Javascript ECP access and CORS issues

[Cantor, Scott]

> I was thinking that maybe the shibboleth apache module was stripping off
> headers or something like that. But I take your response as an answer that
> this isn't the case.

No, certainly not that I'm aware, unless it's in a header being used for other things and it's stomping on that because it needs to set one itself. Module ordering in Apache is also undefined, so that makes some things impossible too.

> So you mean establishing a session via OAuth and then access the shibboleth
> protected resource with the session cookie? Is such an interoperability
> possible?

No, I'm saying they either reject SAML outright, or they rely on the overall session with the browser to secure anything happening inside it rather than trying to secure service calls inside it.

-- Scott