00-comanage-443.conf

# Licensed to the University Corporation for Advanced Internet Development,
# Inc. (UCAID) under one or more contributor license agreements.  See the
# NOTICE file distributed with this work for additional information regarding
# copyright ownership. The UCAID licenses this file to You under the Apache
# License, Version 2.0 (the "License"); you may not use this file except in
# compliance with the License.  You may obtain a copy of the License at
#
#    http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
<VirtualHost _default_:443>
ServerName https://localhost:443
UseCanonicalName On
Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%h %l %u %t \"%r\" %>s %b" common
CustomLog logs/ssl_request_log  "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"

ErrorLog logs/ssl_error_log
TransferLog logs/ssl_access_log
LogLevel warn

SSLEngine on
SSLProtocol all -SSLv2 -SSLv3
SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
SSLHonorCipherOrder on
SSLCompression off
SSLCertificateFile /opt/httpd/ssl/server.crt
SSLCertificateKeyFile /opt/httpd/ssl/server.key

# Optional parameter that will only be uncommented on initialization
# if the file exists:
#SSLCertificateChainFile CHANGE_TO_SSL_HTTPD_CHAIN

BrowserMatch "MSIE [2-5]" \
         nokeepalive ssl-unclean-shutdown \
         downgrade-1.0 force-response-1.0


<Directory />
    AllowOverride none
    Require all denied
</Directory>

DocumentRoot "/var/www/html"

<Directory "/var/www">
    AllowOverride None
    Require all granted
</Directory>

<Directory "/var/www/html">
    Options Indexes FollowSymLinks
    AllowOverride None
    Require all granted
</Directory>

<Directory "/var/www/html/registry">
    Options Indexes FollowSymLinks MultiViews
    DirectoryIndex index.php
    AllowOverride All
    Require all granted
</Directory>

ShibCompatValidUser Off
<Location "/Shibboleth.sso">
  AuthType None
  Require all granted
</Location>

<Location "/shibboleth-sp">
  AuthType None
  Require all granted
</Location>
Alias /shibboleth-sp/main.css /usr/share/shibboleth/main.css

<Directory "/var/www/html/registry/auth/login">
  AuthType shibboleth
  ShibRequestSetting requireSession 1
  Require shib-session
</Directory>

Redirect "/registry/users/logout" "https://localhost/Shibboleth.sso/Logout?return=https%3A//localhost/registry/"

<FilesMatch \.php$>
    SetHandler application/x-httpd-php
</FilesMatch>

<Files ".ht*">
    Require all denied
</Files>

</VirtualHost>