| Audience: DocuShare Administrators |
Use SameSite=Lax for SAML Sign-In
Applies to: Xerox DocuShare 8.1.
When SAML single sign-on is enabled and the session cookie is set to SameSite=Strict, users may authenticate with the identity provider but cannot reach the DocuShare home page. The session is not recognized after the identity-provider redirect.
Why This Happens
SAML sign-in uses a cross-site redirect from the identity provider. A cookie set to SameSite=Strict is not sent on that redirect, so DocuShare does not recognize the session.
Recommended Setting
Do not use SameSite=Strict when SAML is enabled. Use SameSite=Lax, the DocuShare 8.1 default. Lax allows the session cookie on the identity-provider redirect while still providing cross-site protection.
To change the setting, sign in to DocuShare as an administrator and go to Administration > Site Management > Server Configuration. Find Same Site Cookie Value, select Lax, and click Submit. Restart DocuShare for the change to take effect.
Source: Xerox DocuShare 8.1 Release Notes, Known Issues, SPAR 59596.