<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=iso-8859-1"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Aptos;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Aptos",sans-serif;
mso-ligatures:standardcontextual;
mso-fareast-language:EN-US;}
span.E-MailFormatvorlage17
{mso-style-type:personal-compose;
font-family:"Aptos",sans-serif;
color:windowtext;}
..MsoChpDefault
{mso-style-type:export-only;
font-size:11.0pt;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=DE link="#467886" vlink="#96607D" style='word-wrap:break-word'><div class=WordSection1><p class=MsoNormal>Dear all,<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span lang=EN-US>we have recently encountered an outage of our IDP systems, which reads as <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>2025-06-24 07:15:08,876 - ERROR [org.apache.catalina.connector.ClientAbortException:144] -<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>org.apache.catalina.connector.ClientAbortException: java.io.IOException: Broken pipe<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at org.apache.catalina.connector.OutputBuffer.realWriteBytes(OutputBuffer.java:342)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Caused by: java.io.IOException: Broken pipe<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at java.base/sun.nio.ch.FileDispatcherImpl.write0(Native Method)” <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>in idp-warn.log.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>This is likely related to these exceptions logged in tomcat’s localhost.log:<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>24-Jun-2025 07:15:08.876 SEVERE [ajp-nio-127.0.0.1-8009-exec-323] org.apache.catalina.core.StandardWrapperValve.invoke Servlet.service() for servlet [idp] in context with path [/idp] threw exception [Request processing failed: java.lang.IllegalStateException: getOutputStream() has already been called for this response] with root cause<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> java.lang.IllegalStateException: getOutputStream() has already been called for this response<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at org.apache.catalina.connector.Response.getWriter(Response.java:526)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at org.apache.catalina.connector.ResponseFacade.getWriter(ResponseFacade.java:188)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at jakarta.servlet.ServletResponseWrapper.getWriter(ServletResponseWrapper.java:108)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at net.shibboleth.shared.spring.servlet.impl.CookieBufferingFilter$CookieBufferingHttpServletResponseProxy.getWriter(CookieBufferingFilter.java:120)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at jakarta.servlet.ServletResponseWrapper.getWriter(ServletResponseWrapper.java:108)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at net.shibboleth.shared.spring.servlet.impl.DynamicResponseHeaderFilter$ResponseProxy.getWriter(DynamicResponseHeaderFilter.java:163)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at net.shibboleth.shared.spring.velocity.VelocityView.mergeTemplate(VelocityView.java:367)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at net.shibboleth.shared.spring.velocity.VelocityView.doRender(VelocityView.java:305)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at net.shibboleth.shared.spring.velocity.VelocityView.renderMergedTemplateModel(VelocityView.java:235)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at org.springframework.web.servlet.view.AbstractTemplateView.renderMergedOutputModel(AbstractTemplateView.java:181)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at org.springframework.web.servlet.view.AbstractView.render(AbstractView.java:314)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at org.springframework.web.servlet.DispatcherServlet.render(DispatcherServlet.java:1432)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at org.springframework.web.servlet.DispatcherServlet.processDispatchResult(DispatcherServlet.java:1168)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1106)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:979)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1014)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at org.springframework.web.servlet.FrameworkServlet.doOptions(FrameworkServlet.java:950)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:599)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet..java:885)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:658)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:195)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:51)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:164)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at net.shibboleth.shared.spring.servlet.impl.ChainingFilter$Chain.doFilter(ChainingFilter.java:116)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at net.shibboleth.shared.spring.servlet.impl.RequestResponseContextFilter.runFilter(RequestResponseContextFilter.java:69)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at net.shibboleth.shared.servlet.AbstractConditionalFilter.doFilter(AbstractConditionalFilter.java:83)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at net.shibboleth.shared.spring.servlet.impl.ChainingFilter$Chain.doFilter(ChainingFilter.java:114)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at net.shibboleth.shared.spring.servlet.impl.DynamicResponseHeaderFilter.runFilter(DynamicResponseHeaderFilter.java:129)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at net.shibboleth.shared.servlet.AbstractConditionalFilter.doFilter(AbstractConditionalFilter.java:83)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at net.shibboleth.shared.spring.servlet.impl.ChainingFilter$Chain.doFilter(ChainingFilter.java:114)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at net.shibboleth.shared.spring.servlet.impl.CookieBufferingFilter.runFilter(CookieBufferingFilter.java:71)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at net.shibboleth.shared.servlet.AbstractConditionalFilter.doFilter(AbstractConditionalFilter.java:83)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at net.shibboleth.shared.spring.servlet.impl.ChainingFilter$Chain.doFilter(ChainingFilter.java:114)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at net.shibboleth.idp.conf.impl.SLF4JMDCServletFilter.runFilter(SLF4JMDCServletFilter.java:115)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at net.shibboleth.shared.servlet.AbstractConditionalFilter.doFilter(AbstractConditionalFilter.java:83)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at net.shibboleth.shared.spring.servlet.impl.ChainingFilter$Chain.doFilter(ChainingFilter.java:114)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at net.shibboleth.shared.spring.servlet.impl.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:80)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at net.shibboleth.shared.spring.servlet.impl.ChainingFilter$Chain.doFilter(ChainingFilter.java:114)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at net.shibboleth.shared.spring.servlet.impl.ChainingFilter$Chain.doFilter(ChainingFilter.java:110)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at net.shibboleth.shared.spring.servlet.impl.ChainingFilter.doFilter(ChainingFilter.java:76)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:362)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:278)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:164)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve..java:155)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve..java:90)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:598)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:116)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:93)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:666)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:344)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at org.apache.coyote.ajp.AjpProcessor.service(AjpProcessor.java:419)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:63)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:903)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1740)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:52)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1189)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:658)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread..java:63)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> at java.base/java.lang.Thread.run(Thread.java:840)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>We have encountered these exceptions occasionally since at least 2023, however only a few per day. During the outage, we accumulated many more.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>Our IDP is set up to redirect users to Entra for authorization using MFA, while attribute release is handled locally afterwards.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>To accommodate certain SPs, we had to adjust the sameSite settings recently, i.e., about 6 days before our outage:<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>idp.cookie.sameSite=None<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>idp.cookie.sameSiteCondition=shibboleth.SameSiteCondition<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>(with SameSiteCondition hopefully being benign.)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>Unfortunately, I have not been able to identify the reason triggering our outage nor has the IllegalStateException ever occurred in the dedicated system, used to develop the configuration. (The problem might be linked to load?). Currently our IDPs are running fine using this configuration.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>Am I correct in assuming the IllegalStateExceptions are causing the outage (or is vice versa) ?<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>What is causing these IllegalStateExceptions ?<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>If necessary, I will gladly provide more details/configuration settings.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>Thank you.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:DE'>Best wishes<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:DE'><o:p> </o:p></span></p><p class=MsoNormal><span style='mso-fareast-language:DE'>Marius Fuchs, MSc<o:p></o:p></span></p><p class=MsoNormal><span style='mso-fareast-language:DE'><o:p> </o:p></span></p><p class=MsoNormal><span style='mso-fareast-language:DE'>Rechenzentrum<o:p></o:p></span></p><p class=MsoNormal><span style='mso-fareast-language:DE'>Universität Würzburg<o:p></o:p></span></p><p class=MsoNormal><span style='mso-fareast-language:DE'>Am Hubland<o:p></o:p></span></p><p class=MsoNormal><span style='mso-fareast-language:DE'>97074 Würzburg<o:p></o:p></span></p><p class=MsoNormal>Germany<o:p></o:p></p></div></body></html>