AW: Javascript ECP access and CORS issues

[Kevin Flückiger]

Me again

So no ideas about this? I'm really stuck on this..
Isn't it quite common to do programmatical logins with shibboleth? How would this be done otherwise?

Thanks,
Kevin

Von: users [mailto:users-bounces at shibboleth.net] Im Auftrag von Kevin Flückiger
Gesendet: Montag, 29. Februar 2016 11:44
An: Shib Users <users at shibboleth.net>
Betreff: Javascript ECP access and CORS issues

Hi there

I'm trying to access a shibboleth protected resource via the ECP Profile with Javascript. I can actually issue the request to the Service Provider and do get back the AuthnRequest as PAOS payload. The problem: The response from the SP has no CORS headers even though I configured apache to set them on every response via the following config.
<Location />
        SetEnvIfNoCase Origin (.+) HTTP_ORIGIN=$1
        Header always set Access-Control-Allow-Origin "%{HTTP_ORIGIN}e" env=HTTP_ORIGIN
        Header always set Access-Control-Allow-Credentials true
        Header always set Access-Control-Allow-Methods "POST, GET, OPTIONS, DELETE, PUT"
        Header always set Access-Control-Max-Age "1000"
        Header always set Access-Control-Allow-Headers "x-requested-with, Content-Type, origin, authorization, accept, client-security-token, PAOS"
</Location>
This seems to work for every other request, except the one where I set the Headers needed for the ECP request.
I'm on apache 2.4.7, SP is 2.5.5
Has someone seen the same behaviour? Do I need to specify something, except from enabling the ECP profile, in the SP for this to work?
I'm really out of ideas how to get the server to send those CORS headers, so any ideas welcome.