I have a Canvas application in a managed package that uses SSO to authenticate the current Salesforce user into the remote application.
The process works well for some users, but not for others.
For the problem users, the SSO process stops when the Chrome developer console reports:
Refused to display 'https://customUrl--canvas.cs45.my.salesforce.com/idp/login?app=0sp8A0000000001&RelayState=5aaaaaaa-6666-4444-aaaa-1ee140852103&binding=HttpRedirect&inresponseto=id-1aaaaaaa-ffff-4444-bbbb-52511b3c0f2d' in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN'.
Indeed, looking at the Network request shows that the HTTP response headers includes
X-FRAME-OPTIONS:SAMEORIGIN for the problem users.
For the users that work, the same URL is requested, but the X-FRAME-OPTIONS header is absent from the response.
I looked at the similar question Canvas app is not working because of 'X-Frame option' in response header of external site. I believe I have a different issue as the problem header is on a page being served by Salesforce.
I suspect part of the problem is my use of the login as functionality to impersonate other users. If I use the LMA application to login as the user who otherwise works I get the same problem. I.e. Login directly and the Canvas SSO works. For the same user via the LMA login as it fails due to the header.
However, I've asked and been told several times that the same problem is occurring for the problem users with a direct login.
All the users, both working and failing, have the same profile and are all members of the same permission set that grants access to the connected app.
In Session Settings > Clickjack Protection, "Enable clickjack protection for customer Visualforce pages with standard headers" and "Enable clickjack protection for customer Visualforce pages with headers disabled" are both unchecked. Also, I would expect these to be applied consistently to all users.
Any thoughts on where to compare the users who work and those who don't to identify the problem?