<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">My guide to doing this (which others
have reported issues with, though we did have it working at one
point in the past) is here:</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix"><a class="moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/IDP30/Cross-origin+AJAX+requests+for+Shib-protected+resources">https://wiki.shibboleth.net/confluence/display/IDP30/Cross-origin+AJAX+requests+for+Shib-protected+resources</a><br>
</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">I've tried to call out why the various
parts are needed. In this case: <br>
</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">If the shib-protected site is using
HTTP-Redirect, it won't work because XmlHttpRequest follows them
and does not propagate the necessary headers. You need to force
HTTP-POST instead; for the Shib SP, you can do this:</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">
<div class="container" title="Hint: double-click to select code">
<div class="line number1 index0 alt2"><code class="xml plain"><</code><code
class="xml keyword">SSO</code> <code class="xml color1">entityID</code><code
class="xml plain">=</code><code class="xml string">"<a
href="https://idp.example.edu/idp/shibboleth">https://idp.example.edu/idp/shibboleth</a>"</code>
<code class="xml color1">outgoingBindings</code><code
class="xml plain">=</code><code class="xml string">"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"</code><code
class="xml plain">></code></div>
<div class="line number2 index1 alt1"><code class="xml spaces"> </code><code
class="xml plain">SAML2</code></div>
<div class="line number3 index2 alt2"><code class="xml plain"></</code><code
class="xml keyword">SSO</code><code class="xml plain">></code></div>
</div>
</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">On 8/18/2020 12:46 PM, Allan West
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:59197d40-9dc3-09eb-3012-d668db186a17@ufl.edu">
<pre class="moz-quote-pre" wrap="">I need some advice on current, working practices to allow calls from
another site into a shibboleth-protected site. We are getting CORS
errors in the browsers for AJAX calls and other methods that try to call
content from a shibboleth protected site. These services worked until
recently, and now they do not, almost certainly because of increased
security settings in browsers.
What are others doing to allow CORS calls into shibboleth protected sites?
I had a separate thread, "Shib SP to IDP missing header for CORS" based
on my problems with trouble-shooting. I learned that headers can be set
and carried from the SP to the IdP. However, but those headers will
never be passed through the IdP, nor does the IdP seem happy with the
request to authenticate / validate the connection. In Firefox Inspector
traces, the shibboleth-protected site uses a 302 redirect to the IdP to
validate, and the IdP errors on CORS, causing both SP and IdP lines to show:
CORS Missing Allow Origin
That means we need to be allowing this access in some other way, but I
haven't found a good statement of practice on what anyone is doing right
now to allow CORS calls into a shibboleth protected site.
Thanks,
Allan West
UFIT linux system administrator
<a class="moz-txt-link-abbreviated" href="mailto:allan@ufl.edu">allan@ufl.edu</a>
</pre>
</blockquote>
<p><br>
</p>
<pre class="moz-signature" cols="72">--
%% Christopher A. Bongaarts %% <a class="moz-txt-link-abbreviated" href="mailto:cab@umn.edu">cab@umn.edu</a> %%
%% OIT - Identity Management %% <a class="moz-txt-link-freetext" href="http://umn.edu/~cab">http://umn.edu/~cab</a> %%
%% University of Minnesota %% +1 (612) 625-1809 %%
</pre>
</body>
</html>