SAML Logout from Office 365

[Petr Hroudný]

> https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199501597/SameSite
>

Enabling SameSite=none fixes the problem for current Chrome, but not for
other browsers:

- Firefox uses State partitioning
<https://developer.mozilla.org/en-US/docs/Web/Privacy/State_Partitioning>,
thus Client storage is still not accessible
- Safari blocks 3rd party cookies by default, access can only be granted
via Storage API
<https://blog.certa.dev/third-party-cookie-restrictions-for-iframes-in-safari>
- Chrome is also planning to phase out
<https://developers.google.com/privacy-sandbox/3pcd> 3rd party cookies

The primary problem thus seems to be, that Microsoft calls SAML2 IdP Logout
endpoint inside an iFrame...

Regards, Petr
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240527/4d906b92/attachment.htm>