WebSudo Authentication kills session

Problem:

Websudo authentication is successfully triggered. However, after clicking "Ok" in the confirmation dialog the error message "Sending confirmation failed" is shown. When this happens, the current session is terminated, forcing the user to authenticate again.

Reason:

Confluence or Jira sends the session cookie (usually called JSESSIONID) without the SameSite flag.

Actual browsers interpret this absent value as "Lax". This leads to the following behaviour:

• In the pop-up window, the user is sent to the SAML Identity Provider for additional authentication.

• After authentication, the IdP triggers the browser to send a POST request to the Atlassian application, following the SAML POST binding.

• The browser does not send the cookie in the POST request because it's initiated by a 3rd party (the SAML IdP).

• The Tomcat server underneath Jira/Confluence creates a new session ID and sets a new session cookie. This causes the current session to get lost.

Workarounds:

Option 1: Use the integrated functionality since version 4.0.7

Customers using Jira versions earlier than 10 and Confluence versions earlier than 9 can use this option to ensure that the SameSite flag is set correctly.

Steps to enable Option 1:

1. Navigate to the Advanced Settings.

2. Enable the checkbox Set SameSite=None on the session cookie.

3. Save the settings.

Option 2: Configure Tomcat to send SameSite="none"

Tomcat, the application server used by Jira and Confluence, can be configured to send cookies with SameSite=None.
To do this:

1. Open the file:
   <Jira or Confluence installation directory>/conf/context.xml

2. Add the following line inside the <Context> tag:

After restarting, the JSESSIONID cookie should be sent with SameSite=None, and WebSudo should work as expected.

Option 3: Configure Reverse Proxy to rewrite set-cookie headers

Most reverse proxies allow rewriting response headers. The Set-Cookie header should be rewritten to add the SameSite=None attribute when sending the JSESSIONID cookie.

Option 4: Configure IdP to send the SAML response using REDIRECT binding

The session cookie is preserved correctly if the SAML response is sent from the Identity Provider (IdP) using HTTP GET instead of POST.
This can be achieved by configuring the IdP to use Redirect Binding, if supported.

To apply this in the SAML plugin configuration:

• Go to the Identity Provider settings under Request Settings.

• Set the Protocol Binding option to REDIRECT.