<div dir="ltr">I should have added that I looked at posts by others who have had similar issues and for them it seems to have been SameSite. I'll need to read up on that but based on the little I know so far, I wouldn't think it would affect only a single SP, would it?<div><br></div><div>Jason</div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Nov 11, 2022 at 11:39 AM Jason Rotunno <<a href="mailto:jrotunno@swarthmore.edu">jrotunno@swarthmore.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">So we have a service provider that uses CAS to authenticate against our Shib 4 instance. Apparently, it stopped working sometime over the summer but the users only just now got around to reporting it to us:<div><ol><li>Users browse to the SP, click the login link, and are redirected to our IdP.</li><li>They perform password authentication, are redirected to Duo, and authenticate via a push</li><li>They're then redirected back to Shib. At this point the stale request error appears.</li></ol>The logs show what I'm sure many of us have seen before:<br><br></div><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div>2022-11-11 10:54:10,956 - ERROR [net.shibboleth.idp.authn.ExternalAuthenticationException:91] - [104.16.99.52] - </div><div>net.shibboleth.idp.authn.ExternalAuthenticationException: Error retrieving flow conversation</div><div> at net.shibboleth.idp.authn.ExternalAuthentication.getProfileRequestContext(ExternalAuthentication.java:227)</div><div>Caused by: org.springframework.webflow.execution.repository.NoSuchFlowExecutionException: No flow execution could be found with key 'e2s2' -- perhaps this executing flow has ended or expired? This could happen if your users are relying on browser history (typically via the back button) that references ended flows.</div><div> at org.springframework.webflow.execution.repository.support.AbstractFlowExecutionRepository.getConversation(AbstractFlowExecutionRepository.java:172)</div><div>Caused by: org.springframework.webflow.conversation.NoSuchConversationException: No conversation could be found with id '2' -- perhaps this conversation has ended? </div><div> at org.springframework.webflow.conversation.impl.ConversationContainer.getConversation(ConversationContainer.java:126)</div></blockquote><div><br>I turned up logging for spring and noticed this:<br><br></div><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div>2022-11-11 11:02:22,342 - DEBUG [org.springframework.web.servlet.DispatcherServlet:119] - [104.16.99.52] - <b>GET "/idp/profile/Authn/Duo/2FA/duo-callback?state=<something>&code=<other>", parameters={masked}</b></div><div>2022-11-11 11:02:22,342 - DEBUG [org.springframework.webflow.mvc.servlet.FlowHandlerMapping:114] - [104.16.99.52] - <b>No flow mapping found for request with URI '/idp/profile/Authn/Duo/2FA/duo-callback'</b></div><div>2022-11-11 11:02:22,342 - DEBUG [org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerMapping:522] - [104.16.99.52] - Mapped to net.shibboleth.idp.plugin.authn.duo.impl.DuoOIDCAuthnController#authorizationCallback(HttpServletRequest, HttpServletResponse)</div><div>2022-11-11 11:02:22,342 - DEBUG [org.springframework.webflow.execution.repository.impl.DefaultFlowExecutionRepository:106] - [104.16.99.52] - Getting flow execution with key 'e5s3'</div><div>2022-11-11 11:02:22,342 - ERROR [net.shibboleth.idp.authn.ExternalAuthenticationException:91] - [104.16.99.52] - </div><div>2022-11-11 11:02:22,342 - DEBUG [org.springframework.web.servlet.DispatcherServlet:1349] - [104.16.99.52] - Using resolved error view: ModelAndView [view="error"; model={exception=net.shibboleth.idp.authn.ExternalAuthenticationException: Error retrieving flow conversation, request=org.apache.catalina.connector.RequestFacade@1328262b, encoder=class net.shibboleth.utilities.java.support.codec.HTMLEncoder, springContext=Root WebApplicationContext, started on Wed Oct 26 14:18:57 EDT 2022, response=org.apache.catalina.connector.ResponseFacade@35a01e83}]</div><div>2022-11-11 11:02:22,342 - DEBUG [org.springframework.web.servlet.DispatcherServlet:1131] - [104.16.99.52] - Completed 200 OK</div></blockquote><div><br>This happens during every login attempt, in Firefox and Chrome, and on Windows and Linux. I'm at a loss so I'm hoping someone can provide some help.<br><br>Thanks,<br>Jason<br clear="all"><div><br></div>-- <br><div dir="ltr"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><pre cols="72">Jason Rotunno
System & Security Administrator
Swarthmore College
500 College Ave
Swarthmore, PA 19081
610.328.8505<br></pre><pre cols="72"><b>VERIFY before you click!!</b>
- Attackers make their emails look like they come from someone they don't.
- Attackers make links look like they go to websites they don't.
- Attackers disguise malware as receipts, invoices, faxes, etc.</pre><pre cols="72">Forward suspicious emails to <a href="mailto:phishing@swarthmore.edu" style="font-family:Arial,Helvetica,sans-serif" target="_blank">phishing@swarthmore.edu</a><span style="font-family:Arial,Helvetica,sans-serif">.</span></pre></div></div></div></div></div></div></div></div></div></div></div></div></div></div>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><pre cols="72">Jason Rotunno
System & Security Administrator
Swarthmore College
500 College Ave
Swarthmore, PA 19081
610.328.8505<br></pre><pre cols="72"><b>VERIFY before you click!!</b>
- Attackers make their emails look like they come from someone they don't.
- Attackers make links look like they go to websites they don't.
- Attackers disguise malware as receipts, invoices, faxes, etc.</pre><pre cols="72">Forward suspicious emails to <a href="mailto:phishing@swarthmore.edu" style="font-family:Arial,Helvetica,sans-serif" target="_blank">phishing@swarthmore.edu</a><span style="font-family:Arial,Helvetica,sans-serif">.</span></pre></div></div></div></div></div></div></div></div></div></div></div></div>