cookieless SP

[Pascal Rigaux]

On 07/12/14 20:04, Cantor, Scott wrote:
> On 7/12/14, 7:18 AM, "Pascal Rigaux" <pascal.rigaux at univ-paris1.fr> wrote:
>>
>> I'm trying to have Shibboleth SP work without cookies.
>> A solution is to pass session_id in relayState url.
>> The attached patch is a proof of concept how it can be done.
>> What do you think of such a feature? Could it be added (with a config var
>> to enable it)?
>
> I'm not opposed in principal, and your patch seems relatively complete to
> me.
>
> Please file a RFE issue in Jira and attach the patch if you would like it
> to be considered for a future release.

Cool. Will do.

>> With "Single Page Application"s where everythig except login is done in
>> Ajax/CORS,
>> it is quite easy to pass sessionid in HTTP header.
>> If needed shibsession can easily be passed via a "inboundHeader".
>>
>> If you embed such an app in a iframe, third party cookies may be refused
>> (esp. by safari)
>> whereas IDP cookies will usually be accepted in case the user is already
>> logged.
>
> No, it's the opposite. The IdP's cookies won't be accepted or sent back,
> and you won't be able to login. So the SP really can't fix that. That's
> not fixable except by changing the IdP to stop using cookies, and of
> course there isn't any way to do that and still achieve SSO.

Sure, IdP need cookies.

Here is a precise use case that should be more clear:

- user goes to https://portal.univ-foo.bar
- user is redirected to https://idp.univ-foo.bar
- user logins on idp, cookie is accepted since it is not third party
- user is redirected to relayState https://portal.univ-foo.bar
- this page has an iframe https://app.somewhere.com/login
- inside the iframe :
   - redirection to https://app.somewhere.com/Shibboleth.sso/Login
   - redirection to https://idp.univ-foo.bar, the cookie is passed => autologin
   - POST to https://app.somewhere.com/Shibboleth.sso/SAML2/POST
   - redirection to https://app.somewhere.com/login?_shibsession_=xxx
   - gives an html page, which can set session in sessionStorage then redirect to https://app.somewhere.com/

It is complex, but it works.
I already have this in production with CAS authentication.
I would really need it to work with Shibboleth :)


-- 
Ce message a ete verifie par MailScanner
pour des virus ou des polluriels et rien de
suspect n'a ete trouve.