<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-ligatures:standardcontextual;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Arial",sans-serif;
color:windowtext;
font-weight:normal;
font-style:normal;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-ligatures:standardcontextual;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">Hello All,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">Our goal is to have users log into the SP on the main server
<a href="https://foo.example.com">https://foo.example.com</a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">and then be able to use that same SAML session when they visit other servers on the site like:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><a href="https://server01.foo.example.com">https://server01.foo.example.com</a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><a href="https://server02.foo.example.com">https://server02.foo.example.com</a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">The user is able to authenticate at the IdP and connect to the SP on the main server just fine. The problem is that when they go to either of the secondary servers (server01 or 02), the session
seems to be recovered but then it's immediately removed as you can see in the shibd.log entries below. I've turned on debug for every log and I don't see any reason given for the session's removal.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">All three servers have the same SP entity ID and same encryption (pem) files.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">The shibboleth2.xml file is exactly the same on all three machines.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">The sealed.keys file is also exactly the same on all three.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">All three machines are set to the same time and timezone, UTC.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">I made sure that the cookies are created for .foo.example.com so that they'd be visible in the subdomains (tested and working).<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">My main question is, how do I determine why it decided to remove the session?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">I'm watching every log in /var/log/shibboleth/ and I've checked journalctl -xe<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">shibd.log shows the recovery and then removal of the session:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">2023-05-22 21:54:15 DEBUG Shibboleth.SessionCache [1] [default]: checking for revocation of session (_b68e0b16601fc9d4f893502e467c4696)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">2023-05-22 21:54:15 DEBUG Shibboleth.SessionCache [1] [default]: attempting recovery of session (_b68e0b16601fc9d4f893502e467c4696)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">2023-05-22 21:54:15 DEBUG Shibboleth.SessionCache [1] [default]: storing recovered session (_b68e0b16601fc9d4f893502e467c4696)...<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">2023-05-22 21:54:15 DEBUG XMLTooling.StorageService [1] [default]: inserted record (session) in context (_b68e0b16601fc9d4f893502e467c4696) with expiration (1684799655)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">2023-05-22 21:54:15 DEBUG XMLTooling.StorageService [1] [default]: inserted record (UtxmRnAuGzcFGeBvnD3bSLLubHw=) in context (NameID) with expiration (1684821248)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">2023-05-22 21:54:15 INFO Shibboleth.SessionCache [1] [default]: session recovered: ID (_b68e0b16601fc9d4f893502e467c4696) IdP (<a href="https://inf01.example.com:8443/cas/idp">https://inf01.example.com:8443/cas/idp</a>)
Protocol(urn:oasis:names:tc:SAML:2.0:protocol)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">2023-05-22 21:54:15 DEBUG XMLTooling.StorageService [1] [default]: updated expiration of valid records in context (_b68e0b16601fc9d4f893502e467c4696) to (1684799655)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">2023-05-22 21:54:15 DEBUG Shibboleth.Listener [1] [default]: dispatching message (remove::StorageService::SessionCache)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">2023-05-22 21:54:15 INFO Shibboleth.SessionCache [1] [default]: removed session (_b68e0b16601fc9d4f893502e467c4696)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">2023-05-22 21:54:15 DEBUG XMLTooling.StorageService [1] [default]: inserted record (_b68e0b16601fc9d4f893502e467c4696) in context (Revoked) with expiration (1684821255)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">2023-05-22 21:54:15 INFO Shibboleth-TRANSACTION.AuthnRequest [1] [default]: ||https://inf01.example.com:8443/cas/idp||||||urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect||||||<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">Relevant sections of my shibboleth2.xml file:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><DataSealer type="Versioned" path="sealer.keys" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><SessionCache type="StorageService" StorageService="mem" cacheAssertions="false"
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"> cacheAllowance="3600" inprocTimeout="900" cleanupInterval="900"
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"> persistedAttributes="clientName firstName geoLocation serverIpAddress username (snipped list of ten more)" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><ReplayCache StorageService="mem"/><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><ApplicationDefaults entityID=<a href="https://foo.example.com/entry">https://foo.example.com/entry</a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"> REMOTE_USER="eppn subject-id pairwise-id persistent-id"
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"> cipherSuites="DEFAULT:!EXP:!LOW:!aNULL:!eNULL:!DES:!IDEA:!SEED:!RC4:!3DES:!kRSA:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><Sessions lifetime="28800" timeout="3600" relayState="ss:mem" consistentAddress="false" exportLocation=<a href="https://foo.example.com/Shibboleth.sso/GetAssertion">https://foo.example.com/Shibboleth.sso/GetAssertion</a>
checkAddress="false" handlerSSL="true" cookieProps="; domain=.foo.example.com; path=/ ; secure ; HttpOnly" redirectLimit="none" ><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">Apache is setup like this:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">AuthType shibboleth<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">ShibRequireSession On<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">require valid-user<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">Require shib-session<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">but I also tried Require shib-session instead of valid-user but that didn't fix the problem.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">Thank you for any help or pointers,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">Eric Tully<o:p></o:p></span></p>
</div>
</body>
</html>