[labkey-adam]

Rationale

These properties are more likely to be used if they're in the application.properties file that gets distributed to customers and deployed. GH Issue 1748

Related Pull Requests

• Document the SameSite requirement for SAML reauthentication #1472

Changes

• Add properties that should be enabled to allow Chromium browsers to reauthenticate via SAML
• Eliminate unused NLP XML files

User Education

• At a minimum, we should add a troubleshooting section for "Reauthentication failed: wrong user reauthenticated" when attempting to sign a notebook after authenticating with SAML. If they run into this problem, they should enable (or add) the two properties in application.properties. See the original issue: https://github.com/LabKey/internal-issues/issues/1436
• Could add a bullet to the release notes update or configure section

[labkey-bpatel]

Minor consistency nit: this adds server.servlet.session.cookie.http-only=true as an active line in the distributed application.properties, but in server/configs/application.properties it is still commented out - could we uncomment it here too so the two files match?

[labkey-adam]

Minor consistency nit: this adds server.servlet.session.cookie.http-only=true as an active line in the distributed application.properties, but in server/configs/application.properties it is still commented out - could we uncomment it here too so the two files match?

Sure. I uncommented it in the dev/test file. I also switched that file to consistently use ## for descriptions/instructions.