Suppose I have 3 sites that I want to have SSO in, site1.com, site2.com, and auth.com. SSL is always required.
According to how SiteMinder cookies are described here, one of those domains would be the associated "master cookie" domain, and others would redirect to that domain in case of an authentication failure.
How things currently work
To prevent clickjacking, the login page for auth.com has the NoFrames script and a frames buster script implemented for older browers.
After the client logs into site1.com or site2.com, AJAX kicks in and does some operations (polling etc). During this time, Javascript may get a an error saying that the session is invalid. This error occurs while using AJAX. (if it occurred while browsing, there would be a redirection and this entire question doesn't apply)
At this point I can either refresh the page and redirect, or tell the user to login again at auth.com, but then I lose my in-memory application state.
A new/seamless approach for the end-user
As a workaround I'm considering using Javascript to create an iFrame to auth.com/RefreshOnly (iFrames okay) POSTing my session data. Auth.com/RefreshOnly will see the cookie for its domain and, if it chooses, redirect to my origin site1.com, instructing it to update my current cookie.... all within a hidden iFrame.
Question
Is this limited usage of iFrame permissible in an IDP/authentication provider? (not exclusive to Siteminder)
