[java-identity-provider] branch main updated: IDP-2374 - Implement support for SameSite directly when possible

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=cc1bb44b8bc9278692afdd194c5dc29c0d8da213

The following commit(s) were added to refs/heads/main by this push:
     new cc1bb44b8 IDP-2374 - Implement support for SameSite directly when possible
cc1bb44b8 is described below

commit cc1bb44b8bc9278692afdd194c5dc29c0d8da213
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Apr 9 16:05:55 2025 -0400

    IDP-2374 - Implement support for SameSite directly when possible
    
    https://shibboleth.atlassian.net/browse/IDP-2374
    
    Move web.xml to a proper Servlet 5.0 descriptor.
    Add commented cookie attribute decl for SameSite.
    Adjust wiring of SameSite filter and CookieManagers.
---
 .../src/main/resources/net/shibboleth/idp/conf/filters.xml   |  1 +
 .../main/resources/net/shibboleth/idp/conf/global-system.xml | 12 ++++++++++++
 idp-war/src/main/webapp/WEB-INF/web.xml                      | 11 +++++++++--
 3 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/filters.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/filters.xml
index 8a5ad909e..c6ef62b18 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/filters.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/filters.xml
@@ -47,6 +47,7 @@
   
     <!-- Mapped to all requests but runs conditionally, and runs EARLIEST to ensure a last look at cookies. -->
     <bean class="net.shibboleth.shared.spring.servlet.impl.SameSiteCookieHeaderFilter"
+        p:disableBasedOnServletAPI="%{idp.cookie.sameSite.autoDisableFilter:true}"
         p:activationCondition-ref="#{'%{idp.cookie.sameSiteCondition:shibboleth.Conditions.FALSE}'.trim()}"
         p:defaultValue="%{idp.cookie.sameSite:None}"
         p:sameSiteCookies="#{getObject('shibboleth.SameSiteCookieMap')}" />
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/global-system.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/global-system.xml
index 4b093f63b..2584bac47 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/global-system.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/global-system.xml
@@ -328,6 +328,9 @@
         p:httpOnly="%{idp.cookie.httpOnly:true}"
         p:cookieDomain="%{idp.cookie.domain:}"
         p:cookiePath="%{idp.cookie.path:/}"
+        p:sameSite="%{idp.cookie.sameSite:None}"
+        p:sameSiteCondition-ref="#{'%{idp.cookie.sameSiteCondition:shibboleth.Conditions.FALSE}'.trim()}"
+        p:sameSiteCookies="#{getObject('shibboleth.SameSiteCookieMap')}"
         p:maxAge="-1" />
 
     <bean id="shibboleth.PersistentCookieManager" class="net.shibboleth.shared.net.CookieManager" lazy-init="true"
@@ -337,6 +340,9 @@
         p:httpOnly="%{idp.cookie.httpOnly:true}"
         p:cookieDomain="%{idp.cookie.domain:}"
         p:cookiePath="%{idp.cookie.path:/}"
+        p:sameSite="%{idp.cookie.sameSite:None}"
+        p:sameSiteCondition-ref="#{'%{idp.cookie.sameSiteCondition:shibboleth.Conditions.FALSE}'.trim()}"
+        p:sameSiteCookies="#{getObject('shibboleth.SameSiteCookieMap')}"
         p:maxAge="%{idp.cookie.maxAge:31536000}" />
 
     <bean id="shibboleth.StorageAwarePersistentCookieManager" class="net.shibboleth.idp.profile.support.StorageAwareCookieManager" lazy-init="true"
@@ -347,6 +353,9 @@
             p:httpOnly="%{idp.cookie.httpOnly:true}"
             p:cookieDomain="%{idp.cookie.domain:}"
             p:cookiePath="%{idp.cookie.path:/}"
+            p:sameSite="%{idp.cookie.sameSite:None}"
+            p:sameSiteCondition-ref="#{'%{idp.cookie.sameSiteCondition:shibboleth.Conditions.FALSE}'.trim()}"
+            p:sameSiteCookies="#{getObject('shibboleth.SameSiteCookieMap')}"
             p:maxAge="%{idp.cookie.maxAge:31536000}">
         <property name="usernameLookupStrategy">
             <bean parent="shibboleth.Functions.Compose"
@@ -362,6 +371,9 @@
         p:httpOnly="false"
         p:cookieDomain="%{idp.cookie.domain:}"
         p:cookiePath="%{idp.cookie.path:/}"
+        p:sameSite="%{idp.cookie.sameSite:None}"
+        p:sameSiteCondition-ref="#{'%{idp.cookie.sameSiteCondition:shibboleth.Conditions.FALSE}'.trim()}"
+        p:sameSiteCookies="#{getObject('shibboleth.SameSiteCookieMap')}"
         p:maxAge="%{idp.cookie.maxAge:31536000}" />
 
     <!--
diff --git a/idp-war/src/main/webapp/WEB-INF/web.xml b/idp-war/src/main/webapp/WEB-INF/web.xml
index 13335b252..93229a4e4 100644
--- a/idp-war/src/main/webapp/WEB-INF/web.xml
+++ b/idp-war/src/main/webapp/WEB-INF/web.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<web-app xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-    xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" version="3.0">
+<web-app xmlns="https://jakarta.ee/xml/ns/jakartaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee  https://jakarta.ee/xml/ns/jakartaee/web-app_5_0.xsd" version="5.0">
  
     <display-name>Shibboleth Identity Provider</display-name>
 
@@ -59,6 +59,13 @@
             <path>/</path>
             <secure>true</secure>
             <http-only>true</http-only>
+            <!-- Uncomment when deploying on EE10/Servlet6. -->
+            <!--
+            <attribute>
+                <attribute-name>SameSite</attribute-name>
+                <attribute-value>None</attribute-value>
+            </attribute>
+            -->
         </cookie-config>
         <tracking-mode>COOKIE</tracking-mode>
     </session-config>

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.