I have a Visualforce page that uses
apex:canvasApp. The canvas app itself uses a signedrequest for authentication via SAML SSO. Everything loads fine when logged in as a real user, however when an admin impersonates the same user, the whole lightning record page that the Visualforce page is embedded in gets redirected to an "insufficient privileges" error page.
I have read previous discussions around this that mention Salesforce stopped supporting the Login As feature for impersonating users across trust domains around 2015, which is understandable. What I want to do is to make the failure only happen within the iframe in which the Canvas app lives, rather than the heavy-handed redirection of the whole page layout. This makes the Login As feature completely unusable for admins when the canvas app is embedded.
Is there a way to "catch" the exception/redirect or avoid it in this situation such that, when impersonating, just the iframe containing the canvas app fails, but the rest of the page layout successfully loads? This must be a common issue among canvas app developers but I find it strange that there is no documented info or workarounds for it.
I have tried wrapping the
apex:canvasApp within another
apex:iframe with sandbox attributes, but that doesn't seem to be enough to stop the redirect to the error page.