0

I'm working on a tool that embeds an iframe of an external app. The authentication to this external app is via SAML and Keycloak. However when using the iframe, the SAML request to Keycloak does not work: "... has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource."

Scenario 1: Accessing the external app using the browser (normal way)

I get redirected to the Keycloak login page and after successful authentication, it redirects to the external app and everything works fine.

Scenario 2: Loading the external app using the iframe

The iframe is loaded and the Keycloak login page is shown. However, after entering the credentials, the triggered SAML request to Keycloak is blocked due to the CORS issue, see Failed SAML request to Keycloak within the iframe. Once I click on the failed URL (starting with "saml?SAMLRequest=...") and access it the normal way (browser), everything works fine.

I read on multiple sites, e.g. here Keycloak Access-Control-Allow-Origin, that you have to enter your webpage (in this case localhost:8080) to the Web Origin field within the Keycloak interface. This one only exists when choosing the openid-connect value in Client Protocol though. So, when switching from openid-connect to SAML, which I use, the Web Origin field disappears. I even tried to export the config file for that Keycloak client in order to manually enter the WebOrigin property, which did not work either. How can I change the CORS policy for this iframe when using SAML (not openid-connect) since I don't have access to the Web Origin field?

Thanks in advance!

marci_
  • 21
  • 4

1 Answers1

0

Keycloak doesn't allow to be loaded in the iframe by default.

Keycloak admin must allow that explicitly per realm in the Realm settings->Security Defenses->Headers->X-Frame-Options. Make sure you understand all security consequences before you allow Keycloak in the iframe. It's a security setting.

Jan Garaj
  • 25,598
  • 3
  • 38
  • 59
  • Thanks for your reply! I already whitelisted the domains in X-Frame-Options (via allow-from http://...) and Content-Security-Policy (via frame-src 'self' http://...). The iframe itself is visible, "only" the login in it doesnt work, since the SAML request, that is triggered when logging in, is blocked. – marci_ Aug 04 '21 at 13:03