I have an SP-initiated .net core 3.1 application that uses itfoxtec for the SAML authentication. The code has been implemented pretty much verbatim from the itfoxtec Git samples. It has been tested and implemented into Production, and now we have a couple random users that are encountering an endless loop during the assertionconsumerservice process. This was never encountered during testing and I am not able to repeat it myself, which makes it very difficult to diagnose and fix. Based on my investigations this appears to be a session authentication issue between the IDP and the internal SAML session – the IDP says the session is valid while the internal session says its not so they keep looping (I may not have the terminology quite right).
Admittedly I do not know SAML very well, With not being able to repeat the problem I am not sure how to go about diagnosing and correcting it. Can anyone suggest what I might do to determine the problem?
The following is a snippet from the server logs showing the looping
2024-04-29 19:46:15 10.204.33.225 POST /SAML/ACS binding=urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST 443 – 10.204.39.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/123.0.0.0+Safari/537.36 https://services.xxxyyy.ca/ 302 0 0 124
2024-04-29 19:46:15 10.204.33.225 GET / – 443 – 10.204.39.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/123.0.0.0+Safari/537.36 https://services.xxxyyy.ca/ 302 0 0 0
2024-04-29 19:46:15 10.204.33.225 GET / ReturnUrl=%2F 443 – 10.204.39.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/123.0.0.0+Safari/537.36 https://services.xxxyyy.ca/ 302 0 0 0
2024-04-29 19:46:15 10.204.33.225 GET / ReturnUrl=%2F%3FReturnUrl%3D%252F 443 – 10.204.39.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/123.0.0.0+Safari/537.36 https://services.xxxyyy.ca/ 302 0 0 0
2024-04-29 19:46:15 10.204.33.225 GET / ReturnUrl=%2F%3FReturnUrl%3D%252F%253FReturnUrl%253D%25252F 443 – 10.204.39.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/123.0.0.0+Safari/537.36 https://services.xxxyyy.ca/ 302 0 0 0
2024-04-29 19:46:15 10.204.33.225 GET / ReturnUrl=%2F%3FReturnUrl%3D%252F%253FReturnUrl%253D%25252F%25253FReturnUrl%25253D%2525252F 443 – 10.204.39.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/123.0.0.0+Safari/537.36 https://services.xxxyyy.ca/ 302 0 0 0
2024-04-29 19:46:16 10.204.33.225 GET / ReturnUrl=%2F%3FReturnUrl%3D%252F%253FReturnUrl%253D%25252F%25253FReturnUrl%25253D%2525252F%2525253FReturnUrl%2525253D%252525252F 443 – 10.204.39.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/123.0.0.0+Safari/537.36 https://services.xxxyyy.ca/ 302 0 0 0
2024-04-29 19:46:16 10.204.33.225 GET / ReturnUrl=%2F%3FReturnUrl%3D%252F%253FReturnUrl%253D%25252F%25253FReturnUrl%25253D%2525252F%2525253FReturnUrl%2525253D%252525252F%252525253FReturnUrl%252525253D%25252525252F 443 – 10.204.39.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/123.0.0.0+Safari/537.36 https://services.xxxyyy.ca/ 302 0 0 15
2024-04-29 19:46:16 10.204.33.225 GET / ReturnUrl=%2F%3FReturnUrl%3D%252F%253FReturnUrl%253D%25252F%25253FReturnUrl%25253D%2525252F%2525253FReturnUrl%2525253D%252525252F%252525253FReturnUrl%252525253D%25252525252F%25252525253FReturnUrl%25252525253D%2525252525252F 443 – 10.204.39.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/123.0.0.0+Safari/537.36 https://services.xxxyyy.ca/ 302 0 0 0
2024-04-29 19:46:16 10.204.33.225 GET / ReturnUrl=%2F%3FReturnUrl%3D%252F%253FReturnUrl%253D%25252F%25253FReturnUrl%25253D%2525252F%2525253FReturnUrl%2525253D%252525252F%252525253FReturnUrl%252525253D%25252525252F%25252525253FReturnUrl%25252525253D%2525252525252F%2525252525253FReturnUrl%2525252525253D%252525252525252F 443 – 10.204.39.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/123.0.0.0+Safari/537.36 https://services.xxxyyy.ca/ 302 0 0 15
2024-04-29 19:46:16 10.204.33.225 GET / ReturnUrl=%2F%3FReturnUrl%3D%252F%253FReturnUrl%253D%25252F%25253FReturnUrl%25253D%2525252F%2525253FReturnUrl%2525253D%252525252F%252525253FReturnUrl%252525253D%25252525252F%25252525253FReturnUrl%25252525253D%2525252525252F%2525252525253FReturnUrl%2525252525253D%252525252525252F%252525252525253FReturnUrl%252525252525253D%25252525252525252F 443 – 10.204.39.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/123.0.0.0+Safari/537.36 https://services.xxxyyy.ca/ 302 0 0 0
