Question 165534 in Wordpress Question posted in
The official Wordpress documentation can be found here.

Can Acumatica Screens be embedded in a WordPress iFrame?

Does anyone know how to get Acumatica screens to be embedded in an iFrame in a wordpress site? When embedding an Acumatica screen in wordpress – I see the login screen however – after successful login I receive a refused to connect error.

I tried modifying the X-Frame in the web.config file – however still no difference after login. Does anyone know what changes need to be made on the Acumatica site to allow this? Or is it possibly a change that needs to happen in wordpress?

I realize that we should look at integrating the SSO but conceptually would think that the iFrames would work with or without SSO being setup yet or am I wrong in that assumption?

Tags:

2

Answers


  1. 0

    I believe you are running into a same-site cookie policy error. If the issue was cross site scripting error you wouldn’t see the login page.

    Same site cookie policy can be disabled in the web config file:
    https://learn.microsoft.com/en-us/aspnet/samesite/system-web-samesite#using-samesite-in-aspnet-472-and-48

    Change the web.config file settings as follows:

    Step 1: Open the web.config file, which is located in the application instance folder.

    Step 2: Find the <system.web> section and add the following line to this section:

    Note! The first occurrence of <system.web> located in the < location > tag is not the needed section.

    Step 3: Add the text highlighted in bold to the following lines:

    <formsAuth loginUrl="Frames/Login.aspx" timeout="60" requireSSL="true" />

    <sessionState cookieSameSite="None" cookieless="UseCookies" mode="Custom" customProvider="PXSessionStateStore" timeout="60" sessionIDManagerType="PX.Owin.SessionIdManager, PX.Owin">

    Login or Signup to reply.
  2. 0

    the answer provided by Hugues is very valid, but in the scope of Same Site Cookies.
    With iFrame you would generally get following exception:

    The loading of “https://yoursite.acumatica.com/Main?HideScript=On” in a frame is denied by “X-Frame-Options“ directive set to “SAMEORIGIN“.

    For a while solution was to add an explicit header X-Frame-Options and in ALLOW-FROM specify an uri to the site you would like to allow to open Acumatica in iFrame, this however is now outdated: X-Frame-Options

    Currently suggested way would be to use frame-ancestors directive of the Content-Security-Policy (frame-ancestors)

    For applications that run on IIS, like Acumatica, it is done by finding in web.config

    <httpProtocol>
    <customHeaders>

    ...

    And modify and add to this clause line like following example:

    <add name="Content-Security-Policy" value="frame-ancestors 'self' https://my.site1.com *.site2.net http://localhost:82" />

    This is just a syntax example that will allow the Acumatica to be open in iFrame on same domain, on my.site1.com, wildcard for all subdomains on site2.net and on even on the site deployed locally on the server that listens 82 port. Please use last one (http://localhost:82) only for testing purposes.

    So the end result in your web.config should look similar to that block (based on SalesDemo deployment):

    <httpProtocol>
      <customHeaders>
        <remove name="X-Powered-By" />
        <add name="Content-Security-Policy" value="frame-ancestors 'self' https://yourWordPressUri" />
      </customHeaders>
    </httpProtocol>

    Hope this is helping

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search