Apache set headers for /Shibboleth.sso

[Peter Schober]

* Mundry, Marvin <Marvin.Mundry at uni-hamburg.de> [2019-01-23 13:18]:
> when my javascript application on
> https://webapp.example.edu
> makes an xhr request to
> https://data.example.edu/webservice
> it gets redirected to
> https://data.example.edu/Shibboleth.sso/Login?target=https://data.example.edu/webservice

Then you probably shouldn't configure the webserver at
https://data.example.edu/webservice to do that.

I've never seen that contributed "howto" you mentioned, but it
explicitly states that the requested protected resource must be using
the HTTP POST binding for SSO requests to the IDP, and your server
clearly isn't.

-peter