MIT test results - SAML authentication with stricter SameSite settings

Overview

Google Chrome version 80, released on February 4, 2020, introduces changes to its handling of cross-site (aka 3rd party) cookies.

For more information, see https://blog.chromium.org/2020/02/samesite-cookie-changes-in-february.html

While specifics have not yet been finalized, Mozilla Firefox is also likely to update its defaults for cross-site cookies.

This change will impact some MIT services. For example, some vendor sites may need to be updated for successful handling of cross-site cookies when directing between the vendor site and the Touchstone IdP (idp.mit.edu).

Test results to date for Touchstone authentication to vendor sites

*For Chrome 80, Touchstone login to MIT Canvas is successful. For Firefox configured with the more secure SameSite cookie settings, Touchstone login to MIT Canvas is not successful.

Instructions for MIT testers

Instructions for MIT testers