<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">If you are using SSL all the way through to your SP, you should set those differently, as indicated in the messages.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">users <users-bounces@shibboleth.net> on behalf of Cathy Scott <cathystill@gmail.com><br>
<b>Reply-To: </b>Shib Users <users@shibboleth.net><br>
<b>Date: </b>Monday, April 13, 2020 at 10:21 AM<br>
<b>To: </b>Shib Users <users@shibboleth.net><br>
<b>Subject: </b>Re: Shibboleth SP session storage issue<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal">Thanks so much for the quick response, Spencer. I'll see if that resolves the matter.
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Follow-up question. After making the change, I get these WARNs. Are these be concerning?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">2020-04-13 09:09:37 WARN Shibboleth.Application : custom cookieProps setting should include "; secure" for SSL/TLS-only usage<br>
2020-04-13 09:09:37 WARN Shibboleth.Application : handlerSSL should be enabled for SSL/TLS-enabled web sites<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thanks again,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Cathy<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Mon, Apr 13, 2020 at 7:02 AM Spencer Thomas <<a href="mailto:Spencer.Thomas@ithaka.org">Spencer.Thomas@ithaka.org</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Cathy, This may or may not be your issue. When we upgraded from SP2 to SP3, we had to make changes to several config files. We had several symptoms, but one of them looked very
much like what you are reporting.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">In shibboleth2.xml,
<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <Sessions checkAddress="false" handlerSSL="false" lifetime="28800" relayState="ss:mem" timeout="3600"><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">changed to<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <Sessions checkAddress="false" lifetime="28800" relayState="ss:mem" timeout="3600" redirectLimit="host" cookieProps="; path=/; HttpOnly" handlerSSL="false" consistentAddress="false"><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Some of these are unique to our setup, such as handlerSSL=”false” because we are inside a VPN where SSL is handled at the boundary.
<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">consistentAddress=”false” because we are fronted by an AWS ELB and requests can come from multiple apparent IP addresses – this was critical to getting it to work consistently.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Also important, because we are using AJP to connect to our back-end Java app from Apache was this change to the Tomcat server.xml.
<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">- <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" tomcatAuthentication="false"/><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">+ <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" tomcatAuthentication="false" secretRequired="false" allowedRequestAttributesPattern=".*"/><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b>--</b><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b>Spencer Thomas<br>
</b>Technical Architect <b>/</b> JSTOR and Artstor<br>
<a href="https://www.ithaka.org/" target="_blank"><span style="color:#0563C1">ITHAKA</span></a> <b>/</b> 301 E. Liberty St, Suite 250, Ann Arbor, MI 48104<br>
Email: <a href="mailto:Spencer.Thomas@ithaka.org" target="_blank"><span style="color:#0563C1">Spencer.Thomas@ithaka.org</span></a><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Voicemail: 734-887-7004<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<div style="border:none;border-top:solid windowtext 1.0pt;padding:3.0pt 0in 0in 0in;border-color:currentcolor currentcolor">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span style="font-size:12.0pt;color:black">From:
</span></b><span style="font-size:12.0pt;color:black">users <<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a>> on behalf of Cathy Scott
<a href="mailto:cathystill@gmail.com" target="_blank">cathystill@gmail.com</a></span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:12.0pt;color:black"><br>
<b>Reply-To: </b>Shib Users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<b>Date: </b>Monday, April 13, 2020 at 9:40 AM<br>
<b>To: </b>Shib Users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<b>Subject: </b>Shibboleth SP session storage issue</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Hello all,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Hoping to get assistance with a session state issue. Users are successfully authenticating but the session is almost immediately removed. Shib SP v3.0.4.1, upgraded from v2. Here
are selected log examples. Any assistance would be greatly appreciated, thanks.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">native_warn.log<br>
2020-04-13 07:31:36 ERROR Shibboleth.Apache [2372] shib_check_user: Unable to obtain session to export to request.<br>
2020-04-13 07:33:14 ERROR Shibboleth.Listener [2372] shib_check_user [default]: remoted message returned an error: Your session is not available in the session store, and you must re-authenticate.<br>
2020-04-13 07:42:59 ERROR Shibboleth.Apache [2372] shib_handler: Failure sending remoted message (default/SAML2/POST).<br>
2020-04-13 07:43:31 ERROR Shibboleth.Apache [2372] shib_check_user: Failure sending remoted message (set::RelayState).<br>
<br>
shibd.log<br>
2020-04-13 07:29:52 INFO Shibboleth.SessionCache [2] [default]: new session created: ID (_d7acbb8046b19034e92a0f7aade41ecd) IdP (<a href="https://clienturl/idp/shibboleth" target="_blank">https://clienturl/idp/shibboleth</a>) Protocol(urn:oasis:names:tc:SAML:2.0:protocol)
Address (xxx.xxx.71.6)<br>
2020-04-13 07:29:53 INFO Shibboleth.SessionCache [2] [default]: removed session (_d7acbb8046b19034e92a0f7aade41ecd)<br>
2020-04-13 07:31:24 INFO Shibboleth.SessionCache [4] [default]: new session created: ID (_f140df61cc28d15ba00aac901ad6e131) IdP (<a href="https://clienturl/idp/shibboleth" target="_blank">https://clienturl/idp/shibboleth</a>) Protocol(urn:oasis:names:tc:SAML:2.0:protocol)
Address (xxx.xxx.71.6)<br>
2020-04-13 07:31:27 INFO Shibboleth.SessionCache [4] [default]: removed session (_f140df61cc28d15ba00aac901ad6e131)<br>
2020-04-13 08:13:43 INFO Shibboleth.SessionCache [1] [default]: new session created: ID (_e8208c8a842b990b94c1a5be050eed7e) IdP (<a href="https://clienturl/idp/shibboleth" target="_blank">https://clienturl/idp/shibboleth</a>) Protocol(urn:oasis:names:tc:SAML:2.0:protocol)
Address (xxx.xxx.71.28)<br>
2020-04-13 08:13:44 INFO Shibboleth.SessionCache [4] [default]: removed session (_e8208c8a842b990b94c1a5be050eed7e)<br>
2020-04-13 08:13:44 INFO Shibboleth.SessionCache [4] [default]: session (ID: _e8208c8a842b990b94c1a5be050eed7e) no longer in storage<br>
2020-04-13 08:13:44 INFO Shibboleth.SessionCache [4] [default]: removed session (_e8208c8a842b990b94c1a5be050eed7e<o:p></o:p></p>
</div>
</div>
</div>
</div>
<p class="MsoNormal">-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" target="_blank">
https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">
users-unsubscribe@shibboleth.net</a><o:p></o:p></p>
</blockquote>
</div>
</div>
</body>
</html>