<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">Hi All,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">I forgot to mention that I also updated our load balancer to do cookie and source ip session persistence.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">-Chris<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="color:black">From: </span></b><span style="color:black">users <users-bounces@shibboleth.net> on behalf of Christopher Bland <chris@fdu.edu><br>
<b>Reply-To: </b>Shib Users <users@shibboleth.net><br>
<b>Date: </b>Wednesday, May 27, 2020 at 4:17 PM<br>
<b>To: </b>Shib Users <users@shibboleth.net><br>
<b>Subject: </b>[External]IDP v3.4 Duo Stale Requests<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt">Hi All,</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">I am running clustered IDP servers behind a load-balancer. Session information is shared across IDPs using Memcache. My Shibboleth IDPs are v3.4.4. We recently rolled out Duo and have had an increase in
Stale Requests. I have combed through the archives trying to find possible solutions. What I have been able to identify is that the Stale Requests seem to be happening when users do Push authentications. Based on previous posts I have added the JSESSIONID
to the logs to verify the session isn’t getting lost. I have had users try across different browsers and platforms. I have confirmed by screensharing with my users that they are not hitting the back button or using a shortcut. In some instances I have been
able to have the user open a private browser/incognito window and have had inconsistent success replicating the issue. I am seeing the following in my logs:</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2020-05-27 07:38:05,405 - 132.238.11.200 [node01ilzet8g9hq62h752mrpy6u6369434] - INFO [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstJAAS:247] - Profile</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Action ValidateUsernamePasswordAgainstJAAS: Login by 'cbland@fdu.edu' via 'ShibUserPassAuth' succeeded</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2020-05-27 07:38:08,332 - 132.238.11.200 [node01ilzet8g9hq62h752mrpy6u6369434] - INFO [net.shibboleth.idp.authn.duo.impl.ValidateDuoWebResponse:200] - Profile Action ValidateDuoWebResponse: Duo authentication
succeeded for 'cbland@fdu.edu'</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2020-05-27 07:38:08,435 - 132.238.11.200 [node01ilzet8g9hq62h752mrpy6u6369434] - INFO [Shibboleth-Audit.SSO:275] - 20200527T113808Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_3ee4e18947226a1dc52861bf4079c282|https://xxxxxx.fdu.edu/shibboleth-sp|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://idp.fdu.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_05b472163ea0d3f6a8f2493727a21d0a|cbland@fdu.edu|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|displayName,surname,givenName,userPrincipalName|AAdzZWNyZXQ1k+Dh6fEfM90BP/gGDCWqE1hkWHe4CHsMINSFrvN18M3Ms9lO558VrKldF5GONRHir0KI8SALICv8L8QUtVRwDGzqd7smTI6YTpKhqANzUs+KHBWVHYjiLoAzEID8oLQZpJJwNdKS23/CQ6+J20zfKg==|_501fec3c418746ad324642d44bbcecf5|true</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2020-05-27 07:38:08,437 - 132.238.11.200 [node01ilzet8g9hq62h752mrpy6u6369434] - ERROR [org.springframework.webflow.execution.repository.NoSuchFlowExecutionException:76] -</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">org.springframework.webflow.execution.repository.NoSuchFlowExecutionException: No flow execution could be found with key 'e1s2' -- perhaps this executing flow has ended or expired? This could happen if your
users are relying on browser history (typically via the back button) that references ended flows.</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.springframework.webflow.execution.repository.support.AbstractFlowExecutionRepository.getConversation(AbstractFlowExecutionRepository.java:172)</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Caused by: org.springframework.webflow.conversation.NoSuchConversationException: No conversation could be found with id '1' -- perhaps this conversation has ended?</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.springframework.webflow.conversation.impl.ConversationContainer.getConversation(ConversationContainer.java:126)</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2020-05-27 07:38:08,438 - 132.238.11.200 [node01ilzet8g9hq62h752mrpy6u6369434] - WARN [net.shibboleth.ext.spring.error.ExtendedMappingExceptionResolver:136] - Resolved [org.springframework.webflow.execution.repository.NoSuchFlowExecutionException:
No flow execution could be found with key 'e1s2' -- perhaps this executing flow has ended or expired? This could happen if your users are relying on browser history (typically via the back button) that references ended flows.] to ModelAndView: reference to
view with name 'error'; model is {exception=org.springframework.webflow.execution.repository.NoSuchFlowExecutionException: No flow execution could be found with key 'e1s2' -- perhaps this executing flow has ended or expired? This could happen if your users
are relying on browser history (typically via the back button) that references ended flows., request=Request(POST https://idp.fdu.edu/idp/profile/SAML2/Redirect/SSO?execution=e1s2)@218eaf21, encoder=class net.shibboleth.utilities.java.support.codec.HTMLEncoder,
springContext=Root WebApplicationContext: startup date [Sun May 24 13:53:39 EDT 2020]; root of context hierarchy}</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">All suggestions welcome.</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Thank you in advance,</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">-Chris</span><o:p></o:p></p>
</div>
</body>
</html>