Issue #206 Add options for Cookie SameSite attribute

[tsujiguchitky]

Analysis

Chrome treats cookies that have no declared SameSite value as SameSite=Lax cookies.
As a result, OpenAM has some troubles (See #206).

Solution

Add the following settings.

• Default value of SameSite attribute
  • If this value is the initial value, the SameSite attribute is not set.
• SameSite setting list
  • Enable to specify each cookie in {Cookie Name}={SameSite Value} format.
  • This value works to override the default value above
  • By default, amlbcookie and authenticationStep are set to None

Also, add a properties file (SameSiteIncompatibleClient.properties) that excludes user agents, because there are incompatible browsers with SameSite.

Compatibility

This fix adds a parameter to CookieUtils.addCookieToResponse(). If using this method in a customized authentication module etc., rebuild it.

Testing

• SameSite setting patterns
  • Set for all cookies
  • Not set for all cookies
  • amlbcookie only (server side cookie)
  • authId only (client side cookies)
  • amlbcookie & authenticationStep (server side cookies)
  • authId & iPlanetDirectoryPro (client side cookies)
• Chrome & SameSite=None
  • SAML2 Authentication
  • XUI OFF & CDSSO & Session upgrade

Regression testing

• Authentication succeeds if the SameSite attribute is not set
  • Chrome
  • Firefox
  • Edge
  • IE
• Authentication succeeds if SameSite=None
  • Chrome
  • Firefox
  • Edge
  • IE

[ogis-osada]

close #206