1

I have a Canvas application in a managed package that uses SSO to authenticate the current Salesforce user into the remote application.

The process works well for some users, but not for others.

For the problem users, the SSO process stops when the Chrome developer console reports:

Refused to display 'https://customUrl--canvas.cs45.my.salesforce.com/idp/login?app=0sp8A0000000001&RelayState=5aaaaaaa-6666-4444-aaaa-1ee140852103&binding=HttpRedirect&inresponseto=id-1aaaaaaa-ffff-4444-bbbb-52511b3c0f2d' in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN'.

Indeed, looking at the Network request shows that the HTTP response headers includes X-FRAME-OPTIONS:SAMEORIGIN for the problem users.

For the users that work, the same URL is requested, but the X-FRAME-OPTIONS header is absent from the response.

I looked at the similar question Canvas app is not working because of 'X-Frame option' in response header of external site. I believe I have a different issue as the problem header is on a page being served by Salesforce.

I suspect part of the problem is my use of the login as functionality to impersonate other users. If I use the LMA application to login as the user who otherwise works I get the same problem. I.e. Login directly and the Canvas SSO works. For the same user via the LMA login as it fails due to the header.

However, I've asked and been told several times that the same problem is occurring for the problem users with a direct login.

All the users, both working and failing, have the same profile and are all members of the same permission set that grants access to the connected app.

In Session Settings > Clickjack Protection, "Enable clickjack protection for customer Visualforce pages with standard headers" and "Enable clickjack protection for customer Visualforce pages with headers disabled" are both unchecked. Also, I would expect these to be applied consistently to all users.

Any thoughts on where to compare the users who work and those who don't to identify the problem?

  • Are you going through oauth flow in the canvas or signed request ? – Mohith Shrivastava Sep 27 '16 at 22:05
  • @MohithShrivastava The Connected App is configured to use "Access Method - Signed Request (POST)" and "SAML Initiation Method - Service Provider Initiated". There is also a Lifecycle class that injects some extra query string parameters onto the Canvas App URL – Daniel Ballinger Sep 27 '16 at 22:23
  • I'm beginning to suspect more and more that it is just a limitation of the "Login as" functionality. Canvas initiated SSO won't work using /idp/login unless you are directly logged in as the user. – Daniel Ballinger Sep 28 '16 at 1:14
  • I just read this developer.salesforce.com/page/… . See if this helps – Mohith Shrivastava Sep 28 '16 at 2:00
1

Tracked it down to a couple of problems:

  1. Canvas App SSO does not work when using the login as functionality to impersonate another user. It will fail with some variation of a X-Frame-Options header restriction from the idp/login page.
  2. Some users were missing or had an invalid Federation Id on their User record in Salesforce. This didn't result in the X-Frame-Options error.

I did find the Chrome extension "SAML Chrome Panel" useful to capture the SAML requests and responses in the developer tools. There is also the "Identity Provider Event Log" which shows "Error: User does not have a Federation Identifier selected" if the Federation ID is missing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.