Problem with users bookmarking the login page

[Dustin Luck]

Our support desk brought up an issue where users are calling to report a "500 error" when trying to log in to some of our SPs. After some troubleshooting, we determined that the issue is due to users bookmarking the login page when trying to log in to SAML2 SPs. This is how we've reproduced the issue:

1. Visit the SPs URL (e.g., mail.google.com) and start the process of logging in via SSO
2. When the CAS login page is reached, save the URL or bookmark it
3. In a new tab, paste the URL or click the bookmark; the CAS login page will be displayed (everything looks fine to the user)
4. Log in
5. Get the error page

The CAS logs will show an error message stating, "SAML request or context could not be determined from session store". This is because the SP was bypassed and therefore no request was generated and passed in the session header.

My question is this: Has anyone seen/dealt with this issue? Obviously, we can try to train users to not bookmark the login page, but that will not solve the issue for those who ignore the warnings. I'm hoping someone has some ideas for how to communicate with users when they've gotten themselves into this situation.

I appreciate any help or ideas.

Thanks

[Danny]

I see similar error messages following our upgrade to 6.6.4 (from 5.3) during the holidays.  The percentage is small, and given the much larger issues with other upgrades done at the same time, getting to the bottom of it hasn't reached the top of the stack yet.  I did suspect it was related to how they were initiating, as directing them to login to CAS itself and then using a link from the resources menu avoided the error.

And more info...while I was typing this, I checked the logs and saw that a co-worker down the hall had just triggered a 500 error.  I went and asked and indeed he was using a bookmark with the with the URL from a previous SSO login.  Using the correct path worked correctly.  As to a solution....can't help there.

[Baldassare Agosta]

Dear all ,

we also run in this trouble and partially solve with a single dashboard that contanis all links for our SPs