Setting properties int the IdP to empty strings

[Wessel, Keith]

For my second silly question of the day...

If I want to allow my IdP to be loaded in an iframe, throwing caution and clickjacking protection to the wind, can I just add this to idp.properties:

idp.frameoptions =


That's what I had in V3, but it doesn't seem to be working in V4 unless there's some other craziness going on.

Alternatively, it looks like x-frame-options supports an allow-from option if I just want certain sites (our LMSes that are using our media sharing service in a frame) to be able to do this, is that allow-from actually well supported by browsers? If I want to allow from multiple domains, what would that look like in the IdP's configuration?

Keith