If you set up the SimpleSAMLphp instance on a subdomain of the Drupal instance, the integration via drupalauth4ssp fails, because the cookie set by the module is not accessible by the SimpleSAMLphp instance.
Are there any security issues with making the cookie accessible to subdomains of the Drupal instance? I could think of none.
The attached patch introduces a new option in the module's configuration, which makes the cookie accessible from subdomains of the Drupal instance. This way, if the SimpleSAMLphp instance runs on a subdomain, the integration still succeeds.
Closed: outdated
1.1
Code
Not all content is available!
It's likely this issue predates Contrib.social: some issue and comment data are missing.