Use SameSite=Lax for SAML Sign-In

Use SameSite=Lax for SAML Sign-In

Applies to: Xerox DocuShare 8.1.

When SAML single sign-on is enabled and the session cookie is set to SameSite=Strict, users may authenticate with the identity provider but cannot reach the DocuShare home page. The session is not recognized after the identity-provider redirect.

Why This Happens

SAML sign-in uses a cross-site redirect from the identity provider. A cookie set to SameSite=Strict is not sent on that redirect, so DocuShare does not recognize the session.

Recommended Setting

Do not use SameSite=Strict when SAML is enabled. Use SameSite=Lax, the DocuShare 8.1 default. Lax allows the session cookie on the identity-provider redirect while still providing cross-site protection.

To change the setting, sign in to DocuShare as an administrator and go to Administration > Site Management > Server Configuration. Find Same Site Cookie Value, select Lax, and click Submit. Restart DocuShare for the change to take effect.

Source: Xerox DocuShare 8.1 Release Notes, Known Issues, SPAR 59596.