IDP 5 - NoSuchConversationException when clicking URL link from email and _saml_idp cookie set.

[Cantor, Scott]

> When the saml_idp cookie is present, the SP knows which IDP the user
> last authenticated with, so when they click the link in the email, the
> browser sets the Sec-Fetch-Site=cross-origin header on the initial
> request since the origin (gmail, outlook client, etc...) are not on
> the same domain as the link in the email was taking them to

I suspect perhaps that's the trigger, the fact that it's webmail hosting a link and the browsers must be somehow treating that differently than a normal link in an email or a direct access via bookmark or other sort of site link.

I use links in emails to SPs all the time. That doesn't require SameSite mitigations, or at least it didn't.

But I'll have to test that theory.

All I'm trying to point out is that the normal SP/IdP deployment does not include discovery and is simply going to use one IdP, and thos deployments were not all broken the instant SameSite became a thing. We would have heard about it.

> The only way to use SameSite=Strict and have cross-origin requests
> still work is for you to build some intermediate site that all your
> email links point to that is on the same site as the destination page,
> and you have to do something to get the user to create a new request
> essentially like the DS ends up doing.

Again, that may be true of web email (for reasons that don't make a great deal of sense) but it was not historically true if you stick that same link in an email sitting in a mail client, or in particular hosting a link on a page. That's just as much "cross origin" as a link to an SP on outlook.com.

-- Scott