<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0" /> <base href="https://issues.shibboleth.net/jira" />
<title>Message Title</title>
</head>
<body class="jira" style="color: #333; font-family: Arial, sans-serif; font-size: 14px; line-height: 1.429">
<table id="background-table" cellpadding="0" cellspacing="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt; background-color: #f5f5f5; border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<!-- header here -->
<tr>
<td id="header-pattern-container" style="padding: 0px; border-collapse: collapse; padding: 10px 20px">
<table id="header-pattern" cellspacing="0" cellpadding="0" border="0" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tr>
<td id="header-avatar-image-container" valign="top" style="padding: 0px; border-collapse: collapse; vertical-align: top; width: 32px; padding-right: 8px"> <img id="header-avatar-image" class="image_fix" src="cid:jira-generated-image-avatar-0f8bf636-cfc5-42a3-9f64-b990469f2dc6" height="32" width="32" border="0" style="border-radius: 3px; vertical-align: top" />
</td>
<td id="header-text-container" valign="middle" style="padding: 0px; border-collapse: collapse; vertical-align: middle; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 1px"> <a class="user-hover" rel="r7lwbdjaaqpqfi77ck/ic2nmnqo=@https://shibidp.cca.unipd.it/idp/shibboleth" id="email_r7lwbdjaaqpqfi77ck/ic2nmnqo=@https://shibidp.cca.unipd.it/idp/shibboleth" href="https://issues.shibboleth.net/jira/secure/ViewProfile.jspa?name=r7lwbdjaaqpqfi77ck%2Fic2nmnqo%3D%40https%3A%2F%2Fshibidp.cca.unipd.it%2Fidp%2Fshibboleth" style="color:#3b73af;; color: #3b73af; text-decoration: none">r7lwbdjaaqpqfi77ck/ic2nmnqo=@https://shibidp.cca.unipd.it/idp/shibboleth</a> <strong>created</strong> an issue
</td>
</tr>
</table>
</td>
</tr>
<tr>
<td id="email-content-container" style="padding: 0px; border-collapse: collapse; padding: 0 20px">
<table id="email-content-table" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt; border-spacing: 0; border-collapse: separate">
<tr>
<!-- there needs to be content in the cell for it to render in some clients -->
<td class="email-content-rounded-top mobile-expand" style="padding: 0px; border-collapse: collapse; color: #fff; padding: 0 15px 0 16px; height: 15px; background-color: #fff; border-left: 1px solid #ccc; border-top: 1px solid #ccc; border-right: 1px solid #ccc; border-bottom: 0; border-top-right-radius: 5px; border-top-left-radius: 5px; height: 10px; line-height: 10px; padding: 0 15px 0 16px; mso-line-height-rule: exactly">
</td>
</tr>
<tr>
<td class="email-content-main mobile-expand " style="padding: 0px; border-collapse: collapse; border-left: 1px solid #ccc; border-right: 1px solid #ccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #fff">
<table class="page-title-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tr>
<td class="page-title-pattern-first-line " style="padding: 0px; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; padding-top: 10px"> <a href="https://issues.shibboleth.net/jira/browse/SSPCPP" style="color: #3b73af; text-decoration: none">Shibboleth SP - C++</a> / <a href="https://issues.shibboleth.net/jira/browse/SSPCPP-732" style="color: #3b73af; text-decoration: none"><img src="cid:jira-generated-image-avatar-4d0f36dc-6d14-4752-9b71-fbec26e1a7ba" height="16" width="16" border="0" align="absmiddle" alt="Bug" style="vertical-align: text-bottom" /></a> <a href="https://issues.shibboleth.net/jira/browse/SSPCPP-732" style="color: #3b73af; text-decoration: none">SSPCPP-732</a>
</td>
</tr>
<tr>
<td style="vertical-align: top;; padding: 0px; border-collapse: collapse; padding-right: 5px; font-size: 20px; line-height: 30px; mso-line-height-rule: exactly" class="page-title-pattern-header-container"> <span class="page-title-pattern-header" style="font-family: Arial, sans-serif; padding: 0; font-size: 20px; line-height: 30px; mso-text-raise: 2px; mso-line-height-rule: exactly; vertical-align: middle"> <a href="https://issues.shibboleth.net/jira/browse/SSPCPP-732" style="color: #3b73af; text-decoration: none">Shib protected location doesn't set header for cors request</a> </span>
