<div dir="ltr">Thank you Peter, that did the trick.</div><div class="gmail_extra"><br><br><div class="gmail_quote">On Mon, Jul 28, 2014 at 3:22 PM, Peter Schober <span dir="ltr"><<a href="mailto:peter.schober@univie.ac.at" target="_blank">peter.schober@univie.ac.at</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">* Dan LaSota <<a href="mailto:dlasota@alaska.edu">dlasota@alaska.edu</a>> [2014-07-29 00:55]:<br>
> So I headed over to the wiki and looked up the cookieProps<br>
> attribute.<br>
[...]<br>
> Questions: Isn't the handlerSSL="true" and the cookieProps secure<br>
> value the same thing?<br>
<br>
Not at all. Quoting from the wiki:<br>
<a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSessions" target="_blank">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSessions</a> :<br>
<br>
handlerSSL(boolean) (defaults to true)<br>
When true, only web requests over SSL/TLS will be processed by<br>
handlers. Other requests may be blocked, or possibly ignored (and<br>
usually result in a 404 error) depending on the web server, but will<br>
never be processed. This is useful for sites that want to protect SAML<br>
protocol traffic but leave actual content unencrypted.<br>
<br>
cookieProps (string) (default is "; path=/; HttpOnly")<br>
If set to a custom string, the string is appended to the cookie values<br>
maintained by the SP. Used to attach custom meta-properties like path<br>
or the secure and HttpOnly flags to the cookies. A common value for<br>
SSL-only use is "; path=/; secure; HttpOnly". As of V2.5, this<br>
property can be set to a pair of built-in values, "http" and "https",<br>
which expand to the default and SSL-only properties respectively.<br>
<br>
So handlerSSL should be "true" (since you talk about "SSL forced<br>
everything" site), preventing insecure access. For cookieProps read on.<br>
<br>
> I am also seeing samples of https/http and HttpOnly.<br>
><br>
> This is what I want:<br>
> the right value for an SSL forced everything on my multidomain<br>
> *.<a href="http://domain.edu" target="_blank">domain.edu</a> site.<br>
<br>
If you positively need to share SP cookies between webservers in a<br>
shared DNS domain you can't use "https" as cookieProps value, as the<br>
default will cause cookies to be set to the FQDN of the issuing<br>
webserver (causing the HTTP User Agent to not transmit them to other<br>
webservers). From the documentation quoted above:<br>
"A common value for SSL-only use is "; path=/; secure; HttpOnly"."<br>
which is alsothe default when using the 2.5 SP and the setting<br>
"https". So you could just add your domain=.<a href="http://site.domain.edu" target="_blank">site.domain.edu</a> to that,<br>
making it<br>
"domain=.<a href="http://site.domain.edu" target="_blank">site.domain.edu</a>; path=/; secure; HttpOnly"<br>
and differing only in the addition of "HttpOnly" from your current<br>
settings. See <a href="https://www.owasp.org/index.php/HttpOnly" target="_blank">https://www.owasp.org/index.php/HttpOnly</a> for an<br>
explanation of HttpOnly if you're unsure.<br>
<span class="HOEnZb"><font color="#888888">-peter<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</font></span></blockquote></div><br><br clear="all"><div><br></div>-- <br><div dir="ltr">Dan LaSota<br>Instructional Designer, UAF eLearning<br>(907) 451-4067<br><a href="mailto:dan.lasota@alaska.edu" target="_blank">dan.lasota@alaska.edu</a><br>
<a href="http://elearning.uaf.edu" target="_blank">http://elearning.uaf.edu</a></div>
</div>