Speaking of service-now...

[Cantor, Scott]

I'm playing with that myself, and was curious how any schools using it
with Shibboleth are preventing it from issuing requests to the IdP from
within a frame. It seems to do that when its session is expired.

That won't work with Shibboleth if third party cookies are off. I'm
contacting service-now to ask about that, but maybe somebody using it has
a workaround?

-- Scott