Shibboleth IdP - SAMLAuthnConfiguration Proxy - SameSite Cookies

[Jarno Huuskonen]

Hi,

On 2/28/23 20:10, Miles, Ryan via users wrote:
> Hello All,
> 
> We have successfully configured our Shibboleth IdP to proxy authentication via the SAMLAuthnConfiguration through a third-party IdP. However, we ran into the SameSite issue listed here: https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1284276231/SameSite.
> 
> Doing Something:
> As the documentation above states under "Doing Something", setting "idp.cookie.sameSite = None" and "idp.cookie.sameSiteCondition = shibboleth.Conditions.TRUE" does indeed set "SameSite=None" globally, which fixes Chromium but breaks older WebKit / Safari browsers (https://caniuse.com/same-site-cookie-attribute).
> 
> In that same document, there is mention of, "The condition hook is present to allow deployers to create scripted or Java-based code to perform User-Agent testing, which is not something this project believes in doing as a principle and so we do not intend to try and maintain such an approach." Totally agree, but our service management / helpdesk would like us to try this approach to support as many browsers as possible; understanding that this would be code we would have to create / maintain. Would anyone be able to elaborate / provide some details on how to get started?
> 

Maybe this mailing list thread helps:
http://shibboleth.net/pipermail/users/2022-March/051895.html
...
http://shibboleth.net/pipermail/users/2022-March/051910.html

-Jarno

-- 
Jarno Huuskonen