<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Georgia;
panose-1:2 4 5 2 5 4 5 2 3 3;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:Consolas;}
p.CodeStyle, li.CodeStyle, div.CodeStyle
{mso-style-name:CodeStyle;
mso-style-link:"CodeStyle Char";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Georgia",serif;}
span.CodeStyleChar
{mso-style-name:"CodeStyle Char";
mso-style-link:CodeStyle;
font-family:"Georgia",serif;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;
font-weight:normal;
font-style:normal;
text-decoration:none none;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">Check to see if you are running into a SameSite cookie issue.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><a href="https://wiki.shibboleth.net/confluence/display/IDP4/SameSite">https://wiki.shibboleth.net/confluence/display/IDP4/SameSite</a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="margin-left:.5in"><b><span style="font-size:11.0pt">From:</span></b><span style="font-size:11.0pt"> users <users-bounces@shibboleth.net>
<b>On Behalf Of </b>Hucker, Taylor<br>
<b>Sent:</b> Monday, March 01, 2021 2:58 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> [EXTERNAL] Re: Error on IdP v4 after cutover<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt">I can replicate the issue by starting a clean browser everytime.<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt">If I modify my host file to go to specific back-end nodes I see no issue.<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt">When the error occurs this is my last line in idp-process.log<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt">2021-03-01 12:57:49,927 - 65.36.72.77 - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:369] - Profile Action SelectAuthenticationFlow: Selecting inactive authentication
flow authn/External<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt">When I get past the error I see the same line then the following.<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt">2021-03-01 13:47:25,577 - 10.254.0.2 - INFO [net.unicon.idp.externalauth.AuthenticatedNameTranslator:61] - Created an IdP subject instance with principals containing attributes for
thucker <o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt">2021-03-01 13:47:25,634 - 10.254.0.2 - INFO [net.shibboleth.idp.authn.impl.ValidateExternalAuthentication:176] - Profile Action ValidateExternalAuthentication: External authentication
succeeded for Subject<o:p></o:p></span></p>
<div>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;color:black">Could it be an issue with the plugin? <o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in;background:white"><span style="font-size:11.0pt;color:black">Thanks,<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in;background:white"><span style="font-size:11.0pt;color:black">Taylor<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in;background:white"><b><span style="font-size:11.0pt;font-family:"Tahoma",sans-serif;color:black"> </span></b><span style="font-size:11.0pt;color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in;background:white"><b><span style="font-size:11.0pt;font-family:"Tahoma",sans-serif;color:black">--------------------------------</span></b><span style="font-size:11.0pt;color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in;background:white"><b><span style="font-size:11.0pt;font-family:"Tahoma",sans-serif;color:black">Taylor Hucker</span></b><span style="font-size:10.0pt;font-family:"Tahoma",sans-serif;color:black"><br>
Applications System Administrator<br>
Texas A&M University - Corpus Christi<br>
</span><span style="color:black"><a href="mailto:Taylor.Hucker@tamucc.edu"><span style="font-size:11.0pt;background:white">Taylor.Hucker@tamucc.edu</span></a></span><span style="font-size:11.0pt;color:black"><o:p></o:p></span></p>
</div>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:12.0pt;margin-left:.5in">
<b><span style="color:black">From: </span></b><span style="color:black">users <<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a>> on behalf of Hucker, Taylor <<a href="mailto:taylor.hucker@tamucc.edu">taylor.hucker@tamucc.edu</a>><br>
<b>Date: </b>Monday, March 1, 2021 at 12:24 PM<br>
<b>To: </b>Shib Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<b>Subject: </b>Error on IdP v4 after cutover<o:p></o:p></span></p>
</div>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt">2/25 we moved our IdP v4 environment into production.</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:12.0pt;margin-left:.5in">
<span style="font-size:11.0pt">It was noticed today when going to an SP this error page appears, “Sorry, it looks like there is a problem finding your session. This can happen if you waited too long on the login page, or if you were redirected to a different
server that issued the original request. This error usually goes away if you try accessing your desired application again.”<br>
<br>
</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt">It appears that if we access any resource (same or different) then the authentication occurs.</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;color:black">I am seeing this in the logs
</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;color:black">2021-03-01 12:05:56,299 - 151.80.19.216 - ERROR [org.springframework.webflow.execution.repository.NoSuchFlowExecutionException:74] -</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;color:black">org.springframework.webflow.execution.repository.NoSuchFlowExecutionException: No flow execution could be found with key 'e1s1' -- perhaps this executing flow has ended
or expired? This could happen if your users are relying on browser history (typically via the back button) that references ended flows.</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;color:black"> at org.springframework.webflow.execution.repository.support.AbstractFlowExecutionRepository.getConversation(AbstractFlowExecutionRepository.java:172)</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;color:black">Caused by: org.springframework.webflow.conversation.NoSuchConversationException: No conversation could be found with id '1' -- perhaps this conversation has ended?</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;color:black"> at org.springframework.webflow.conversation.impl.ConversationContainer.getConversation(ConversationContainer.java:126)</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;color:black">The issue is repeatable in every clean browser sessions on the first auth attempt.
</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;color:black">Our environemnt contains 2 nodes sitting behind F5. Currently have one node offline. We also use Unicons
</span><a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__nam12.safelinks.protection.outlook.com_-3Furl-3Dhttps-253A-252F-252Fgithub.com-252FUnicon-252Fshib-2Dcas-2Dauthn-26data-3D04-257C01-257Ctaylor.hucker-2540tamucc.edu-257Caf89ac934b694f32b2c808d8dcdf4abc-257C34cbfaf167a64781a9ca514eb2550b66-257C0-257C0-257C637502198883850863-257CUnknown-257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0-253D-257C1000-26sdata-3D6zIilOmXo67hCooULSjQst152Q-252BZ3ti6LpBi4KFYPi8-253D-26reserved-3D0&d=DwMF-g&c=CJqEzB1piLOyyvZjb8YUQw&r=YbL7Tj_EqBW9abl6xEy1bg&m=KvbPlqUF7lq0uhLqKgGbUV-xwgKarLVJKzPL0l-NixA&s=1iGuL4BCxjH2rRHWZOg950yESfb_vkDThwUywBVNT9w&e="><span style="font-size:11.0pt">https://github.com/Unicon/shib-cas-authn</span></a><span style="font-size:11.0pt;color:black">
plugin to delegate auth to CAS.</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;color:black">Any suggestions?</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in;background:white"><span style="font-size:11.0pt;color:black">Thanks,</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in;background:white"><span style="font-size:11.0pt;color:black">Taylor</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in;background:white"><b><span style="font-size:11.0pt;font-family:"Tahoma",sans-serif;color:black"> </span></b><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in;background:white"><b><span style="font-size:11.0pt;font-family:"Tahoma",sans-serif;color:black">--------------------------------</span></b><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in;background:white"><b><span style="font-size:11.0pt;font-family:"Tahoma",sans-serif;color:black">Taylor Hucker</span></b><span style="font-size:10.0pt;font-family:"Tahoma",sans-serif;color:black"><br>
Applications System Administrator<br>
Texas A&M University - Corpus Christi<br>
</span><span style="color:black"><a href="mailto:Taylor.Hucker@tamucc.edu"><span style="font-size:11.0pt;background:white">Taylor.Hucker@tamucc.edu</span></a></span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"> <o:p></o:p></p>
</div>
</body>
</html>