Add SAML reauth props to distributed application.properties file

server/configs/application.properties

@@ -91,19 +91,19 @@ mail.smtpUser=@@smtpUser@@
 #mail.graph.clientId=@@graphClientId@@
 #mail.graph.clientSecret=@@graphClientSecret@@
 
-# Optional - JMS configuration for remote ActiveMQ message management for distributed pipeline jobs
-# https://www.labkey.org/Documentation/wiki-page.view?name=jmsQueue
+## Optional - JMS configuration for remote ActiveMQ message management for distributed pipeline jobs
+## https://www.labkey.org/Documentation/wiki-page.view?name=jmsQueue
 #context.resources.jms.ConnectionFactory.type=org.apache.activemq.ActiveMQConnectionFactory
 #context.resources.jms.ConnectionFactory.factory=org.apache.activemq.jndi.JNDIReferenceFactory
 #context.resources.jms.ConnectionFactory.description=JMS Connection Factory
-# Use an in-process ActiveMQ queue
+## Use an in-process ActiveMQ queue
 #context.resources.jms.ConnectionFactory.brokerURL=vm://localhost?broker.persistent=false&broker.useJmx=false
-# Use an out-of-process ActiveMQ queue
+## Use an out-of-process ActiveMQ queue
 #context.resources.jms.ConnectionFactory.brokerURL=tcp://localhost:61616
 #context.resources.jms.ConnectionFactory.brokerName=LocalActiveMQBroker
 
-# Optional - LDAP configuration for LDAP group/user synchronization
-# https://www.labkey.org/Documentation/wiki-page.view?name=LDAP_sync
+## Optional - LDAP configuration for LDAP group/user synchronization
+## https://www.labkey.org/Documentation/wiki-page.view?name=LDAP_sync
 #context.resources.ldap.ConfigFactory.type=org.labkey.premium.ldap.LdapConnectionConfigFactory
 #context.resources.ldap.ConfigFactory.factory=org.labkey.premium.ldap.LdapConnectionConfigFactory
 #context.resources.ldap.ConfigFactory.host=myldap.mydomain.com
@@ -117,24 +117,24 @@ mail.smtpUser=@@smtpUser@@
 #useLocalBuild#spring.devtools.restart.additional-paths=@@pathToServer@@/build/deploy
 #useLocalBuild#spring.devtools.restart.trigger-file=.restartTrigger
 
-# HTTP session timeout for users - defaults to 30 minutes
+## HTTP session timeout for users - defaults to 30 minutes
 #server.servlet.session.timeout=30m
 
-# SAML IdPs return authentication assertions via a cross-site POST. Without an explicit SameSite value,
-# Chromium-based browsers treat JSESSIONID as Lax and withhold it from that POST, except during a grace period
-# covering cookies less than two minutes old. Reauthentication deliberately never replaces the session -- the
-# signed-in session is what it verifies against -- so the cookie only ages, and any reauthentication more
-# than a couple of minutes after sign-in arrives with no session cookie. That fails two ways: the server sees
-# a guest on that request and rejects the reauthentication, and the response mints a guest session whose
-# Set-Cookie overwrites the signed-in JSESSIONID, logging the user out. SameSite=None
-# keeps the session attached to the callback and is only honored on Secure cookies,
-# so this requires HTTPS.
+## SAML IdPs return authentication assertions via a cross-site POST. Without an explicit SameSite value,
+## Chromium-based browsers treat JSESSIONID as Lax and withhold it from that POST, except during a grace period
+## covering cookies less than two minutes old. Reauthentication deliberately never replaces the session -- the
+## signed-in session is what it verifies against -- so the cookie only ages, and any reauthentication more
+## than a couple of minutes after sign-in arrives with no session cookie. That fails two ways: the server sees
+## a guest on that request and rejects the reauthentication, and the response mints a guest session whose
+## Set-Cookie overwrites the signed-in JSESSIONID, logging the user out. SameSite=None keeps the session attached to
+## the callback and is only honored on Secure cookies, so this requires HTTPS.
 #server.servlet.session.cookie.same-site=none
 #server.servlet.session.cookie.secure=true
-#server.servlet.session.cookie.http-only=true
+
+server.servlet.session.cookie.http-only=true
 
 ## Turn on JSON-formatted HTTP access logging to stdout. See issue 48565
-## https://tomcat.apache.org/tomcat-9.0-doc/config/valve.html#JSON_Access_Log_Valve
+## https://tomcat.apache.org/tomcat-11.0-doc/config/valve.html#JSON_Access_Log_Valve
 #jsonaccesslog.enabled=true
 
 ## Optional configuration, modeled on the non-JSON Spring Boot properties

server/configs/webapps/embedded/config/application.properties

@@ -48,6 +48,13 @@ server.port=80
 #server.ssl.key-store-password=@@keyStorePassword@@
 #server.ssl.key-store-type=PKCS12
 
+## Required for SAML reauthentication (e.g., signing ELNs electronically) in Chromium-based browsers.
+##   Enable both together, and only with HTTPS.
+#server.servlet.session.cookie.same-site=none
+#server.servlet.session.cookie.secure=true
+
+server.servlet.session.cookie.http-only=true
+
 server.error.include-stacktrace=always
 server.error.include-message=always