Ancestry Logout Problem

I have discovered a puzzling problem with http://www.ancestry.com
The problem is occuring in two family history rooms in two different buildings in our stake. The issue is that we have problems in logging out !

The FH rooms are all using the required ASA5505 firewall (extended access) and we have no problems in accessing Ancestry, NewFamily Search and a host of other web sites related to genealogy. However, after logging into Ancestry, it very difficult to logout. We click the "logout" link at the top and then wait. A new URL is seen in the address field, but the URL never completes and the logout page remains blank.

I've tried this with both FireFox v3 and IE v6 both do the same thing.
I do not see this problem when using Ancestry at home, so I suspect that it may have something to do with the ASA5505 blocking a specific address that's being used for the logout.

No error messages are seen. The browser just hangs up on the logout. The computer isn't frozen as I can click on another web site and wander away from Ancestry with no problem.

Has anyone else seen this? I realize that Ancestry isn't an LDS program, but the issue may be related to the ASA, so I thought I'd inquire.

If I remember right, these are what I call "FamilyHistory Workrooms" (not official FHC).

Ancestry does offer a subset of it's offerings free to FHCs. I think those units use a special login. However, the Church may be working on changing that over to a portal, so that Ancestry knows who's a FHC based on how it connects to them. But then the expansion of local units to using the same network could have some interesting side-effects there.

Bottom line - there's a lot of possibilities other then simple firewall blocking going on.

RussellHltn wrote:Ancestry does offer a subset of it's offerings free to FHCs.

I don't think so anymore. New management nearly 2 years ago decided to start charging the Church, and at that time the Church wasn't willing to pay. Unless something has changed, I doubt FHC's still get the offerings. I'm glad I don't work for them anymore as there was more than just this one piece of drama going on from the inside.

Techgy wrote:...We click the "logout" link at the top and then wait. A new URL is seen in the address field, but the URL never completes and the logout page remains blank.

I've tried this with both FireFox v3 and IE v6 both do the same thing.
I do not see this problem when using Ancestry at home, so I suspect that it may have something to do with the ASA5505 blocking a specific address that's being used for the logout.

Actually, I think your guess may be a good one. I wouldn't be surprised if there is some call to a web anaylitics partner or something. As Russell says, it could be one of many things, but I think there is merit in your suggestion.

RussellHltn wrote:If I remember right, these are what I call "FamilyHistory Workrooms" (not official FHC).

Ancestry does offer a subset of it's offerings free to FHCs. I think those units use a special login. However, the Church may be working on changing that over to a portal, so that Ancestry knows who's a FHC based on how it connects to them. But then the expansion of local units to using the same network could have some interesting side-effects there.

Bottom line - there's a lot of possibilities other then simple firewall blocking going on.

Yes, these are FH workrooms. However, the members who are using Ancestry have their own personal accounts.

mkmurray wrote:Actually, I think your guess may be a good one. I wouldn't be surprised if there is some call to a web anaylitics partner or something. As Russell says, it could be one of many things, but I think there is merit in your suggestion.

I would have to believe that if the ASA was blocking a portion of the site because it was hosing information out for statistical analysis, that we'd be seeing the familiar error message about the site being blocked. We see nothing - nada - zip. The URL that's doing the logout just sits there. We've waited several minutes and nothing happened.

I'm going to check this out in another building in the next day or so and see if it's common in all the facilities. There may be a way of tracing the path of the logout to see if there's any other sites that are being used. I could also temporarily remove the ASA for a few minutes and repeat the logout.

This would at least isolate the problem.

Techgy wrote:I would have to believe that if the ASA was blocking a portion of the site because it was hosing information out for statistical analysis, that we'd be seeing the familiar error message about the site being blocked. We see nothing - nada - zip. The URL that's doing the logout just sits there. We've waited several minutes and nothing happened.

I'm going to check this out in another building in the next day or so and see if it's common in all the facilities. There may be a way of tracing the path of the logout to see if there's any other sites that are being used. I could also temporarily remove the ASA for a few minutes and repeat the logout.

This would at least isolate the problem.

By no means can you depend on the ASA providing a blocking message when it blocks a site. I have seen many situations where a site is blocked and the browser simply seems to be trying to load the page for several minutes, and never succeeds. This was the symptom when multiple people had a problem logging in to ldscatalog.com.

So you certainly should try other troubleshooting steps.

Alan_Brown wrote:So you certainly should try other troubleshooting steps.

