Shibboleth Developers

[Will Norris <>]

I wanted to offer this up for discussion before I actually file it as  
a bug...  We've been having isolated incidents at USC over the past  
month or two of IP mismatch errors when accessing a particular SP on  
campus.  Example log:

> 2007-01-01 16:28:23 INFO Shibboleth-TRANSACTION : New session (ID:
> a7121ef3d0658a3d1c7998acb2924d1b) with (applicationId: default) for
> principal from (IdP: urn:mace:inqueue:usc.edu) at (ClientAddress:
> 66.134.120.166) with (NameIdentifier: 424c13bb-662c-46f4-b9de- 
> c9f83188abba)
>
> 2007-01-01 16:28:23 INFO Shibboleth-TRANSACTION : Destroyed invalid
> session (ID: a7121ef3d0658a3d1c7998acb2924d1b) with (applicationId:
> default), request was from (ClientAddress: 72.14.194.26)


The second IP address (72.14.194.26) is one used by Google's Web  
Accelerator (http://webaccelerator.google.com/).  I'm still waiting  
to hear back from the client to see if disabling GWA solved his  
problem, but I'm fairly certain that it will.  As a long term  
solution however, I'm wondering if Shibboleth should block these and  
other "prefetching" requests.

More information at (http://37signals.com/svn/archives2/ 
google_web_accelerator_hey_not_so_fast_an_alert_for_web_app_designers.ph 
p)

-will
(credit to Ryan Bolger for figuring this out)

Attachment: smime.p7s
Description: S/MIME cryptographic signature