Development of javascript based SAML ECP client

[Nick Weedon]

Dear Shibboleth dev,

I have written a Javascript ECP profile client library as a Bower module 
(currently in my private bower registry) and at some point I plan to 
publish this as a public open source javascript library (available 
through Bower's public registry) along with a tutorial that covers 
installing and setting up the Shibboleth 3 IdP and then hooking it up to 
spring-security-saml, which is what I have done.

The Javascript ECP library I have written is fully functional (just 
basic password auth atm) but currently only so long as the IdP server 
provides CORS headers.
I see a problem with using CORS in so far as that it is not part of the 
SAML ECP specification and so one cannot expect such a client to be 
fully inter-operable with other IdPs.

I have been bashing my head against a wall trying to think of a way to 
implement ECP profile via javascript without violating the SAML spec. I 
don't see any way to do this using cross origin hacks (e.g. JSONP, 
iframe posting, image data hack etc) because AFAIK all of these methods 
either involve modifying the server code (and violating the spec) or are 
not capable of communicating the required HTTP headers.

The only other option I have found involves mapping (via mod_rewrite or 
some similar means) a reverse proxy to the origin domain of the script 
or perhaps to implement some kind of 'CORS friendly' generic proxy. This 
at least means that the IdP setup does not have to know about CORS. 
Still, not ideal however due to the special/significant setup work involved.

Perhaps there really are no better options but I thought i would ask 
since I see in the shibboleth wiki that there is some discussion on the 
possible implementation of a javascript client.

I am wondering, have any of you had any thoughts about a 
clean/inter-operable way to solve the browser based ECP cross domain issue?

NB: In case any of you are curious, the ECP javascript client is going 
well and my next step will be to add functionality to allow it to 
seamlessly hook into existing ajax calls on a page, thereby firing a 
'auth required' when a password is needed but otherwise transparently 
authenticating with the IdP when the user is 'Signed On'.

Regards,
Nick Weedon (http://www.weedon.org.au)