<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Menlo;
panose-1:2 11 6 9 3 8 4 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word;-webkit-nbsp-mode: space;line-break:after-white-space">
<div class="WordSection1">
<p class="MsoNormal">Then you might be looking at a samesite issue. Which again is one of those catch 22s depending on how you feel about old safari users.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">--Joel<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="margin-bottom:12.0pt"><b><span style="font-size:12.0pt;color:black">From:
</span></b><span style="font-size:12.0pt;color:black">users <users-bounces@shibboleth.net> on behalf of prasanna cg via users <users@shibboleth.net><br>
<b>Date: </b>Monday, August 29, 2022 at 11:00 AM<br>
<b>To: </b>Cantor, Scott <cantor.2@osu.edu><br>
<b>Cc: </b>prasanna cg <prasannacgin@yahoo.in>, Shib Users <users@shibboleth.net><br>
<b>Subject: </b>Re: Cross Origin requests for Shibboleth IDP v4.2<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><strong><span style="font-family:"Calibri",sans-serif;color:black;background:#FFE5E5">EXTERNAL EMAIL</span></strong><o:p></o:p></p>
</div>
<p class="MsoNormal">Thanks for correcting me, Scott. I verified and we are NOT blocking third party cookies in the browser. All cookies are chosen to be allowed. And reg the IDP config, below is how my “idp.properties” looks where we had already overridden
the idp.frameoptions and idp.csp properties with null (no value). Isn't this a workaround ? If no, Isn't there any other way to get around ?<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:Menlo;color:#32F4F1"># X-Frame-Options value, set to DENY or SAMEORIGIN to block framing<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:Menlo;color:#32F4F1">#idp.frameoptions = DENY<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="font-size:8.5pt;font-family:Menlo;color:#32F4F1">idp.frameoptions</span></b><span style="font-size:8.5pt;font-family:Menlo;color:black"> =</span><span style="font-size:8.5pt;font-family:Menlo;color:#32F4F1"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:Menlo;color:#32F4F1"># Content-Security-Policy value, set to match X-Frame-Options default<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:Menlo;color:#32F4F1">#idp.csp = frame-ancestors 'none';<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="font-size:8.5pt;font-family:Menlo;color:#32F4F1">idp.csp</span></b><span style="font-size:8.5pt;font-family:Menlo;color:black"> =</span><span style="font-size:8.5pt;font-family:Menlo;color:#32F4F1"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black"><br>
<br>
</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black">— Prasanna</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black"><br>
<br>
</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">On Aug 29, 2022, at 7:47 PM, Cantor, Scott <<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>> wrote:<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">That's not a cross-oirign issue in the usual sense, it's a "We don't support frames and block them by default" issue, or it's simply down to you blocking third party cookies in your browser.<br>
<br>
The idp.frameoptions and idp.csp properties control the headers that block frame handling, and we do not recommend changing them.<br>
<br>
-- Scott<br>
<br>
<o:p></o:p></p>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</body>
</html>