Shibboleth ignoring configuration settings

Question

When testing shibd from command line (/usr/sbin/shibd -t) I'm seeing this warning:

WARN Shibboleth.Application : empty/missing cookieProps setting, set to "https" for SSL/TLS-only usage

My app is in fact HTTPS only, so I want to extend this to Shibboleth (I am a development environment and am not in production).

Previously,/etc/shibboleth/shibboleth2.xml config file contained this in the ApplicationDefaults section:

  <Sessions lifetime="28800" timeout="3600" checkAddress="false"
        handlerURL="/Shibboleth.sso" handlerSSL="true" 
        exportLocation="http://localhost/Shibboleth.sso/GetAssertion"
        exportACL="127.0.0.1"
        idpHistory="false" idpHistoryDays="7">

So, I added the following

cookieProps="; path=/; secure; httpOnly" after HandlerSSL="true"

same section:

  <Sessions lifetime="28800" timeout="3600" checkAddress="false"
        handlerURL="/Shibboleth.sso" handlerSSL="true" cookieProps="; path=/; secure; httpOnly"
        exportLocation="http://localhost/Shibboleth.sso/GetAssertion"
        exportACL="127.0.0.1"
        idpHistory="false" idpHistoryDays="7">

Now the error I'm seeing when issuing shibd -t is:

WARN Shibboleth.Application : custom cookieProps setting should include "; secure" for SSL/TLS-only usage

Why is shib ignoring the secure declaration?

Answer 1

Using: cookieProps="https"

did the trick for me.