First Last Prev Next    This bug is not in your last search results.
Bug 54483 - simplesamlphp: make "Secure" and "SameSite" cookie attribute configurable
simplesamlphp: make "Secure" and "SameSite" cookie attribute configurable
Status: CLOSED FIXED
Product: UCS
Classification: Unclassified
Component: SAML
UCS 5.0
Other Linux
: P5 normal (vote)
: UCS 5.0-1-errata
Assigned To: Christian Castens
Florian Best
https://git.knut.univention.de/univen...
:
Depends on:
Blocks: 54792
  Show dependency tree / graph
 
Reported: 2022-02-23 14:32 CET by Florian Best
Modified: 2022-06-08 20:17 CEST (History)
1 user (show)

See Also:
What kind of report is it?: ---
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional): SAML, Security
Max CVSS v3 score:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Florian Best univentionstaff 2022-02-23 14:32:18 CET 
Cookies in simplesamlphp currently don't set flags and we cannot configure any.

We should make the "SameSite" and "Secure" configurable via UCR.
I think we cannot set "SameSite=Strict" as the UMC login dialog won't work then anymore. This has to be tested.
Comment 2 Christian Castens univentionstaff 2022-05-10 12:38:03 CEST 
The cookie attributes "Secure" and "SameSite" can now be set for the language and session cookies of the SAML IDP via UCR variables saml/idp/{session,language}-cookie/{secure,samesite}.


Successful build
Package: simplesamlphp
Version: 1.16.3-1+deb10u2A~5.0.0.202205101009
Branch: ucs_5.0-0
Scope: errata5.0-1


Successful build
Package: univention-saml
Version: 7.0.4-21A~5.0.0.202205101228
Branch: ucs_5.0-0
Scope: errata5.0-1
commit: 2c5d4852bf5a8af26d2bc40ee430bbec1bad67b2
Comment 3 Florian Best univentionstaff 2022-05-19 20:38:37 CEST 
OK: Secure=true
OK: SameSite=Lax|Strict are working
~ SameSite=None doesn't work for me. simplesamlphp complains about:
Missing cookie
You appear to have disabled cookies in your browser. Please check the settings in your browser, and try again.
https://ucs-sso.$domainname/simplesamlphp/module.php/core/no_cookie.php

→ I see no problems with using "Strict" even on HTTP. Maybe it's just ok - I don't think we need "None".
OK: YAML
First Last Prev Next    This bug is not in your last search results.