<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><br><div><div>On Oct 15, 2014, at 2:39 PM, David Bantz <<a href="mailto:dabantz@alaska.edu">dabantz@alaska.edu</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><meta http-equiv="Content-Type" content="text/html charset=windows-1252"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">Following up, the vendor has corrected their description of what they are doing to state they are issuing the SAML request in an iframe.<div>I take it the IdP log message </div><div><div style="margin: 0px; font-family: Monaco; background-color: rgb(255, 250, 194); position: static; z-index: auto; font-size: 11px;">WARN...No login context available, unable to proceed with authentication</div></div><div><div>reflects that inability to use cookies in the iframe. </div><div><br></div><div>Thanks to Mike and Scott’s hints that the vendor was using frames, I found an interesting if ultimately inconclusive thread from 2008 which I relayed to the vendor.</div><div><span style="color: rgb(51, 51, 51); background-color: rgb(255, 255, 255);"><br></span></div></div></div></blockquote><br></div><div>There are techniques one can use to make this "mostly" work in an iFrame, if one really, really had to, but as noted, for any number of reasons, it's best to avoid/not support if you have any choice. (I've been working on an engagement where I've had to make some things work with an iFrame, because there wasn't a choice, which is the reason I have very recent experience with iFrames.) If you add a P3P header, you can get IE to accept the cookies in an iFrame. But then you actually need to have organizational policy behind that P3P header, and campus policy is hard work. (And you'd need to get all the pages that the IdP presents that write out a cookie to include said P3P header, which would be an effort in itself.) And with Safari, it will accept them (at least in my testing) as long as it already has a cookie from the domain being presented in the iFrame. So one could craft a special error page that presented a link to a page that wrote out essentially a "no-op" cookie, just to have one there. And, of course, you're counting on browser behavior to not change and break one of these "work-around" strategies.</div><div><br></div><div>So opening a new page is definitely the way to go. The vendor can then do things to auto-close that page after the user completes the login.</div><div apple-content-edited="true"><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><br>--<br>Michael A. Grady<br>Senior IAM Consultant, Unicon, Inc.</div></div></span></div></span></span>
</div>
<br></body></html>