Apache set headers for /Shibboleth.sso

[Mundry, Marvin]

I would like to make a cross domain request to a shibboleth protected resource. I have tried following this guide
https://wiki.shibboleth.net/confluence/display/IDP30/Cross-origin+AJAX+requests+for+Shib-protected+resources
which does not work for me.

when my javascript application on
https://webapp.example.edu
makes an xhr request to
https://data.example.edu/webservice
it gets redirected to
https://data.example.edu/Shibboleth.sso/Login?target=https://data.example.edu/webservice

this url cannot be accessed by the browser due to missing CORS headers.


Unfortunately I cannot set Access-Control-Allow-Origin & Access-Control-Allow-Credentials headers using apache for the /Shibboleth.sso location.

<Location /Shibboleth.sso>
SetHandler shib
Header always set Access-Control-Allow-Origin webapp.example.edu
</Location>
The Header statement does not have any effect when SetHandler shib is set.

How can I set Headers for /Shibboleth.sso?

--

Best regards,

Marvin Mundry