1

SharePoint 2013 on-premises. My app has domain "myApp.com" and my sitecollection has the domain "mySitecollection.com". I use adfs authentication. I created a page on "mysitecollection.com". On this page I add the appart to a webpartzone. When I this page in IE I got the following error:

This content cannot be displayed in a frame

When I go to site contents and click on the app I resolve this issue. When I log out and log in I got this issue again.

I add this code to the masterpage of "mysitecollection.com":

<WebPartPages:AllowFraming runat=”server” />

And I have these logic in my SharePoint app mvc web project:

P3PHeaderFilterAttribute.cs:

public class P3PHeaderFilterAttribute : ActionFilterAttribute
    {
        public override void OnResultExecuted(ResultExecutedContext filterContext)
        {
            filterContext.HttpContext.Response.AddHeader("p3p",
                "CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"");

            base.OnResultExecuted(filterContext);
        }
    }

FilterConfig.cs:

public class FilterConfig
    {
        public static void RegisterGlobalFilters(GlobalFilterCollection filters)
        {
            filters.Add(new P3PHeaderFilterAttribute());
        }
    }

global.ascx:

protected void Application_Start()
        {
            AreaRegistration.RegisterAllAreas();
            FilterConfig.RegisterGlobalFilters(GlobalFilters.Filters);
            RouteConfig.RegisterRoutes(RouteTable.Routes);
            BundleConfig.RegisterBundles(BundleTable.Bundles); 

            // https://platinumdogs.me/2015/03/06/enable-iframing-in-a-sharepoint-provider-hosted-mvc-app/
            // allow cross domain framing: Disable the HTTP Header X-Frame-Options: SAMEORIGIN
            AntiForgeryConfig.SuppressXFrameOptionsHeader = true;
        }

Why do I still have this iframe issue and how can I fix this? In chrome it is working fine.

App MVC Web project web.config:

