the user’s LDAP record, then that might trigger the loop. Check the user’s LDAP record.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">In your IDP audit log, compare normal logins to the SP with logins that loop. The audit entry lists which attributes the IDP released. Perhaps the looping logins
are missing attribute(s).<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Come to think of it, you may be right about the browser being the problem. If the browser does not accept cookies then that might cause the looping. Perhaps
the SP is expecting to see a cookie from the browser, so if the browser does not present it, then the SP redirects to its login URL, etc.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Stephen C. Losen<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">ITS - Systems and Storage<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">University of Virginia<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><a href="mailto:scl@virginia.edu"><span style="color:#0563C1">scl@virginia.edu</span></a> 434-924-0640<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> users [mailto:users-bounces@shibboleth.net]
<b>On Behalf Of </b>Manolo Garcia Alvarez<br>
<b>Sent:</b> Thursday, January 31, 2019 5:33 AM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: Strange behavior: lots of logins by one user<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">That makes sense Stephen, thanks a lot.<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">We are reducing the suspects to Google Suite (which is the SP that's causing the logins), an specific browser or a combination of both. About your "Force Authentication" suggestion, we are running 3,1 and this is a production environment
and will affect a lot of users, so I don't think it's possible. We're now trying to identify the browser of the users with huge number of logins, but as you said it's clear the problem it's on the SP.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thanks again !!<o:p></o:p></p>
</div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="3" width="100%" align="center">
</div>
<p class="MsoNormal"><b><span style="font-size:8.5pt;font-family:"Verdana",sans-serif;color:#2E3A69">Manolo García</span></b><span style="font-size:8.5pt;font-family:"Verdana",sans-serif;color:#2E3A69"> <br>
Arquitectura i Sistemes<br>
<b>Universitat Oberta de Catalunya</b> <br>
</span> <br>
<span style="font-size:8.5pt;font-family:"Verdana",sans-serif;color:#4D4D4D">93 326 (3451) | 689 88 30 93 | </span><a href="mailto:mgarciaal@uoc.edu" target="_blank"><span style="font-size:8.5pt;font-family:"Verdana",sans-serif">mgarciaal@uoc.edu</span></a><span style="font-size:8.5pt;font-family:"Verdana",sans-serif;color:#4D4D4D"> </span><o:p></o:p></p>
</div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Verdana",sans-serif;color:#4D4D4D">Parc Mediterrani de la Tecnologia (edifici B3)<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Verdana",sans-serif;color:#4D4D4D">Av. Carl Friedrich Gauss, 5.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Verdana",sans-serif;color:#4D4D4D">08860 Castelldefels<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><img border="0" id="_x0000_i1026" src="http://cv.uoc.edu/WebMail/resources/img/UOC_e_mail.gif" alt="Universitat Oberta de Catalunya"> <br>
<span style="font-size:7.5pt;font-family:"Verdana",sans-serif;color:#969798">Aquest missatge s'adreça exclusivament a qui va destinat i pot contenir informació privilegiada o confidencial i dades de caràcter personal, la difusió de les quals és regulada per
la Llei orgànica de protecció de dades i la Llei de serveis de la societat de la informació. Si no sou la persona destinatària indicada (o la responsable de lliurar-lo a qui va destinat), no heu de copiar aquest missatge ni lliurar-lo a tercers per cap concepte.
Si heu rebut aquest missatge per error o l'heu aconseguit per altres mitjans, us demanem que ens ho comuniqueu immediatament per aquesta mateixa via i l'elimineu irreversiblement.</span> <br>
<br>
<span style="font-size:7.5pt;font-family:"Verdana",sans-serif;color:#969798">Abans d'imprimir aquest missatge electrònic penseu en el medi ambient.</span><o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">El mié., 30 ene. 2019 a las 12:48, Losen, Stephen C (scl) (<<a href="mailto:scl@virginia.edu" target="_blank">scl@virginia.edu</a>>) escribió:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Hi Manolo,</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">I suspect a redirect loop. The user logs in to the IDP and the IDP passes the assertion to the browser.
