Duo Web iframe and Office (embedded) browsers

[pgp]

The Microsoft Office “thick” clients (Word, Excel, etc. on MacOS, Windows, iPhone, Android) support enterprise logins to Office 365 with an embedded browser that’s launched when you try to sign-in.

If using the iframe as shown in https://duo.com/docs/duoweb

<iframe id="duo_iframe">
</iframe>

For our custom WebSSO, when the embedded browser attempts to render the html page with the iframe, it fails and the sign-up stops. A Microsoft employee wrote

https://blogs.technet.microsoft.com/office_integration__sharepoint/2018/02/26/officeword-excel-etc-fails-to-render-duo-multifactor-authentication-login-page/

(which seems to have disappeared from the website very recently, but I have the content appended below.)

In that blog the suggestion was a iframe element like

<iframe id="duo_iframe" src="/images/tiny.gif">
</iframe>

The difference being that a minimal image is initially inserted into the iframe. We found that this does fix the problem and people can sign-in from those browsers (and it still works on traditional ones).

So, I was wondering what the folks at Duo think of this, and if it appears to be reasonable, be officially documented?

(Here’s that blog’s content, including its (one) comment)

Office(Word, Excel, etc) fails to render DUO multifactor authentication login page

Warren_R_Msft February 26, 2018

Issue:

You have a custom multifactor authentication login pages that leverage DUI API, and all works fine from web browsers but the Office client (Word, Excel, etc) fails to render all of the HTML property, you may see a flicker of the login page but in the end Office shows this error:

“Your organization’s policies are preventing us from completing this action for you. For more info, please contact your help desk.”

Cause:

When the DUO iframe is loaded from the “duo.form.login.template.html” file, the code is <iframe id="duo_iframe" width="100%" height="350px" frameborder="0">
Note that the SRC attribute of the Iframe element is missing, causing the iFrame to load the URL about:blank (The Iframe SRC attribute is set at a later point in the Duo-Web-v2.js file). For security reasons Office does not allow navigation to any non-https end point within the webview which is shown to capture user credentials. The lack of a SRC attribute causes the embedded browser to load “about:blank” in the IFRAME which is not based on HTTPS and Office cannot allow such navigation to take place.

Workaround:

Specifying a SRC attribute for the Iframe element resolves the issue : <iframe id="duo_iframe" src="images/TempImage.gif" width="100%" height="350px" frameborder="0"> (Since we have a SRC, about:blank no longer loads, and hence the issue does not occur)

Comments (1)

You must be logged in to post a comment.

hamhands
July 25, 2018 at 5:56 pm	

Thanks for this. I was experiencing this issue with Sharepoint-hosted content protected by CAS + Duo. Users would enter their credentials and submit the CAS login form, then the embedded browser would close and the Office app would show the error above. This happened when opening Word, Excel, PP, and Visio docs as well as when Sharepoint lists were connected to Outlook. Sure enough, the markup for the Duo IFRAME did not contain a src attribute. Once I added one pointing to a blank document, the Duo view started rendering. This is with Office 2013 so the compatibility level of the embedded browser is pretty ancient. The Duo view doesn’t look very nice in it, but it’s functional. Thanks again for the post.

[Dooley]

Hi Phil,
I discussed this with our engineering team, and please be aware that we do not recommend setting the src on the iframe. It will fix this specific bug but can (and does) break other integrations.

We are actively working on a fix for this and will be releasing a new minor version of the Duo Web SDK that fixes this bug without breaking other integrations. I’ll follow up in this thread when that becomes available.

[pgp]

Hi,
I look forward to trying out the new version. Also, if you could elaborate on which other integrations the src fix can break, that may be helpful.

[DuoforSchool]

We are also having this issues. We protect SharePoint on Prem through ADFS/WAP and documents being opened no longer work. We need this fixed.

[PatrickKnight]

Hey @DuoforSchool if you open up a support case we can help you out with this ADFS issue.

[DuoforSchool]

Will do - Thank you!

[cmillerLCE]

We ran into this same issue, using the Duo ADFS MFA adapter. Duo was able to compile us a special version of the ADFS MFA Adapter that had the iframe fix(workaround) that allowed the Duo authentication request to be rendered in that MS Office integrated browser popup window. It’s been working fine for us. I’ve noticed at least 1 formal release of the Duo ADFS MFA adapter since then but didn’t see that fix listed in the release notes so I’ve stuck on this older version that works.

I thought I was the only one in the world with the problem since I couldn’t find anyone else with a fix. Thankfully Duo support and engineering stepped up and provided a custom version of the adapter.

My support case number for this issue in case it helps is 00290231.

[shivaramg]

Hi,
Can you let us know an estimate of when this fix will be released.

We have an issue where the embedded browser fails on iframe and loads about:blank
We tried changing our code to append src when it loads the iframe but still doesnt work

Thanks

[Dan_McNeece]

We are having this problem too with a login from Excel. Any word on an update?

[jmgregory]

We’ve hit this issue as well, specifically with SharePoint Designer 2013, and it’s blocking us from delivering for our customer. Could you please update on the status of the fix? Has it been released, and if so, which version number?

One more piece of data if it helps: each time we attempt to log in and fail, we see a new “DuoAuth not configured” message in the Windows Event Viewer application log.

[Amy2]

Hi everyone, we released an update to the Duo Web SDK that contained a fix for this earlier this year. We do not currently have an update for when a fix will be available in AD FS, however.

You all probably know the drill by now, but for anyone who may be new here, please reach out to your Account Executive or Customer Success Manager (or contact Duo Support) to have your name added to a feature request for this. They may have another solution for you as well.