[JIRA] Resolved: (SDSJ-90) Hardening the '_saml_idp' cookie in the centralized DS

[Rod Widdowson (JIRA)]

     [ https://issues.shibboleth.net/jira/browse/SDSJ-90?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Rod Widdowson resolved SDSJ-90.
-------------------------------

    Resolution: Fixed

In final testing we spotted that the DS was trying to set with a domain of "".  This was rejected of course and so we lost the cookie.  That in turn was traced to an incorrect demorganization, itself flushed by some code tidy which ensured that the domain was initialized to "";

Fixed in checkin 2197

> Hardening the '_saml_idp' cookie in the centralized DS
> ------------------------------------------------------
>
>                 Key: SDSJ-90
>                 URL: https://issues.shibboleth.net/jira/browse/SDSJ-90
>             Project: Shibboleth Discovery Service - Java
>          Issue Type: Bug
>    Affects Versions: 1.1.2
>            Reporter: Tom Scavo
>            Assignee: Rod Widdowson
>            Priority: Minor
>             Fix For: 1.1.3
>
>          Time Spent: 4 hours
>  Remaining Estimate: 0 minutes
>
> Note the following issues with respect to the '_saml_idp' cookie used in the centralized DS:
> * In the SamlCookiePlugin class, the static getCookie method should take into account the path and domain in addition to the cookie name
> * The SamlCookiePlugin constructor should ensure that the configured 'cacheDomain' attribute has a leading dot as required by RFC 2965
> * The '_saml_idp' cookie used by the CDS is not marked as 'secure' (is this a security vulnerability?)
> * The 'cacheDomain' configuration property is an undocumented feature but I think it should be documented since it allows the deployer to configure a centralized DS such that the '_saml_idp' cookie is equivalent to the so-called common domain cookie. Out of the box, the '_saml_idp' cookie defaults to the request-host (not a common domain).

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira