Looking for other third-party SPs that fail with stricter SameSite settings

[Matt MacAdam]

This is what we're doing at Auth0 (in production) as of a couple months
ago--as far as I know it's worked really well (except for someone using
Mulesoft, which tried to send them back as multiple "Cookie" headers in the
request--not allowed per HTTP 1.1 and nginx was having none of it).  The
downside is the browser still throws the SameSite errors, so I have to
remind folks it's normal to see that error for the backwards compatible
version of the cookie.

-- 
Matt MacAdam
Senior Developer Support Engineer
Auth0 (Bellevue, USA, Pacific Time)

On Thu, Jan 30, 2020 at 2:08 PM Niva Agmon <niva.agmon at temple.edu> wrote:

> Andy,
>
>
>
> > What change has Jaegger made?
>
>
>
> They’re setting both new and "legacy" cookies in their test environment.
> (Definitely didn't change to HTTP-Redirect binding as far as I can see…)
>
>
>
> Set-Cookie: sqsession=6a44....; Path=/apps/Router; Secure; HttpOnly;
> SameSite=None;
>
> Set-Cookie: sqsession_legacy=6a443...; Path=/apps/Router; Secure; HttpOnly
>
> Set-Cookie: squserid=399...; Path=/apps/Router; Secure; HttpOnly;
> SameSite=None;
>
> Set-Cookie: squserid_legacy=399..; Path=/apps/Router; Secure; HttpOnly
>
>
>
> Niva
>
>
>
> *From:* users <users-bounces at shibboleth.net> *On Behalf Of *Morgan,
> Andrew Jason
> *Sent:* Thursday, January 30, 2020 1:11 PM
> *To:* Shib Users <users at shibboleth.net>
> *Subject:* Re: Looking for other third-party SPs that fail with stricter
> SameSite settings
>
>
>
> *External Email*
>
> Niva,
>
>
>
> What change has Jaegger made?
>
>
>
> We received an email from them saying they were changing *their* cookies
> to SameSite=None.  That won't help with SSO, though.  We want them to
> change from HTTP-Post to HTTP-Redirect binding for their SAML requests.  We
> (Oregon State University) have asked them to make that change, but they
> have not agreed to it yet.
>
>
>
> Thanks,
>
>
>
> Andy Morgan
>
> Identity & Access Management
>
> Oregon State University
>
>
> ------------------------------
>
> *From:* users <users-bounces at shibboleth.net> on behalf of Niva Agmon <
> niva.agmon at temple.edu>
> *Sent:* Thursday, January 30, 2020 10:05 AM
> *To:* Shib Users <users at shibboleth.net>
> *Subject:* RE: Looking for other third-party SPs that fail with stricter
> SameSite settings
>
>
>
> We were notified about Jagger (SciQuest) today.
> Just tried it and it looks like at least the SSO part is working,  but
> will continue testing. They recommended checking with their test site and
> the SameSite settings enabled in Chrome 79.
>
> Niva Agmon
> Temple University
>
> -----Original Message-----
> From: users <users-bounces at shibboleth.net> On Behalf Of
> shibboleth655 at lewenberg.com
> Sent: Friday, January 24, 2020 2:22 PM
> To: Shib Users <users at shibboleth.net>
> Subject: Looking for other third-party SPs that fail with stricter
> SameSite settings
>
> External Email
>
> We are testing our Shibboleth IdP against the important SPs using the
> stricter SameSite settings that will be used in the upcoming Chrome 80
> release (see https://www.chromium.org/updates/same-site).
>
> We have found that the following SPs _fail_, that is, we cannot login at
> all:
>
> - ServiceNow
> - Instructure
> - Rimeto
>
> If you have found other third-party SPs that don't work with these new
> settings please reply to this post and let us know.
>
> Thanks, Adam Lewenberg
> Stanford University
>
>
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20200130/344fe521/attachment.html>