I am attempting to enable SSO on our Sitecore 9.1 (initial release) installation. Our identity provider is Shibboleth which we currently use for several other systems.
My strategy was to disable Identity Server and configure federated authentication directly from Sitecore to Shibboleth (no Identity Server between).
Following this 3-part blog post I was able to get it working… mostly. Part 3: https://blogs.perficientdigital.com/2018/06/06/federated-authentication-in-sitecore-9-part-3-implementation-of-saml2p/
The issue is that it works in the browser (hence forth called browser "S" for success) I was using while working on the solution but NOT when running in incognito mode (browser "F" for fails).
The issue seems to be cookies… or rather a lack of cookies.
The error I see in the Owin.log.* file as a result of a failed login attempt with browser "F" is:
11380 13:32:22 ERROR Sustainsys.Saml2.Owin.Saml2AuthenticationMiddleware - Saml2 Authentication failed. The received SAML data is
<saml2p:Response
………lot’s of data here……..
</saml2p:Response>
Exception: Sustainsys.Saml2.Exceptions.UnexpectedInResponseToException
Message: Received message contains unexpected InResponseTo "ide14965ae7bfb4ba3a7f10330bae6e9e3". No cookie preserving state from the request was found so the message was not expected to have an InResponseTo attribute. This error typically occurs if the cookie set when doing SP-initiated sign on have been lost.
Source: Sustainsys.Saml2
at Sustainsys.Saml2.Saml2P.Saml2Response.ReadAndValidateInResponseTo(XmlElement xml, Saml2Id expectedInResponseTo, IOptions options)
at Sustainsys.Saml2.Saml2P.Saml2Response..ctor(XmlElement xml, Saml2Id expectedInResponseTo, IOptions options)
at Sustainsys.Saml2.WebSso.AcsCommand.Run(HttpRequestData request, IOptions options)
at Sustainsys.Saml2.Owin.Saml2AuthenticationHandler.<AuthenticateCoreAsync>d__0.MoveNext()
Based on this error message, I started looking at the browser cookies. When I compare traffic using Fiddler between browsers "S" and "F", I found a difference when navigating from the login screen to the Identity Provider (aka - clicking the "Saml Connect" button.. see screenshot).
On browser "S" several cookies are sent in the request and a cookie is set in the response. On browser "F" no cookies are sent in the request (not even ASP.NET Session cookie) and no cookies are set in the response.
Now, if I use browser "F" and login with native Sitecore creds first, THEN login with "Saml Connect", it works. The difference seems to be that there are now cookies in the browser to send (see screenshot)
So the question is why is there no cookie being set in browser "F"? Have you seen this issue before and know any workarounds?
EDIT: After some more troubleshooting, it is specifically the presence of the ASP Session cookie that determines if login works or not.
