[java-identity-provider] branch main updated: IDP-2063 - Default cookies and examples to __Host- prefixed

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=fedebfd52995c9a5dffe238deece3d5085fd00b0

The following commit(s) were added to refs/heads/main by this push:
     new fedebfd52 IDP-2063 - Default cookies and examples to __Host- prefixed
fedebfd52 is described below

commit fedebfd52995c9a5dffe238deece3d5085fd00b0
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Fri Jan 6 14:12:29 2023 -0500

    IDP-2063 - Default cookies and examples to __Host- prefixed
    
    https://shibboleth.atlassian.net/browse/IDP-2063
    
    Limited change to session and container session for now.
---
 .../shibboleth/idp/conf/session-manager-system.xml | 30 +++++++++++-----------
 idp-conf/src/main/resources/conf/idp.properties    |  5 ++--
 idp-war/src/main/webapp/WEB-INF/web.xml            |  4 +--
 3 files changed, 19 insertions(+), 20 deletions(-)

diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/session-manager-system.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/session-manager-system.xml
index 3832885c9..872e187fd 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/session-manager-system.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/session-manager-system.xml
@@ -77,21 +77,21 @@
     <bean id="shibboleth.DefaultSPSessionSerializerRegistry" class="net.shibboleth.idp.session.SPSessionSerializerRegistry" />
     
     <bean id="shibboleth.SessionManager" class="net.shibboleth.idp.session.impl.StorageBackedSessionManager"
-            depends-on="shibboleth.OpenSAMLConfig"
-            p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier"
-            p:authenticationFlowDescriptors="#{@'shibboleth.AuthenticationFlowDescriptorManager'.getComponents()}"
-            p:cookieManager-ref="shibboleth.CookieManager"
-            p:cookieName="%{idp.session.cookieName:shib_idp_session}"
-            p:storageService-ref="#{'%{idp.session.StorageService:shibboleth.ClientSessionStorageService}'.trim()}"
-            p:consistentAddressCondition="#{getObject('%{idp.session.consistentAddressCondition:}'.trim()) ?:
-                T(net.shibboleth.idp.session.impl.StorageBackedSessionManager.DefaultConsistentAddressConditionFactory).getDefaultConsistentAddressCondition(%{idp.session.consistentAddress:true})}"
-            p:sessionTimeout="%{idp.session.timeout:PT60M}"
-            p:sessionSlop="%{idp.session.slop:PT0S}"
-            p:maskStorageFailure="%{idp.session.maskStorageFailure:false}"
-            p:trackSPSessions="%{idp.session.trackSPSessions:false}"
-            p:secondaryServiceIndex="%{idp.session.secondaryServiceIndex:false}"
-            p:IDGenerator-ref="shibboleth.SessionIDGenerator"
-            p:SPSessionSerializerRegistry="#{getObject('shibboleth.SPSessionSerializerRegistry') ?: getObject('shibboleth.DefaultSPSessionSerializerRegistry')}" />
+        depends-on="shibboleth.OpenSAMLConfig"
+        p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier"
+        p:authenticationFlowDescriptors="#{@'shibboleth.AuthenticationFlowDescriptorManager'.getComponents()}"
+        p:cookieManager-ref="shibboleth.CookieManager"
+        p:cookieName="%{idp.session.cookieName:__Host-shib_idp_session}"
+        p:storageService-ref="#{'%{idp.session.StorageService:shibboleth.ClientSessionStorageService}'.trim()}"
+        p:consistentAddressCondition="#{getObject('%{idp.session.consistentAddressCondition:}'.trim()) ?:
+            T(net.shibboleth.idp.session.impl.StorageBackedSessionManager.DefaultConsistentAddressConditionFactory).getDefaultConsistentAddressCondition(%{idp.session.consistentAddress:true})}"
+        p:sessionTimeout="%{idp.session.timeout:PT60M}"
+        p:sessionSlop="%{idp.session.slop:PT0S}"
+        p:maskStorageFailure="%{idp.session.maskStorageFailure:false}"
+        p:trackSPSessions="%{idp.session.trackSPSessions:false}"
+        p:secondaryServiceIndex="%{idp.session.secondaryServiceIndex:false}"
+        p:IDGenerator-ref="shibboleth.SessionIDGenerator"
+        p:SPSessionSerializerRegistry="#{getObject('shibboleth.SPSessionSerializerRegistry') ?: getObject('shibboleth.DefaultSPSessionSerializerRegistry')}" />
 
     <!-- Management bean to collect and expose LogoutPropagationFlowDescriptors. -->
     
diff --git a/idp-conf/src/main/resources/conf/idp.properties b/idp-conf/src/main/resources/conf/idp.properties
index ceaac7563..c6765a694 100644
--- a/idp-conf/src/main/resources/conf/idp.properties
+++ b/idp-conf/src/main/resources/conf/idp.properties
@@ -25,7 +25,8 @@ idp.scope = example.org
 #idp.cookie.secure = true
 #idp.cookie.httpOnly = true
 #idp.cookie.domain =
-#idp.cookie.path =
+# Note the path is now / to allow defaulting to __Host- prefixed names.
+#idp.cookie.path = /
 #idp.cookie.maxAge = 31536000
 # These control operation of the SameSite filter, which is off by default.
 #idp.cookie.sameSite = None
@@ -127,7 +128,7 @@ idp.storage.htmlLocalStorage = true
 #idp.session.StorageService = shibboleth.ClientSessionStorageService
 
 # Name of cookie used for session
-#idp.session.cookieName = shib_idp_session
+#idp.session.cookieName = __Host-shib_idp_session
 # Size of session IDs
 #idp.session.idSize = 32
 # Bind sessions to IP addresses
diff --git a/idp-war/src/main/webapp/WEB-INF/web.xml b/idp-war/src/main/webapp/WEB-INF/web.xml
index 1eddfd9e4..9fed125cd 100644
--- a/idp-war/src/main/webapp/WEB-INF/web.xml
+++ b/idp-war/src/main/webapp/WEB-INF/web.xml
@@ -54,11 +54,9 @@
     <session-config>
         <session-timeout>15</session-timeout>
         <cookie-config>
-            <!-- Uncomment to add __Host- protection. -->
-            <!--
+            <!-- Comment name and path to revert __Host- protection. -->
             <name>__Host-JSESSIONID</name>
             <path>/</path>
-            -->
             <secure>true</secure>
             <http-only>true</http-only>
         </cookie-config>

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.