- What could be auto-generating the first director ("frame-ancestors 'self'")? IIS? Chrome>?
Please check if your application has any code that sets the header, as well as other IIS global/site-level CSP header settings.
- If two headers are present, would the second directive (the custom one added via IIS) be ignored.
When multiple CSP headers are present, the most-restrictive CSP directives are enforced. More details you can refer to this doc:https://w3c.github.io/webappsec-csp/#multiple-policies
- What can I try in order to resolve the error?
First make sure you only apply one CSP directive(based on question 2), and in this case, frame-ancestors *.otherdomain.com; should match your needs.