SAML Logout from Office 365

[Petr Hroudný]

pi 24. 5. 2024 o 17:38 Cantor, Scott <cantor.2 at osu.edu> napísal(a):

> I doubt this is about local storage, it's likely a SameSite issue with the
> cookies in either case.
>

I tried to look for differences and they are:

working SAML Logout:

Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Cookie: JSESSIONID=node0vb27lyy5bv7md6xvjslgvj0r143.node0;
shib_idp_session=c43e08b0b26341fd22b30068aec9d522a66d533665b7282b694c015bb2bc8bc5

Office 365 SAML Logout:

Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Cookie: JSESSIONID=node0vb27lyy5bv7md6xvjslgvj0r143.node0  (only on Firefox
but missing on Chrome, Safari etc.)

shib_idp_session cookie is missing on all browsers - could this explain the
inability to find a session in client's storage?

IdP doesn't seem to use any SameSite= parameter for Cookies:

Set-Cookie: JSESSIONID=node01i3tafqghf06d1dfqb4on1kq9c145.node0; Path=/idp;
Secure; HttpOnly
Set-Cookie: shib_idp_session=c43e08b0b26341fd22b30068aec9d522a66d533665b7282b694c015bb2bc8bc5;
Path=/idp; Secure; HttpOnly

Should I add it somewhere (Shibbolet, Jetty) or make some other changes to
get it working?

Thanks, Petr
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240524/7b665ddb/attachment.htm>