correct value for cookieProps

[Peter Schober]

* Dan LaSota <dlasota at alaska.edu> [2014-07-29 00:55]:
> So I headed over to the wiki and looked up the cookieProps
> attribute.
[...]
> Questions: Isn't the handlerSSL="true" and the cookieProps secure
> value the same thing?

Not at all. Quoting from the wiki:
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSessions :

handlerSSL(boolean) (defaults to true)
  When true, only web requests over SSL/TLS will be processed by
  handlers. Other requests may be blocked, or possibly ignored (and
  usually result in a 404 error) depending on the web server, but will
  never be processed. This is useful for sites that want to protect SAML
  protocol traffic but leave actual content unencrypted.

cookieProps (string) (default is "; path=/; HttpOnly")
  If set to a custom string, the string is appended to the cookie values
  maintained by the SP. Used to attach custom meta-properties like path
  or the secure and HttpOnly flags to the cookies. A common value for
  SSL-only use is "; path=/; secure; HttpOnly". As of V2.5, this
  property can be set to a pair of built-in values, "http" and "https",
  which expand to the default and SSL-only properties respectively.

So handlerSSL should be "true" (since you talk about "SSL forced
everything" site), preventing insecure access. For cookieProps read on.

> I am also seeing samples of https/http and HttpOnly.
> 
> This is what I want:
> the right value for an SSL forced everything on my multidomain
> *.domain.edu site.

If you positively need to share SP cookies between webservers in a
shared DNS domain you can't use "https" as cookieProps value, as the
default will cause cookies to be set to the FQDN of the issuing
webserver (causing the HTTP User Agent to not transmit them to other
webservers). From the documentation quoted above:
  "A common value for SSL-only use is "; path=/; secure; HttpOnly"."
which is alsothe default when using the 2.5 SP and the setting
"https". So you could just add your domain=.site.domain.edu to that,
making it
"domain=.site.domain.edu; path=/; secure; HttpOnly"
and differing only in the addition of "HttpOnly" from your current
settings. See https://www.owasp.org/index.php/HttpOnly for an
explanation of HttpOnly if you're unsure.
-peter