login.microsoftonline refused to connect from iframe

Diljith PC 11 Reputation points
2021-05-08T09:55:15.427+00:00

Hi All,

I have an enterprise application integrated with Azure AD using SAML SSO. Also, all the users in the tenant has MFA and SSPR enabled with few users yet to configure their SSPR.

Architecture of application:
Enterprise app is similar to an appstore where we have links to many sub apps. Upon clicking a sub app, an iframe loads with in the Home page and inside that iframe, we are loading the sub app. So whenever the user who has not configured the SSPR tries to login, it will always redirect to the configuration page and they usually skips the setup and lands on the home page. And now the same user clicks on the sub app and when the sub app gets opened in an iframe, we will see an error message saying login.microsoftonline refused to connect.
Can someone share your thoughts here. Is it because we opening the sub app in iframe. I can see in network trace that , the sub app is also redirecting to login.microsoftonline for the sspr setup. Please share your though to avoid this situation.

Thank you
Diljith.

C#
C#
An object-oriented and type-safe programming language that has its roots in the C family of languages and includes support for component-oriented programming.
10,279 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,569 questions

4 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Vikash Singh 6 Reputation points
    2021-09-30T07:36:11.187+00:00

    Try these, it should work for different browsers.

    https://blog.atwork.at/medium.aspx?id=c14c3ae3-3aba-429d-a748-b74283dbd463&date=/post/2020/09/13/

    Note : You can use Firefox to get it worked rather edge.

    Happy SharePointing!! :)

    1 person found this answer helpful.
  2. Ken Tucker 5,846 Reputation points
    2021-05-08T10:14:33.837+00:00

    I would look in the developer tools when the iframe is loading and see why it is blocked. I suspect the site either has an x-frame-option or content-security-policy which is preventing the site being loaded in an iframe.

  3. VipulSparsh-MSFT 16,231 Reputation points Microsoft Employee
    2021-05-17T13:51:45.947+00:00

    @Diljith PC Thanks for reaching out and apologies for delay on this.

    Due to the popularity of clickjacking on the internet, it is common to prevent login pages from being display inside frames. The X-FRAME-Options meta tag in HTML makes it easy for providers to implement this safeguard on a widespread or domain/origin-specific basis.
    So as your page sends the request for login before doing SSPR it would fail.

    Can you try popups/add-in communication via web sockets in your app to handle the login request.
    Read more here : https://learn.microsoft.com/en-us/archive/blogs/richard_dizeregas_blog/connecting-to-office-365-from-an-office-add-in#mastering-the-popup

    -----------------------------------------------------------------------------------------------------------------

    If the suggested response helped you resolve your issue, please do not forget to accept the response as Answer and "Up-Vote" for the answer that helped you for benefit of the community

    0 comments
  4. Sudhir Lenka 6 Reputation points
    2021-06-04T19:15:58.79+00:00

    Did you manage to solve this issue ? we are having the same issue and struggling for the solution.

    Please help if you managed to resolve it.

    -Sudhir.

    0 comments