Looking for other third-party SPs that fail with stricter SameSite settings

[Niva Agmon]

Andy,



> What change has Jaegger made?



They're setting both new and "legacy" cookies in their test environment. (Definitely didn't change to HTTP-Redirect binding as far as I can see...)

Set-Cookie: sqsession=6a44....; Path=/apps/Router; Secure; HttpOnly; SameSite=None;
Set-Cookie: sqsession_legacy=6a443...; Path=/apps/Router; Secure; HttpOnly
Set-Cookie: squserid=399...; Path=/apps/Router; Secure; HttpOnly; SameSite=None;
Set-Cookie: squserid_legacy=399..; Path=/apps/Router; Secure; HttpOnly

Niva

From: users <users-bounces at shibboleth.net> On Behalf Of Morgan, Andrew Jason
Sent: Thursday, January 30, 2020 1:11 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: Looking for other third-party SPs that fail with stricter SameSite settings

External Email
Niva,

What change has Jaegger made?

We received an email from them saying they were changing *their* cookies to SameSite=None.  That won't help with SSO, though.  We want them to change from HTTP-Post to HTTP-Redirect binding for their SAML requests.  We (Oregon State University) have asked them to make that change, but they have not agreed to it yet.

Thanks,

Andy Morgan
Identity & Access Management
Oregon State University

________________________________
From: users <users-bounces at shibboleth.net<mailto:users-bounces at shibboleth.net>> on behalf of Niva Agmon <niva.agmon at temple.edu<mailto:niva.agmon at temple.edu>>
Sent: Thursday, January 30, 2020 10:05 AM
To: Shib Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Subject: RE: Looking for other third-party SPs that fail with stricter SameSite settings

We were notified about Jagger (SciQuest) today.
Just tried it and it looks like at least the SSO part is working,  but will continue testing. They recommended checking with their test site and the SameSite settings enabled in Chrome 79.

Niva Agmon
Temple University

-----Original Message-----
From: users <users-bounces at shibboleth.net<mailto:users-bounces at shibboleth.net>> On Behalf Of shibboleth655 at lewenberg.com<mailto:shibboleth655 at lewenberg.com>
Sent: Friday, January 24, 2020 2:22 PM
To: Shib Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Subject: Looking for other third-party SPs that fail with stricter SameSite settings

External Email

We are testing our Shibboleth IdP against the important SPs using the
stricter SameSite settings that will be used in the upcoming Chrome 80
release (see https://www.chromium.org/updates/same-site).

We have found that the following SPs _fail_, that is, we cannot login at
all:

- ServiceNow
- Instructure
- Rimeto

If you have found other third-party SPs that don't work with these new
settings please reply to this post and let us know.

Thanks, Adam Lewenberg
Stanford University


--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20200130/131ba513/attachment.html>