title: CORS Issue with AJAX redirect to SAML 2.0 Identity Provider
body: <p>I have an Angular web application that I'm hosting on an Apache web server that's configured with the <a href="https://github.com/UNINETT/mod_auth_mellon" rel="nofollow noreferrer">mod_auth_mellon</a> module. With mod_auth_mellon, my Apache server acts as a Service Provider with a SAML 2.0 Identity Provider (iDP), for which I have an established Relying Party Trust.</p>
  
  <p>Once authenticated, the web application will fire off an AJAX call in the background every minute. This call goes through a reverse proxy that I've set up on the Apache server.</p>
  
  <p><strong>The typical browser flow:</strong> Once the Apache mellon session (MellonSessionLength) expires, any request going through Apache will redirect back to the SAML iDP to re-negotate. Assuming I'm still authenticated with the iDP, mellon will establish a new session and automatically redirect me back to my original destination. Normally, this re-negotiation is an extra request or two that happens seamlessly behind the scenes.</p>
  
  <p><strong>The problem:</strong> The mellon session will typically expire when my background AJAX request is firing, which redirects that request back to the iDP. On the AJAX request back to the iDP, the browser is giving a CORS error and the response includes a generic log-in page (rather than my redirect destination). My (Apache) requests should appear to originate from the same domain as the iDP, but not the same subdomain (but, in reality, they are two different servers): <em>(mywebapp.mydomain.com vs. idp.mydomain.com)</em>. If I simply copy the request URL into the browser bar manually, the re-negotiation happens without a problem.</p>
  
  <p><strong>Question #1:</strong> As far as I can tell, it's the browser that's blocking this request. Is this an Apache configuration issue? </p>
  
  <p><strong>Question #2:</strong> If I can fix the CORS issue, will the JavaScript be able to successfully interpret the response from the iDP such that mellon establishes a new session? I've been reading some articles that give me some pause - some people talk about potentially having to embed a hidden iFrame on the page to handle the iDP response prior to redirecting to the destination URL. </p>