2024-04-29 19:46:16 10.204.33.225 GET / ReturnUrl=%2F%3FReturnUrl%3D%252F%253FReturnUrl%253D%25252F%25253FReturnUrl%25253D%2525252F%2525253FReturnUrl%2525253D%252525252F%252525253FReturnUrl%252525253D%25252525252F%25252525253FReturnUrl%25252525253D%2525252525252F%2525252525253FReturnUrl%2525252525253D%252525252525252F%252525252525253FReturnUrl%252525252525253D%25252525252525252F%25252525252525253FReturnUrl%25252525252525253D%2525252525252525252F 443 – 10.204.39.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/123.0.0.0+Safari/537.36 https://services.xxxyyy.ca/ 302 0 0 15
2024-04-29 19:46:16 10.204.33.225 GET / ReturnUrl=%2F%3FReturnUrl%3D%252F%253FReturnUrl%253D%25252F%25253FReturnUrl%25253D%2525252F%2525253FReturnUrl%2525253D%252525252F%252525253FReturnUrl%252525253D%25252525252F%25252525253FReturnUrl%25252525253D%2525252525252F%2525252525253FReturnUrl%2525252525253D%252525252525252F%252525252525253FReturnUrl%252525252525253D%25252525252525252F%25252525252525253FReturnUrl%25252525252525253D%2525252525252525252F%2525252525252525253FReturnUrl%2525252525252525253D%252525252525252525252F 443 – 10.204.39.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/123.0.0.0+Safari/537.36 https://services.xxxyyy.ca/ 302 0 0 0
2024-04-29 19:46:17 10.204.33.225 GET / ReturnUrl=%2F%3FReturnUrl%3D%252F%253FReturnUrl%253D%25252F%25253FReturnUrl%25253D%2525252F%2525253FReturnUrl%2525253D%252525252F%252525253FReturnUrl%252525253D%25252525252F%25252525253FReturnUrl%25252525253D%2525252525252F%2525252525253FReturnUrl%2525252525253D%252525252525252F%252525252525253FReturnUrl%252525252525253D%25252525252525252F%25252525252525253FReturnUrl%25252525252525253D%2525252525252525252F%2525252525252525253FReturnUrl%2525252525252525253D%252525252525252525252F%252525252525252525253FReturnUrl%252525252525252525253D%25252525252525252525252F 443 – 10.204.39.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/123.0.0.0+Safari/537.36 https://services.xxxyyy.ca/ 302 0 0 0
2024-04-29 19:46:17 10.204.33.225 GET / ReturnUrl=%2F%3FReturnUrl%3D%252F%253FReturnUrl%253D%25252F%25253FReturnUrl%25253D%2525252F%2525253FReturnUrl%2525253D%252525252F%252525253FReturnUrl%252525253D%25252525252F%25252525253FReturnUrl%25252525253D%2525252525252F%2525252525253FReturnUrl%2525252525253D%252525252525252F%252525252525253FReturnUrl%252525252525253D%25252525252525252F%25252525252525253FReturnUrl%25252525252525253D%2525252525252525252F%2525252525252525253FReturnUrl%2525252525252525253D%252525252525252525252F%252525252525252525253FReturnUrl%252525252525252525253D%25252525252525252525252F%25252525252525252525253FReturnUrl%25252525252525252525253D%2525252525252525252525252F 443 – 10.204.39.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/123.0.0.0+Safari/537.36 https://services.xxxyyy.ca/ 302 0 0 0
2024-04-29 19:46:17 10.204.33.225 GET / ReturnUrl=%2F%3FReturnUrl%3D%252F%253FReturnUrl%253D%25252F%25253FReturnUrl%25253D%2525252F%2525253FReturnUrl%2525253D%252525252F%252525253FReturnUrl%252525253D%25252525252F%25252525253FReturnUrl%25252525253D%2525252525252F%2525252525253FReturnUrl%2525252525253D%252525252525252F%252525252525253FReturnUrl%252525252525253D%25252525252525252F%25252525252525253FReturnUrl%25252525252525253D%2525252525252525252F%2525252525252525253FReturnUrl%2525252525252525253D%252525252525252525252F%252525252525252525253FReturnUrl%252525252525252525253D%25252525252525252525252F%25252525252525252525253FReturnUrl%25252525252525252525253D%2525252525252525252525252F%2525252525252525252525253FReturnUrl%2525252525252525252525253D%252525252525252525252525252F 443 – 10.204.39.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/123.0.0.0+Safari/537.36 https://services.xxxyyy.ca/ 302 0 0 0
2024-04-29 19:46:17 10.204.33.225 GET / ReturnUrl=%2F%3FReturnUrl%3D%252F%253FReturnUrl%253D%25252F%25253FReturnUrl%25253D%2525252F%2525253FReturnUrl%2525253D%252525252F%252525253FReturnUrl%252525253D%25252525252F%25252525253FReturnUrl%25252525253D%2525252525252F%2525252525253FReturnUrl%2525252525253D%252525252525252F%252525252525253FReturnUrl%252525252525253D%25252525252525252F%25252525252525253FReturnUrl%25252525252525253D%2525252525252525252F%2525252525252525253FReturnUrl%2525252525252525253D%252525252525252525252F%252525252525252525253FReturnUrl%252525252525252525253D%25252525252525252525252F%25252525252525252525253FReturnUrl%25252525252525252525253D%2525252525252525252525252F%2525252525252525252525253FReturnUrl%2525252525252525252525253D%252525252525252525252525252F%252525252525252525252525253FReturnUrl%252525252525252525252525253D%25252525252525252525252525252F 443 – 10.204.39.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/123.0.0.0+Safari/537.36 https://services.xxxyyy.ca/ 302 0 0 0