We have an authorization server which exposes a login page, we would like to authenticate users in our single page app using this authorization server. My employer does not want to redirect users to the authorization server to login due to UX, and I do not want to resort to using the resource owner password flow.
Since we are developing the client ourselves is it acceptable to embed the authorization servers login page in our client via an iframe, prevent other websites from embedding it via the Content-Security-Policy header, and use the Authorization code flow + PKCE?
If it helps we are using IdenityServer4.
EDIT: From what I understand the main concern with allowing your authorization servers login page to be embedded in an Iframe is that it would be susceptible to click jacking attacks. But if I add headers which only allow it to be embedded only in trusted clients we would be protected against that, assuming the end user is using a compliant browser. https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-23#section-10.13