Parcelwise: sign-in loops between Microsoft and ACME on iPhones and Macs
Description
Some people at Eindhoven get stuck in a loop: Microsoft sign-in, back to your sign-in page, Microsoft again. All on iPhones and a couple of Macs. Windows is fine.
Linked issues
- relates to ENG-1717 Single sign-on loops on iPhones and Macs: Safari drops the session cookie on the SAML POST Done
Comments (7)
iOS 17.6 on the iPhones, Safari 17 on the Macs. Chrome on the iPhone works.
Reproduced on iOS 17.6 and in Safari on macOS: when Entra ID sends the person back to us, Safari leaves out our session cookie, so we start the sign-in again. Sent to engineering as urgent.
ENG-1717. Session cookie on the SAML assertion POST is SameSite=Lax; Safari drops it on the cross-site POST. Needs SameSite=None; Secure on that cookie. Affects any customer on iOS.
Confirmed in identity-service; fix is in review.
Fixed in today's release. Could one of the Eindhoven iPhone users try?
Works on iPhone now. Thanks!
Hi Femke, thanks. Which iOS and Safari versions? And does it happen in Chrome on the same iPhones? Meanwhile, Chrome or Edge on those devices should get people in.