119 lines
5.5 KiB
XML
119 lines
5.5 KiB
XML
<SPConfig xmlns="urn:mace:shibboleth:3.0:native:sp:config"
|
|
xmlns:conf="urn:mace:shibboleth:3.0:native:sp:config"
|
|
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
|
|
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
|
|
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
|
|
clockSkew="180">
|
|
|
|
<!--
|
|
By default, in-memory StorageService, ReplayCache, ArtifactMap, and SessionCache
|
|
are used. See example-shibboleth2.xml for samples of explicitly configuring them.
|
|
-->
|
|
|
|
<!-- The ApplicationDefaults element is where most of Shibboleth's SAML bits are defined. -->
|
|
<ApplicationDefaults entityID="https://monitor-dev.cert.sunet.se"
|
|
REMOTE_USER="eppn subject-id"
|
|
metadataAttributePrefix="Meta-">
|
|
|
|
<!--
|
|
Controls session lifetimes, address checks, cookie handling, and the protocol handlers.
|
|
You MUST supply an effectively unique handlerURL value for each of your applications.
|
|
The value defaults to /Shibboleth.sso, and should be a relative path, with the SP computing
|
|
a relative value based on the virtual host. Using handlerSSL="true", the default, will force
|
|
the protocol to be https. You should also set cookieProps to "https" for SSL-only sites.
|
|
Note that while we default checkAddress to "false", this has a negative impact on the
|
|
security of your site. Stealing sessions via cookie theft is much easier with this disabled.
|
|
-->
|
|
<Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
|
|
checkAddress="false" handlerSSL="true" cookieProps="https">
|
|
|
|
<!--
|
|
Configures SSO for a default IdP. To allow for >1 IdP, remove
|
|
entityID property and adjust discoveryURL to point to discovery service.
|
|
If you use this, you have to remove the SessionInitiator below.
|
|
<SSO entityID="https://swamididp.example.org
|
|
discoveryProtocol="SAMLDS" discoveryURL="https://ds.example.org/DS/WAYF">
|
|
SAML2 SAML1
|
|
</SSO>
|
|
-->
|
|
|
|
<!-- SAML and local-only logout. -->
|
|
|
|
<Logout>SAML2 Local</Logout>
|
|
<SessionInitiator type="Chaining" Location="/satosa" id="satosa"
|
|
entityID="https://test-sso-proxy.cert.sunet.se/idp">
|
|
<SessionInitiator type="SAML2" template="bindingTemplate.html"/>
|
|
</SessionInitiator>
|
|
|
|
<!--
|
|
md:AssertionConsumerService locations handle specific SSO protocol bindings,
|
|
such as SAML 2.0 POST or SAML 1.1 Artifact. The isDefault and index attributes
|
|
are used when sessions are initiated to determine how to tell the IdP where and
|
|
how to return the response.
|
|
-->
|
|
<md:AssertionConsumerService Location="/SAML2/POST" index="1"
|
|
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
|
|
conf:ignoreNoPassive="true"/>
|
|
|
|
<!-- Extension service that generates "approximate" metadata based on SP configuration. -->
|
|
<Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>
|
|
|
|
<!-- Status reporting service. -->
|
|
<Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>
|
|
|
|
<!-- Session diagnostic service. -->
|
|
<Handler type="Session" Location="/Session" showAttributeValues="false"/>
|
|
|
|
<!-- JSON feed of discovery information. -->
|
|
<Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
|
|
|
|
<!--
|
|
md:ArtifactResolutionService locations resolve artifacts issued when using the
|
|
SAML 2.0 HTTP-Artifact binding on outgoing messages, generally uses SOAP.
|
|
-->
|
|
<md:ArtifactResolutionService Location="/Artifact/SOAP" index="1"
|
|
Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"/>
|
|
|
|
</Sessions>
|
|
|
|
<!--
|
|
Allows overriding of error template information/filenames. You can
|
|
also add attributes with values that can be plugged into the templates.
|
|
-->
|
|
<Errors supportContact="cert@cert.sunet.se"
|
|
helpLocation="/about.html"
|
|
styleSheet="/shibboleth-sp/main.css"/>
|
|
|
|
<!-- Example of remotely supplied batch of signed metadata. -->
|
|
|
|
<!-- SWAMID Metadata -->
|
|
<MetadataProvider
|
|
type="XML"
|
|
path="frontend.xml"/>
|
|
|
|
<!-- Example of locally maintained metadata. -->
|
|
<!--
|
|
<MetadataProvider type="XML" file="partner-metadata.xml"/>
|
|
-->
|
|
|
|
<!-- Map to extract attributes from SAML assertions. -->
|
|
<AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/>
|
|
|
|
<!-- Use a SAML query if no attributes are supplied during SSO. -->
|
|
<AttributeResolver type="Query" subjectMatch="true"/>
|
|
|
|
<!-- Default filtering policy for recognized attributes, lets other data pass. -->
|
|
<AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>
|
|
|
|
<!-- Simple file-based resolver for using a single keypair. -->
|
|
<CredentialResolver type="File" key="certs/sp-key.pem" certificate="certs/sp-cert.pem"/>
|
|
|
|
</ApplicationDefaults>
|
|
|
|
<!-- Policies that determine how to process and authenticate runtime messages. -->
|
|
<SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/>
|
|
|
|
<!-- Low-level configuration about protocols and bindings available for use. -->
|
|
<ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/>
|
|
|
|
</SPConfig>
|