cookieless SP

[Pascal Rigaux]

Oops, I should have made it more clear that it's only useful for following settings:
- safari: block cookies "From third parties and advertisers"
   (which is the default setting)
- firefox: Accept third-party cookies "From Visited"
   (which may become the default setting)

Agreed no way to make such things work with setting block cookies "Always".


On 07/13/14 23:10, Cantor, Scott wrote:
> On 7/12/14, 4:22 PM, "Pascal Rigaux" <pascal.rigaux at univ-paris1.fr> wrote:
>>>
>> - user goes to https://portal.univ-foo.bar
>> - user is redirected to https://idp.univ-foo.bar
>> - user logins on idp, cookie is accepted since it is not third party
>> - user is redirected to relayState https://portal.univ-foo.bar
>> - this page has an iframe https://app.somewhere.com/login
>> - inside the iframe :
>>    - redirection to https://app.somewhere.com/Shibboleth.sso/Login
>>    - redirection to https://idp.univ-foo.bar, the cookie is passed =>
>> autologin
>
> Hmm, not in my testing. That's the exact definition of a third party
> cookie. The cookie is *not* sent back to the IdP there. I think you are
> perhaps seeing the results of the differencees between browsers in how
> they treat that issue. Some browsers will allow cookie reads but not
> writes, but Firefox at least has generally blocked both.
>
> Also, even when reads work, the V2 IdP also sets a cookie (the login
> context) during the SSO process, so you need both read and write to work.
> That *may* not be as much true in V3 because the web flow conversation
> basically piggy backs on the container session.
>
>> It is complex, but it works.
>> I already have this in production with CAS authentication.
>
> Then I'm pretty sure you have third party cookies enabled or are using a
> browser with a weak definition.
>
>> I would really need it to work with Shibboleth :)
>
> I don't believe it can. Either that or I'm misinterpreting the testing
> I've done in the past.

-- 
Ce message a ete verifie par MailScanner
pour des virus ou des polluriels et rien de
suspect n'a ete trouve.