Shibboleth IdP - SAMLAuthnConfiguration Proxy - SameSite Cookies

[Cantor, Scott]

> I'm guessing because there are no cookies when the third-party IdP POST back?

It appears that way because without a session, the cookies are new and are accomodated by Chrome's 2 minute rule. Take longer than 2 minutes the first time through and it will break the same way.

> Option 2 - Use the Redirect binding with the proxy flow / third-party Idp instead
> of POST? 

Redirect is not a valid binding for SSO responses, they're too large for that.

-- Scott