Custom Headers on SP responses

[Cantor, Scott]

> I'm still trying to set custom Headers (CORS Headers to be precisely) on SP
> responses. I'm trying to set headers on apache 2.4 with the <Location "/">
> directive. So basically every response from this server should get my custom
> Headers attached. This works fine for every request except when mod_shib
> intercepts the requests.

mod_shib intercepts every request, more or less. Any protected resource is quite explicitly being intercepted by the module. I think you mean it works unless mod_shib generates the response.

> After login for example I can access shibboleth protected resources and the
> headers are always there. If I access /Shibboleth.sso/Session, no headers are
> attached (the same for every other SP Endpoint). Is this behavior on
> purpose? I believe it shouldn't be like this, should it?

The handlers are, well, handlers. They're being handled in terms of response generation from within the module. If the headers aren't set, it's probably because mod_headers isn't running first. I believe I mentioned that Apache has no (working) support for controlling module order.

-- Scott