Hyperlinks to Shibboleth protected URLs in MS Office documents

[Cantor, Scott]

> If you want, I can provide you with an HTTP-trace of that client using
> Fiddler.

I should be able to simulate it.

> The requests fail, so I assume he gives up.

That's understandable given that it's a HEAD. It's also useful to observe whether it is hitting the SP each time and getting a fresh request, to avoid replay issues.

> No further requests. That ms-office browser will cease its attempt
> (perhaps not able to process the javascript?).

You need Javascript at least for client storage to work without a full browser to display the bypass button.

> Now the default browser is opened (Edge, since it is a default windows
> 10 image) and it re-issues that last request using the default browser:

That's where the bug is, because at that point the state of the flow has advanced, and the original e1s1 key won't work anymore, even if the Java session is intact.

> If Jetty would have used that jsessionid from the request, it might have
> worked.

No, it wouldn't. There's no way to make that work without, as a starting point, turning off the local storage feature. So that becomes an IdP change, which you can't control, so you're done.

> Of course I know this is not a problem of the Shibboleth software, but
> any ideas to circumvent this behaviour are welcome.

It's impossible to circumvent in the general case from what I can see. If switching to POST doesn't convince it to stop using the internal browser soon enough at least.

-- Scott