I use SharePoint to host our website on the internet. Site users use Form-based authentication to log in.

These past few days, the site has a very weird issue with people logging in and being redirected to other random peoples' profiles and details.

Here is what I have tried so far to trouble-shoot the issue:

  • Contacted the users to check if there is any chance of someone else having used their PC before they logged in. Most Users say they used a private device and also don’t know the user whose profile they see.
  • Tried looking at default ULS logs, but did not see anything suspicious, except that the two people logged in at about the same times.
  • Tried generating some logs from code in login and profile webparts into an SQL data base and also to ULS, the logs show that in the error instances, the session cookies and fedauth cookies get mixed up in different ways.
  • Sometimes, the session cookie changes to a different user’s session cookie.

  • Sometimes, there is a single fedauth cookie at login time, but in later requests two fedauth cookies show up in each request, one from the user’s own original session, and other from the different session, whose profile is seen.

  • Sometimes, both of these issues happen at once.

  • I am also using load-balancing hardware to forward requests based on cookies, to different servers. So I tried routing the user directly to a single portal server. The issue still persisted.
  • I also have two web front-end servers that are part of the same farm, so I tried shutting one server down, to narrow down the issue. Issue still persists.
  • I have also tried changing various parameters in SPSecurityTokenServiceConfig, to no effect.
  • Also tried clearing distributed token cache, but it didn't help.

I am all out of ideas what to investigate next.

  • My Security Token Service Config: SecurityTokenServicePublicUrlSuffix : /_vti_bin/spsecuritytokenserviceactive.svc SecurityTokenServiceMetadataPublicUrlSuffix : /_vti_bin/spsecuritytokenserviceactive.svc/mex LocalLoginProvider : SPLocalLoginProviderName=SharePoint TrustedLoginProviderNames : {} TrustedLoginProviders : {} TrustedAccessProviders : {} TrustedSecurityTokenServices : {} AuthenticationPipelineClaimMappingRules : {WindowsMappingRule} AllowMetadataOverHttp : False UseSessionCookies : True – Hammad May 22 '17 at 10:43
  • WindowsTokenLifetime : 00:30:00 FormsTokenLifetime : 00:20:00 CookieLifetime : 00:20:00 ServiceTokenLifetime : 10:00:00 MaxLogonTokenCacheItems : 250 MaxLogonTokenOptimisticCacheItems : 100000 LogonTokenCacheExpirationWindow : 00:30:00 MaxServiceTokenCacheItems : 250 MaxServiceTokenOptimisticCacheItems : 100000 ServiceTokenCacheExpirationWindow : 00:10:00 ApplicationTokenLifetime : 1.12:00:00 AuthenticatorTokenLifetime : 1.12:00:00 MinApplicationTokenCacheItems : 250 MaxApplicationTokenCacheItems : 100000 ApplicationTokenCacheExpirationWindow : 00:10:00 – Hammad May 22 '17 at 10:44
  • LoopbackTokenLifetime : 10:00:00 AllowOAuthOverHttp : True CookieValueHandlerType : Microsoft.SharePoint.IdentityModel.SPSessionSecurityTokenCookieValue NameIdentifier : 00000003-0000-0ff1-ce00-000000000000@44cdce4e-ee50-4039-9d74-478682ede717 PidEnabled : True HybridStsSelectionEnabled : True Name : SecurityTokenServiceManager TypeName : Microsoft.SharePoint.Administration.Claims.SPSecurityTokenServiceManager DisplayName : SecurityTokenServiceManager Id : 40721f54-d352-4560-83dc-ca8b35380d02 Status : Online Parent : SPSecurityTokenServiceName=SecurityTokenService – Hammad May 22 '17 at 10:44
  • Version : 10999811 Properties : {} Farm : SPFarm Name=SharePoint_Config UpgradedPersistedProperties : {} CanSelectForBackup : True DiskSizeRequired : 0 CanSelectForRestore : True CanRenameOnRestore : False – Hammad May 22 '17 at 10:44
  • Have you been able to reliably recreate this? I'd run Fiddler on one of the client machines to try to recreate it and see what is happening on their side. Might help point you in the right direction. – Taylor May 22 '17 at 14:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.