Possible 5.1.3 / OP cookie regression

[Wessel, Keith]

Just confirming, OP plugin 4.2.0 fixes this, correct? If we're running 4.2.0, we can safely upgrade to IdP 5.1.3? That's what it looks like in Jira, but I wanted to make sure. It wasn'tclearto me from Henri's announcement of 4.2.0 or the release notes, but that might just be because I didn't understand the nature of the regression.


Keith


-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott via users
Sent: Thursday, August 22, 2024 10:07 AM
To: users at shibboleth.net
Cc: Cantor, Scott <cantor.2 at osu.edu>
Subject: Re: Possible 5.1.3 / OP cookie regression

Henri and I bottomed this out as a bug in Nimbus we have to report and probably code around for now. It's a bit convoluted, but I added what I think I understand to be the impact at the top of the OP release notes [1].

It's possible to use 5.1.3 with a workaround, but regardless of the version SameSite isn't set in various cases. The trigger is what it always seems to be, not using HTML Storage.

Bug is at [2].

Google should be shot into the sun. Just gonna close every email with that now.

-- Scott

[1] https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/2776760321/OPReleaseNotes__;!!DZ3fjg!7ztklWGOdm95M5Blcvr5CdInejtxrxSW9M5o4y0q6YaWmt3jmFkvGjJA4kt--6W49-d2tT9oHhBa6Ynk9-Ev$ 
[2] https://urldefense.com/v3/__https://shibboleth.atlassian.net/browse/JOIDC-223__;!!DZ3fjg!7ztklWGOdm95M5Blcvr5CdInejtxrxSW9M5o4y0q6YaWmt3jmFkvGjJA4kt--6W49-d2tT9oHhBa6Y5IHHWu$ 


-- 
For Consortium Member technical support, see https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!DZ3fjg!7ztklWGOdm95M5Blcvr5CdInejtxrxSW9M5o4y0q6YaWmt3jmFkvGjJA4kt--6W49-d2tT9oHhBa6ePf2ehO$ 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net