Embed to Website - Revision history

Ollvihe: /* Using SAML authentication with embedding */

2026-06-22T09:25:46Z

Using SAML authentication with embedding

← Older revision		Revision as of 09:25, 22 June 2026
Line 28:		Line 28:
	If the browser has popup blocking enabled, the new window cannot open. In such cases, a descriptive message prompts the user to disable popup blocking. Additionally, the user can manually open the authentication window by clicking the embedded frame, even if popups are blocked. Once the identity provider login is successful, the new window will close, and the original browser window will redirect to QPR ProcessAnalyzer. However, if the separate browser window is closed before completing the login, the original window will display the standard QPR ProcessAnalyzer login view.		If the browser has popup blocking enabled, the new window cannot open. In such cases, a descriptive message prompts the user to disable popup blocking. Additionally, the user can manually open the authentication window by clicking the embedded frame, even if popups are blocked. Once the identity provider login is successful, the new window will close, and the original browser window will redirect to QPR ProcessAnalyzer. However, if the separate browser window is closed before completing the login, the original window will display the standard QPR ProcessAnalyzer login view.

	In addition, for SAML authentication to work correctly when the identity provider is located on a ~~'''~~different origin~~'''~~ than the QPR ProcessAnalyzer server itself, the <code>Cross-Origin-Opener-Policy</code> HTTP header must be changed from its default value of <code>"same-origin"</code> to <code>"unsafe-none"</code>. ~~'''~~Cross-Origin-Opener-Policy (COOP) Header~~:'''~~ This is a response header that provides a way for a document to control whether a new document opened in a top-level context (like a new tab or window) shares the same browsing context group as its opener. Setting it to <code>unsafe-none</code> allows the cross-origin authentication flow to complete successfully in this embedded scenario. For more technical details, see https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Opener-Policy		In addition, for SAML authentication to work correctly when the identity provider is located on a different origin than the QPR ProcessAnalyzer server itself, the <code>Cross-Origin-Opener-Policy</code> HTTP header must be changed from its default value of <code>"same-origin"</code> to <code>"unsafe-none"</code>.

			Cross-Origin-Opener-Policy (COOP) Header This is a response header that provides a way for a document to control whether a new document opened in a top-level context (like a new tab or window) shares the same browsing context group as its opener. Setting it to <code>unsafe-none</code> allows the cross-origin authentication flow to complete successfully in this embedded scenario. For more technical details, see https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Opener-Policy.

Ollvihe: /* Using SAML authentication with embedding */

2026-06-22T09:24:59Z

Using SAML authentication with embedding

← Older revision		Revision as of 09:24, 22 June 2026
Line 28:		Line 28:
	If the browser has popup blocking enabled, the new window cannot open. In such cases, a descriptive message prompts the user to disable popup blocking. Additionally, the user can manually open the authentication window by clicking the embedded frame, even if popups are blocked. Once the identity provider login is successful, the new window will close, and the original browser window will redirect to QPR ProcessAnalyzer. However, if the separate browser window is closed before completing the login, the original window will display the standard QPR ProcessAnalyzer login view.		If the browser has popup blocking enabled, the new window cannot open. In such cases, a descriptive message prompts the user to disable popup blocking. Additionally, the user can manually open the authentication window by clicking the embedded frame, even if popups are blocked. Once the identity provider login is successful, the new window will close, and the original browser window will redirect to QPR ProcessAnalyzer. However, if the separate browser window is closed before completing the login, the original window will display the standard QPR ProcessAnalyzer login view.

	In addition, for SAML authentication to work correctly when the identity provider is located on a '''different origin''' than the QPR ProcessAnalyzer server itself, the <code>Cross-Origin-Opener-Policy</code> HTTP header must be changed from its default value of <code>"same-origin"</code> to <code>"unsafe-none"</code>.		In addition, for SAML authentication to work correctly when the identity provider is located on a '''different origin''' than the QPR ProcessAnalyzer server itself, the <code>Cross-Origin-Opener-Policy</code> HTTP header must be changed from its default value of <code>"same-origin"</code> to <code>"unsafe-none"</code>. '''Cross-Origin-Opener-Policy (COOP) Header:''' This is a response header that provides a way for a document to control whether a new document opened in a top-level context (like a new tab or window) shares the same browsing context group as its opener. Setting it to <code>unsafe-none</code> allows the cross-origin authentication flow to complete successfully in this embedded scenario. For more technical details, see https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Opener-Policy
	~~----'''Additional Information:'''~~

	* '''Cross-Origin-Opener-Policy (COOP) Header:''' This is a response header that provides a way for a document to control whether a new document opened in a top-level context (like a new tab or window) shares the same browsing context group as its opener. Setting it to <code>unsafe-none</code> allows the cross-origin authentication flow to complete successfully in this embedded scenario. For more technical details, see https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Opener-Policy