Techgy, have you ever played around with the Firefox Extenstion Firebug? You would be able to trace every request to every site the browser is making (even for every single image request). I bet it would tell you what resources the site is trying to hit that are not coming back.

mkmurray wrote:Techgy, have you ever played around with the Firefox Extenstion Firebug? You would be able to trace every request to every site the browser is making (even for every single image request). I bet it would tell you what resources the site is trying to hit that are not coming back.

Thanks for the suggestion. I use FireFox all the time, but haven't tried the Firebug yet. I'll give it a try this afternoon and report back on the results.

We have no problems logging out of personal accounts at the Draper Utah Family History Center. The biggest problem we have is that patrons don't remember to click on log out, then their personal account is left logged in.

I will be in the Draper FHC again tonight and will test it again to see if anything has changed, but in the past we have not had any problems.

GarysTurn wrote:We have no problems logging out of personal accounts at the Draper Utah Family History Center. The biggest problem we have is that patrons don't remember to click on log out, then their personal account is left logged in.

I will be in the Draper FHC again tonight and will test it again to see if anything has changed, but in the past we have not had any problems.

I suspect that it might be related to the ASA5505. I was under the impression that the official FHC's use a different firewall (PIX?) which may be scripted differently. Ancestry states on their site that after 30 minutes of inactivity, that the account is closed. However, I've found accounts that have been open a day or two later.

mkmurray wrote:I don't think so anymore. New management nearly 2 years ago decided to start charging the Church, and at that time the Church wasn't willing to pay.

Yes, it underwent a major change, but it's still there. The Church and Ancestry did some horse trading. They gave the Church free access to the images in exchange for the index on a couple of Census. I think that's how Ancestry was able to launch. So they are under contractual obligation to provide some access.

What they had been doing was giving away full access to the FHCs. That's what ended except for the very large FHCs.

GarysTurn wrote:We have no problems logging out of personal accounts at the Draper Utah Family History Center. The biggest problem we have is that patrons don't remember to click on log out, then their personal account is left logged in.

I will be in the Draper FHC again tonight and will test it again to see if anything has changed, but in the past we have not had any problems.

Gary, does the Draper FHC use an ASA Firewall or a PIX? Most FHCs use a PIX, but Techgy is referring to an installation that uses the ASA. These have different filtering levels, which could very well be the crux of the problem.

I have confirmed that the Ancestry logout problem is being caused by the ASA, but I have not been able to determine the page that's causing the problem. This past weekend us folks down here in So Cal have been under a blanket of ash from all these fires and it's taken most of our attention in dealing with that.

I tried to send in a support request to Ancestry to see if they can offer some help, but after two responses I have given up as their answers had absolutely nothing to do with the problem.

I'll take another look at things this week and see if I can determine what link is responsible for the problem.

Techgy wrote:I have confirmed that the Ancestry logout problem is being caused by the ASA, but I have not been able to determine the page that's causing the problem. This past weekend us folks down here in So Cal have been under a blanket of ash from all these fires and it's taken most of our attention in dealing with that.

I tried to send in a support request to Ancestry to see if they can offer some help, but after two responses I have given up as their answers had absolutely nothing to do with the problem.

I'll take another look at things this week and see if I can determine what link is responsible for the problem.

I've got some contacts there, I'll ask around and see what I can find.

mkmurray wrote:I've got some contacts there, I'll ask around and see what I can find.

Thanks. I appreciate the effort.

I may have identified the URL that's causing the problem.
Immediately upon clicking the "Logout" link on Ancestry a number of ancestry.com links are seen. The final link is:

myfamilyancestry.112.2o7.net

This might be an address that is blocked by the ASA.
I'll check further later today but at the moment my curiosity is peaked.

Techgy wrote:I may have identified the URL that's causing the problem.
Immediately upon clicking the "Logout" link on Ancestry a number of ancestry.com links are seen. The final link is:

myfamilyancestry.112.2o7.net

This might be an address that is blocked by the ASA.
I'll check further later today but at the moment my curiosity is peaked.

Me too, I'll ask my previous coworkers if they know what that url is for.

Following that link, I get: What is 2o7.net?

2o7.net is a domain used by Omniture to help provide portions of its Omniture SiteCatalyst and Omniture SearchCenter products. Specifically, this domain is used by Omniture to place cookies, on behalf of its customers, on the computers of visitors to customers’ selected websites.

Follow the link for more info.

RussellHltn wrote:Following that link, I get: What is 2o7.net?



Follow the link for more info.

