correct value for cookieProps

[Dan LaSota]

Thank you Peter, that did the trick.


On Mon, Jul 28, 2014 at 3:22 PM, Peter Schober <peter.schober at univie.ac.at>
wrote:

> * Dan LaSota <dlasota at alaska.edu> [2014-07-29 00:55]:
> > So I headed over to the wiki and looked up the cookieProps
> > attribute.
> [...]
> > Questions: Isn't the handlerSSL="true" and the cookieProps secure
> > value the same thing?
>
> Not at all. Quoting from the wiki:
> https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSessions :
>
> handlerSSL(boolean) (defaults to true)
>   When true, only web requests over SSL/TLS will be processed by
>   handlers. Other requests may be blocked, or possibly ignored (and
>   usually result in a 404 error) depending on the web server, but will
>   never be processed. This is useful for sites that want to protect SAML
>   protocol traffic but leave actual content unencrypted.
>
> cookieProps (string) (default is "; path=/; HttpOnly")
>   If set to a custom string, the string is appended to the cookie values
>   maintained by the SP. Used to attach custom meta-properties like path
>   or the secure and HttpOnly flags to the cookies. A common value for
>   SSL-only use is "; path=/; secure; HttpOnly". As of V2.5, this
>   property can be set to a pair of built-in values, "http" and "https",
>   which expand to the default and SSL-only properties respectively.
>
> So handlerSSL should be "true" (since you talk about "SSL forced
> everything" site), preventing insecure access. For cookieProps read on.
>
> > I am also seeing samples of https/http and HttpOnly.
> >
> > This is what I want:
> > the right value for an SSL forced everything on my multidomain
> > *.domain.edu site.
>
> If you positively need to share SP cookies between webservers in a
> shared DNS domain you can't use "https" as cookieProps value, as the
> default will cause cookies to be set to the FQDN of the issuing
> webserver (causing the HTTP User Agent to not transmit them to other
> webservers). From the documentation quoted above:
>   "A common value for SSL-only use is "; path=/; secure; HttpOnly"."
> which is alsothe default when using the 2.5 SP and the setting
> "https". So you could just add your domain=.site.domain.edu to that,
> making it
> "domain=.site.domain.edu; path=/; secure; HttpOnly"
> and differing only in the addition of "HttpOnly" from your current
> settings. See https://www.owasp.org/index.php/HttpOnly for an
> explanation of HttpOnly if you're unsure.
> -peter
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>



-- 
Dan LaSota
Instructional Designer, UAF eLearning
(907) 451-4067
dan.lasota at alaska.edu
http://elearning.uaf.edu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140805/e6534ba9/attachment-0001.html