<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Segoe UI";
panose-1:2 11 5 2 4 2 4 2 2 3;}
@font-face
{font-family:wf_segoe-ui_normal;}
@font-face
{font-family:"Segoe UI Light";
panose-1:2 11 5 2 4 2 4 2 2 3;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-GB" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Hi Mark,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">I went through the same pain as you a few months ago – the issue came down to SameSite, where the randomness was because Chrome allows the cookies for some amount of time, then stops them.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Based on reading bug reports, I fixed the issue by adding this to the bottom of global.xml:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> <bean id="abertay.SameSiteExpression" class="java.util.regex.Pattern" factory-method="compile"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> c:_0="(Firefox)|(Chrom(e|ium)/[1234789])" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> <bean id="abertay.SameSiteCondition" class="net.shibboleth.ext.spring.util.SpringExpressionPredicate"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> c:expression="#custom.matcher(#input.getHeader('User-Agent') ?: '').find() and !(#input.getHeader('User-Agent') ?: '').contains('UCBrowser')"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> p:customObject-ref="abertay.SameSiteExpression" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">And setting this property in idp.properties:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> idp.cookie.sameSiteCondition = abertay.SameSiteCondition<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">You may wish to change the "abertay"s to "Bristol".
</span><span style="font-family:"Segoe UI Emoji",sans-serif;mso-fareast-language:EN-US">😊</span><span style="mso-fareast-language:EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Cheers,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Duncan Sinclair.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt">-- <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt">Duncan Sinclair<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt">Infrastructure Specialist – Systems<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt">Abertay University, Dundee<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> users <users-bounces@shibboleth.net>
<b>On Behalf Of </b>Mark van Rossum<br>
<b>Sent:</b> Wednesday, 13 October 2021 3:49 pm<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: Error: "No flow execution could be found with key '....'"<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="mso-element:para-border-div;border:none;border-left:solid #910A19 4.5pt;padding:0cm 0cm 0cm 5.0pt;background:#FDF2F4">
<p style="background:#FDF2F4;border:none;padding:0cm"><span style="font-size:9.0pt;font-family:"Segoe UI",sans-serif;color:#212121">[EXTERNAL MAIL] This message was sent from outside the University. Do not reply, click links, or open attachments unless you
recognise the source of this email and know the content is safe. Email </span><span style="color:black"><a href="mailto:itservicedesk@abertay.ac.uk"><span style="font-size:9.0pt;font-family:"Segoe UI",sans-serif">itservicedesk@abertay.ac.uk</span></a></span><span style="font-size:9.0pt;font-family:"Segoe UI",sans-serif;color:#212121">
if you require help.<o:p></o:p></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">Hi thanks for the reply.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">I've got Chromes dev tools open on a failed attempt, and I can see that on the POST back from AAD to Shib, no cookies are included. A successful attempt includes a JSESSIONSID cookie at this stage.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">How could a SameSite issue cause a cookie to be randomly withheld in about 8% of cases? All my testing is done with the latest Chrome. I can redo a login to an SP and it works ten times in a
row, then breaks once, then works again etc.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black;background:white">From reading the Shib SameSite docs [1] the advice is to "do nothing" otherwise you risk breaking Safari. </span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black;background:white">Do I have to just take the hit on that, and set SameSite=None?</span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black;background:white">Thanks,</span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black;background:white">Mark</span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">[1] </span><a href="https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.atlassian.net%2Fwiki%2Fspaces%2FIDP4%2Fpages%2F1284276231%2FSameSite&data=04%7C01%7C%7Cec61ceae26db4529231a08d98e5893ad%7Caacb1abaf38f410e9153c16a00ebf4cc%7C0%7C0%7C637697333354630329%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=H1kEABX50eqadvNrjdmCLBbv%2FHvq3MdGmHCMNIl1WKc%3D&reserved=0"><span style="font-size:12.0pt">https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1284276231/SameSite</span></a><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
</div>
<div>
<div style="margin-top:12.0pt;margin-bottom:12.0pt;min-width: 424px" id="LPBorder_GTaHR0cHM6Ly9zaGliYm9sZXRoLmF0bGFzc2lhbi5uZXQvd2lraS9zcGFjZXMvSURQNC9wYWdlcy8xMjg0Mjc2MjMxL1NhbWVTaXRl">
