Issues with MS Office embedded links

[Schwoerer, Brad]

Before I submit a Jira improvement request, I was seeking some feedback…

Recently, we have had a few complaints about embedded links in Office documents causing an issue with SSO sites.  After looking into it, it seems that it can be solved by switching the SP to use POST instead of the Redirect method.  This is due to the fact that the Office products follow links until they get a 200 response.  After they get a 200 response, Office hands the request off to the browser.  The issue with the Redirect method is that the Office internal browser has the session cookies that are not passed to the browser but the /idp/profile/SAML2/Redirect/SSO?execution=e2s1 link is.   Instead of trying to switch non-local SPs to POST, I came up with some Apache mod-rewrite rules that handle it, but with still some possible issues.  I was wondering if it would be worth while to put some code into the IDP that would essentially do the same thing as the mod-rewrite.  Maybe it is possible without code, but with a pure webflow rules.

        RewriteCond %{HTTP_USER_AGENT} "Microsoft Office"  [OR]
        RewriteCond %{HTTP_USER_AGENT} "ms-office"
        RewriteRule "^/idp/profile/SAML.*" - [R=200,L]

The main thing is that I am trying to prevent is shibboleth from handling those pages. Ideally, the page would display a message that if they are seeing this page, that there is a problem following the embedded link in office.

Is this worth while to create Jira request for this?


-Bradley
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20160412/5a663a1e/attachment.html>