</td>
</tr>
</table>
</td>
</tr>
<tr>
<td class="email-content-main mobile-expand wrapper-special-margin" style="padding: 0px; border-collapse: collapse; border-left: 1px solid #ccc; border-right: 1px solid #ccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #fff; padding-top: 10px; padding-bottom: 5px">
<table class="keyvalue-table" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">
Issue Type:
</th>
<td class="has-icon" style="padding: 0px; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"> <img src="cid:jira-generated-image-avatar-4d0f36dc-6d14-4752-9b71-fbec26e1a7ba" height="16" width="16" border="0" align="absmiddle" alt="Bug" style="vertical-align: text-bottom" /> Bug
</td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">
Affects Versions:
</th>
<td style="padding: 0px; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top">
2.6.0
</td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">
Assignee:
</th>
<td style="padding: 0px; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"> <a class="user-hover" rel="cantor.2@osu.edu" id="email_cantor.2@osu.edu" href="https://issues.shibboleth.net/jira/secure/ViewProfile.jspa?name=cantor.2%40osu.edu" style="color:#3b73af;; color: #3b73af; text-decoration: none">Scott Cantor</a>
</td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">
Components:
</th>
<td style="padding: 0px; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top">
Web Server Modules
</td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">
Created:
</th>
<td style="padding: 0px; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top">
30/May/17 8:14 AM
</td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">
Environment:
</th>
<td style="padding: 0px; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top">
<p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0">RedHat 7 and Debian 8<br /> Apache 2.4<br /> SP 2.6.0 (using the os packages on Debian and your rpm on RedHat).</p>
</td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">
Labels:
</th>
<td style="padding: 0px; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top">
cors ajax headers
</td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">
Priority:
</th>
<td class="has-icon" style="padding: 0px; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"> <img src="cid:jira-generated-image-static-minor-285dc0ac-2a94-414c-9302-c4c093f5348e" height="16" width="16" border="0" align="absmiddle" alt="Minor" style="vertical-align: text-bottom" /> Minor
</td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">
Reporter:
</th>
<td style="padding: 0px; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"> <a class="user-hover" rel="r7lwbdjaaqpqfi77ck/ic2nmnqo=@https://shibidp.cca.unipd.it/idp/shibboleth" id="email_r7lwbdjaaqpqfi77ck/ic2nmnqo=@https://shibidp.cca.unipd.it/idp/shibboleth" href="https://issues.shibboleth.net/jira/secure/ViewProfile.jspa?name=r7lwbdjaaqpqfi77ck%2Fic2nmnqo%3D%40https%3A%2F%2Fshibidp.cca.unipd.it%2Fidp%2Fshibboleth" style="color:#3b73af;; color: #3b73af; text-decoration: none">r7lwbdjaaqpqfi77ck/ic2nmnqo=@https://shibidp.cca.unipd.it/idp/shibboleth</a>
</td>
</tr>
</table>
</td>
</tr>
<tr>
<td class="email-content-main mobile-expand issue-description-container" style="padding: 0px; border-collapse: collapse; border-left: 1px solid #ccc; border-right: 1px solid #ccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #fff; padding-top: 5px; padding-bottom: 10px">
<table class="text-paragraph-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 2px">
<tr>
<td class="text-paragraph-pattern-container mobile-resize-text " style="padding: 0px; border-collapse: collapse; padding: 0 0 10px 0">
<p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0">Hi,<br /> I have a resource shib-protected that is requested with cross-origin ajax.<br /> I have follow this instruction:<br /> <a href="https://wiki.shibboleth.net/confluence/display/IDP30/Cross-origin+AJAX+requests+for+Shib-protected+resources" class="external-link" rel="nofollow" style="color: #3b73af; text-decoration: none">https://wiki.shibboleth.net/confluence/display/IDP30/Cross-origin+AJAX+requests+for+Shib-protected+resources</a></p>