Yea, I noticed that when I did a DNS search. That's why I'm suspicious as to that being the block. I suspect that a cookie is being placed on the user's site when they logon and that cookie is cleared upon logout. Why it only fails upon logout I don't know.

I did a little experimenting a couple of days ago when I was having problems in logging out. I ran a clean-up program that I use to remove cookies, and other privacy items. Although Ancestry didn't log me out, clearing these privacy items DID.

Techgy wrote:Yea, I noticed that when I did a DNS search. That's why I'm suspicious as to that being the block. I suspect that a cookie is being placed on the user's site when they logon and that cookie is cleared upon logout. Why it only fails upon logout I don't know.

I did a little experimenting a couple of days ago when I was having problems in logging out. I ran a clean-up program that I use to remove cookies, and other privacy items. Although Ancestry didn't log me out, clearing these privacy items DID.

I wonder if the firewall block list includes Omniture in the OK list, but this obscure domain is not one that I would think to unblock as well.

mkmurray wrote:I wonder if the firewall block list includes Omniture in the OK list, but this obscure domain is not one that I would think to unblock as well.

After a brief review of the Omniture site I'm no longer sure that they're the problem. They offer an "opt-out" feature on their site that prohibits the placement of a cookie for tracking. Also according to their policy they're only purpose is tracking. As their URL is the final one in a list of URL's being used for the logout, the actual logout must be occuring before the Omniture URL is seen. If the Omniture site was being block, this might hold up the browser from continuing, but it wouldn't prevent the logout.

Back to the drawing board.

Techgy wrote:After a brief review of the Omniture site I'm no longer sure that they're the problem. They offer an "opt-out" feature on their site that prohibits the placement of a cookie for tracking. Also according to their policy they're only purpose is tracking. As their URL is the final one in a list of URL's being used for the logout, the actual logout must be occuring before the Omniture URL is seen. If the Omniture site was being block, this might hold up the browser from continuing, but it wouldn't prevent the logout.

Back to the drawing board.

I've tried again this past Sunday to determine what's being blocked by the ASA5505 that is preventing Ancestry from logging out, but haven't been successful. My best option at this point would be to contact the GSD and report the problem.

If anyone has any recommendations, I'd love to have them.

Techgy wrote:As their URL is the final one in a list of URL's being used for the logout, the actual logout must be occuring before the Omniture URL is seen.

How are you determining this is the last one? From a working session, or a "stalled" one?

mkmurray wrote:Techgy, have you ever played around with the Firefox Extenstion Firebug? You would be able to trace every request to every site the browser is making (even for every single image request). I bet it would tell you what resources the site is trying to hit that are not coming back.

RussellHltn wrote:How are you determining this is the last one? From a working session, or a "stalled" one?

I used a FireFox addon called "FireBug" to log the URL's that are used for the LogOut link.

I contacted the Global Service Desk (GSD) this morning and reported the problem. They had a number of reports regarding the Ancestry site, but nothing in relation to the problem we're seeing. I have no doubt that the logout problem is related to the ASA as I can bypass the ASA and the problem disappears.

The fellow on the GSD had no suggestion as to a work-a-round but he did take the report and I assume that the programmers will now to do some research to determine where the block is occuring. When I hear back as to a resolution, I'll post it.

I'm trying to understand your testing method. If the URL to 112.2o7.net is the last "call" that executes in a stalled session, then I think that's the culprit. If it's the last call in the log out script, then maybe the logout is supposed to happen before then.

RussellHltn wrote:I'm trying to understand your testing method. If the URL to 112.2o7.net is the last "call" that executes in a stalled session, then I think that's the culprit. If it's the last call in the log out script, then maybe the logout is supposed to happen before then.

The call to 112.2o7.net is - IMHO - not the logout. I would have to believe that the actual logout is being handled by Ancestry itself and that this final URL is hanging up so that you don't get a confirmation of the logout.

I received a call back from the GSD this afternoon with a suggestion of a resolution. Their "resolution" was a change in the scripting of the ASA. Unfortunately, it didn't resolve the problem.

However, during my experimentation I accidentally discovered that when the blank screen appears upon an attempt to logout from Ancestry, if I refresh the browser screen twice, while on the blank screen, I'm finally logged out of Ancestry.

I don't recall trying this before and at this point I don't know if this is a result of their script changes or whether it will work in another building. I'm taking a few days vacation this week so in the next couple of days if I'm around the stake center I'll try this procedure on another unmodified ASA.

