The WebView logic that checks for the session cookies returned by the Clients
login form was tricked into thinking that it was on the dozuki domain, when
really it was still on the SAML login page. This is because we use a "Black
List" when deciding if we shouldn't capture and return the cookies. That black
list was capturing some false positives due to query params in SAML urls that
include the dozuki hostname.
The solution was to make the regex/string-comparison stricter to only look at
the first part of the domain, rather than anywhere in the URL string.
SAML login for most customers was broken.
The WebView logic that checks for the session cookies returned by the Clients login form was tricked into thinking that it was on the dozuki domain, when really it was still on the SAML login page. This is because we use a "Black List" when deciding if we shouldn't capture and return the cookies. That black list was capturing some false positives due to query params in SAML urls that include the dozuki hostname.
The solution was to make the regex/string-comparison stricter to only look at the first part of the domain, rather than anywhere in the URL string.