Prevent the issue of broken SAML login flow

indigo-iam · Dec 20, 2024 · 0a6b1a5 · 0a6b1a5
1 parent ec17288
commit 0a6b1a5
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 1 deletion.
diff --git a/compose/custom-nginx/iam.conf b/compose/custom-nginx/iam.conf
@@ -38,6 +38,8 @@ server {
     proxy_set_header        X-SSL-Client-Verify  $ssl_client_verify;
     proxy_set_header        X-SSL-Protocol $ssl_protocol;
     proxy_set_header        X-SSL-Server-Name $ssl_server_name;
+
+    proxy_cookie_flags ~ secure samesite=none;
   }
 
   location /iam-test-client {

diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/IamConfig.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/IamConfig.java
@@ -49,6 +49,7 @@
 import org.springframework.security.oauth2.provider.ClientDetailsService;
 import org.springframework.security.oauth2.provider.code.AuthorizationCodeServices;
 import org.springframework.security.oauth2.provider.token.TokenEnhancer;
+import org.springframework.session.web.http.DefaultCookieSerializer;
 
 import com.google.common.collect.Maps;
 
@@ -309,8 +310,15 @@ UsernameValidator usernameRegExpValidator() {
   }
 
   @Bean(destroyMethod = "shutdown")
-  public ScheduledExecutorService taskScheduler() {
+  ScheduledExecutorService taskScheduler() {
     return Executors.newSingleThreadScheduledExecutor();
   }
 
+  @Bean
+  DefaultCookieSerializer defaultCookieSerializer() {
+    DefaultCookieSerializer cs = new DefaultCookieSerializer();
+    cs.setSameSite(null);
+    return cs;
+  }
+
 }