I have 2 separate apps that uses Okta SSO using PKCE flow.
Both of these apps are built on Spring boot 2.6.3, Joinfaces and okta spring boot starter.
Both apps sso works when used in browser.
I am trying to embed a jsf page from app2 into app1 using iframe. The sso works fine for app1 when I launch in browser. When app1 tries to display the embedded jsf page from app2 the sso fails. It gives me an error saying “invalid credentials”.
Both the apps are using the same domain.
Any pointers on why the sso fails on embedded iframe for app2?
The custom option for iframe is enabled in okta admin.