<div dir="ltr">Thanks Spencer! And I did hear back that users are able to log in and maintain a session. I greatly appreciate your assistance. <br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Apr 13, 2020 at 7:23 AM Spencer Thomas <<a href="mailto:Spencer.Thomas@ithaka.org">Spencer.Thomas@ithaka.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_-3468363262151991112WordSection1">
<p class="MsoNormal">If you are using SSL all the way through to your SP, you should set those differently, as indicated in the messages.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div style="border-color:rgb(181,196,223) currentcolor currentcolor;border-style:solid none none;border-width:1pt medium medium;padding:3pt 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12pt;color:black">From: </span></b><span style="font-size:12pt;color:black">users <<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a>> on behalf of Cathy Scott <<a href="mailto:cathystill@gmail.com" target="_blank">cathystill@gmail.com</a>><br>
<b>Reply-To: </b>Shib Users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<b>Date: </b>Monday, April 13, 2020 at 10:21 AM<br>
<b>To: </b>Shib Users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<b>Subject: </b>Re: Shibboleth SP session storage issue<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<div>
<p class="MsoNormal">Thanks so much for the quick response, Spencer. I'll see if that resolves the matter.
<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Follow-up question. After making the change, I get these WARNs. Are these be concerning?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">2020-04-13 09:09:37 WARN Shibboleth.Application : custom cookieProps setting should include "; secure" for SSL/TLS-only usage<br>
2020-04-13 09:09:37 WARN Shibboleth.Application : handlerSSL should be enabled for SSL/TLS-enabled web sites<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Thanks again,<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Cathy<u></u><u></u></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">On Mon, Apr 13, 2020 at 7:02 AM Spencer Thomas <<a href="mailto:Spencer.Thomas@ithaka.org" target="_blank">Spencer.Thomas@ithaka.org</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border-color:currentcolor currentcolor currentcolor rgb(204,204,204);border-style:none none none solid;border-width:medium medium medium 1pt;padding:0in 0in 0in 6pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal">Cathy, This may or may not be your issue. When we upgraded from SP2 to SP3, we had to make changes to several config files. We had several symptoms, but one of them looked very
much like what you are reporting.<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">In shibboleth2.xml,
<u></u><u></u></p>
<p class="MsoNormal"> <Sessions checkAddress="false" handlerSSL="false" lifetime="28800" relayState="ss:mem" timeout="3600"><u></u><u></u></p>
<p class="MsoNormal">changed to<u></u><u></u></p>
<p class="MsoNormal"> <Sessions checkAddress="false" lifetime="28800" relayState="ss:mem" timeout="3600" redirectLimit="host" cookieProps="; path=/; HttpOnly" handlerSSL="false" consistentAddress="false"><u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">Some of these are unique to our setup, such as handlerSSL=”false” because we are inside a VPN where SSL is handled at the boundary.
<u></u><u></u></p>
<p class="MsoNormal">consistentAddress=”false” because we are fronted by an AWS ELB and requests can come from multiple apparent IP addresses – this was critical to getting it to work consistently.<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">Also important, because we are using AJP to connect to our back-end Java app from Apache was this change to the Tomcat server.xml.