Ollvihe at 09:23, 22 June 2026

2026-06-22T09:23:43Z

← Older revision		Revision as of 09:23, 22 June 2026
Line 1:		Line 1:
	QPR ProcessAnalyzer can be embedded to another website, such as Microsoft Sharepoint. The embedding is based on the ''iframe'' html element. By default, QPR ProcessAnalyzer only allows to be embedded by a website in the same origin that is restricted by the Content-Security-Policy ~~HTTL~~ header. More information how to change the CSP setting in [[QPR_ProcessAnalyzer_Security_Hardening#HTTP_Response_Headers\|Security Hardening]]. Note also the special behavior when using the [[#Using_SAML_authentication_with_embedding\|SAML authentication with embedding]].		QPR ProcessAnalyzer can be embedded to another website, such as Microsoft Sharepoint. The embedding is based on the ''iframe'' html element. By default, QPR ProcessAnalyzer only allows to be embedded by a website in the same origin that is restricted by the Content-Security-Policy HTTP header. More information how to change the CSP setting in [[QPR_ProcessAnalyzer_Security_Hardening#HTTP_Response_Headers\|Security Hardening]]. Note also the special behavior when using the [[#Using_SAML_authentication_with_embedding\|SAML authentication with embedding]].

	== Example embedding webpage ==		== Example embedding webpage ==

Ollvihe: /* Change CSP frame-ancestors setting */

2026-06-22T09:23:19Z

Change CSP frame-ancestors setting

← Older revision		Revision as of 09:23, 22 June 2026
Line 21:		Line 21:
	If the CSP prevents the embedded website from showing, there will be a descriptive error message in the browser console. It contains details which CSP directive didn't allow to open the page.		If the CSP prevents the embedded website from showing, there will be a descriptive error message in the browser console. It contains details which CSP directive didn't allow to open the page.

	More information about the Content-Security-Policy ~~HTTL~~ header: https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP.		More information about the Content-Security-Policy HTTP header: https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP.

	== Using SAML authentication with embedding ==		== Using SAML authentication with embedding ==

Ollvihe: /* Example embedding webpage */

2026-06-22T09:22:59Z

Example embedding webpage

← Older revision		Revision as of 09:22, 22 June 2026
Line 8:		Line 8:
	<html>		<html>
	<body>		<body>
	<iframe src="https://processanalyzer.company.com/qprpa/ui/#/dashboard?sys:dashboardIdentifier=/MyProject/MyDashboard" height="600" width="900"></iframe>		<iframe src="https://processanalyzer.company.com/qprpa/ui/#/dashboard?sys:dashboardIdentifier=/MyProject/MyDashboard?param1=value1&param2=value2" height="600" width="900"></iframe>
	</body>		</body>
	</html>		</html>

Ollvihe: /* Change CSP frame-ancestors setting */

2026-06-22T09:21:53Z

Change CSP frame-ancestors setting

← Older revision		Revision as of 09:21, 22 June 2026
Line 14:		Line 14:

	== Change CSP frame-ancestors setting ==		== Change CSP frame-ancestors setting ==
	By default, the Content-Security-Policy ~~HTTL~~ header '''frame-ancestors''' directive is set to '''self''', allowing the parent website where QPR ProcessAnalyzer is embedded to, to be located in the same origin. If the parent website is in another origin, the CSP needs to be changed as follows (allowing to embed QPR ProcessAnalyzer in the example.com website):		By default, the Content-Security-Policy HTTP header '''frame-ancestors''' directive is set to '''self''', allowing the parent website where QPR ProcessAnalyzer is embedded to, to be located in the same origin. If the parent website is in another origin, the CSP needs to be changed as follows (allowing to embed QPR ProcessAnalyzer in the example.com website):
	<pre>		<pre>
	frame-ancestors 'self' example.com;		frame-ancestors 'self' example.com;

MarHink: Added required change details on Cross-Origin-Opener-Policy header.

2025-11-11T12:58:02Z

Added required change details on Cross-Origin-Opener-Policy header.

← Older revision		Revision as of 12:58, 11 November 2025
Line 27:		Line 27:

	If the browser has popup blocking enabled, the new window cannot open. In such cases, a descriptive message prompts the user to disable popup blocking. Additionally, the user can manually open the authentication window by clicking the embedded frame, even if popups are blocked. Once the identity provider login is successful, the new window will close, and the original browser window will redirect to QPR ProcessAnalyzer. However, if the separate browser window is closed before completing the login, the original window will display the standard QPR ProcessAnalyzer login view.		If the browser has popup blocking enabled, the new window cannot open. In such cases, a descriptive message prompts the user to disable popup blocking. Additionally, the user can manually open the authentication window by clicking the embedded frame, even if popups are blocked. Once the identity provider login is successful, the new window will close, and the original browser window will redirect to QPR ProcessAnalyzer. However, if the separate browser window is closed before completing the login, the original window will display the standard QPR ProcessAnalyzer login view.

