47qaz (47qaz) asked a question.
This is not about running okta in an iframe, I see all of those questions and this is a bit different.
We have an existing application (APP X on DOMAIN A) which is authenticated and is acting as a resource server; it has an integration to a third-party application (APP Y on DOMAIN B) that runs in an iframe embeded on a page within APP X. The third party app is not authenticated today.
The desire is to add authentication and identity to APP Y. We can make modifications to both applications (but not change their domains) Can anyone point to a reference or suggest an approach?
I am guessing we could pass the token using window.postMessage() and watch for changes and relay them along to the iFrame? Is there something bad about this I don't understand?
In order to be able to help you most efficiently, I recommend that you open a case with us to investigate your environment and provide you with the best solution.