InCommon Operations Notifications

["Nicholas Roy" <>]

Hello,

In recent weeks, browsers such as Chrome 
(https://www.chromium.org/updates/same-site), Firefox, and Safari 
(https://bugs.webkit.org/show_bug.cgi?id=198181) have begun changing the 
default behavior of session cookies. These changes will impact all 
browser-mediated single sign-on protocols, as well as other web applications. 
The browsers will start to enforce tighter controls around cookies perceived 
as “cross-site”. Unfortunately, these are exactly the types of cookies that 
make efficient web single sign-on work correctly. Technical professionals 
responsible for their organization’s integrations with federation, single 
sign-on, and related technologies, are advised to read more about this issue, 
here: https://wiki.shibboleth.net/confluence/display/DEV/IdP+SameSite+Testing.

You may need to change how your SAML service provider and/or identity 
provider software stores session state. It is recommended that Service 
Providers take advantage of memory-based session caches, per their SAML 
software’s documentation. For Shibboleth Service Provider, please see: 
https://wiki.shibboleth.net/confluence/display/SP3/SameSite. For Shibboleth 
Identity Provider, please see: 
https://wiki.shibboleth.net/confluence/display/IDP30/SameSite. Identity 
Providers and Service Providers should consider if and how this will impact 
their integrations using InCommon or bi-laterally, and determine if changes 
are needed to their configurations.

Deployers of Shibboleth, SimpleSAMLphp, and SATOSA all have viable 
work-arounds they can use that are known to alleviate the SameSite issue, at 
least for the time being. The state of other software is out of the scope of 
this advisory.

To discuss this issue with others in the InCommon community, we recommend you 
subscribe to the  mailing list, at 
https://lists.incommon.org, and post there.

Thank you,

Nick Roy
on behalf of the InCommon Technical Advisory Committee (InC-TAC) and the 
Community Architecture Committee for Trust and Identity (CACTI)

Attachment: signature.asc
Description: OpenPGP digital signature