'Don't have a security code' link missing in from ADFS JavaScript integration. Error: The page’s settings blocked the loading of a resource

Products

• VIP Service

Issue/Introduction

The VIP JavaScript integration is missing the Don't have a security code link in the Confirm Your Identity window.

The browser debug tools shows an error:

Content-Security-Policy: The page’s settings blocked the loading of a resource (frame-src) at https://vipeg.example.com/myvip/trustedserviceaccess because it violates the following directive: “default-src 'self' https://userservices.vip.symantec.com https://userservices.cl.vip.symantec.com https://userservices.vip.csp01.saas.broadcom.com https://vipegw.example.com:8234 https://ssp.vip.symantec.com 'unsafe-inline' 'unsafe-eval' https://script-src” idpinitiatedsignon
A message is received from [undefined] vip:947:31
WARNING: IDP url is not responding in time, fallback to SC.

Cause

To protect against common security vulnerabilities and provide administrators the ability to take advantage of the latest advancements in browser-based protection mechanisms, AD FS 2019 added the functionality to customize the HTTP security response headers sent by AD FS. This is accomplished through the introduction of two new cmdlets: Get-AdfsResponseHeaders and  Set-AdfsResponseHeaders. This is expected in environments where users can external AD FS-protected resources externally.

Enabling the browser developer tools (F12), then clicking on the CONSOLE tab during login attempts will expose the URL the AD FS server is blocking. The blocked URL needs to be added to the AD FS response headers. 

Resolution

Refer to this article. Apply the same steps in the resolution: VIP JavaScript PUSH fails with login failure message with ADFS integration on Server 2019