Suppose I have 3 sites that I want to have SSO in, site1.com, site2.com, and auth.com. SSL is always required.
According to how SiteMinder cookies are described here, one of those domains would be the associated "master cookie" domain, and others would redirect to that domain in case of an authentication failure.
How things currently work
To prevent clickjacking, the login page for auth.com has the NoFrames script and a frames buster script implemented for older browers.
At this point I can either refresh the page and redirect, or tell the user to login again at auth.com, but then I lose my in-memory application state.
A new/seamless approach for the end-user
auth.com/RefreshOnly (iFrames okay) POSTing my session data.
Auth.com/RefreshOnly will see the cookie for its domain and, if it chooses, redirect to my origin
site1.com, instructing it to update my current cookie.... all within a hidden iFrame.
Is this limited usage of iFrame permissible in an IDP/authentication provider? (not exclusive to Siteminder)