Cross Site ADFS Requests fail when Third Party Cookie Disabled

Karl Fraser 1 Reputation point
2020-08-11T09:55:57.987+00:00

Chrome 83 have disabled Third Party Cookie in Incognito, and are looking to implement in the standard browser in Jan 2022. I'm looking for options around handling these requests which currently fail with Third Party Cookies disabled (In Firefox as well).
We have a website abcd.com that redirects to adfs.xyz.com and authenticates users on ADFS 4.0 and then takes the user back to abdc.com. This works successfully, but when we request content from content.xyz.com (Cross Site) it fails at adfs.xyz.com ADFS page with an "Refused to display https://adfs.xyz.com/adfs/ls/'in a frame because it set 'X-Frame-Options' to 'deny'"

Some of my thoughts where to do a URL Transform (rewrite) on the ADFS server and or Content Server, but I feel the requests from abcd.com to xyz.com would not be rewritten.
Is there a way to have multiple domains in the header of ADFS?

Or does the website need to be re-written without iFrames?

Active Directory Federation Services
Active Directory Federation Services
An Active Directory technology that provides single-sign-on functionality by securely sharing digital identity and entitlement rights across security and enterprise boundaries.
1,240 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Pierre Audonnet - MSFT 10,181 Reputation points Microsoft Employee
    2020-08-11T14:29:03.43+00:00

    iFrames are blocked by default for authentication endpoints. It is so for security reasons.
    That said, you can modify the headers that ADFS will return (even on ADFS for Windows Server 2016 as long you have the installed KB4493473 and KB4507459). See here for documentation.

    Example: 

    Set-AdfsResponseHeaders -SetHeaderName "X-Frame-Options" -SetHeaderValue "allow-from https://www.example.com"
    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.