<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">- <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" tomcatAuthentication="false"/><u></u><u></u></p>
<p class="MsoNormal">+ <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" tomcatAuthentication="false" secretRequired="false" allowedRequestAttributesPattern=".*"/><u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal"><b>--</b><u></u><u></u></p>
<p class="MsoNormal"><b>Spencer Thomas<br>
</b>Technical Architect <b>/</b> JSTOR and Artstor<br>
<a href="https://www.ithaka.org/" target="_blank"><span style="color:rgb(5,99,193)">ITHAKA</span></a> <b>/</b> 301 E. Liberty St, Suite 250, Ann Arbor, MI 48104<br>
Email: <a href="mailto:Spencer.Thomas@ithaka.org" target="_blank"><span style="color:rgb(5,99,193)">Spencer.Thomas@ithaka.org</span></a><u></u><u></u></p>
<p class="MsoNormal">Voicemail: 734-887-7004<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<div style="border-style:solid none none;border-width:1pt medium medium;padding:3pt 0in 0in;border-color:currentcolor">
<p class="MsoNormal"><b><span style="font-size:12pt;color:black">From:
</span></b><span style="font-size:12pt;color:black">users <<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a>> on behalf of Cathy Scott
<a href="mailto:cathystill@gmail.com" target="_blank">cathystill@gmail.com</a></span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:12pt;color:black"><br>
<b>Reply-To: </b>Shib Users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<b>Date: </b>Monday, April 13, 2020 at 9:40 AM<br>
<b>To: </b>Shib Users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<b>Subject: </b>Shibboleth SP session storage issue</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<div>
<p class="MsoNormal">Hello all,<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Hoping to get assistance with a session state issue. Users are successfully authenticating but the session is almost immediately removed. Shib SP v3.0.4.1, upgraded from v2. Here
are selected log examples. Any assistance would be greatly appreciated, thanks.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">native_warn.log<br>
2020-04-13 07:31:36 ERROR Shibboleth.Apache [2372] shib_check_user: Unable to obtain session to export to request.<br>
2020-04-13 07:33:14 ERROR Shibboleth.Listener [2372] shib_check_user [default]: remoted message returned an error: Your session is not available in the session store, and you must re-authenticate.<br>
2020-04-13 07:42:59 ERROR Shibboleth.Apache [2372] shib_handler: Failure sending remoted message (default/SAML2/POST).<br>
2020-04-13 07:43:31 ERROR Shibboleth.Apache [2372] shib_check_user: Failure sending remoted message (set::RelayState).<br>
<br>
shibd.log<br>
2020-04-13 07:29:52 INFO Shibboleth.SessionCache [2] [default]: new session created: ID (_d7acbb8046b19034e92a0f7aade41ecd) IdP (<a href="https://clienturl/idp/shibboleth" target="_blank">https://clienturl/idp/shibboleth</a>) Protocol(urn:oasis:names:tc:SAML:2.0:protocol)
Address (xxx.xxx.71.6)<br>
2020-04-13 07:29:53 INFO Shibboleth.SessionCache [2] [default]: removed session (_d7acbb8046b19034e92a0f7aade41ecd)<br>
2020-04-13 07:31:24 INFO Shibboleth.SessionCache [4] [default]: new session created: ID (_f140df61cc28d15ba00aac901ad6e131) IdP (<a href="https://clienturl/idp/shibboleth" target="_blank">https://clienturl/idp/shibboleth</a>) Protocol(urn:oasis:names:tc:SAML:2.0:protocol)
Address (xxx.xxx.71.6)<br>
2020-04-13 07:31:27 INFO Shibboleth.SessionCache [4] [default]: removed session (_f140df61cc28d15ba00aac901ad6e131)<br>
2020-04-13 08:13:43 INFO Shibboleth.SessionCache [1] [default]: new session created: ID (_e8208c8a842b990b94c1a5be050eed7e) IdP (<a href="https://clienturl/idp/shibboleth" target="_blank">https://clienturl/idp/shibboleth</a>) Protocol(urn:oasis:names:tc:SAML:2.0:protocol)
Address (xxx.xxx.71.28)<br>
2020-04-13 08:13:44 INFO Shibboleth.SessionCache [4] [default]: removed session (_e8208c8a842b990b94c1a5be050eed7e)<br>
2020-04-13 08:13:44 INFO Shibboleth.SessionCache [4] [default]: session (ID: _e8208c8a842b990b94c1a5be050eed7e) no longer in storage<br>
2020-04-13 08:13:44 INFO Shibboleth.SessionCache [4] [default]: removed session (_e8208c8a842b990b94c1a5be050eed7e<u></u><u></u></p>
</div>
</div>
</div>
</div>
<p class="MsoNormal">-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" target="_blank">
https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">
users-unsubscribe@shibboleth.net</a><u></u><u></u></p>
</blockquote>
</div>
</div>
</div>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a></blockquote></div>