<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Afternoon all,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I was wondering if anyone else has noticed this possible issue that I describe below. I set up my testing SP with an embedded DS about a year ago, but I configured it pretty by-the-book from what I remember.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">When I look at the network activity in my browser, I notice that after select an IdP from the /shibboleth-ds page it proceeds to set the “_saml_idp” cookie as described in both the IdP Discovery spec and the SAML v2.0 spec. In the latter
spec, it is mentioned that the “The cookie MUST be marked as secure”. But according to the browser the Secure parameter is not set. I should note that when testing a different SP that uses the Discovery Service living on our *<b>IdP</b>*, the IdP DS is in
fact setting “_saml_idp” as secure.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Is this something I am just doing wrong in my configuration of the SP’s embedded DS? Is this even a problem or am I misunderstanding the use of that cookie?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">As an aside, just before sending this email I also noticed that the “shib_idp_session” cookie from the IdP is also not being set as secure.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thank you,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b><span style="color:black">Nathan Lee </span></b><span style="color:black">|<b> </b></span><span style="color:black">Systems Infrastructure Administrator<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">Systems Engineering | Division of Information Technology<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">Texas A&M University<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:black">0971 TAMU | College Station, TX 77843<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">ph: 979.862.5761 | <a href="mailto:leenathan24@exchange.tamu.edu"><span style="color:#954F72">leenathan24@exchange.tamu.edu</span></a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif;color:black">- - - - - - - - - - - - - - - - - - - - - - - - <br>
</span><b><span style="font-family:"Arial",sans-serif;color:#500000"><a href="http://it.tamu.edu/"><span style="color:#954F72">IT.tamu.edu</span></a></span></b><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>