Login to a third party SAML app that's in an iFrame

[Eric Goodman]

>>So my question is: How should one authenticate the SAML SP protected 
>>application that's hosted in the iFrame? The design goal is to keep the 
>>content of that application within the iFrame (securely).

>Unless you're prepared to live with specific third party cookie settings, you can't. 
>There was a thread about it recently wherein somebody asked about some SP changes, 
>and that helps to a degree, but fundamentally it depends on whether the IdP can get 
>cookies set or not.

I was afraid that was going to be the answer. And I think I found the thread you are talking about?:

  http://shibboleth.1660669.n2.nabble.com/Login-box-embedded-in-external-portals-outside-IdP-td7599967.html


I should clarify that I'm really not interested in displaying the IdP login screen in an iframe, just the content of the authenticated application. I don't know if that makes a difference. 


Would the IdP still fight out of the iframe if the authentication is done with "isPassive=True"? I think I can assume the user will have a valid IdP login before the iframe is displayed, but I suspect the IdP doesn't necessarily make this distinction. 


Clearly we can go the route of web services or portlets and pulling all the information out of the "third party" app to display it natively on the landing page, but that has its own development and support issues (and not all apps will allow for this kind of a "pull" of data).


And clearly we can also just open a new page for the content, but the specific design goal is of course to not do that. 

--- Eric