The browser presents the assertion to the SP. For some reason the SP rejects the login, perhaps because the user is missing from the SP’s own user database, or an attribute value is missing or unacceptable to the SP. Instead of displaying an error page,
the SP redirects the browser back to the SP’s own login URL. This would be reasonable if the SP were displaying its own username/password page. (When login fails, let the user try again.) But in the case of SAML, redirecting back to the SP login URL results
in a redirect to your IDP to authenticate again. The user has a valid SSO session, so the IDP silently gives the browser another assertion and the browser presents it to the SP, which rejects it and redirects to the SP login URL again, etc. The browser address
window at the top probably shows at least two URLs flickering back and forth, and each trip through the loop gets logged on the IDP as a successful login.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">The solution is not on the IDP. It is behaving normally and correctly. The culprit is the SP, which
should display an error instead of redirecting to login again. If the SP has a configuration “dashboard” then this behavior may be configurable. Otherwise you need to notify the SP admins.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Or I suppose you could configure “Forced Authentication” for the troublesome SP. This will cause your
IDP to display its login page rather than silently redirect. I think you can do this in conf/relying-party.xml with an override for the SP. A quick check of the IDP wiki shows this is possible if you are running IDP 3.4.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Stephen C. Losen</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">ITS - Systems and Storage</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">University of Virginia</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><a href="mailto:scl@virginia.edu" target="_blank"><span style="color:#0563C1">scl@virginia.edu</span></a>
434-924-0640</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> users [mailto:<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a>]
<b>On Behalf Of </b>Manolo Garcia Alvarez<br>
<b>Sent:</b> Wednesday, January 30, 2019 5:49 AM<br>
<b>To:</b> Shib Users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<b>Subject:</b> Strange behavior: lots of logins by one user</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<div>
<div>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Hi,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">we are using Shibboleth as an IdP with a lot of SP's for a community of about 50.000 active users, without problems so far. Nevertheless, our idp-audit shows a strange behavior
of some users: a few number of users are registering successful logins in a short period of time (1 hour typically):<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">This is one of them:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><img border="0" width="169" height="148" id="gmail-m_-10327104618541616gmail-m_-5750858342992814627gmail-m_-8572229857172875907_x005f_x0000_i1025" src="cid:image001.png@01D4B92D.38C74F80" alt="image.png"><o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">The bump on the graph shows just one user (login amartingil) who has more than 1800 logins in one hour according to the idp-login.log, so it's clear that's not possible for one
real user. In this example, the SP is Google and all the logins are registered in one of three the servers that are running Shibboleth. That's just one case, but we find this everyday with another set of users and another period of time. I can attach the relevant
parts of the logs if it's useful.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">I have done some research in the list and internet but I can't find anybody with the same problem. Is there someone with the same problem or information about this issue?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Thanks a lot !<o:p></o:p></p>
</div>
</div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="3" width="100%" align="center">
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span style="font-size:8.5pt;font-family:"Verdana",sans-serif;color:#2E3A69">Manolo García</span></b><span style="font-size:8.5pt;font-family:"Verdana",sans-serif;color:#2E3A69"> <br>
Arquitectura i Sistemes<br>
<b>Universitat Oberta de Catalunya</b> <br>
</span> <br>
<span style="font-size:8.5pt;font-family:"Verdana",sans-serif;color:#4D4D4D">93 326 (3451) | 689 88 30 93 | </span><a href="mailto:mgarciaal@uoc.edu" target="_blank"><span style="font-size:8.5pt;font-family:"Verdana",sans-serif">mgarciaal@uoc.edu</span></a><span style="font-size:8.5pt;font-family:"Verdana",sans-serif;color:#4D4D4D"> </span><o:p></o:p></p>
</div>
<div>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:8.5pt;font-family:"Verdana",sans-serif;color:#4D4D4D">Parc Mediterrani de la Tecnologia (edifici B3)</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:8.5pt;font-family:"Verdana",sans-serif;color:#4D4D4D">Av. Carl Friedrich Gauss, 5.</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:8.5pt;font-family:"Verdana",sans-serif;color:#4D4D4D">08860 Castelldefels</span><o:p></o:p></p>
</div>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><img border="0" id="gmail-m_-10327104618541616gmail-m_-5750858342992814627gmail-m_-8572229857172875907_x005f_x0000_i1027" src="http://cv.uoc.edu/WebMail/resources/img/UOC_e_mail.gif" alt="Universitat Oberta de Catalunya"> <br>
<span style="font-size:7.5pt;font-family:"Verdana",sans-serif;color:#969798">Aquest missatge s'adreça exclusivament a qui va destinat i pot contenir informació privilegiada o confidencial i dades de caràcter personal, la difusió de les quals és regulada per
la Llei orgànica de protecció de dades i la Llei de serveis de la societat de la informació. Si no sou la persona destinatària indicada (o la responsable de lliurar-lo a qui va destinat), no heu de copiar aquest missatge ni lliurar-lo a tercers per cap concepte.
Si heu rebut aquest missatge per error o l'heu aconseguit per altres mitjans, us demanem que ens ho comuniqueu immediatament per aquesta mateixa via i l'elimineu irreversiblement.</span> <br>
<br>
<span style="font-size:7.5pt;font-family:"Verdana",sans-serif;color:#969798">Abans d'imprimir aquest missatge electrònic penseu en el medi ambient.</span><o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal">-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" target="_blank">
https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">
users-unsubscribe@shibboleth.net</a><o:p></o:p></p>
</blockquote>
</div>
</div>
</body>
</html>