<p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0">Everything work fine on apache 2.2 and SP 2.4, but when I tried with apache 2.4 and SP 2.6 the headers Access-Control-Allow-Origin is not set.<br /> The only workaround that I have find is to set the header on the reverse proxy which is in front of the application server.<br /> The header is correctly set if the resource is not shib-protected, or if is protected with basic-auth, or if I'm already authenticated on the sp that is called by the ajax request.<br /> It's seems that mod_headers is not hooked in the request processing.<br /> This is the apache log (trace 8) for a basic-auth protected resource:</p>
<p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0"><span class="error">[Thu Mar 30 17:11:01.459411 2017]</span> <span class="error">[core:trace3]</span> <span class="error">[pid 7249]</span> request.c(119): <span class="error">[client 147.162.xxx.xxx:50777]</span> auth phase 'check user' gave status 401: /auth-basic/edifici, referer: <a href="http://xxx.unipd.it:8000/cors.html" class="external-link" rel="nofollow" style="color: #3b73af; text-decoration: none">http://xxx.unipd.it:8000/cors.html</a><br /> <span class="error">[Thu Mar 30 17:11:01.459475 2017]</span> <span class="error">[headers:debug]</span> <span class="error">[pid 7249]</span> mod_headers.c(848): AH01503: headers: ap_headers_error_filter()<br /> <span class="error">[Thu Mar 30 17:11:01.459522 2017]</span> <span class="error">[http:trace3]</span> <span class="error">[pid 7249]</span> http_filters.c(1006): <span class="error">[client 147.162.xxx.xxx:50777]</span> Response sent with status 401, headers:, referer: <a href="http://xxx.unipd.it:8000/cors.html" class="external-link" rel="nofollow" style="color: #3b73af; text-decoration: none">http://xxx.unipd.it:8000/cors.html</a></p>
<p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0">This is the apache log (trace 8) for a shib-auth protected resource if I'm already logged in:</p>
<p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0"><span class="error">[Thu Mar 30 18:08:36.648732 2017]</span> <span class="error">[mod_shib:debug]</span> <span class="error">[pid 4851]</span> mod_shib.cpp(810): <span class="error">[client 147.162.xxx.xxx:59147]</span> shib_handler skipped since check_user ran, referer: <a href="http://xxx.unipd.it:8000/cors.html" class="external-link" rel="nofollow" style="color: #3b73af; text-decoration: none">http://xxx.unipd.it:8000/cors.html</a><br /> <span class="error">[Thu Mar 30 18:08:36.648846 2017]</span> <span class="error">[headers:debug]</span> <span class="error">[pid 4851]</span> mod_headers.c(823): AH01502: headers: ap_headers_output_filter()<br /> <span class="error">[Thu Mar 30 18:08:36.648880 2017]</span> <span class="error">[http:trace3]</span> <span class="error">[pid 4851]</span> http_filters.c(1006): <span class="error">[client 147.162.xxx.xxx:59147]</span> Response sent with status 200, headers:, referer: <a href="http://xxx.unipd.it:8000/cors.html" class="external-link" rel="nofollow" style="color: #3b73af; text-decoration: none">http://xxx.unipd.it:8000/cors.html</a></p>
<p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0">This is the apache log (trace 8) for a shib-auth protected resource if I'm NOT logged in:</p>
<p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0"><span class="error">[Thu Mar 30 17:12:44.121806 2017]</span> <span class="error">[core:trace3]</span> <span class="error">[pid 7250]</span> request.c(119): <span class="error">[client 147.162.xxx.xxx:54562]</span> auth phase 'check user' gave status -2: /auth-shib/edifici, referer: <a href="http://xxx.unipd.it:8000/cors.html" class="external-link" rel="nofollow" style="color: #3b73af; text-decoration: none">http://xxx.unipd.it:8000/cors.html</a><br /> <span class="error">[Thu Mar 30 17:12:44.121908 2017]</span> <span class="error">[http:trace3]</span> <span class="error">[pid 7250]</span> http_filters.c(1006): <span class="error">[client 147.162.199.31:54562]</span> Response sent with status 200, headers:, referer: <a href="http://xxx.unipd.it:8000/cors.html" class="external-link" rel="nofollow" style="color: #3b73af; text-decoration: none">http://xxx.unipd.it:8000/cors.html</a></p>
