<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Lucida Sans Typewriter";
panose-1:2 11 5 9 3 5 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Lucida Sans Typewriter";
color:#1F497D;
font-weight:normal;
font-style:normal;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Lucida Sans Typewriter";color:#1F497D">Hi Noriyuki,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Lucida Sans Typewriter";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Lucida Sans Typewriter";color:#1F497D">This is just a guess since you say that IE has problems while other browsers do not. IE has a security feature not found in other browsers that causes some
web apps to fail for IE but no other browsers.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Lucida Sans Typewriter";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Lucida Sans Typewriter";color:#1F497D">If IE makes a https (SSL) request and receives a cookie in the response, then IE unconditionally considers that cookie “secure”. Therefore IE will NOT include
this cookie in any subsequent http (non-SSL) requests.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Lucida Sans Typewriter";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Lucida Sans Typewriter";color:#1F497D">Other browsers only consider a cookie secure if the web server tags it secure. If a non-IE browser receives a cookie from a https request that is not tagged
secure, then the browser will present it to http requests. IE will NOT do this. I know of no IE browser setting to change this.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Lucida Sans Typewriter";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Lucida Sans Typewriter";color:#1F497D">Look for a mix of https and http requests to the SP or to the IDP. If this is indeed your problem, then you can force all requests to be https or else declare
that IE is not supported.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Lucida Sans Typewriter";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Steve Losen<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">ITS – Enterprise Infrastructure</span><span style="font-family:"Lucida Sans Typewriter";color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">University of Virginia<o:p></o:p></span></p>
<p class="MsoNormal"><a href="mailto:scl@virginia.edu"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#0563C1">scl@virginia.edu</span></a><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> 434-924-0640</span><span style="font-size:11.0pt;font-family:"Lucida Sans Typewriter";color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Lucida Sans Typewriter";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> users <users-bounces@shibboleth.net>
<b>On Behalf Of </b>Noriyuki TAKEI<br>
<b>Sent:</b> Monday, April 22, 2019 10:37 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Strange behavior only via Internet Explore<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal">Hi,all<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I found the strange behavior only when accessing a SP via Internet Explore.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">When I go to an specific SP via Internet Explorer, I got the following error message in idp-warn.log.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">--- start ---<o:p></o:p></p>
</div>
<p class="MsoNormal">2019-04-23 11:22:44,260 - XXX.XXX.XXX.XXX - ERROR [org.opensaml.profile.action.impl.DecodeMessage:73] - Profile Action DecodeMessage: Unable to decode incoming request<br>
org.opensaml.messaging.decoder.MessageDecodingException: This message decoder only supports the HTTP GET method<br>
at org.opensaml.saml.saml2.binding.decoding.impl.HTTPRedirectDeflateDecoder.doDecode(HTTPRedirectDeflateDecoder.java:90)<o:p></o:p></p>
<div>
<div>
<p class="MsoNormal">--- end ---<o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">The following message got displayed in the browser.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">--- start ---<o:p></o:p></p>
</div>
<div>
<div>
<p class="MsoNormal">Web Login Service - Stale Request<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">You may be seeing this page because you used the Back button while browsing a secure web site or application. Alternatively, you may have mistakenly bookmarked the web login form instead of the actual web site you wanted to bookmark or
used a link created by somebody else who made the same mistake.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Left unchecked, this can cause errors on some browsers or result in you returning to the web site you tried to leave, so this page is presented instead.<o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal">--- end ---<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">However,when I go to the same sp again via the same tabs of the same browser, it worked properly.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">When terminating all the browser and accessing the same SP via Internet Explore,the above-mentioned error occurred again.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I guess the above-mentioned error proceeds in the following sequence from idp-warn.log, HTTP Header and apache access logs.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">(1) At first, the browser access to an SP.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">(2) The SP redirects the browser to [IDP's FQDN]/idp/profile/SAML2/Redirect/SSO via Get method with SAML Request attached to query parameter.(However, it seems that the browser gets this response from cache according to IE's log )<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">(3) The SP redirects the browser again to [IDP's FQDN]/idp/profile/SAML2/Redirect/SSO via Post method with SAML Request attached to query parameter.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">(4) the above-mentioned error occurs.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">In addition, one SP works properly, but the other SP does not.I don't understand the difference between two SPs.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Do you have any ideas to solve this problem?<o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>