shibstate cookie

[Pottinger, Hardy J.]

Hi, Scott, well... this was a pretty slap-dash solution, anyway, I'm prepared to continue to rely on it. Can you point me to the info on how to config so that the shibstate cookie is again used (assuming this is a SP-level config, if it's IdP-level, I'll have to rethink things).

--Hardy
________________________________________
From: users-bounces at shibboleth.net [users-bounces at shibboleth.net] on behalf of Cantor, Scott [cantor.2 at osu.edu]
Sent: Monday, June 02, 2014 4:41 PM
To: Shib Users
Subject: Re: shibstate cookie

On 6/2/14, 5:33 PM, "Pottinger, Hardy J." <PottingerHJ at missouri.edu> wrote:

>Hi, I have a bit of code I work on [1] which leverages a WAYF page to
>provide a branch point in a login process where the user can opt in to
>Shibboleth authentication, or application-based authentication. Up until
>very recently, it worked great. However, we finally upgraded this server
>to a current version of Shibboleth, and I've discovered that the
>shibstate cookie, which my hacked version of the WAYF page utilized in
>order to pass off the user to the correct URL on the application server,
>is now no longer being set. I'm wondering if someone can help me figure
>out where this data might now reside? I'm assuming it's a POST variable.
>And, given enough time digging around in Shibboleth sessions I'm sure
>I'll find it, but, I'm hoping maybe someone can just point me in the
>right direction?

The cookie is set if you choose that method to track RelayState. The
default is now to do so in memory and not set a cookie. Even when it does
exist in a cookie, it hasn't ever been anything but an opaque object, and
is not a supported interface. I have, and will continue to, change the
format as needed.

The standard interface to the DS does not include that piece of
information, with the exception of the legacy WAYF/SAML1 flow when the
relay state option is left out, and the URL passed by value as the target
parameter. The newer DS interface does't have a parameter for this.

>To keep things simple, here's exactly what I'm after: the URL which the
>user visited which started the authentication process.

There is no supported way to obtain it. You would need to build your own
discovery protocol that included it, and generate the requests in and out
of that to include that extra parameter.

>Googling around, I can see the shibstate cookie was the focus of some bug
>fixes, so, I'm assuming it's gone for good.

It's not, it's just not relevant unless you're prepared to change a
setting and rely on an unsupported interface.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net