From 238724047712ab245b8af29edb54b626df1a526e Mon Sep 17 00:00:00 2001 From: Pavol Mederly Date: Wed, 19 Sep 2018 23:31:29 +0200 Subject: [PATCH] Add demo Shibboleth containers These containers are used to demonstrate Shibboleth-based SSO capabilities of TIER midPoint Docker container. They are NOT to be used in "midPoint-Grouper" demo. --- .../shibboleth/idp-metadata.xml | 207 +++++++++++++ .../shibboleth/shibboleth2.xml | 136 ++++++++ .../shibboleth/sp-cert.pem | 20 ++ .../configs-and-secrets/shibboleth/sp-key.pem | 28 ++ demo/shibboleth/directory/Dockerfile | 30 ++ .../container_files/seed-data/ds-setup.inf | 28 ++ .../container_files/seed-data/users.ldif | 24 ++ demo/shibboleth/docker-compose.yml | 37 +++ demo/shibboleth/idp/Dockerfile | 5 + .../shibboleth-idp/conf/attribute-filter.xml | 29 ++ .../conf/attribute-resolver.xml | 293 ++++++++++++++++++ .../idp/shibboleth-idp/conf/idp.properties | 195 ++++++++++++ .../idp/shibboleth-idp/conf/ldap.properties | 58 ++++ .../conf/metadata-providers.xml | 80 +++++ .../credentials/idp-backchannel.crt | 19 ++ .../credentials/idp-backchannel.p12 | Bin 0 -> 2500 bytes .../credentials/idp-browser.p12 | Bin 0 -> 2470 bytes .../credentials/idp-encryption.crt | 19 ++ .../credentials/idp-encryption.key | 27 ++ .../credentials/idp-signing.crt | 19 ++ .../credentials/idp-signing.key | 27 ++ .../idp/shibboleth-idp/credentials/sealer.jks | Bin 0 -> 500 bytes .../shibboleth-idp/credentials/sealer.kver | 2 + .../shibboleth-idp/metadata/idp-metadata.xml | 207 +++++++++++++ .../shibboleth-idp/metadata/midpoint-sp.xml | 80 +++++ 25 files changed, 1570 insertions(+) create mode 100644 demo/shibboleth/configs-and-secrets/shibboleth/idp-metadata.xml create mode 100644 demo/shibboleth/configs-and-secrets/shibboleth/shibboleth2.xml create mode 100644 demo/shibboleth/configs-and-secrets/shibboleth/sp-cert.pem create mode 100644 demo/shibboleth/configs-and-secrets/shibboleth/sp-key.pem create mode 100644 demo/shibboleth/directory/Dockerfile create mode 100644 