Bug 1131612

Summary: [GSS] (6.4.0) PickletLink IdP Filter eating cookies added to response by other filters
Product: [JBoss] JBoss Enterprise Application Platform 6 Reporter: Derek Horton <dehort>
Component: SecurityAssignee: Peter Skopek <pskopek>
Status: CLOSED CURRENTRELEASE QA Contact: Ondrej Kotek <okotek>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 6.3.0CC: anmiller, bbaranow, kkhan, okotek, pskopek
Target Milestone: DR4   
Target Release: EAP 6.4.0   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: 1131582 Environment:
Last Closed: 2019-08-19 12:38:49 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1123426, 1131582    

Description Derek Horton 2014-08-19 16:29:39 UTC 
+++ This bug was initially created as a clone of Bug #1131582 +++

Description of problem:

PickletLink IdP Filter eating cookies added to response by other filters

Steps to Reproduce:
1. create a filter that adds a cookie to the httpServletResponse (response.addCookie(...))
2. ensure that you are using IDPfilter

Regardless of which is mapped first (cookie filter or idpFilter), the cookies you add to the response will not be returned to the browser. Simply commenting out the IdPFilter mapping will allow the cookies to be properly returned to the browser.

This behavior appears to happen without regard to the presence of a SAML assertion in the incoming request (ie. it doesn't matter if you directly access the IdP or are redirected there from a trusted SP).
Comment 1 Derek Horton 2014-08-19 17:16:10 UTC 
Upstream PR:
https://github.com/picketlink/picketlink/pull/372
Comment 2 JBoss JIRA Server 2014-08-25 15:55:03 UTC 
Pedro Igor <pigor.craveiro> updated the status of jira PLINK-529 to Resolved
Comment 3 Kabir Khan 2014-10-03 16:22:12 UTC 
I believe this should be fixed by the SP11 upgrade in 1123426
Comment 4 Ondrej Kotek 2014-10-10 09:22:48 UTC 
The fix does not work for me. For JBoss EAP 6.4.0.DR4:
  * a test filter is called twice (unlike JBoss EAP 6.3.0)
  * cookies created in the filter are not returned to the browser for base URI (like JBoss EAP 6.3.0)

See BZ 1133099. Backport of PLINK-558 helped. There is manual reproducer available.
Comment 5 Ondrej Kotek 2014-10-13 09:51:38 UTC 
BZ 1123426 (Upgrade PicketLink from 2.5.3.SP10-redhat-1 to 2.5.3.SP11-x) is verified but included commits are in wrong order. PLINK-558 commit is the important one and should be placed as the last one.
Comment 6 Ondrej Kotek 2015-01-26 11:39:04 UTC 
Verified for JBoss EAP 6.4.0.DR7, like BZ 1122717.