So currently the login flow pages are served up with content security policy headers to not allow being embedded in another domain/origin. The reason for this is to prevent clickjacking attacks and was explicitly done that way.
I guess for this we would need a csp setting for the OpenID provider where one can allow specific domains/origins.