<?xml version="1.0" encoding="utf-8"?>
<!--
  For more information on how to configure your ASP.NET application, please visit
  http://go.microsoft.com/fwlink/?LinkId=301880
  -->
<configuration>
  <configSections>
    <section name="system.identityModel" type="System.IdentityModel.Configuration.SystemIdentityModelSection, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" />
    <section name="system.identityModel.services" type="System.IdentityModel.Services.Configuration.SystemIdentityModelServicesSection, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" />
  </configSections>
  <appSettings>
    <add key="webpages:Version" value="3.0.0.0" />
    <add key="webpages:Enabled" value="false" />
    <add key="ClientValidationEnabled" value="true" />
    <add key="UnobtrusiveJavaScriptEnabled" value="true" />
    <add key="ClientId" value="0aeb5a99-dcc6-4208-9398-a4fc10272c6b" />
    <add key="ClientSigningCertificatePath" value="E:\Certs\S2S.pfx" />
    <add key="ClientSigningCertificatePassword" value="Password!@#$" />
    <add key="IssuerId" value="32b83da0-4ef5-4bd2-a664-4561f4a1a40c" />
    <add key="spsaml:ClaimProviderType" value="SAML" />
    <add key="spsaml:TrustedProviderName" value="MyCompany Provisioning" />
    <add key="spsaml:IdentityClaimType" value="SMTP" />
  </appSettings>
  <system.web>
    <compilation debug="true" targetFramework="4.5" />
    <httpRuntime targetFramework="4.5" />
    <authentication mode="None" />
    <authorization>
      <deny users="?" />
    </authorization>
  </system.web>
  <system.webServer>
    <modules>
      <add name="WSFederationAuthenticationModule" type="System.IdentityModel.Services.WSFederationAuthenticationModule, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" preCondition="managedHandler" />
      <add name="SessionAuthenticationModule" type="System.IdentityModel.Services.SessionAuthenticationModule, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" preCondition="managedHandler" />
    </modules>
  </system.webServer>
  <runtime>
    <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
      <dependentAssembly>
        <assemblyIdentity name="Newtonsoft.Json" culture="neutral" publicKeyToken="30ad4fe6b2a6aeed" />
        <bindingRedirect oldVersion="0.0.0.0-9.0.0.0" newVersion="9.0.0.0" />
      </dependentAssembly>
      <dependentAssembly>
        <assemblyIdentity name="System.Web.Optimization" publicKeyToken="31bf3856ad364e35" />
        <bindingRedirect oldVersion="1.0.0.0-1.1.0.0" newVersion="1.1.0.0" />
      </dependentAssembly>
      <dependentAssembly>
        <assemblyIdentity name="WebGrease" publicKeyToken="31bf3856ad364e35" />
        <bindingRedirect oldVersion="0.0.0.0-1.5.2.14234" newVersion="1.5.2.14234" />
      </dependentAssembly>
      <dependentAssembly>
        <assemblyIdentity name="System.Web.Helpers" publicKeyToken="31bf3856ad364e35" />
        <bindingRedirect oldVersion="1.0.0.0-3.0.0.0" newVersion="3.0.0.0" />
      </dependentAssembly>
      <dependentAssembly>
        <assemblyIdentity name="System.Web.WebPages" publicKeyToken="31bf3856ad364e35" />
        <bindingRedirect oldVersion="1.0.0.0-3.0.0.0" newVersion="3.0.0.0" />
      </dependentAssembly>
      <dependentAssembly>
        <assemblyIdentity name="System.Web.Mvc" publicKeyToken="31bf3856ad364e35" />
        <bindingRedirect oldVersion="0.0.0.0-5.2.3.0" newVersion="5.2.3.0" />
      </dependentAssembly>
    </assemblyBinding>
  </runtime>
  <system.codedom>
    <compilers>
      <compiler language="c#;cs;csharp" extension=".cs" type="Microsoft.CodeDom.Providers.DotNetCompilerPlatform.CSharpCodeProvider, Microsoft.CodeDom.Providers.DotNetCompilerPlatform, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" warningLevel="4" compilerOptions="/langversion:6 /nowarn:1659;1699;1701" />
      <compiler language="vb;vbs;visualbasic;vbscript" extension=".vb" type="Microsoft.CodeDom.Providers.DotNetCompilerPlatform.VBCodeProvider, Microsoft.CodeDom.Providers.DotNetCompilerPlatform, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" warningLevel="4" compilerOptions="/langversion:14 /nowarn:41008 /define:_MYTYPE=\&quot;Web\&quot; /optionInfer+" />
    </compilers>
  </system.codedom>
  <system.serviceModel>
    <bindings>
      <basicHttpBinding>
        <!--Used by app for SharePoint-->
        <binding name="secureBinding">
          <security mode="Transport" />
        </binding>
      </basicHttpBinding>
    </bindings>
    <protocolMapping>
      <add binding="basicHttpBinding" scheme="https" bindingConfiguration="secureBinding" />
    </protocolMapping>
  </system.serviceModel>
  <system.identityModel>
    <identityConfiguration>
      <audienceUris>
        <add value="urn:sharepoint:myCompany:provisioning"/>
      </audienceUris>
      <securityTokenHandlers>
        <add type="System.IdentityModel.Services.Tokens.MachineKeySessionSecurityTokenHandler, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />
        <remove type="System.IdentityModel.Tokens.SessionSecurityTokenHandler, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />
      </securityTokenHandlers>
      <certificateValidation certificateValidationMode="None" />
      <issuerNameRegistry type="System.IdentityModel.Tokens.ValidatingIssuerNameRegistry, System.IdentityModel.Tokens.ValidatingIssuerNameRegistry">
        <authority name="adfs.dev.com">
          <keys>
            <add thumbprint="44243b28d7b9c69027d8e9b780634cc31549bd21"/>
          </keys>
          <validIssuers>
            <add name="http://adfs.dev.com/adfs/services/trust"/>
          </validIssuers>
        </authority>
      </issuerNameRegistry>
    </identityConfiguration>
  </system.identityModel>
  <system.identityModel.services>
    <federationConfiguration>
      <cookieHandler requireSsl="true" />
      <wsFederation passiveRedirectEnabled="true" reply="https://apps.myCompany.com" issuer="https://adfs.dev.com/adfs/ls/" realm="urn:sharepoint:myCompany:provisioning" requireHttps="true" />
    </federationConfiguration>
  </system.identityModel.services>
</configuration>
<!--ProjectGuid: {6A153F6B-DD14-4C55-AAE9-17FE7BBAB293}-->
Improve this question
8
  • Is that page hosted on your myApp.com or in the app web?
    – Sergei Sergeev
    Commented Dec 12, 2016 at 17:35
  • I am talking about a page on "mysitecollection.com". On that page I added a appart to a webpartzone.
    – Ola
    Commented Dec 13, 2016 at 6:47
  • "I add this code to the masterpage" If you added WebPartPages:AllowFraming to your mySitecollection.com it will not take effect. You need to modify your app, not host web.
    – Sergei Sergeev
    Commented Dec 13, 2016 at 7:39
  • What do I need to modify in my app?
    – Ola
    Commented Dec 13, 2016 at 9:21
  • You have added SuppressXFrameOptionsHeader , normally that should help..
    – Sergei Sergeev
    Commented Dec 13, 2016 at 11:48

