<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 12 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Monaco;
panose-1:0 0 0 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.apple-style-span
{mso-style-name:apple-style-span;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">I asked this in a recent thread (with no conclusive answer), and haven’t had a chance to test yet. Perhaps you have…<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Do you know if suppressing the UI (isPassive=True) would still generate this error authenticating within an iframe? I suspect yes, but was wondering if you
have more direct evidence from your recent experience.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">--- Eric<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> users-bounces@shibboleth.net [mailto:users-bounces@shibboleth.net]
<b>On Behalf Of </b>Michael A Grady<br>
<b>Sent:</b> Wednesday, October 15, 2014 5:29 PM<br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> Re: Shib login in pop-up browser window?<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Oct 15, 2014, at 2:39 PM, David Bantz <<a href="mailto:dabantz@alaska.edu">dabantz@alaska.edu</a>> wrote:<o:p></o:p></p>
</div>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<div>
<p class="MsoNormal">Following up, the vendor has corrected their description of what they are doing to state they are issuing the SAML request in an iframe.<o:p></o:p></p>
<div>
<p class="MsoNormal">I take it the IdP log message <o:p></o:p></p>
</div>
<div>
<div>
<p class="MsoNormal" style="background:#FFFAC2"><span style="font-size:8.5pt;font-family:"Monaco","serif"">WARN...No login context available, unable to proceed with authentication<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal">reflects that inability to use cookies in the iframe. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thanks to Mike and Scott’s hints that the vendor was using frames, I found an interesting if ultimately inconclusive thread from 2008 which I relayed to the vendor.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">There are techniques one can use to make this "mostly" work in an iFrame, if one really, really had to, but as noted, for any number of reasons, it's best to avoid/not support if you have any choice. (I've been working on an engagement
where I've had to make some things work with an iFrame, because there wasn't a choice, which is the reason I have very recent experience with iFrames.) If you add a P3P header, you can get IE to accept the cookies in an iFrame. But then you actually need to
have organizational policy behind that P3P header, and campus policy is hard work. (And you'd need to get all the pages that the IdP presents that write out a cookie to include said P3P header, which would be an effort in itself.) And with Safari, it will
accept them (at least in my testing) as long as it already has a cookie from the domain being presented in the iFrame. So one could craft a special error page that presented a link to a page that wrote out essentially a "no-op" cookie, just to have one there.
And, of course, you're counting on browser behavior to not change and break one of these "work-around" strategies.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">So opening a new page is definitely the way to go. The vendor can then do things to auto-close that page after the user completes the login.<o:p></o:p></p>
</div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif";color:black"><br>
--<br>
Michael A. Grady<br>
Senior IAM Consultant, Unicon, Inc.<o:p></o:p></span></p>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>