Having problems with SAML auth on IdP version 4.1.3

[Duncan Sinclair]

Hi again,

I've got a HAR file of the web traffic if you're interested, but having had a look at it myself, I'm beginning to think it's a 'SameSite' problem.

On the POST back to the Shibboleth Authn end-point, the shib_idp_* and JSESSION cookies are being blocked due to SameSite restrictions.

I turned on HTML Local Storage to try to get round this problem, but presumably that doesn't work during the proxied authentication.

Anybody got any tips on how to get the correct 'SafeSite' values set?

Cheers,


Duncan.

-- 
Duncan Sinclair
Infrastructure Specialist – Systems
Abertay University, Dundee

-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Duncan Sinclair
Sent: Tuesday, 27 July 2021 2:57 pm
To: Shib Users <users at shibboleth.net>
Subject: RE: Having problems with SAML auth on IdP version 4.1.3

[EXTERNAL MAIL] This message was sent from outside the University. Do not reply, click links, or open attachments unless you recognise the source of this email and know the content is safe. Email itservicedesk at abertay.ac.uk if you require help.

Hi Scott,

I don't think it's a prefetch problem -- at least my logs don't show any signs of prefetch.

I've just managed to reproduce the error, and watching the network log on Chrome there wasn't any prefetch.

What do you want to see from the Chrome network logs?

Cheers,


Duncan.

--
Duncan Sinclair
Infrastructure Specialist – Systems
Abertay University, Dundee

-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott
Sent: Tuesday, 27 July 2021 2:29 pm
To: Shib Users <users at shibboleth.net>
Subject: Re: Having problems with SAML auth on IdP version 4.1.3

[EXTERNAL MAIL] This message was sent from outside the University. Do not reply, click links, or open attachments unless you recognise the source of this email and know the content is safe. Email itservicedesk at abertay.ac.uk if you require help.

On 7/27/21, 9:21 AM, "users on behalf of Duncan Sinclair" <users-bounces at shibboleth.net on behalf of d.sinclair at abertay.ac.uk> wrote:

>    I know it's difficult to reproduce, as I've tried quite a bit. The only time I've seen it was in Chrome, and I didn't
> have the developer window open at the time to see what actually happened.

That's probably Chrome doing pre-fetches. I have never reproduced that behavior, but there's nothing we can do about it if it does, that's going to trigger a replay error every time.

>    Is there anything I can do to help?

Figure out a way to reproduce it and then at least we can understand it. I have no expectation that we could fix it if that’s the cause. We can't do much about broken clients. If it's a replay issue, then you could in theory configure the IdP to ignore replay but that's about all.

I have never experienced this supposed prefetch problem in Chrome in all the years people have been complaining about it, but I don't use it often, only for testing.

-- Scott


--
For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
[Abertay Named UK University of the Year for Teaching Quality]<https://abertay.co/ZTQw>

Abertay University is a charity registered in Scotland, No. SC016040

Follow us: www.abertay.ac.uk<http://www.abertay.ac.uk> | @AbertayUni<https://twitter.com/AbertayUni> | AbertayLinkedIn<https://www.linkedin.com/edu/school?id=12685> | AbertayFacebook<https://www.facebook.com/AbertayUni>

Any views or opinions expressed in this email and any attachments are solely those of the author and do not necessarily represent those of Abertay University. This email and any attachments may be confidential and are intended solely for the use of the intended recipient. If you are not the intended recipient, you must take no action based on the email or its attachments, nor must you copy or show them to anyone. Please contact the sender if you believe you have received this email in error.
--
For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net