<HTML xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<HEAD><!-- Template generated by Exclaimer Mail Disclaimers on 12:11:57 Montag, 11 Mai 2020 -->
<STYLE type=text/css>P.ImprintUniqueID {
MARGIN: 0cm 0cm 0pt
}
LI.ImprintUniqueID {
MARGIN: 0cm 0cm 0pt
}
DIV.ImprintUniqueID {
MARGIN: 0cm 0cm 0pt
}
TABLE.ImprintUniqueIDTable {
MARGIN: 0cm 0cm 0pt
}
DIV.Section1 {
page: Section1
}
</STYLE>
<!-- Template generated by Exclaimer Mail Disclaimers on 12:11:57 Montag, 11 Mai 2020 -->
<STYLE type=text/css>P.ImprintUniqueID {
MARGIN: 0cm 0cm 0pt
}
LI.ImprintUniqueID {
MARGIN: 0cm 0cm 0pt
}
DIV.ImprintUniqueID {
MARGIN: 0cm 0cm 0pt
}
TABLE.ImprintUniqueIDTable {
MARGIN: 0cm 0cm 0pt
}
DIV.Section1 {
page: Section1
}
</STYLE>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<meta name="Generator" content="Microsoft Word 15 (filtered medium)" />
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</HEAD>
<BODY lang="DE" link="#0563C1" vlink="#954F72">
<P class=ImprintUniqueID>
<P class=ImprintUniqueID>
<div class="WordSection1">
<p class="MsoNormal">Hello,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span lang="EN-GB">we’re running the Shibboleth IDP on a domain I’ll call example.com<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">We have two service providers SP1 (which also lives on example.com) and SP2 (which lives on test.com)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">SP2 has an iFrame which shows a protected page from SP1. This worked fine so far, since the users have to log in to access SP2 and the iFrame making the call to SP2 had all the cookies needed for SSO by SP1. Since the
introduction of the “SameSite” cookie parameters in the new versions of Chrome, this behaviour is now broken.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">My questions are: is this use case valid (i.e. is SP2 allowed to link a secure page from SP1 in an iFrame, or is this bad practice)? If so, what should we do to fix this issue?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">Kind regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">Serban<o:p></o:p></span></p>
</div>
</P>
<P class=ImprintUniqueID></P></P>
<P class=ImprintUniqueID> </P>
<P class=ImprintUniqueID><FONT color=#7d7d7d size=1 face=Arial>Sitz der
Gesellschaft / Corporate Headquarters: Lufthansa Industry Solutions AS GmbH,
Norderstedt, Registereintragung / Registration: Amtsgericht Kiel 3688
NO<BR/>Geschaeftsfuehrung / Management Board: Bernd Appel<BR/><BR/><BR/></FONT></P></BODY>
</HTML>