cookieless SP

[Cantor, Scott]

On 7/12/14, 7:18 AM, "Pascal Rigaux" <pascal.rigaux at univ-paris1.fr> wrote:
>
>I'm trying to have Shibboleth SP work without cookies.
>A solution is to pass session_id in relayState url.
>The attached patch is a proof of concept how it can be done.
>What do you think of such a feature? Could it be added (with a config var
>to enable it)?

I'm not opposed in principal, and your patch seems relatively complete to
me.

Please file a RFE issue in Jira and attach the patch if you would like it
to be considered for a future release.

>With "Single Page Application"s where everythig except login is done in
>Ajax/CORS,
>it is quite easy to pass sessionid in HTTP header.
>If needed shibsession can easily be passed via a "inboundHeader".
>
>If you embed such an app in a iframe, third party cookies may be refused
>(esp. by safari)
>whereas IDP cookies will usually be accepted in case the user is already
>logged.

No, it's the opposite. The IdP's cookies won't be accepted or sent back,
and you won't be able to login. So the SP really can't fix that. That's
not fixable except by changing the IdP to stop using cookies, and of
course there isn't any way to do that and still achieve SSO.

>The problem is the login done in browser, the redirect from SP to
>application relies on shibsession
>cookie.

I'm willing to accept there's value in that, but it isn't to make frames
work unless you mean that the app itself is framed but the login process
somehow isn't.

-- Scott