[shib_auth] class registry in drupal 7 conflicting with shib sessions

[Andy Kohler]

You might also try disabling memcache, if you use it.

In our environment, we've found that with memcache enabled (via
settings.php, as a backend cache for everything except forms), Shib-created
sessions can seemingly overlap (a user logging in within a few minutes of
another user sees the first user's name).

This isn't the same as Mike's problem, but since cache is involved, it
might be relevant.

--Andy


On Wed, Aug 28, 2013 at 3:07 AM, Patrick Dawkins <p.dawkins at ucl.ac.uk>wrote:

> Hi Mike
>
>
> The shib_auth module doesn't get involved with the registry - it contains
> no classes or interfaces, and the statement "SELECT * FROM registry WHERE
> module = 'shib_auth'" yields nothing.
>
> I have never had registry issues with Shibboleth (although I have with
> Drupal Commerce, for which the registry rebuild<https://drupal.org/project/registry_rebuild>module is very useful).
>
> So it sounds like it's something else and you have more debugging to do.
>
> Since cache clearing has something to do with it, perhaps you have a
> module that's doing extra caching somewhere that's misbehaving. And the
> Performance section by no means lists all the caches in Drupal core or
> contrib - the list of caches can include bootstrap, block, page, menu,
> theme, system, user, node, token, views, entity, etc. What cookies are set
> in the browser after Shibboleth login - when it's working and when it isn't?
>
>
> Regards
> Patrick
>
>
>
> On 27 August 2013 20:29, Mike Cammilleri <mikec at stat.wisc.edu> wrote:
>
>> We are using the shibboleth module with D7 which works, most of the time.
>> Users can click on the shibboleth login link, be directed to the Idp,
>> authenticated successfully and returned to D7, at which point .htaccess
>> allows them in with
>>
>> AuthType Shibboleth
>> ShibRequireSession Off
>> require shibboleth
>> ShibUseHeaders On
>>
>> About an hour or so goes by and all of a sudden D7 stops allowing the
>> shib-authenticated user in. The user can still authenticate to the shib
>> Idp, but when returned to the D7 site, drupal just behaves as if they never
>> logged in at all. No error page, no 404 not found, no white page of death,
>> just back to the D7 site and the login button for shib is still sitting
>> there as if they never clicked on it.
>>
>> In order to fix this, all I need to do is flush the Class Registry from
>> the Flush All Caches menu. Simply flushing that cache corrects the behavior
>> and once again D7 will allow users to log in via shib. Until another hour
>> goes by and D7 stops allowing shib users, and I need to flush the Class
>> Registry again.
>>
>> Has anyone experienced this? What is in the Class Registry that could be
>> causing D7 to think users aren't logged in? (Local drupal accounts work
>> fine by the way). I turned off all caching in the Performance section,
>> except for block caching which is greyed out because I'm using the Access
>> Control module. This still has not fixed the problem.
>>
>> Any hints would be greatly appreciated.
>>
>> ______________________________**_________________
>> shib_auth mailing list
>> shib_auth at listserv.niif.hu
>> https://listserv.niif.hu/**mailman/listinfo/shib_auth<https://listserv.niif.hu/mailman/listinfo/shib_auth>
>>
>>
>
> _______________________________________________
> shib_auth mailing list
> shib_auth at listserv.niif.hu
> https://listserv.niif.hu/mailman/listinfo/shib_auth
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://listserv.niif.hu/pipermail/shib_auth/attachments/20130828/77302ccd/attachment-0001.html>