# authenticationChallenge embedded framing issues

**URL:** <https://forum.inductiveautomation.com/t/authenticationchallenge-embedded-framing-issues/107821>\
**Category:** Ignition\
**Tags:** scripting, ignition81, perspective\
**Created:** [June 26, 2025, 9:20am UTC](https://forum.inductiveautomation.com/t/authenticationchallenge-embedded-framing-issues/107821 "2025-06-26T09:20:32Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![xubin](https://avatars.discourse-cdn.com/v4/letter/x/bcef8e/32.png) [@xubin](https://forum.inductiveautomation.com/u/xubin)\
**Post date:** [June 26, 2025, 9:20am UTC](https://forum.inductiveautomation.com/t/authenticationchallenge-embedded-framing-issues/107821/1 "2025-06-26T09:20:32Z")

</div>

I try to use scripts to do the user authentication when action triggered by user using " **embedded**" parameter on framing. It shows refuse to connect by idp. But it was worked with " **new**" parameter. Any work around to avoid open new browser tab? Thank you.

```python
system.perspective.authenticationChallenge(idp = "keycloak", timeout = 3, forceAuth = 'True', payload = {"isAction":"True","Value":self.getSibling("ToggleSwitch").props.selected}, framing = "embedded")

```

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/0/2/02e15a420f3a736e08fec8fb3064cca0272fab81.png)

---

<div class="post-metadata">

**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\
**Post date:** [June 26, 2025, 3:44pm UTC](https://forum.inductiveautomation.com/t/authenticationchallenge-embedded-framing-issues/107821/2 "2025-06-26T15:44:52Z")

</div>

Whether a given site will work inside an iframe is up to that website; there's nothing you can do about it if you don't own the website in question.

---

<div class="post-metadata">

**Author:** ![xubin](https://avatars.discourse-cdn.com/v4/letter/x/bcef8e/32.png) [@xubin](https://forum.inductiveautomation.com/u/xubin)\
**Post date:** [June 27, 2025, 12:44am UTC](https://forum.inductiveautomation.com/t/authenticationchallenge-embedded-framing-issues/107821/3 "2025-06-27T00:44:03Z")

</div>

I am the owner of the website, any settings to change? Firewall or anti-virus? Figure shows using " **new**" or " **self**" parameter.

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/c/1/c192c1db3c3bc89b806106227e376d19b0c42114.png)

---

<div class="post-metadata">

**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\
**Post date:** [June 27, 2025, 3:23am UTC](https://forum.inductiveautomation.com/t/authenticationchallenge-embedded-framing-issues/107821/4 "2025-06-27T03:23:41Z")

</div>

You need to return a [content security policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy) or [x-frame-options](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Frame-Options) header.