sp4a1, SubjectConfirmationData/@InResponseTo did not match the valid value: null

[Scott Cantor]

> Trying to set a cookie identical to the above from a CGI shell script
> on the same web server I fail to set the cookie as well: Well, I can
> set it but the User Agent does not return it in subsequent request
> headers -- probably for the same reason the above fails:
> 
>> A zero or negative number will expire the cookie immediately.


In HTTP, yes. In Java, -1 is the API signal for a session cookie. So the internal behavior of the code isn't meant to produce a -1 on the wire. However, when it actually is trying to delete a cookie, then the -1 would show up on the wire.

So I would assume you're seeing it delete an older cookie, not issue a new one, but it should be doing both at times. The cleanup happens whenever it goes to set one (correcting the bug in the current SP where they accumulate because the deletion only happens on the response step).

All of this has worked fine in all our testing. I'll have to run another fresh test to make sure it's doing what it was doing before and see what the cookie looks like. As of today, you should be able to toggle off the SAML property to turn off the InResponseTo checking to get past it for now.


--Scott