<div dir="ltr"><div>The problem was caused by jetty-9.4.43.v20210629, which in etc/jetty-rewrite.xml unconditionally sets:<br></div><div><br></div><div><div><span><span><span><span><span><b><span><span>X-Frame-Options</span></span></b><span>: DENY</span></span></span></span></span></span></div><div><span><span><span><span><span><span><br></span></span></span></span></span></span></div><div><span><span><span><span><span><span>Shibboleth correctly ommits X-Frame-Options on SLO pages and follows idp.frameoptions setting on SSO pages, so after modification of jetty-rewrite.xml SLO works as expected.<br></span></span></span></span></span></span></div><div><span><span><span><span><span><span><br></span></span></span></span></span></span></div><div><span><span><span><span><span><span>Regards, Petr<br></span></span></span></span></span></span></div><div><span><span><span><span><span><span><br></span></span></span></span></span></span></div><div><span><span><span><span><span><span><br></span></span></span></span></span></span></div></div><div><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">št 12. 8. 2021 o 10:43 Petr Hroudný <<a href="mailto:petr.hroudny@gmail.com">petr.hroudny@gmail.com</a>> napísal(a):<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div dir="ltr" class="gmail_attr">st 11. 8. 2021 o 23:35 Cantor, Scott <<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>> napísal(a):<br></div><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><br>
The reporting is very difficult to debug but a look at a javascript console might reveal an incompatibility of some kind.<br>
<br>
Getting a peek at the HTML coming back in the frames is the only other way to really gauge what might be happening.<br></blockquote><div><br></div><div>The console revealed this:</div><div><br></div><div><span><span><span><span>The loading of “<a title="https://idp.stuba.sk/idp/profile/SAML2/Redirect/SLO?SAMLResponse=fZFPa8MwDMW%2FSvC9sZ26%2BWOawFgvhY5BU3rYpdiJspqldogcuo%2B%2FJKWsg9Gj0Ht6%2BklrVJe2kzv36Qa%2FB%2BycRQi%2BL61FObdyMvRWOoUGpVUXQOkrWb687WQUMtn1zrvKtSTYAHpjlTfO5uTsfYeSUlN3IfpBqxC%2FpoKO%2Bsa0QKcBEd1DbXqoPC137yTYbnJySoXQSiQV56DqOKsTvUpExpmOeZxmKR9l9r7mwY0GxldxEydCNdlyCVmcpGKlRSwSVacRbyYD4gBbi15Zn5OIRXzB0gWPDiyVLJOMfZDgCD3Om49QpFhP5HL29Q%2B3eH4KhQj9hE%2BKO%2F71eg1RNWDqiR%2FPRmvXgj%2Bv6UPALa2TpVd%2BwL%2FVq6shOKp2gOfZOKtlOVQVIBJa3BJ%2Bh9L%2F3lz8AA%3D%3D&SigAlg=http%3A%2F%2Fwww.w3.org%2F2001%2F04%2Fxmldsig-more%23rsa-sha256&Signature=oa3as%2FX60GhW5I74wFW80xu2vUhYH48xgd1heSMs%2FWZrmN28gLowLpLTlQ09r9DkzLIRZLtK21KGPTKukBu6mHgrXf9qMpjyWMYHXNv%2F%2BR0s1EJTcTRtHY1SXJFMJDV9eodrecbmUi7mxou61%2Bnnt2FY2AYVacLjMSicI9xA%2FvxKUmkvMNYXp9ITjWTpiVll9xdNIXraRX8zommH9U10wKy%2BRWmVev%2BPonMP2yXGYMzyD2CaU9kfbQK5WbnjWQULCWgRxx8jR7ljx9E4aYi5JSM1D7xsKbR7w4CmuIAuCqz%2FlPS5eo%2BmFEk6OYBINhzxD8QDvO8TeRqSjnVerxNq8FRM5isNK1XpMX0aosiRXMZydIPrwIe91eNBXYKcAPob%2BK6ILHS%2BadSUZZ6PjmGbqb77l06fk%2BnPbmbHfGk13JTFZscJK0O%2FFaOdThW3mEAriF23G8S7teSRub1alKyz5jAbg%2BKeZRjPmbFxtdDmqm9YuLDPICl50MeyhROTJadJ" href="https://idp.stuba.sk/idp/profile/SAML2/Redirect/SLO?SAMLResponse=fZFPa8MwDMW%2FSvC9sZ26%2BWOawFgvhY5BU3rYpdiJspqldogcuo%2B%2FJKWsg9Gj0Ht6%2BklrVJe2kzv36Qa%2FB%2BycRQi%2BL61FObdyMvRWOoUGpVUXQOkrWb687WQUMtn1zrvKtSTYAHpjlTfO5uTsfYeSUlN3IfpBqxC%2FpoKO%2Bsa0QKcBEd1DbXqoPC137yTYbnJySoXQSiQV56DqOKsTvUpExpmOeZxmKR9l9r7mwY0GxldxEydCNdlyCVmcpGKlRSwSVacRbyYD4gBbi15Zn5OIRXzB0gWPDiyVLJOMfZDgCD3Om49QpFhP5HL29Q%2B3eH4KhQj9hE%2BKO%2F71eg1RNWDqiR%2FPRmvXgj%2Bv6UPALa2TpVd%2BwL%2FVq6shOKp2gOfZOKtlOVQVIBJa3BJ%2Bh9L%2F3lz8AA%3D%3D&SigAlg=http%3A%2F%2Fwww.w3.org%2F2001%2F04%2Fxmldsig-more%23rsa-sha256&Signature=oa3as%2FX60GhW5I74wFW80xu2vUhYH48xgd1heSMs%2FWZrmN28gLowLpLTlQ09r9DkzLIRZLtK21KGPTKukBu6mHgrXf9qMpjyWMYHXNv%2F%2BR0s1EJTcTRtHY1SXJFMJDV9eodrecbmUi7mxou61%2Bnnt2FY2AYVacLjMSicI9xA%2FvxKUmkvMNYXp9ITjWTpiVll9xdNIXraRX8zommH9U10wKy%2BRWmVev%2BPonMP2yXGYMzyD2CaU9kfbQK5WbnjWQULCWgRxx8jR7ljx9E4aYi5JSM1D7xsKbR7w4CmuIAuCqz%2FlPS5eo%2BmFEk6OYBINhzxD8QDvO8TeRqSjnVerxNq8FRM5isNK1XpMX0aosiRXMZydIPrwIe91eNBXYKcAPob%2BK6ILHS%2BadSUZZ6PjmGbqb77l06fk%2BnPbmbHfGk13JTFZscJK0O%2FFaOdThW3mEAriF23G8S7teSRub1alKyz5jAbg%2BKeZRjPmbFxtdDmqm9YuLDPICl50MeyhROTJadJ" rel="noopener noreferrer" target="_blank">https://........../idp/profile/SAML2/Redirect/SLO?SAMLResponse=</a>..... in a frame is denied by “X-Frame-Options“ directive set to “DENY“.</span></span></span></span></div><div><span><span><span><span><br></span></span></span></span></div><div><span><span><span><span>Tried to set idp.frameoptions to SAMEORIGIN or empty, but it's apparently buggy:</span></span></span></span></div><div><span><span><span><span><br></span></span></span></span></div><div><span><span><span><span>- during SSO, it produces:</span></span></span></span></div><div><span><span><span><span><br></span></span></span></span></div><div><span><span><span><span><b><span><span>X-Frame-Options</span></span></b><span>: DENY, SAMEORIGIN</span></span></span></span></span></div><div><span><span><span><span><span><br></span></span></span></span></span></div><div><span><span><span><span><span>- during SLO, idp.frameoptions is completely ignored, and DENY is hardcoded at some other place:</span></span></span></span></span></div><div><span><span><span><span><span><br></span></span></span></span></span></div><div><span><span><span><span><span><b><span><span>X-Frame-Options</span></span></b><span>: DENY</span></span></span></span></span></span></div><div><span><span><span><span><span><span><br></span></span></span></span></span></span></div><div><span><span><span><span><span><span>Thanks, Petr<br></span></span></span></span></span></span></div><div><span><span><span><span><br></span></span></span></span></div></div></div>
</blockquote></div></div>