They've agreed that the problem is either with the scripting or the filtering, but apparently haven't been able to pin it down - yet.

Edit: I'll be calling the GSD back this afternoon to follow up on a call they made to me. However, I'm curious as to whether anyone else has seen this problem?

After multiple attempts by the Global Service Desk to resolve this issue I have decided to close the request. I've spent numerous hours on the phone in an attempt to find a resolution but nothing's been successful.

The final attempt was made today with the GSD monitoring the ASA 5505 firewall scripting while several attempts were made to log out. Nothing concrete was discovered. I have confirmed that the problem is with the filtering as removing the firewall results in the logout problem going away.

Hopefully someone else will see this issue and perhaps a resolution can be found down the road.

We do have a work-a-round that works and is relatively easy to do. When logging out of Ancestry we receive a blank screen. If the browser is refreshed twice while on that blank screen then Ancestry will log us out.

Techgy wrote:.......The final attempt was made today with the GSD monitoring the ASA 5505 firewall scripting while several attempts were made to log out. Nothing concrete was discovered. I have confirmed that the problem is with the filtering as removing the firewall results in the logout problem going away.

Hopefully someone else will see this issue and perhaps a resolution can be found down the road.

We do have a work-a-round that works and is relatively easy to do. When logging out of Ancestry we receive a blank screen. If the browser is refreshed twice while on that blank screen then Ancestry will log us out.

Bless those hard workers at the GSD! A few days ago I received a phone call from them in regards to this issue. Apparently, even though we had stopped worrying about the problem, they had not. :p

They had continued to work on the problem and had come up with a solution. Now exactly what they did isn't clear to me, but it only took a few moments for them to make a change in the scripting of the ASA and point it to a different server.

If anyone else has this problem rest assured that a fix is available.
My thanks to the team at the GSD for a good job!:D

I hesitated to resurrect an older thread, but the problem with Ancestry has reappeared. I haven't contacted the support desk as yet, but I suspect that either Ancestry has made changes or the scripting has been altered again following some updates.

Either way, we're having problems getting logged in and logged out. I've had reports of issues doing searches on Ancestry as well.

Has anyone experienced any issues with Ancestry.com? We're using the General Access level on ASA5505's and rarely have problems with anything. I have enough members and Family History Consultants in the stake who use Ancestry that it's worth pursuing and finding a fix for this.

Edit: I've done some checking and during the logout and login the web site of: http://myfamilyancestry.112.2o7.net is being referenced. This points to http://www.omniture.com/en/privacy/2o7#optout which I believe has something to do with statistical reporting for Ancestry. I believe that the ASA5505's are blocking this web site, which is what's hanging up Ancestry - again. We've been through this before as noted earlier in this thread.

Techgy wrote:Has anyone experienced any issues with Ancestry.com?

Interesting, I've just seen a report by a FHC that they're having problems with patrons not being able to properly log out of Heritage Quest. (This FHC is too small to get the church's subscription.)

RussellHltn wrote:Interesting, I've just seen a report by a FHC that they're having problems with patrons not being able to properly log out of Heritage Quest. (This FHC is too small to get the church's subscription.)

In Ancestry when a patron tries to LOGOUT the http://myfamilyancestry.112.2o7.net/ reference is the last item in the list. At this point the patron is already logged out, but the browser is hung up with a blank screen, so you don't know if you're out or not. It's been quite annoying.

I'm wondering if I can put a block of my own in place for this site at the browser level so that the browser will ignore this site? Just a wild idea. I've sent an Email to support in the hope that they can do some work on this. I may do some experimentation of my own this weekend.

I haven't had any reports of problems with Heritage Quest, but most of our stake efforts are towards training on nFS.

techgy wrote:In Ancestry when a patron tries to LOGOUT the http://myfamilyancestry.112.2o7.net/ reference is the last item in the list. At this point the patron is already logged out, but the browser is hung up with a blank screen, so you don't know if you're out or not.

I haven't had any reports of problems with Heritage Quest, but most of our stake efforts are towards training on nFS.

It appears that the above URL is no longer being used. However, the problem had reappeared. The solution for the recent occurrence was a change in a setting on the ASA5505 scripting. One of the settings controls the length of the URL that's permitted through the ASA. For some reason this setting is enabled which cuts short the URL used for logout on Ancestry.

Contact the GSD (global service desk) and have them disable this setting and you solve your problem.

Edit: You can refer to ticket #1386202 for the details in getting this corrected. I've already had this procedure done on 3 ASA's and it worked perfectly.