[java-identity-provider] branch master updated: Turn off SameSite filter by default.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=8ccc54d376cf942537ab5c8cc444af59cacf4676

The following commit(s) were added to refs/heads/master by this push:
       new  8ccc54d   Turn off SameSite filter by default.
8ccc54d is described below

commit 8ccc54d376cf942537ab5c8cc444af59cacf4676
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Jan 28 09:52:58 2020 -0500

    Turn off SameSite filter by default.
---
 idp-conf/src/main/resources/conf/idp.properties           | 2 ++
 idp-conf/src/main/resources/system/conf/global-system.xml | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/idp-conf/src/main/resources/conf/idp.properties b/idp-conf/src/main/resources/conf/idp.properties
index cdba7c0..8309eb3 100644
--- a/idp-conf/src/main/resources/conf/idp.properties
+++ b/idp-conf/src/main/resources/conf/idp.properties
@@ -23,7 +23,9 @@ idp.scope = example.org
 #idp.cookie.domain =
 #idp.cookie.path =
 #idp.cookie.maxAge = 31536000
+# These control operation of the SameSite filter, which is off by default.
 #idp.cookie.sameSite = None
+#idp.cookie.sameSiteCondition = shibboleth.Conditions.FALSE
 
 # Enable cross-site request forgery mitigation for views. 
 idp.csrf.enabled = true
diff --git a/idp-conf/src/main/resources/system/conf/global-system.xml b/idp-conf/src/main/resources/system/conf/global-system.xml
index e299e08..b92a13f 100644
--- a/idp-conf/src/main/resources/system/conf/global-system.xml
+++ b/idp-conf/src/main/resources/system/conf/global-system.xml
@@ -167,7 +167,7 @@
         
     <bean id="shibboleth.SameSiteCookieFilter"
         class="net.shibboleth.utilities.java.support.net.SameSiteCookieHeaderFilter"
-        p:activationCondition="#{getObject('shibboleth.SameSiteCondition') ?: true}"
+        p:activationCondition-ref="#{'%{idp.cookie.sameSiteCondition:shibboleth.Conditions.FALSE}'.trim()}"
         p:defaultValue="%{idp.cookie.sameSite:None}"
         p:sameSiteCookies="#{getObject('shibboleth.SameSiteCookieMap')}" />
 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.