Canvas App SSO problems with Identity Provider Login (IDP) page X-FRAME-OPTIONS:SAMEORIGIN

Question

I have a Canvas application in a managed package that uses SSO to authenticate the current Salesforce user into the remote application.

The process works well for some users, but not for others.

For the problem users, the SSO process stops when the Chrome developer console reports:

Refused to display 'https://customUrl--canvas.cs45.my.salesforce.com/idp/login?app=0sp8A0000000001&RelayState=5aaaaaaa-6666-4444-aaaa-1ee140852103&binding=HttpRedirect&inresponseto=id-1aaaaaaa-ffff-4444-bbbb-52511b3c0f2d' in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN'.

Indeed, looking at the Network request shows that the HTTP response headers includes X-FRAME-OPTIONS:SAMEORIGIN for the problem users.

For the users that work, the same URL is requested, but the X-FRAME-OPTIONS header is absent from the response.

I looked at the similar question Canvas app is not working because of 'X-Frame option' in response header of external site. I believe I have a different issue as the problem header is on a page being served by Salesforce.

I suspect part of the problem is my use of the login as functionality to impersonate other users. If I use the LMA application to login as the user who otherwise works I get the same problem. I.e. Login directly and the Canvas SSO works. For the same user via the LMA login as it fails due to the header.

However, I've asked and been told several times that the same problem is occurring for the problem users with a direct login.

All the users, both working and failing, have the same profile and are all members of the same permission set that grants access to the connected app.

In Session Settings > Clickjack Protection, "Enable clickjack protection for customer Visualforce pages with standard headers" and "Enable clickjack protection for customer Visualforce pages with headers disabled" are both unchecked. Also, I would expect these to be applied consistently to all users.

Any thoughts on where to compare the users who work and those who don't to identify the problem?

Answer 1

Tracked it down to a couple of problems:

1. Canvas App SSO does not work when using the login as functionality to impersonate another user. It will fail with some variation of a X-Frame-Options header restriction from the idp/login page.
2. Some users were missing or had an invalid Federation Id on their User record in Salesforce. This didn't result in the X-Frame-Options error.

I did find the Chrome extension "SAML Chrome Panel" useful to capture the SAML requests and responses in the developer tools. There is also the "Identity Provider Event Log" which shows "Error: User does not have a Federation Identifier selected" if the Federation ID is missing.