Embedded DS not working inside an iframe?
Jason Bau
I'm noticing that the Embedded DS is not working when the entire
index.html page is inside an iframe. This situation arises when my
Web App gets framed by another (friendly) App, and then the user tries
to log into my app.
I did do some stylistic modification to the index.html provided with
the EDS 1.0.1 package, but the <div id="idpSelect"> element is
present, and there is no other DOM element on index.html with
id=idpSelect.
Can someone else corroborate? If so, I will file a bug report.
Jason
--
To unsubscribe from this list send an email to users-un...@shibboleth.net
Cantor, Scott
>
>I'm noticing that the Embedded DS is not working when the entire
>index.html page is inside an iframe. This situation arises when my
>Web App gets framed by another (friendly) App, and then the user tries
>to log into my app.
Turn off third party cookies and the login process won't work regardless,
so the EDS isn't really the primary issue.
-- Scott
Jason Bau
Though I understand the un-desirability of being framed in certain
cases, I'm not sure why operating a shib-enabled site in an iframe
should not be supported if the site owner requires it.
Jason
Cantor, Scott
>Though I understand the un-desirability of being framed in certain
>cases, I'm not sure why operating a shib-enabled site in an iframe
>should not be supported if the site owner requires it.
Obviously that can't be the cause of the problem if you're running with
them enabled.
As for why not, we'll have to leave it at a difference in philosophy.
Jason Bau
philosophically, can the de-obfuscated source for idpselect.js at
least be made available so I can fix it on my own?
It hardly seems consistent with the open-source nature of the rest of
the SP codebase to have the EDS be distributed as an unmodifiable
"binary".
Jason
Rod Widdowson
https://wiki.shibboleth.net/confluence/display/SHIB2/SourceAccess
and thence
http://svn.shibboleth.net/view/js-embedded-discovery/
Apart from philosophical issues, I am pretty sure that if you do this you will no longer be able to get a "in an Iframe" DS to work
from a session initiator....
Cantor, Scott
> If the idea is not to make changes that you disagree with
> philosophically, can the de-obfuscated source for idpselect.js at
> least be made available so I can fix it on my own?
Obviously the issue isn't with third party cookies. I was making a point about the end result, not the EDS. If there's a bug, file it.
Cantor, Scott
>
> Apart from philosophical issues, I am pretty sure that if you do this you will no longer be able to get a "in an Iframe" DS to work
> from a session initiator....
Assuming privacy hostile cookies are enabled, there isn't any SP limitation that should prevent it, that I know of.
Rod Widdowson
> that I know of.
I was thinking about the EDS itself. It has been too long since I was in that area & I certainly never looked at iframes, but as I
remember it grabs the outermost frame and pulls the parameters from that URL.
So it's fine if you supply the parameters in the configuration, but less fine otherwise.
But this is all speculation.
> If there's a bug, file it.
+1
Jason Bau
>> Assuming privacy hostile cookies are enabled, there isn't any SP limitation that should prevent it,
>> that I know of.
>
I'm from the lab working on this:
So on the general evils of tracking, we're similiarly aligned philosophically.
> I was thinking about the EDS itself. It has been too long since I was in that area & I certainly never looked at iframes, but as I
> remember it grabs the outermost frame and pulls the parameters from that URL.
>
I think it's possible to first getElementById('idpSelect') then walk
the DOM to get the enclosing frame, then pull the URLs from that.