links in word documents & Shib

[Cantor, Scott]

Ok, so the problem here is that the initial redirect is:

SP (no longer drops cookie) -> IdP SSO endpoint (drops cookie) -> IdP
login handler

The browser doesn't start until the final step, and the cookie in the
middle is missed.

I suspect you might be able to fix that, but it would require that you
choose to switch from redirect to the IdP to a POST binding. That might
work, but would have to be tested for appearance/usability/compatibility.
If Word were to say "ok, I got a form back, load that into browser", that
might work. Or it might blow up or crash, no idea.

If you want to test that, you would change the outgoingBindings setting.
You won't have one, but you can set one in the <SSO> element (I think,
should work) and set it:

outgoingBindings="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"

That would be SAML 2.0 only, but that's all you would need anyway.

-- Scott