SAML authentication fails when SAMESITE cookies are used
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
OpenStack Identity (keystone) |
New
|
Undecided
|
Unassigned |
Bug Description
It has been noticed that SAML authentication fails during the postResponse stage of SAML authentication the error presented to the user is
```
Bad Request
Your browser sent a request that this server could not understand.
```
When enabling debugging of Apache2 Mellon (/etc/apache2/
```
MellonDiagnosti
MellonDiagnosti
```
and looking in `/var/log/
```
User has disabled cookies, or has lost the cookie before returning from the SAML2 login server.
```
Upon closer inspection it is clear the `mellon-cookie` is missing as it should be created before being redirected to the SAML IdP. However, in Google Chrome, this cookie is not being created hence the error above.
Users can manually create the cookie via developer tools however this not appropriate solution. A temporary solution has been to edit `/etc/apache2/
```
SetEnv MELLON_
```
Which has resolved the issue at the cost of disabling SAMESITE cookies.
This problem has been noticed after Zed upgrades and has persisted after an Antelope upgrade.