<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">We also had an issue with Firefox (v131.0+) where SameSite=None cookies are rejected when there is no Secure attribute included.<div><br></div><div>This bit us because the AWS load balancer cookies which provided “stickiness” failed the test (the SSL we terminated in the ELB and the apache layer wasn’t seeing it as “secure”…yes, this is overly complicated). It was addressed in the apache configs to force “Secure” on the two cookies in question.<br id="lineBreakAtBeginningOfMessage"><div>
<div><br>//<br>John Pfeifer<br>Division of Information Technology<br>University of Maryland, College Park</div>
</div>
<div><br><blockquote type="cite"><div>On Jan 30, 2025, at 2:51 PM, IAM David Bantz via users <users@shibboleth.net> wrote:</div><br class="Apple-interchange-newline"><div><div dir="ltr">You did note that, in addition to users attempting to use the browser "back" button, that the same error can be triggered by using a cached, bookmarked, or other incorrect URL. I've observed many attempts to grab the URL displayed in the browser during a sign-in sequence, typically of the form:<br><a href="https://myidp.myu.edu/idp/profile/SAML2/POST/SSO?execution=e1s1">https://myidp.myu.edu/idp/profile/SAML2/POST/SSO?execution=e1s1</a><br>which is, of course, not a proper request initiator.<br><br>A frustrating variant we've noticed occurs when users have relied on a google search for the intended resource URL, and for whatever reason, the google result is not in fact the proper URL to initiate sign-in.<br><br>All to say you want to ensure your users are initiating the SSO sign-in from the proper functioning URL, not relying on any other process to guess a starting URL. If attempting to resolve a user's issue, they and you need to know exactly what was entered in the address box or what link was clicked on, and not rely on a displayed address(es) intermediate in the sign-in process.<br><br>David St Pierre Bantz<br>U Alaska IAM</div><br><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">On Thu, Jan 30, 2025 at 10:27 AM Lee, Dong via users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="msg5247510946082459703">
<div lang="EN-US" style="overflow-wrap: break-word;">
<div class="m_5247510946082459703WordSection1"><p class="MsoNormal"><span style="font-size:11pt">Hi,<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11pt">We have observed an uptick in reports from users receiving the following error message. They report not clicking the back button, and some also report this being their first login attempt of the day.<u></u><u></u></span></p><p class="MsoNormal"><b><span style="font-size:11pt"><u></u> <u></u></span></b></p><p class="MsoNormal"><b><span style="font-size:11pt">Error Message to Users:</span></b><span style="font-size:11pt"><u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt">You may be seeing this page because you used the Back button while browsing a secure web site or application. Alternatively, you may have mistakenly bookmarked the web login form instead of the actual web
site you wanted to bookmark or used a link created by somebody else who made the same mistake.<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt">Left unchecked, this can cause errors on some browsers or result in you returning to the web site you tried to leave, so this page is presented instead.<u></u><u></u></span></p><p class="MsoNormal"><b><span style="font-size:11pt"><u></u> <u></u></span></b></p><p class="MsoNormal"><b><span style="font-size:11pt">Log Entry:</span></b><span style="font-size:11pt"><u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt">ERROR [net.shibboleth.idp.authn.ExternalAuthenticationException:91] – x.x.x.x - net.shibboleth.idp.authn.ExternalAuthenticationException: Error retrieving flow conversation<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt"> at net.shibboleth.idp.authn.ExternalAuthentication.getProfileRequestContext(ExternalAuthentication.java:227)<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt">Caused by: org.springframework.webflow.execution.repository.NoSuchFlowExecutionException: No flow execution could be found with key 'e1s2' -- perhaps this executing flow has ended or expired? This could happen
if your users are relying on browser history (typically via the back button) that references ended flows.<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt"> at org.springframework.webflow.execution.repository.support.AbstractFlowExecutionRepository.getConversation(AbstractFlowExecutionRepository.java:172)<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt">Caused by: org.springframework.webflow.conversation.NoSuchConversationException: No conversation could be found with id '1' -- perhaps this conversation has ended?<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt"> at org.springframework.webflow.conversation.impl.ConversationContainer.getConversation(ConversationContainer.java:126)<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11pt">Here are some questions:<u></u><u></u></span></p>
<ol style="margin-top:0in" start="1" type="1">
<li class="MsoNormal"><span style="font-size:11pt">Is the error message associated with the error in the log?<u></u><u></u></span></li><li class="MsoNormal"><span style="font-size:11pt">What do I need to look at, or where should I look, on the IDP servers? We have three servers behind a load balancer in Azure.<u></u><u></u></span></li><li class="MsoNormal"><span style="font-size:11pt">When working with users, we recommend clearing all browser cookies and caches. However, this does not resolve the issue.<u></u><u></u></span></li></ol><p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif">To be honest, I’m not sure what questions I should ask. If I find something in the response that matches our situation, I will post more specific follow
up questions.<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif">Thank you,<u></u><u></u></span></p><p class="MsoNormal"><span style="font-family:Calibri,sans-serif;color:rgb(31,73,125)">Dong Lee<u></u><u></u></span></p><p class="MsoNormal"><span style="font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-family:Calibri,sans-serif;color:rgb(31,73,125)">Identity Management & System Integration
<u></u><u></u></span></p><p class="MsoNormal"><span style="font-family:"Calibri Light",sans-serif;color:rgb(31,73,125)">Center for Information Technology Services
<u></u><u></u></span></p><p class="MsoNormal" style="margin-bottom:12pt"><span style="font-family:"Calibri Light",sans-serif;color:rgb(31,73,125)">University of Maryland, Baltimore<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:"Aptos Display",sans-serif;color:rgb(14,40,65)">410-706-3027<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif"><a href="mailto:dlee@umaryland.edu" target="_blank"><span style="color:rgb(5,99,193)">dlee@umaryland.edu</span></a><u></u><u></u></span></p><p class="MsoNormal"><span><u></u> <u></u></span></p><p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" rel="noreferrer" target="_blank">https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</div></blockquote></div>
-- <br>For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw<br>To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br></div></blockquote></div><br></div></body></html>