title: spring security saml and OBSSOCookie
body: <p>our company is using Oracle access system for SAML single sign on. I implemented spring security with Spring Security SAML library, it worked great until I just found one issue recently.
  Oracle Access System is using OBSSOCookie as identifier, but when saml response post back, I have no way to retrieve this cookie.
  Have a look at this code:</p>
  
  <pre><code>@RequestMapping(value = "/callback")
  public void callback(HttpServletRequest request, HttpServletResponse response)
          throws IOException, NoSuchPaddingException, IllegalBlockSizeException, BadPaddingException {
  
      Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
      SAMLCredential credential = (SAMLCredential) authentication.getCredentials();
      try {
          XMLHelper.nodeToString(SAMLUtil.marshallMessage(credential.getAuthenticationAssertion()));
      } catch (MessageEncodingException e) {
          e.printStackTrace();
      }
  
      String nameID = credential.getNameID().getValue();
      List&lt;Attribute&gt; attributes = credential.getAttributes();
      JSONObject jso = new JSONObject();
      String uid;
      String employeeType="";
      String company_name="";
      String FirstName;
      String roles_entitled="";
      String LastName;
      String primary_role="";
  
  
      jso.put("nameID", nameID);
      jso.put("uid", uid);
      jso.put("company_name", company_name);
      jso.put("roles_entitled", roles_entitled);
      jso.put("primary_role", primary_role);
      jso.put("employeeType", employeeType);
      jso.put("FirstName", FirstName);
      jso.put("LastName", LastName);
  
      String frontend_url = sideCarService.getFrontendNodeUrl();
      String token = KeyGenerator.createUserToken(jso, 3600 * 24 * 30);
  
      String encoded = new String(Base64.encodeBase64(jso.toString().getBytes()));
      response.sendRedirect(frontend_url + "#t/" + token + "/atts/" + encoded);
  }
  </code></pre>
  
  <p>Looking at this code, I can  retrieve all the info from saml response, then generate a token, giving back to frontend cookie for use.</p>
  
  <p>But I really want to get OBSSOCookie, so that I can use with other microservice to retrieve data from other applicaiton which is using same saml login solution.</p>
  
  <p>I tried to user request.getHeaders(), but response is empty. No OBSSOCookie at all. </p>
  
  <p>Any idea for how to obtain OBSSOCookie from spring saml library?</p>
  
  <p>Thanks</p>