Shib login in pop-up browser window?

[David Bantz]

A vendor’s service is issuing a request for new session when it detects that the SP session has expired or timed out:

> When the session has timed out, and the user clicks on a save button, what we normally do is open a new pop-up window and redirect the user to the login screen in that pop-up window so they can re-authenticate without losing their work in the main window.  This is essentially what is happening here, which is why there is a pop-up window showing up in the screenshot that shows the UA error page.

Should this work?  The vendor tells me they are issuing exactly the same SAML request they do for initial log in (which always works), just doing so through a pop-up window; but users report seeing the common “error” version of the login page in a pop-up when this occurs.  I’m hoping to be able to capture the SAML from a user’s browser when this occurs, but have yet to be given that access...

David Bantz
U Alaska