[Shib-Users] Office Hyperlinks & Shib cookie errors

[Philip Brusten]

On 3/03/2011 17:17, Philip Brusten wrote:
> On 17/11/2010 20:11, Scott Cantor wrote:
>   > Oh yes.  It seems that office has a minibrowser and tries to do it in
>> house
>>> until it sees the first redirect, at *that* point it then fires up IE or
>>> whatever.
>> I think it may be following all the redirects and then starting the
>> browser.
>> If it were stopping at the first one, the IdP would be ok, and you'd just
>> lose the relay state. That much is fixable by just changing the SP config,
>> but the IdP part isn't.
> We also stumble on this issue  once in a while. Like Scott says, the
> minibrowser of office will handle all the redirects (HTTP 302) until it
> finds a HTTP 200. Then it starts the default browser to show the web
> page to the users. Every cookie set in the earlier HTTP responses are lost.
>
> I hope, in the future, the IdP can work cookieless for this use case.
>
> A possible workaround is to redirect the user to a DS or WAYF. Since
> that minibrowser won't have a session with the DS or WAYF, the user will
> have to give some interaction (in most cases) before being redirected to
> the IdP. Using a DS or WAYF together with relayState by value should
> provide you a workarround.
>
This issue came up again.
By using the outgoingBindings [1] property of the SessionInitiator you 
can return a HTTP 200 very early in the login process and no cookies get 
lost in this internal ms-office-browser.

I've documented this in greater detail at 
https://admin.kuleuven.be/icts/services/aai/documentation/sp/linksfromofficetosp.html

Kr,

Philip

[1] 
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSessionInitiator#NativeSPSessionInitiator-Attributes