<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Cathy, This may or may not be your issue. When we upgraded from SP2 to SP3, we had to make changes to several config files. We had several symptoms, but one of them looked very much like what you are reporting.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">In shibboleth2.xml, <o:p></o:p></p>
<p class="MsoNormal"> <Sessions checkAddress="false" handlerSSL="false" lifetime="28800" relayState="ss:mem" timeout="3600"><o:p></o:p></p>
<p class="MsoNormal">changed to<o:p></o:p></p>
<p class="MsoNormal"> <Sessions checkAddress="false" lifetime="28800" relayState="ss:mem" timeout="3600" redirectLimit="host" cookieProps="; path=/; HttpOnly" handlerSSL="false" consistentAddress="false"><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Some of these are unique to our setup, such as handlerSSL=”false” because we are inside a VPN where SSL is handled at the boundary.
<o:p></o:p></p>
<p class="MsoNormal">consistentAddress=”false” because we are fronted by an AWS ELB and requests can come from multiple apparent IP addresses – this was critical to getting it to work consistently.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Also important, because we are using AJP to connect to our back-end Java app from Apache was this change to the Tomcat server.xml.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">- <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" tomcatAuthentication="false"/><o:p></o:p></p>
<p class="MsoNormal">+ <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" tomcatAuthentication="false" secretRequired="false" allowedRequestAttributesPattern=".*"/><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b>--<o:p></o:p></b></p>
<p class="MsoNormal"><b>Spencer Thomas<br>
</b>Technical Architect <b>/</b> JSTOR and Artstor<br>
<a href="https://www.ithaka.org/"><span style="color:#0563C1">ITHAKA</span></a> <b>/</b> 301 E. Liberty St, Suite 250, Ann Arbor, MI 48104<br>
Email: <a href="mailto:Spencer.Thomas@ithaka.org"><span style="color:#0563C1">Spencer.Thomas@ithaka.org</span></a><o:p></o:p></p>
<p class="MsoNormal">Voicemail: 734-887-7004<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">users <users-bounces@shibboleth.net> on behalf of Cathy Scott
<a href="mailto:cathystill@gmail.com">cathystill@gmail.com</a></span><span style="font-size:12.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><br>
<b>Reply-To: </b>Shib Users <users@shibboleth.net><br>
<b>Date: </b>Monday, April 13, 2020 at 9:40 AM<br>
<b>To: </b>Shib Users <users@shibboleth.net><br>
<b>Subject: </b>Shibboleth SP session storage issue<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal">Hello all,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Hoping to get assistance with a session state issue. Users are successfully authenticating but the session is almost immediately removed. Shib SP v3.0.4.1, upgraded from v2. Here are selected log examples. Any assistance would be greatly
appreciated, thanks.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">native_warn.log<br>
2020-04-13 07:31:36 ERROR Shibboleth.Apache [2372] shib_check_user: Unable to obtain session to export to request.<br>
2020-04-13 07:33:14 ERROR Shibboleth.Listener [2372] shib_check_user [default]: remoted message returned an error: Your session is not available in the session store, and you must re-authenticate.<br>
2020-04-13 07:42:59 ERROR Shibboleth.Apache [2372] shib_handler: Failure sending remoted message (default/SAML2/POST).<br>
2020-04-13 07:43:31 ERROR Shibboleth.Apache [2372] shib_check_user: Failure sending remoted message (set::RelayState).<br>
<br>
shibd.log<br>
2020-04-13 07:29:52 INFO Shibboleth.SessionCache [2] [default]: new session created: ID (_d7acbb8046b19034e92a0f7aade41ecd) IdP (<a href="https://clienturl/idp/shibboleth">https://clienturl/idp/shibboleth</a>) Protocol(urn:oasis:names:tc:SAML:2.0:protocol)
Address (xxx.xxx.71.6)<br>
2020-04-13 07:29:53 INFO Shibboleth.SessionCache [2] [default]: removed session (_d7acbb8046b19034e92a0f7aade41ecd)<br>
2020-04-13 07:31:24 INFO Shibboleth.SessionCache [4] [default]: new session created: ID (_f140df61cc28d15ba00aac901ad6e131) IdP (<a href="https://clienturl/idp/shibboleth">https://clienturl/idp/shibboleth</a>) Protocol(urn:oasis:names:tc:SAML:2.0:protocol)
Address (xxx.xxx.71.6)<br>
2020-04-13 07:31:27 INFO Shibboleth.SessionCache [4] [default]: removed session (_f140df61cc28d15ba00aac901ad6e131)<br>
2020-04-13 08:13:43 INFO Shibboleth.SessionCache [1] [default]: new session created: ID (_e8208c8a842b990b94c1a5be050eed7e) IdP (<a href="https://clienturl/idp/shibboleth">https://clienturl/idp/shibboleth</a>) Protocol(urn:oasis:names:tc:SAML:2.0:protocol)
Address (xxx.xxx.71.28)<br>
2020-04-13 08:13:44 INFO Shibboleth.SessionCache [4] [default]: removed session (_e8208c8a842b990b94c1a5be050eed7e)<br>
2020-04-13 08:13:44 INFO Shibboleth.SessionCache [4] [default]: session (ID: _e8208c8a842b990b94c1a5be050eed7e) no longer in storage<br>
2020-04-13 08:13:44 INFO Shibboleth.SessionCache [4] [default]: removed session (_e8208c8a842b990b94c1a5be050eed7e<o:p></o:p></p>
</div>
</div>
</div>
</body>
</html>