Feature Request for Policy to enable advanced setting for ADFS SSO Cookie behavior "Continue where you left off".
This is related to this public bug here: https://bugs.chromium.org/p/chromium/issues/detail?id=709477
Currently users using ADFS SAML SSO, when they are logged in, in browser, do the following steps:
1. Go to 3 Dots>Settings->Advanced->On Startup-> and choose "Continue where you left off".
2. Go to do 3 Dots>Settings-"Privacy and Security-> Content Settings->Cookies->and make sure "Allow sites to save and read cookie data (recommended)" is ON and "Keep data only until you quit your browser" is OFF.
3. Go to ADFS site, enter ADFS password.
4. Shut down Chromebook.
5. Turn on Chromebook, navigate to same ADFS site from step 3.
Users should not be prompted for password again.
-----
Support article below describes how to workaround issues but customers have claimed they do NOT utilize logout servlets.
How can the non-persistent session cookie that identifies a user during a browser session be deleted (e.g. upon logout)?
After successful authentication via SAML, Google sets a session cookie to identify an user's session. When the user explicitly logs out (e.g. by clicking the logout button), this cookie needs to be destroyed. If your implementation involves persistent session management ("remember me on this computer" functionality), you may need to control how and when this cookie is destroyed. Upon logout, Google redirects to your logout servlet. In your logout servlet, you may present the user with some options that could determine whether the session cookie should be deleted or not.
---
[Issue]
Users are not encountering the ADFS or Google logout. The session cookie simply expires over time or when the browser gets closed. Users must re-enter credentials (password) after they closeout their browser session. Customers should NOT have to re-enter credentials for ADFS SSO enabled web portals repeatedly even after they have signed into their Chrome OS Devices.
Comment 1 by benhenry@chromium.org
, Aug 1