The SSO protocol redirects to your site, you then perform auth and redirect back to our site.
If one is to setup an IFRAME here, the redirect you perform once you authenticated the user would have to go to your site, it then would have to do some sort of magic to pass the information back into the IFRAME.
This is technically complex and very hard to get right. On the other option of custom footer and header is both technically way simpler to implement, way less error prone and as an added bonus faster cause you are not forced to make 2 separate requests to build up a page.