Shib SP to IDP missing header for CORS

[Allan West]

I suspect I'm missing something obvious, but I'm unsuccessfully trying
to get two shibboleth-protected sites to play nicely together with a
cross site scripting call. We've got the sites setting cookies for:
    "SameSite=None; Secure"

to make Chrome happy, and when we look at pages on the sites directly we
get headers including:
    Access-Control-Allow-Origin: https://ir.aa.ufl.edu

However, when we start on the site:
    https://ir.aa.ufl.edu

and call the other site's data, the trace shows:
    CORS Missing Allow Origin

on the 302 Redirect from the other site to our IdP.

How do we assert headers into the apache shibboleth redirect? We're
running SP 3.1.0, which I believe is latest. On the shibboleth site I
found a page about CORS headers that refers to the IdP, and which is
documented as known not to work. There was an email thread in January,
2019, in which Scott stated:
 
> That would be an Apache question. The SP adds its own headers at times
but it doesn't remove any, which I've tested plenty of times.
 
I am definitely seeing an absence of headers in the SP to IdP redirect
that exist in other pages returned from that site.

Maybe it's just poor Google-fu on my part; if someone can tell me what
search terms to use, I'll go search some more next week.

Thanks,
Allan West
UFIT linux system administrator
allan at ufl.edu