			In addition, for SAML authentication to work correctly when the identity provider is located on a '''different origin''' than the QPR ProcessAnalyzer server itself, the <code>Cross-Origin-Opener-Policy</code> HTTP header must be changed from its default value of <code>"same-origin"</code> to <code>"unsafe-none"</code>.
			----'''Additional Information:'''

			* '''Cross-Origin-Opener-Policy (COOP) Header:''' This is a response header that provides a way for a document to control whether a new document opened in a top-level context (like a new tab or window) shares the same browsing context group as its opener. Setting it to <code>unsafe-none</code> allows the cross-origin authentication flow to complete successfully in this embedded scenario. For more technical details, see https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Opener-Policy

Ollvihe: /* Change CSP frame-ancestors setting */

2025-11-11T11:02:15Z

Change CSP frame-ancestors setting

← Older revision		Revision as of 11:02, 11 November 2025
Line 14:		Line 14:

	== Change CSP frame-ancestors setting ==		== Change CSP frame-ancestors setting ==
	By default, the Content-Security-Policy HTTL header '''frame-ancestors'' directive is set to '''self''', allowing the parent website where QPR ProcessAnalyzer is embedded to, to be located in the same origin. If the parent website is in another origin, the CSP needs to be changed as follows (allowing to embed QPR ProcessAnalyzer in the example.com website):		By default, the Content-Security-Policy HTTL header '''frame-ancestors''' directive is set to '''self''', allowing the parent website where QPR ProcessAnalyzer is embedded to, to be located in the same origin. If the parent website is in another origin, the CSP needs to be changed as follows (allowing to embed QPR ProcessAnalyzer in the example.com website):
	<pre>		<pre>
	frame-ancestors 'self' example.com;		frame-ancestors 'self' example.com;

Ollvihe: /* Example webpage */

2025-10-26T20:15:43Z

Example webpage

← Older revision		Revision as of 20:15, 26 October 2025
Line 1:		Line 1:
	QPR ProcessAnalyzer can be embedded to another website, such as Microsoft Sharepoint. The embedding is based on the ''iframe'' html element. By default, QPR ProcessAnalyzer only allows to be embedded by a website in the same origin that is restricted by the Content-Security-Policy HTTL header. More information how to change the CSP setting in [[QPR_ProcessAnalyzer_Security_Hardening#HTTP_Response_Headers\|Security Hardening]]. Note also the special behavior when using the [[#Using_SAML_authentication_with_embedding\|SAML authentication with embedding]].		QPR ProcessAnalyzer can be embedded to another website, such as Microsoft Sharepoint. The embedding is based on the ''iframe'' html element. By default, QPR ProcessAnalyzer only allows to be embedded by a website in the same origin that is restricted by the Content-Security-Policy HTTL header. More information how to change the CSP setting in [[QPR_ProcessAnalyzer_Security_Hardening#HTTP_Response_Headers\|Security Hardening]]. Note also the special behavior when using the [[#Using_SAML_authentication_with_embedding\|SAML authentication with embedding]].

	== Example webpage ==		== Example embedding webpage ==
	This is a simple example page containing an iframe element that embeds QPR ProcessAnalyzer.		This is a simple example page containing an iframe element that embeds QPR ProcessAnalyzer.

Ollvihe at 20:15, 26 October 2025

2025-10-26T20:15:22Z

← Older revision		Revision as of 20:15, 26 October 2025
Line 1:		Line 1:
	QPR ProcessAnalyzer can be embedded to another website, such as Microsoft Sharepoint. The embedding is based on the ''iframe'' html element. By default, QPR ProcessAnalyzer only ~~allowes~~ to be embedded by a website in the same origin that is restricted by the Content-Security-Policy HTTL header. More information how to change the CSP setting in [[QPR_ProcessAnalyzer_Security_Hardening#HTTP_Response_Headers\|Security Hardening]].		QPR ProcessAnalyzer can be embedded to another website, such as Microsoft Sharepoint. The embedding is based on the ''iframe'' html element. By default, QPR ProcessAnalyzer only allows to be embedded by a website in the same origin that is restricted by the Content-Security-Policy HTTL header. More information how to change the CSP setting in [[QPR_ProcessAnalyzer_Security_Hardening#HTTP_Response_Headers\|Security Hardening]]. Note also the special behavior when using the [[#Using_SAML_authentication_with_embedding\|SAML authentication with embedding]].

	== Example webpage ==		== Example webpage ==