<table class="MsoNormalTable" border="1" cellpadding="0" width="100%" style="width:100.0%;border:solid #C8C8C8 1.0pt">
<tbody>
<tr>
<td width="100%" valign="top" style="width:100.0%;border:none;padding:9.0pt 27.0pt 9.0pt 9.0pt">
<div style="margin-right:6.0pt;margin-bottom:9.0pt" id="LPTitle676941">
<p class="MsoNormal"><a href="https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.atlassian.net%2Fwiki%2Fspaces%2FIDP4%2Fpages%2F1284276231%2FSameSite&data=04%7C01%7C%7Cec61ceae26db4529231a08d98e5893ad%7Caacb1abaf38f410e9153c16a00ebf4cc%7C0%7C0%7C637697333354640299%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=%2FCLMwULQbYwx1iM7XHC%2Badk31dTTg0vMAXe9Mtmgnqw%3D&reserved=0" target="_blank"><span style="font-size:16.0pt;font-family:"Segoe UI Light",sans-serif;text-decoration:none">SameSite
- Identity Provider 4 - Confluence</span></a><span style="font-size:16.0pt;font-family:"Segoe UI Light",sans-serif"><o:p></o:p></span></p>
</div>
<div style="margin-right:6.0pt;margin-bottom:9.0pt;max-height: 100px;overflow:hidden" id="LPDescription676941">
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:wf_segoe-ui_normal;color:#666666">SameSite and Frames. Note the caveat above of "tested and supported". The IdP officially does not support the use of frames, and the shipping defaults block frames.<o:p></o:p></span></p>
</div>
<div id="LPMetadata676941">
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:wf_segoe-ui_normal;color:#A6A6A6">shibboleth.atlassian.net<o:p></o:p></span></p>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="2" width="98%" align="center">
</div>
<div id="divRplyFwdMsg">
<p class="MsoNormal"><b><span style="color:black">From:</span></b><span style="color:black"> users <</span><a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a><span style="color:black">> on behalf of Cantor, Scott <</span><a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a><span style="color:black">><br>
<b>Sent:</b> 13 October 2021 14:59<br>
<b>To:</b> Shib Users <</span><a href="mailto:users@shibboleth.net">users@shibboleth.net</a><span style="color:black">><br>
<b>Subject:</b> Re: Error: "No flow execution could be found with key '....'"</span>
<o:p></o:p></p>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal">On 10/13/21, 9:41 AM, "users on behalf of Mark van Rossum" <<a href="mailto:users-bounces@shibboleth.net%20on%20behalf%20of%20Mark.vanRossum@bristol.ac.uk">users-bounces@shibboleth.net on behalf of Mark.vanRossum@bristol.ac.uk</a>> wrote:<br>
<br>
> If it was SameSite issues would it be consistently broken? <br>
<br>
No, not really, but the bug I recalled [1] never actually turned into anything real. There was a case where you could get it to "crash" ungracefully and it's been patched to produce the proper error but the cause was never anything but standard scenarios where
the session simply isn't there, so there has never been any sign that the reasons for the error are ever anything but what they always are. SameSite just happens to be a clear and direct cause.<br>
<br>
-- Scott<br>
<br>
[1] <a href="https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.atlassian.net%2Fbrowse%2FIDP-1831&data=04%7C01%7C%7Cec61ceae26db4529231a08d98e5893ad%7Caacb1abaf38f410e9153c16a00ebf4cc%7C0%7C0%7C637697333354650241%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=pvzw7uSPJqJe2wF5ssqBTH7GoS8kahkXnERDImkDj7Q%3D&reserved=0">
https://shibboleth.atlassian.net/browse/IDP-1831</a><br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.atlassian.net%2Fwiki%2Fx%2FZYEpPw&data=04%7C01%7C%7Cec61ceae26db4529231a08d98e5893ad%7Caacb1abaf38f410e9153c16a00ebf4cc%7C0%7C0%7C637697333354660198%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=%2BJFKbEy76FQa2Ah2VDuZZLb69D9Qj5oF3LVCQhUGH%2B0%3D&reserved=0">
https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a><o:p></o:p></p>
</div>
</div>
</div>
</div>
<!DOCTYPE html>
<table>
<tbody>
<tr>
<td>
<p><a href="https://abertay.co/ZTQw"><img src="https://abertay.co/stemailsig2020" height="117" width="400" alt="Abertay Named UK University of the Year for Teaching Quality"></a></p>
<p style="font-family:arial; font-size:12px; font-style:italic;">Abertay University is a charity registered in Scotland, No. SC016040</p>
<p></p>
<p style="font-family:arial; font-size:14px; font-weight:bold;">Follow us: <a href="http://www.abertay.ac.uk">
www.abertay.ac.uk</a> | <a href="https://twitter.com/AbertayUni">@AbertayUni</a> |
<a href="https://www.linkedin.com/edu/school?id=12685">AbertayLinkedIn</a> | <a href="https://www.facebook.com/AbertayUni">
AbertayFacebook</a></p>
<p style="font-family:arial; font-size:9px;">Any views or opinions expressed in this email and any attachments are solely those of the author and do not necessarily represent those of Abertay University. This email and any attachments may be confidential and
are intended solely for the use of the intended recipient. If you are not the intended recipient, you must take no action based on the email or its attachments, nor must you copy or show them to anyone. Please contact the sender if you believe you have received
this email in error.</p>
</td>
</tr>
</tbody>
</table>
</body>
</html>