Shibboleth IdP - SAMLAuthnConfiguration Proxy - SameSite Cookies

[Miles, Ryan]

Hello All,

We have successfully configured our Shibboleth IdP to proxy authentication via the SAMLAuthnConfiguration through a third-party IdP. However, we ran into the SameSite issue listed here: https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1284276231/SameSite.

Doing Something:
As the documentation above states under "Doing Something", setting "idp.cookie.sameSite = None" and "idp.cookie.sameSiteCondition = shibboleth.Conditions.TRUE" does indeed set "SameSite=None" globally, which fixes Chromium but breaks older WebKit / Safari browsers (https://caniuse.com/same-site-cookie-attribute). 

In that same document, there is mention of, "The condition hook is present to allow deployers to create scripted or Java-based code to perform User-Agent testing, which is not something this project believes in doing as a principle and so we do not intend to try and maintain such an approach." Totally agree, but our service management / helpdesk would like us to try this approach to support as many browsers as possible; understanding that this would be code we would have to create / maintain. Would anyone be able to elaborate / provide some details on how to get started?

Observations:
I've noticed the issue only appears after the initial proxy authentication. i.e. The initial proxy authentication via the third-party IdP is able to POST back without "SameSite=None". However, when the Shibboleth IdP session expires and the user tries to SSO into another proxied app, the subsequent flow / POST back is blocked due to the "third-party" cookie policy in Chromium. Other than setting "SameSite=None" conditionally, would either of the following options be feasible:

Option 1 - Clear the Shibboleth IdP cookies during the proxy flow "/idp/profile/Authn/SAML2/POST/SSO/start" prior to returning to the third-party IdP to reauthenticate?
I've noticed that if you delete the "JSESSIONID" or "shib_idp_session" cookies prior to the proxy flow running a second time (after the Shibboleth IdP session expires), everything seems to work in Chromium without "SameSite=None". I'm guessing because there are no cookies when the third-party IdP POST back?

Option 2 - Use the Redirect binding with the proxy flow / third-party Idp instead of POST? 
I know it currently states in the documentation "IdP-acting-as-SP" the only supported binding is POST: https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1282539600/SAMLAuthnConfiguration#General-Configuration. Is it possible to change the binding for the proxy flow in the code and would that resolve the issue since it wouldn't be using POST?

We are running Shibboleth IdP 4.3.0, with "idp.session.StorageService" set to "shibboleth.ClientSessionStorageService"

Any feedback is appreciated.


Thanks,
Ryan

Identity Management (IDM) | IT Security | Kent State University
Direct: E: rmmiles at kent.edu | P: (330) 672-9294
IDM: E: it-idm at kent.edu | P: (330) 672-3455
1550 Johnston Drive Kent, OH 44243