<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">
<blockquote type="cite">
<pre style="text-wrap-mode: wrap; font-variant-ligatures: normal; orphans: 2; widows: 2; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">><i> Everything works fine except for sometimes, when many
</i>><i> students are logging in at the same time to the same SP.
</i>
That sounds like a race condition, but it's too early to assume where.
><i> Users also get the message about "Web Login Service - Stale
</i>><i> Request" on the login page and never get a chance to log in.
</i>
That goes hand in hand if there's actually no state token, the token value is how the IdP recovers the right conversation to resume after it comes back from the OP.
Yes, so far we do understand that the state parameter is used to identify the ongoing session.
><i> Does anyone have any hint on where to look for further error
</i>><i> investigation.
</i>
You should be at minimum determining if the responses do in fact have a state token or not from web logs.
We are trying to record a session when this happens, problem is that it only occurs under certain conditions and when it does it is necessary to get this working again so time for problem solving is short.
</pre>
</blockquote>
<div>Do you have any historical web logs that show requests to the RP’s callback endpoint? For example, to the path:</div>
<div><br>
</div>
<span class="url-filename">GET idp/profile/Authn/OIDC/RP/callback</span>
<div><br>
</div>
<div>If so, it should contain the ‘code’ and ’state’ query parameters, such as: </div>
<div><br>
<div>GET idp/profile/Authn/OIDC/RP/callback?code=SplxlOBeZQQYbYS6WxSbIA&state=af0ifjsldkj</div>
<div><br>
</div>
<div>It seems to be missing the state, but if you can check they exist in the request, that would get us further. You may have asked the OP to POST the response back by configuring the property:</div>
<div><br>
</div>
<div>idp.authn.oidc.rp.client.responseMode = form_post</div>
<div><br>
</div>
<div>In which case you would not see them in the URL. But that is not the default.</div>
<div><br>
</div>
<div>Phil</div>
<div><br>
<blockquote type="cite">
<pre style="text-wrap-mode: wrap; font-variant-ligatures: normal; orphans: 2; widows: 2; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">
As far as we know the only thing resolving this is to restart the server running shibboleth.
We have tried to restart apache, tomcat, passport on the gluu-server and nothing seems to resolve the problem.
Any ideas are welcome!
Regards Tomas</pre>
</blockquote>
</div>
</div>
<mc type="body"><font size="1"><font face="Corbel"><br>
<p>Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under company number. 05747339, VAT number GB 197 0632 86. Jisc’s registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.<br>
<br>
</p>
<p>Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 02881024, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.<br>
<br>
</p>
<p>Jisc Commercial Limited is a wholly owned Jisc subsidiary and a company limited by shares which is registered in England under company number 09316933, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.<br>
<br>
</p>
<p>For more details on how Jisc handles your data see our privacy notice here: https://www.jisc.ac.uk/website/privacy-notice</p>
</font></font>
</body>
</html>