SAML Login Failure After Azure AD Redirect Due to Missing JSESSIONID Cookie

This issue is typically caused by inconsistent SameSite cookie attribute handling across system components.

Symptoms

During SAML login (e.g., Azure AD):

• User successfully authenticates at Identity Provider
• Redirect to /MicroStrategy/saml/SSO fails to complete login
• User is not authenticated in Strategy after redirect
• Authentication loop or return to login page occurs
  

Cause

After the SAML response is posted back to /MicroStrategy/saml/SSO, the JSESSIONID cookie is not available in the request.

Although Strategy sets the correct attributes (e.g., SameSite=None; Secure), a reverse proxy or Load Balancer modifies the cookie (for example, changing it to SameSite=Strict).

This causes:

• Session loss during SAML round-trip
• Failure to validate SAML response (InResponseTo)
• Authentication failure after IdP login
  

Solution

Ensure consistent cookie handling across all layers in the authentication flow.

1. Strategy Web/Library configuration

Ensure cookies are set with:

• SameSite=None
• Secure
• HttpOnly

2. Reverse Proxy / Load Balancer configuration

Verify that no component modifies Set-Cookie headers.

Ensure:

• JSESSIONID is not rewritten
• No forced SameSite=Strict injection
• No duplicate cookie attributes are added

3. HTTPS consistency

Ensure HTTPS is used end-to-end to support Secure cookies.

Validation

After applying changes:

1. Clear browser cache and cookies
2. Retry SAML login
3. Confirm in browser developer tools:
• JSESSIONID exists after redirect

• Cookie includes correct attributes (SameSite=None; Secure)

4. Login completes successfully
   

Key Takeaway

When troubleshooting SAML login issues in Strategy, always verify cookie behavior across all infrastructure layers, including reverse proxies and load balancers—not only the Strategy configuration itself.