<p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0">In this last case the mod_headers is not called.<br /> Anyway if I set the header on the reverse proxy everything work.</p>
<p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0">Regards.</p>
</td>
</tr>
</table>
</td>
</tr>
<tr>
<td class="email-content-main mobile-expand " style="padding: 0px; border-collapse: collapse; border-left: 1px solid #ccc; border-right: 1px solid #ccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #fff">
<table id="actions-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 1px">
<tr>
<td id="actions-pattern-container" valign="middle" style="padding: 0px; border-collapse: collapse; padding: 10px 0 10px 24px; vertical-align: middle; padding-left: 0">
<table align="left" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tr>
<td class="actions-pattern-action-icon-container" style="padding: 0px; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 0px; vertical-align: middle"> <a href="https://issues.shibboleth.net/jira/browse/SSPCPP-732#add-comment" target="_blank" title="Add Comment" style="color: #3b73af; text-decoration: none"> <img class="actions-pattern-action-icon-image" src="cid:jira-generated-image-static-comment-icon-1fc10bc4-5e1f-4d1e-b147-f8fc1d6ab380" alt="Add Comment" title="Add Comment" height="16" width="16" border="0" style="vertical-align: middle" /> </a>
</td>
<td class="actions-pattern-action-text-container" style="padding: 0px; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 4px; padding-left: 5px"> <a href="https://issues.shibboleth.net/jira/browse/SSPCPP-732#add-comment" target="_blank" title="Add Comment" style="color: #3b73af; text-decoration: none">Add Comment</a>
</td>
</tr>
</table>
</td>
</tr>
</table>
</td>
</tr>
<!-- there needs to be content in the cell for it to render in some clients -->
<tr>
<td class="email-content-rounded-bottom mobile-expand" style="padding: 0px; border-collapse: collapse; color: #fff; padding: 0 15px 0 16px; height: 5px; line-height: 5px; background-color: #fff; border-top: 0; border-left: 1px solid #ccc; border-bottom: 1px solid #ccc; border-right: 1px solid #ccc; border-bottom-right-radius: 5px; border-bottom-left-radius: 5px; mso-line-height-rule: exactly">
</td>
</tr>
</table>
</td>
</tr>
<tr>
<td id="footer-pattern" style="padding: 0px; border-collapse: collapse; padding: 12px 20px">
<table id="footer-pattern-container" cellspacing="0" cellpadding="0" border="0" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tr>
<td id="footer-pattern-text" class="mobile-resize-text" width="100%" style="padding: 0px; border-collapse: collapse; color: #999; font-size: 12px; line-height: 18px; font-family: Arial, sans-serif; mso-line-height-rule: exactly; mso-text-raise: 2px">
This message was sent by Atlassian JIRA <span id="footer-build-information">(v7.0.10#70120-<span title="37e3d7a6fc4d580639533e7f7c232c925e554a6a" data-commit-id="37e3d7a6fc4d580639533e7f7c232c925e554a6a}">sha1:37e3d7a</span>)</span>
</td>
<td id="footer-pattern-logo-desktop-container" valign="top" style="padding: 0px; border-collapse: collapse; padding-left: 20px; vertical-align: top">
<table style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tr>
<td id="footer-pattern-logo-desktop-padding" style="padding: 0px; border-collapse: collapse; padding-top: 3px"> <img id="footer-pattern-logo-desktop" src="cid:jira-generated-image-static-footer-desktop-logo-a6270272-ac5a-4011-81fc-35f264471fae" alt="Atlassian logo" title="Atlassian logo" width="169" height="36" class="image_fix" />
</td>
</tr>
</table>
</td>
</tr>
</table>
</td>
</tr>
</table>
</body>
</html>