<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">Hello all,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">On IdP 4.1, I recently changed from "idp.authn.flows = MFA" to "idp.authn.flows = SAML" for the following reason: we previously used Shibboleth as our only IdP, but now we use it only as a proxy between our
new primary IdP (Okta) and any SPs in the InCommon Federation which cannot work with Okta directly. I used
<a href="https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1282539600/SAMLAuthnConfiguration">
https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1282539600/SAMLAuthnConfiguration</a> and
<a href="https://shibboleth.atlassian.net/wiki/spaces/KB/pages/1459979597/Using+SAML+Proxying+to+another+IdP">
https://shibboleth.atlassian.net/wiki/spaces/KB/pages/1459979597/Using+SAML+Proxying+to+another+IdP</a> which eventually got me up and running.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">However, there's an issue I've been struggling to track down. After a successful SP-initiated login to one of these federated SPs (or even an SP we directly control, if we configure it with Shib metadata instead
of Okta metadata), eventually when the session is too old (say, some hours later) another SP-initiated login from an SP using the proxy will result in an error. The user experience is:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">1. User chooses to log into our Shib IdP from some SP.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2. The SP redirects to Shib.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">3. The Shib session is too old so it redirects to Okta.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">4. Okta might prompt for re-auth (or might not, if that already happened recently due to recently having used an SP which doesn't use Shib as a proxy) and then it redirects to Shib.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">5. Shib responds with nothing ("ERR_EMPTY_RESPONSE" in Chrome, "Secure Connection Failed" in Firefox, etc.) and idp-warn.log shows "org.eclipse.jetty.io.RuntimeIOException: org.eclipse.jetty.io.EofException:
Early EOF".<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Troubleshooting steps already taken:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">- Restarting the IdP service does not help.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">- Deleting cookies (just the domain of the Shib IdP) from the browser solves the problem temporarily, but then when that brand new IdP session gets too old, the error comes back same as before.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">- Reverting to "idp.authn.flows = MFA" clears up the problem immediately and permanently. Any browsers that so much as see the start of this MFA flow (they don't even need to actually submit to it) will no
longer have the bad cookies, so flipping it back to "idp.authn.flows = SAML" will provide trouble-free operation as well (but only temporarily).<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">After turning up the verbosity for idp-warn.log, this is the full error/trace:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2021-11-24 11:23:18,718 - ERROR [org.eclipse.jetty.io.RuntimeIOException:91] -
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">org.eclipse.jetty.io.RuntimeIOException: org.eclipse.jetty.io.EofException: Early EOF<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.server.Request.extractFormParameters(Request.java:587)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.server.Request.extractContentParameters(Request.java:531)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.server.Request.getParameters(Request.java:435)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.server.Request.getParameter(Request.java:1075)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at net.shibboleth.idp.saml.saml2.profile.impl.SAMLAuthnController.finishSAML(SAMLAuthnController.java:232)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at java.base/java.lang.reflect.Method.invoke(Method.java:566)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:197)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:141)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:106)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:894)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:808)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:87)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1063)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:963)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1006)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:909)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at javax.servlet.http.HttpServlet.service(HttpServlet.java:707)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:883)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.servlet.ServletHolder$NotAsync.service(ServletHolder.java:1452)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.servlet.ServletHolder.handle(ServletHolder.java:791)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.servlet.ServletHandler$ChainEnd.doFilter(ServletHandler.java:1626)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at net.shibboleth.idp.log.SLF4JMDCServletFilter.doFilter(SLF4JMDCServletFilter.java:76)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:193)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1601)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at net.shibboleth.utilities.java.support.net.RequestResponseContextFilter.doFilter(RequestResponseContextFilter.java:61)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:193)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1601)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:201)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1601)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:548)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:143)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:602)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:235)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:1624)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:233)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1435)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:188)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:501)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:1594)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:186)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1350)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.server.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:234)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:146)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.server.Server.handle(Server.java:516)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.server.HttpChannel.lambda$handle$1(HttpChannel.java:388)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.server.HttpChannel.dispatch(HttpChannel.java:633)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:380)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.server.HttpChannelOverHttp.earlyEOF(HttpChannelOverHttp.java:237)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.http.HttpParser.parseNext(HttpParser.java:1614)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.server.HttpConnection.parseRequestBuffer(HttpConnection.java:370)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:267)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:311)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:105)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.io.ssl.SslConnection$DecryptedEndPoint.onFillable(SslConnection.java:540)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.io.ssl.SslConnection.onFillable(SslConnection.java:395)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.io.ssl.SslConnection$2.succeeded(SslConnection.java:161)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:105)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.io.ChannelEndPoint$1.run(ChannelEndPoint.java:104)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.runTask(EatWhatYouKill.java:336)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.doProduce(EatWhatYouKill.java:313)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.tryProduce(EatWhatYouKill.java:171)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.run(EatWhatYouKill.java:129)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:383)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:882)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:1036)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at java.base/java.lang.Thread.run(Thread.java:829)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Caused by: org.eclipse.jetty.io.EofException: Early EOF<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.server.HttpInput$3.getError(HttpInput.java:1187)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.server.HttpInput$3.noContent(HttpInput.java:1175)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.server.HttpInput.read(HttpInput.java:333)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.server.HttpInput.read(HttpInput.java:270)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.util.UrlEncoded.decodeUtf8To(UrlEncoded.java:485)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.util.UrlEncoded.decodeTo(UrlEncoded.java:577)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.eclipse.jetty.server.Request.extractFormParameters(Request.java:582)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> ... 74 common frames omitted<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">With so many java files and line numbers mentioned, any ideas about where to look next would be greatly appreciated. Happy Thanksgiving!<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Michael<o:p></o:p></span></p>
</div>
</body>
</html>