Picketlink modules version: picketlink 2.5.3SP1  (stock EAP 6.3beta2)

To recreate:

1. create a filter that adds a cookie to the httpServletResponse (response.addCookie(...))

2. ensure that you are using IDPfilter

Regardless of which is mapped first (cookie filter or idpFilter), the cookies you add to the response will not be returned to the browser. Simply commenting out the IdPFilter mapping will allow the cookies to be properly returned to the browser.

This behavior appears to happen without regard to the presence of a SAML assertion in the incoming request (ie. it doesn't matter if you directly access the IdP or are redirected there from a trusted SP).

This may be related to https://issues.jboss.org/browse/PLINK-381?