151 lines
4.6 KiB
YAML
151 lines
4.6 KiB
YAML
#
|
|
# Connector overrides for the internal Sunet test deployment
|
|
#
|
|
---
|
|
spring:
|
|
ssl:
|
|
bundle:
|
|
pem:
|
|
connector-web-server:
|
|
keystore:
|
|
certificate: file:${CONNECTOR_DIRECTORY}/credentials/tomcat/tomcat-cert.pem
|
|
private-key: file:${CONNECTOR_DIRECTORY}/credentials/tomcat/tomcat-key.pem
|
|
sunet-tls-trust:
|
|
truststore:
|
|
certificate: file:/etc/ssl/certs/infra.crt
|
|
|
|
server:
|
|
port: 8443
|
|
servlet:
|
|
context-path: /idp
|
|
ssl:
|
|
enabled: true
|
|
bundle: connector-web-server
|
|
error:
|
|
include-stacktrace: never
|
|
|
|
management:
|
|
server:
|
|
port: 8444
|
|
health:
|
|
redis:
|
|
enabled: false
|
|
|
|
credential:
|
|
bundles:
|
|
keystore:
|
|
pkcs11-store:
|
|
type: PKCS11
|
|
provider: SunPKCS11
|
|
password: ${PKCS11_PIN}
|
|
pkcs11:
|
|
configuration-file: ${CONNECTOR_DIRECTORY}/credentials/pkcs11.cfg
|
|
jks:
|
|
connector-sign:
|
|
name: "Connector Signing Credential"
|
|
store-reference: pkcs11-store
|
|
key:
|
|
certificates: file:${CONNECTOR_DIRECTORY}/credentials/sign.crt
|
|
# The alias should be the name of the CKA_LABEL attribute
|
|
alias: sc_eidas_sign
|
|
key-password: ${PKCS11_PIN}
|
|
monitor: true
|
|
connector-encrypt:
|
|
name: "Connector Encryption Credential"
|
|
store-reference: pkcs11-store
|
|
key:
|
|
# certificates: file:${CONNECTOR_DIRECTORY}/credentials/enc.crt
|
|
# The alias should be the name of the CKA_LABEL attribute
|
|
alias: sc_eidas_encrypt
|
|
key-password: ${PKCS11_PIN}
|
|
monitor: true
|
|
connector-hsm-md-sign:
|
|
name: "Connector HSM Metadata Signing Credential"
|
|
store-reference: pkcs11-store
|
|
key:
|
|
certificates: file:${CONNECTOR_DIRECTORY}/credentials/sctest2.crt
|
|
alias: sctest2
|
|
key-password: ${PKCS11_PIN}
|
|
monitor: true
|
|
#pem:
|
|
#oauth2:
|
|
# TODO: Fix certs
|
|
#name: "Connector OAuth2 Credential"
|
|
#certificates: file:${CONNECTOR_DIRECTORY}/credentials/oauth2.crt
|
|
# private-key: file:${CONNECTOR_DIRECTORY}/credentials/oauth2.key
|
|
monitoring:
|
|
enabled: true
|
|
test-interval: 10m
|
|
health-endpoint-enabled: true
|
|
|
|
connector:
|
|
domain: test.connector.eidas.swedenconnect.se
|
|
base-url: https://${connector.domain}${server.servlet.context-path}
|
|
backup-directory: ${CONNECTOR_DIRECTORY}/backup
|
|
eu-metadata:
|
|
location: https://test.md.eidas.swedenconnect.se/role/idp.xml
|
|
validation-certificate: file:${CONNECTOR_DIRECTORY}/credentials/sctest2.crt
|
|
eidas:
|
|
credentials:
|
|
# Use same as for IdP except for the metadata signing credential
|
|
metadata-sign:
|
|
pem:
|
|
name: "Credential Metadata Signing"
|
|
certificates: file:${CONNECTOR_DIRECTORY}/credentials/sctest2.crt
|
|
private-key: file:${CONNECTOR_DIRECTORY}/credentials/sctest2.key
|
|
prid:
|
|
policy-resource: file:${CONNECTOR_DIRECTORY}/prid/policy.properties
|
|
idp:
|
|
ping-whitelist:
|
|
- https://test.test.swedenconnect.se/sp
|
|
# idm:
|
|
# TODO: Change to true when IdM integration should be turned on
|
|
# active: false
|
|
# api-base-url: https://test.idm.eidas.swedenconnect.se/idm
|
|
#service-url: https://test.idm.eidas.swedenconnect.se/idm
|
|
#oauth2:
|
|
# resource-id: https://test.idm.eidas.swedenconnect.se/idm
|
|
# client-id: ${saml.idp.entity-id}
|
|
# check-scopes:
|
|
# - ${connector.idm.oauth2.resource-id}/idrecord_check
|
|
# get-scopes:
|
|
# - ${connector.idm.oauth2.resource-id}/idrecord_get
|
|
# server:
|
|
# issuer: ${saml.idp.entity-id}/as
|
|
# credential:
|
|
# bundle: oauth2
|
|
|
|
saml:
|
|
idp:
|
|
entity-id: https://test.connector.eidas.swedenconnect.se/eidas
|
|
base-url: ${connector.base-url}
|
|
session:
|
|
module: memory
|
|
replay:
|
|
type: memory
|
|
context: "connector-replay-cache"
|
|
metadata-providers:
|
|
- location: https://test.md.swedenconnect.se/role/sp.xml
|
|
backup-location: ${connector.backup-directory}/metadata/sc-cache.xml
|
|
validation-certificate: file:${CONNECTOR_DIRECTORY}/credentials/sctest2.crt
|
|
credentials:
|
|
# Use same as for IdP except for the metadata signing credential
|
|
sign:
|
|
bundle: connector-sign
|
|
encrypt:
|
|
bundle: connector-encrypt
|
|
metadata-sign:
|
|
bundle: connector-hsm-md-sign
|
|
#future-sign: file:${CONNECTOR_DIRECTORY}/credentials/idp-signing.crt
|
|
audit:
|
|
in-memory:
|
|
capacity: 1000
|
|
file:
|
|
log-file: ${CONNECTOR_DIRECTORY}/logs/audit.log
|
|
|
|
logging:
|
|
level:
|
|
se:
|
|
swedenconnect:
|
|
opensaml: DEBUG
|
|
eidas: INFO
|