Javascript ECP access and CORS issues

[Kevin Flückiger]

Hi there

I'm trying to access a shibboleth protected resource via the ECP Profile with Javascript. I can actually issue the request to the Service Provider and do get back the AuthnRequest as PAOS payload. The problem: The response from the SP has no CORS headers even though I configured apache to set them on every response via the following config.
<Location />
        SetEnvIfNoCase Origin (.+) HTTP_ORIGIN=$1
        Header always set Access-Control-Allow-Origin "%{HTTP_ORIGIN}e" env=HTTP_ORIGIN
        Header always set Access-Control-Allow-Credentials true
        Header always set Access-Control-Allow-Methods "POST, GET, OPTIONS, DELETE, PUT"
        Header always set Access-Control-Max-Age "1000"
        Header always set Access-Control-Allow-Headers "x-requested-with, Content-Type, origin, authorization, accept, client-security-token, PAOS"
</Location>
This seems to work for every other request, except the one where I set the Headers needed for the ECP request.
I'm on apache 2.4.7, SP is 2.5.5
Has someone seen the same behaviour? Do I need to specify something, except from enabling the ECP profile, in the SP for this to work?
I'm really out of ideas how to get the server to send those CORS headers, so any ideas welcome.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160229/d4c62f3b/attachment.html>