ShibRequestSetting forceAuthn true vs 1 vs on

[Dan McLaughlin]

I found the problem.  We had maxTimeSinceAuthn=120. It's been like that
since 2021, and we hadn't seen issues.  However, we recently started
enforcing MFA, and now it seems users are taking longer than 2 minutes to
complete the auth flow.  And it's worse when they are first establishing
their MFA device.  In theory, I guess we could remove that setting
since NotOnOrAfter is 5 minutes. I increased maxTimeSinceAuthn to 300, and
we have stopped seeing the issue.

--

Thanks,

Dan

On Mon, Jun 8, 2026 at 12:08 PM Scott Cantor via users <users at shibboleth.net>
wrote:

>
>
> > On Jun 8, 2026, at 12:55 PM, Dan McLaughlin <
> dmclaughlin at tech-consortium.com> wrote:
> >
> > That may not be it then.  Firefox we have the same issue as Chrome.
> I'll keep digging, but I think you might be on to something regarding
> cookies.
> >
> > Of all the cookies, which in your opinion is most likely the cause?  One
> of the shib cookies, or the jsessionid?
>
> The error is due to JSESSIONID being absent or the container session
> timing out. That is literally what the error means, it's not a matter of
> opinion. Why is the only relevant question.
>
> It's not impossible Firefox reintroduced it. They never publicly
> documented anything we could find when they reversed it, so no reason
> they'd disclose that they changed it back.
>
> And in fact I just checked and lo and behold the FF settings are magically
> back again, so I think they repeated their original mistake and copied what
> Chrome did. They all start with network.cookie.sameSite. I'll revert any
> change to the documentation since it's back.
>
> Apple, to their immense credit, has still AFAIK rejected implementing this
> idiotic idea.
>
> -- Scott
>
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20260608/413595f2/attachment.htm>