1 Answer 1

Reset to default
1
+50

The most likely cause for such behavior is ADFS.

When you are not logged in into your myApp.com you redirected to ADFS authentication page. This page by default sets x-frame-options:DENY and it's not possible to change that (and not recommended since this is security setting).
Some additional info: one two

I didn't find any relative information over internet about how you can change this default behavior. You can try, may you will be lucky.

I can suggest only workarounds:

  • don't use ADFS auth in your myApp.com and use windows auth (you may lose SSO under some circumstances)
    OR

  • for client web part "pages" disable authentication at all and rely on app-only security if you need to talk with SharePoint (of course if it's suitable for your requirements)
    OR

  • use ADFS, but when user tries to open client web part "page", give a message "You need to authenticated, please click the link below", the link will open yours app page in a new window (not iframed, target="_blank"), or you can try to trigger javascript window.open from your client web part to open your page a new browser window, not iframed, after login process is done, listen for close window event and refresh app's part page
    OR
  • don't use client web parts at all and instead provide some pre-configured script editor web parts, which will talk to SharePoint from javscript and to your web api via CORS

UPD
As per comments from @Ola below, it appears that the fix is actually rather simple - you need to add SharePoint domain, ADFS domain and your app domain under Trusted sites in IE. Note, that this solution works, if you are using SharePointContextSaml and configured your app properly for ADFS authentication. Consider this great writing by Wictor Wilen: SharePoint 2013 with SAML Claims and Provider Hosted Apps

Improve this answer
11
  • Thank you for this information. You triggered me to check also the header of the ADFS login page (adfs.dev.com/adfs/ls?..................). There you see x-frame-options:DENY. When I open the app in a seperated browser tab I see the ADFS login page again but I was already logged in ADFS before when I entered the "mySitecollection.com". So this triggered me that the "adfs.dev.com" is in another zone than the "mySitecollection.com" and "myApp.com". I put al the 3 urls in the local intranet zone. And now it is working fine! Thank you Kai for the trigger.
    – Ola
    Commented Dec 19, 2016 at 14:24
  • That sounds strange for me that this solution works. How did you implement ADFS authentication in your app? In other words how do you in your app verify that user already authenticated?
    – Sergei Sergeev
    Commented Dec 19, 2016 at 14:50
  • I created in VS a new app project. In this app project I use the SharePoint ClientContext : ClientContext clientContext = SharePointContextProvider.Current.GetSharePointContext(HttpContext.Current).CreateUserClientContextForSPHost();. See also updated post for the web.config of the app mvc website.
    – Ola
    Commented Dec 21, 2016 at 11:09
  • By default SharePointContextProvider doesn't support adfs. It's working most probably because you actually using windows authentication and not ADFS. In Visual Studio under MVC project properties make sure that Windows auth is disabled - https://i.sstatic.net/I6P2w.png. If it's enabled (like I think in your case) then your approach with trusted sites will work, but not with adfs. Or you are actually using SharePointContextSaml
    – Sergei Sergeev
    Commented Dec 21, 2016 at 11:43
  • Hi Kai, By default SharePointContextProvider doesn't support adfs. Can you justify? I have same scenerio. it will be helpful. and also need alternate of "SharePointContextProvider "
    – Prashant Shah
    Commented Dec 22, 2016 at 6:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.