Sustainsys.Saml2 not setting same site = none - sustainsys-saml2

Question

We are using the v2.4 sustainsys.saml2 library and can't get the software to set the same site = none flag required by chrome 80. We get an error in the event viewer (reproduced below)
We are using .net V4.7.2 , windows server 2012 r2 and IIS. Our IdP has not yet implemented their fix for this issue. Could this be related?
Log Name: Application
Source: ASP.NET 4.0.30319.0
Date: 2/7/2020 9:43:02 AM
Event ID: 1309
Task Category: Web Event
Level: Warning
Keywords: Classic
User: N/A
Computer: WSATPWEB02
Description:
Event code: 3005
Event message: An unhandled exception has occurred.
Event time: 2/7/2020 9:43:02 AM
Event time (UTC): 2/7/2020 4:43:02 PM
Event ID: 5319961cdc244a7fb390e1d5d01d9014
Event sequence: 21
Event occurrence: 3
Event detail code: 0
Exception information:
Exception type: NullReferenceException
Exception message: Object reference not set to an instance of an object.
at Sustainsys.Saml2.SameSiteHelper.DisallowsSameSiteNone(String userAgent)
at Sustainsys.Saml2.SameSiteHelper.EmitSameSiteNone(String userAgent)
at Sustainsys.Saml2.Configuration.Saml2Notifications.<>c.<.ctor>b__64_3(String userAgent)
at Sustainsys.Saml2.HttpModule.Saml2AuthenticationModule.OnAuthenticateRequest(Object sender, EventArgs e)
at System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
at System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep step)
at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)
Request information:
Request URL: https://testportal.myatphub.ca:443/Saml2/SignIn?ReturnUrl=/Authservices
Request path: /Saml2/SignIn
User host address: 10.254.9.72
User:
Is authenticated: False
Authentication Type:
Thread account name: IIS APPPOOL\DefaultAppPool
Thread information:
Thread ID: 53
Thread account name: IIS APPPOOL\DefaultAppPool
Is impersonating: False
Stack trace: at Sustainsys.Saml2.SameSiteHelper.DisallowsSameSiteNone(String userAgent)
at Sustainsys.Saml2.SameSiteHelper.EmitSameSiteNone(String userAgent)
at Sustainsys.Saml2.Configuration.Saml2Notifications.<>c.<.ctor>b__64_3(String userAgent)
at Sustainsys.Saml2.HttpModule.Saml2AuthenticationModule.OnAuthenticateRequest(Object sender, EventArgs e)
at System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
at System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep step)
at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)
Custom event details:
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="ASP.NET 4.0.30319.0" />
<EventID Qualifiers="32768">1309</EventID>
<Level>3</Level>
<Task>3</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2020-02-07T16:43:02.000000000Z" />
<EventRecordID>101086</EventRecordID>
<Channel>Application</Channel>
<Computer>WSATPWEB02</Computer>
<Security />
</System>
<EventData>
<Data>3005</Data>
<Data>An unhandled exception has occurred.</Data>
<Data>2/7/2020 9:43:02 AM</Data>
<Data>2/7/2020 4:43:02 PM</Data>
<Data>5319961cdc244a7fb390e1d5d01d9014</Data>
<Data>21</Data>
<Data>3</Data>
<Data>0</Data>
<Data>/LM/W3SVC/1/ROOT-2-132255671020333604</Data>
<Data>Full</Data>
<Data>/</Data>
<Data>C:\inetpub\wwwroot\</Data>
<Data>WSATPWEB02</Data>
<Data>
</Data>
<Data>1864</Data>
<Data>w3wp.exe</Data>
<Data>IIS APPPOOL\DefaultAppPool</Data>
<Data>NullReferenceException</Data>
<Data>Object reference not set to an instance of an object.
at Sustainsys.Saml2.SameSiteHelper.DisallowsSameSiteNone(String userAgent)
at Sustainsys.Saml2.SameSiteHelper.EmitSameSiteNone(String userAgent)
at Sustainsys.Saml2.Configuration.Saml2Notifications.<>c.<.ctor>b__64_3(String userAgent)
at Sustainsys.Saml2.HttpModule.Saml2AuthenticationModule.OnAuthenticateRequest(Object sender, EventArgs e)
at System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
at System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep step)
at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)
</Data>
<Data>https://testportal.myatphub.ca:443/Saml2/SignIn?ReturnUrl=/Authservices</Data>
<Data>/Saml2/SignIn</Data>
<Data>10.254.9.72</Data>
<Data>
</Data>
<Data>False</Data>
<Data>
</Data>
<Data>IIS APPPOOL\DefaultAppPool</Data>
<Data>53</Data>
<Data>IIS APPPOOL\DefaultAppPool</Data>
<Data>False</Data>
<Data> at Sustainsys.Saml2.SameSiteHelper.DisallowsSameSiteNone(String userAgent)
at Sustainsys.Saml2.SameSiteHelper.EmitSameSiteNone(String userAgent)
at Sustainsys.Saml2.Configuration.Saml2Notifications.<>c.<.ctor>b__64_3(String userAgent)
at Sustainsys.Saml2.HttpModule.Saml2AuthenticationModule.OnAuthenticateRequest(Object sender, EventArgs e)
at System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
at System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep step)
at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)
</Data>
</EventData>
</Event>

Answer 1

That looks like a bug in the library, but you can work around it in your code.
The problem is in the default implementation of the EmitSameSiteNone notification. Could you please hook up your own implementation and see if that lets you troubleshoot? Is there a user agent string present in the request headers?