demo/shibboleth/directory/container_files/seed-data/ds-setup.inf create mode 100644 demo/shibboleth/directory/container_files/seed-data/users.ldif create mode 100644 demo/shibboleth/docker-compose.yml create mode 100644 demo/shibboleth/idp/Dockerfile create mode 100644 demo/shibboleth/idp/shibboleth-idp/conf/attribute-filter.xml create mode 100644 demo/shibboleth/idp/shibboleth-idp/conf/attribute-resolver.xml create mode 100644 demo/shibboleth/idp/shibboleth-idp/conf/idp.properties create mode 100644 demo/shibboleth/idp/shibboleth-idp/conf/ldap.properties create mode 100644 demo/shibboleth/idp/shibboleth-idp/conf/metadata-providers.xml create mode 100644 demo/shibboleth/idp/shibboleth-idp/credentials/idp-backchannel.crt create mode 100644 demo/shibboleth/idp/shibboleth-idp/credentials/idp-backchannel.p12 create mode 100644 demo/shibboleth/idp/shibboleth-idp/credentials/idp-browser.p12 create mode 100644 demo/shibboleth/idp/shibboleth-idp/credentials/idp-encryption.crt create mode 100644 demo/shibboleth/idp/shibboleth-idp/credentials/idp-encryption.key create mode 100644 demo/shibboleth/idp/shibboleth-idp/credentials/idp-signing.crt create mode 100644 demo/shibboleth/idp/shibboleth-idp/credentials/idp-signing.key create mode 100644 demo/shibboleth/idp/shibboleth-idp/credentials/sealer.jks create mode 100644 demo/shibboleth/idp/shibboleth-idp/credentials/sealer.kver create mode 100644 demo/shibboleth/idp/shibboleth-idp/metadata/idp-metadata.xml create mode 100644 demo/shibboleth/idp/shibboleth-idp/metadata/midpoint-sp.xml diff --git a/demo/shibboleth/configs-and-secrets/shibboleth/idp-metadata.xml b/demo/shibboleth/configs-and-secrets/shibboleth/idp-metadata.xml new file mode 100644 index 0000000..35914b7 --- /dev/null +++ b/demo/shibboleth/configs-and-secrets/shibboleth/idp-metadata.xml @@ -0,0 +1,207 @@ + + + + + + + + example.org + + + + + + + +MIIDEzCCAfugAwIBAgIUS9SuTXwsFVVG+LjOEAbLqqT/el0wDQYJKoZIhvcNAQEL +BQAwFTETMBEGA1UEAwwKaWRwdGVzdGJlZDAeFw0xNTEyMTEwMjIwMjZaFw0zNTEy +MTEwMjIwMjZaMBUxEzARBgNVBAMMCmlkcHRlc3RiZWQwggEiMA0GCSqGSIb3DQEB +AQUAA4IBDwAwggEKAoIBAQCMAoDHx8xCIfv/6QKqt9mcHYmEJ8y2dKprUbpdcOjH +YvNPIl/lHPsUyrb+Nc+q2CDeiWjVk1mWYq0UpIwpBMuw1H6+oOqr4VQRi65pin0M +SfE0MWIaFo5FPvpvoptkHD4gvREbm4swyXGMczcMRfqgalFXhUD2wz8W3XAM5Cq2 +03XeJbj6TwjvKatG5XPdeUe2FBGuOO2q54L1hcIGnLMCQrg7D31lR13PJbjnJ0No +5C3k8TPuny6vJsBC03GNLNKfmrKVTdzr3VKp1uay1G3DL9314fgmbl8HA5iRQmy+ +XInUU6/8NXZSF59p3ITAOvZQeZsbJjg5gGDip5OZo9YlAgMBAAGjWzBZMB0GA1Ud +DgQWBBRPlM4VkKZ0U4ec9GrIhFQl0hNbLDA4BgNVHREEMTAvggppZHB0ZXN0YmVk +hiFodHRwczovL2lkcHRlc3RiZWQvaWRwL3NoaWJib2xldGgwDQYJKoZIhvcNAQEL +BQADggEBAIZ0a1ov3my3ljJG588I/PHx+TxAWONWmpKbO9c/qI3Drxk4oRIffiac +ANxdvtabgIzrlk5gMMisD7oyqHJiWgKv5Bgctd8w3IS3lLl7wHX65mTKQRXniG98 +NIjkvfrhe2eeJxecOqnDI8GOhIGCIqZUn8ShdM/yHjhQ2Mh0Hj3U0LlKvnmfGSQl +j0viGwbFCaNaIP3zc5UmCrdE5h8sWL3Fu7ILKM9RyFa2ILHrJScV9t623IcHffHP +IeaY/WtuapsrqRFxuQL9QFWN0FsRIdLmjTq+00+B/XnnKRKFBuWfjhHLF/uu8f+E +t6Lf23Kb8yD6ZR7dihMZAGHnYQ/hlhM= + + + + + + + + + +MIIDFDCCAfygAwIBAgIVAN3vv+b7KN5Se9m1RZsCllp/B/hdMA0GCSqGSIb3DQEB +CwUAMBUxEzARBgNVBAMMCmlkcHRlc3RiZWQwHhcNMTUxMjExMDIyMDE0WhcNMzUx +MjExMDIyMDE0WjAVMRMwEQYDVQQDDAppZHB0ZXN0YmVkMIIBIjANBgkqhkiG9w0B +AQEFAAOCAQ8AMIIBCgKCAQEAh91caeY0Q85uhaUyqFwP2bMjwMFxMzRlAoqBHd7g +u6eo4duaeLz1BaoR2XTBpNNvFR5oHH+TkKahVDGeH5+kcnIpxI8JPdsZml1srvf2 +Z6dzJsulJZUdpqnngycTkGtZgEoC1vmYVky2BSAIIifmdh6s0epbHnMGLsHzMKfJ +Cb/Q6dYzRWTCPtzE2VMuQqqWgeyMr7u14x/Vqr9RPEFsgY8GIu5jzB6AyUIwrLg+ +MNkv6aIdcHwxYTGL7ijfy6rSWrgBflQoYRYNEnseK0ZHgJahz4ovCag6wZAoPpBs +uYlY7lEr89Ucb6NHx3uqGMsXlDFdE4QwfDLLhCYHPvJ0uwIDAQABo1swWTAdBgNV +HQ4EFgQUAkOgED3iYdmvQEOMm6u/JmD/UTQwOAYDVR0RBDEwL4IKaWRwdGVzdGJl +ZIYhaHR0cHM6Ly9pZHB0ZXN0YmVkL2lkcC9zaGliYm9sZXRoMA0GCSqGSIb3DQEB +CwUAA4IBAQBIdd4YWlnvJjql8+zKKgmWgIY7U8DA8e6QcbAf8f8cdE33RSnjI63X +sv/y9GfmbAVAD6RIAXPFFeRYJ08GOxGI9axfNaKdlsklJ9bk4ducHqgCSWYVer3s +RQBjxyOfSTvk9YCJvdJVQRJLcCvxwKakFCsOSnV3t9OvN86Ak+fKPVB5j2fM/0fZ +Kqjn3iqgdNPTLXPsuJLJO5lITRiBa4onmVelAiCstI9PQiaEck+oAHnMTnC9JE/B +DHv3e4rwq3LznlqPw0GSd7xqNTdMDwNOWjkuOr3sGpWS8ms/ZHHXV1Vd22uPe70i +s00xrv14zLifcc8oj5DYzOhYRifRXgHX + + + + + + + + + +MIIDEzCCAfugAwIBAgIUG6Nn1rlERS1vsi88tcdzSYX0oqAwDQYJKoZIhvcNAQEL +BQAwFTETMBEGA1UEAwwKaWRwdGVzdGJlZDAeFw0xNTEyMTEwMjIwMTRaFw0zNTEy +MTEwMjIwMTRaMBUxEzARBgNVBAMMCmlkcHRlc3RiZWQwggEiMA0GCSqGSIb3DQEB +AQUAA4IBDwAwggEKAoIBAQCBXv0o3fmT8iluyLjJ4lBAVCW+ZRVyEXPYQuRi7vfD +cO4a6d1kxiJLsaK0W88VNxjFQRr8PgDkWr28vwoH1rgk4pLsszLD48DBzD942peJ +l/S6FnsIJjmaHcBh4pbNhU4yowu63iKkvttrcZAEbpEro6Z8CziWEx8sywoaYEQG +ifPkr9ORV6Cn3txq+9gMBePG41GrtZrUGIu+xrndL0Shh4Pq0eq/9MAsVlIIXEa8 +9WfH8J2kFcTOfoWtIc70b7TLZQsx4YnNcnrGLSUEcstFyPLX+Xtv5SNZF89OOIxX +VNjNvgE5DbJb9hMM4UAFqI+1bo9QqtxwThjc/sOvIxzNAgMBAAGjWzBZMB0GA1Ud +DgQWBBStTyogRPuAVG6q7yPyav1uvE+7pTA4BgNVHREEMTAvggppZHB0ZXN0YmVk +hiFodHRwczovL2lkcHRlc3RiZWQvaWRwL3NoaWJib2xldGgwDQYJKoZIhvcNAQEL +BQADggEBAFMfoOv+oISGjvamq7+Y4G7ep5vxlAPeK3RATYPYvAmyH946qZXh98ni +QXyuqZW5P5eEt86toY45IwDU5r09SKwHughEe99iiEkxh0mb2qo84qX9/qcg+kyN +jeLd/OSyolpUCEFNwOFcog7pj7Eer+6AHbwTn1Mjb5TBsKwtDMJsaxPvdj0u7M5r +xL/wHkFhn1rCo2QiojzjSlV3yLTh49iTyhE3cG+RxaNKDCxhp0jSSLX1BW/ZoPA8 ++PMJEA+Q0QbyRD8aJOHN5O8jGxCa/ZzcOnYVL6AsEXoDiY3vAUYh1FUonOWw0m9H +p+tGUbGS2l873J5PrsbpeKEVR/IIoKo= + + + + + + + urn:mace:shibboleth:1.0:nameIdentifier + urn:oasis:names:tc:SAML:2.0:nameid-format:transient + + + + + + + + + + + + + localhost + + + + + + +MIIDEzCCAfugAwIBAgIUS9SuTXwsFVVG+LjOEAbLqqT/el0wDQYJKoZIhvcNAQEL +BQAwFTETMBEGA1UEAwwKaWRwdGVzdGJlZDAeFw0xNTEyMTEwMjIwMjZaFw0zNTEy +MTEwMjIwMjZaMBUxEzARBgNVBAMMCmlkcHRlc3RiZWQwggEiMA0GCSqGSIb3DQEB +AQUAA4IBDwAwggEKAoIBAQCMAoDHx8xCIfv/6QKqt9mcHYmEJ8y2dKprUbpdcOjH +YvNPIl/lHPsUyrb+Nc+q2CDeiWjVk1mWYq0UpIwpBMuw1H6+oOqr4VQRi65pin0M +SfE0MWIaFo5FPvpvoptkHD4gvREbm4swyXGMczcMRfqgalFXhUD2wz8W3XAM5Cq2 +03XeJbj6TwjvKatG5XPdeUe2FBGuOO2q54L1hcIGnLMCQrg7D31lR13PJbjnJ0No +5C3k8TPuny6vJsBC03GNLNKfmrKVTdzr3VKp1uay1G3DL9314fgmbl8HA5iRQmy+ +XInUU6/8NXZSF59p3ITAOvZQeZsbJjg5gGDip5OZo9YlAgMBAAGjWzBZMB0GA1Ud +DgQWBBRPlM4VkKZ0U4ec9GrIhFQl0hNbLDA4BgNVHREEMTAvggppZHB0ZXN0YmVk +hiFodHRwczovL2lkcHRlc3RiZWQvaWRwL3NoaWJib2xldGgwDQYJKoZIhvcNAQEL +BQADggEBAIZ0a1ov3my3ljJG588I/PHx+TxAWONWmpKbO9c/qI3Drxk4oRIffiac +ANxdvtabgIzrlk5gMMisD7oyqHJiWgKv5Bgctd8w3IS3lLl7wHX65mTKQRXniG98 +NIjkvfrhe2eeJxecOqnDI8GOhIGCIqZUn8ShdM/yHjhQ2Mh0Hj3U0LlKvnmfGSQl +j0viGwbFCaNaIP3zc5UmCrdE5h8sWL3Fu7ILKM9RyFa2ILHrJScV9t623IcHffHP +IeaY/WtuapsrqRFxuQL9QFWN0FsRIdLmjTq+00+B/XnnKRKFBuWfjhHLF/uu8f+E +t6Lf23Kb8yD6ZR7dihMZAGHnYQ/hlhM= + + + + + + + + + +MIIDFDCCAfygAwIBAgIVAN3vv+b7KN5Se9m1RZsCllp/B/hdMA0GCSqGSIb3DQEB +CwUAMBUxEzARBgNVBAMMCmlkcHRlc3RiZWQwHhcNMTUxMjExMDIyMDE0WhcNMzUx +MjExMDIyMDE0WjAVMRMwEQYDVQQDDAppZHB0ZXN0YmVkMIIBIjANBgkqhkiG9w0B +AQEFAAOCAQ8AMIIBCgKCAQEAh91caeY0Q85uhaUyqFwP2bMjwMFxMzRlAoqBHd7g +u6eo4duaeLz1BaoR2XTBpNNvFR5oHH+TkKahVDGeH5+kcnIpxI8JPdsZml1srvf2 +Z6dzJsulJZUdpqnngycTkGtZgEoC1vmYVky2BSAIIifmdh6s0epbHnMGLsHzMKfJ +Cb/Q6dYzRWTCPtzE2VMuQqqWgeyMr7u14x/Vqr9RPEFsgY8GIu5jzB6AyUIwrLg+ +MNkv6aIdcHwxYTGL7ijfy6rSWrgBflQoYRYNEnseK0ZHgJahz4ovCag6wZAoPpBs +uYlY7lEr89Ucb6NHx3uqGMsXlDFdE4QwfDLLhCYHPvJ0uwIDAQABo1swWTAdBgNV +HQ4EFgQUAkOgED3iYdmvQEOMm6u/JmD/UTQwOAYDVR0RBDEwL4IKaWRwdGVzdGJl +ZIYhaHR0cHM6Ly9pZHB0ZXN0YmVkL2lkcC9zaGliYm9sZXRoMA0GCSqGSIb3DQEB +CwUAA4IBAQBIdd4YWlnvJjql8+zKKgmWgIY7U8DA8e6QcbAf8f8cdE33RSnjI63X +sv/y9GfmbAVAD6RIAXPFFeRYJ08GOxGI9axfNaKdlsklJ9bk4ducHqgCSWYVer3s +RQBjxyOfSTvk9YCJvdJVQRJLcCvxwKakFCsOSnV3t9OvN86Ak+fKPVB5j2fM/0fZ +Kqjn3iqgdNPTLXPsuJLJO5lITRiBa4onmVelAiCstI9PQiaEck+oAHnMTnC9JE/B +DHv3e4rwq3LznlqPw0GSd7xqNTdMDwNOWjkuOr3sGpWS8ms/ZHHXV1Vd22uPe70i +s00xrv14zLifcc8oj5DYzOhYRifRXgHX + + + + + + + + + +MIIDEzCCAfugAwIBAgIUG6Nn1rlERS1vsi88tcdzSYX0oqAwDQYJKoZIhvcNAQEL +BQAwFTETMBEGA1UEAwwKaWRwdGVzdGJlZDAeFw0xNTEyMTEwMjIwMTRaFw0zNTEy +MTEwMjIwMTRaMBUxEzARBgNVBAMMCmlkcHRlc3RiZWQwggEiMA0GCSqGSIb3DQEB +AQUAA4IBDwAwggEKAoIBAQCBXv0o3fmT8iluyLjJ4lBAVCW+ZRVyEXPYQuRi7vfD +cO4a6d1kxiJLsaK0W88VNxjFQRr8PgDkWr28vwoH1rgk4pLsszLD48DBzD942peJ +l/S6FnsIJjmaHcBh4pbNhU4yowu63iKkvttrcZAEbpEro6Z8CziWEx8sywoaYEQG +ifPkr9ORV6Cn3txq+9gMBePG41GrtZrUGIu+xrndL0Shh4Pq0eq/9MAsVlIIXEa8 +9WfH8J2kFcTOfoWtIc70b7TLZQsx4YnNcnrGLSUEcstFyPLX+Xtv5SNZF89OOIxX +VNjNvgE5DbJb9hMM4UAFqI+1bo9QqtxwThjc/sOvIxzNAgMBAAGjWzBZMB0GA1Ud +DgQWBBStTyogRPuAVG6q7yPyav1uvE+7pTA4BgNVHREEMTAvggppZHB0ZXN0YmVk +hiFodHRwczovL2lkcHRlc3RiZWQvaWRwL3NoaWJib2xldGgwDQYJKoZIhvcNAQEL +BQADggEBAFMfoOv+oISGjvamq7+Y4G7ep5vxlAPeK3RATYPYvAmyH946qZXh98ni +QXyuqZW5P5eEt86toY45IwDU5r09SKwHughEe99iiEkxh0mb2qo84qX9/qcg+kyN +jeLd/OSyolpUCEFNwOFcog7pj7Eer+6AHbwTn1Mjb5TBsKwtDMJsaxPvdj0u7M5r +xL/wHkFhn1rCo2QiojzjSlV3yLTh49iTyhE3cG+RxaNKDCxhp0jSSLX1BW/ZoPA8 ++PMJEA+Q0QbyRD8aJOHN5O8jGxCa/ZzcOnYVL6AsEXoDiY3vAUYh1FUonOWw0m9H +p+tGUbGS2l873J5PrsbpeKEVR/IIoKo= + + + + + + + + + + + + + + diff --git a/demo/shibboleth/configs-and-secrets/shibboleth/shibboleth2.xml b/demo/shibboleth/configs-and-secrets/shibboleth/shibboleth2.xml new file mode 100644 index 0000000..a644264 --- /dev/null +++ b/demo/shibboleth/configs-and-secrets/shibboleth/shibboleth2.xml @@ -0,0 +1,136 @@ + + + + + + + + + + + + + + + + + SAML2 + + + + SAML2 Local + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/demo/shibboleth/configs-and-secrets/shibboleth/sp-cert.pem b/demo/shibboleth/configs-and-secrets/shibboleth/sp-cert.pem new file mode 100644 index 0000000..9cc228a --- /dev/null +++ b/demo/shibboleth/configs-and-secrets/shibboleth/sp-cert.pem @@ -0,0 +1,20 @@ +-----BEGIN CERTIFICATE----- +MIIDPDCCAiQCCQDNZe8r0hVtuTANBgkqhkiG9w0BAQUFADBgMQswCQYDVQQGEwJV +UzELMAkGA1UECAwCTUkxEjAQBgNVBAcMCUFubiBBcmJvcjEXMBUGA1UECgwOSW50 +ZXJuZXQyL1RJRVIxFzAVBgNVBAMMDnNwLmV4YW1wbGUub3JnMB4XDTE3MDkyMjE5 +NTAzNVoXDTI3MDkyMDE5NTAzNVowYDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAk1J +MRIwEAYDVQQHDAlBbm4gQXJib3IxFzAVBgNVBAoMDkludGVybmV0Mi9USUVSMRcw +FQYDVQQDDA5zcC5leGFtcGxlLm9yZzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC +AQoCggEBAMTNJmsNpTpR4NrDJwOgK/o3UYlNdi1c6xBflt+liLAsQc160QReV4dS +SGK8LZvN58a/BTIsH8dLhQlUQ8qQUY2AfolVrNxb7Waumeh/POzYUTRylnoGpU3W +bGMEPxE/AdgP5U/adYvyu4XI5epv7wjZJOTqcVag15SalY+aso+ZC/5l+UzRxmWB +ZxKTsSL1y7PFehY4/Zl3Y3oGVsVl/zspt5lteoZQeeVxUX29S3Af11yHY4xpEp+7 +rvAzY/nlsTiHAsUoCFK/NFQ2evvSRx52B9Fk1cWP1MDVDm2QjQqD9xBGYSnX6bhQ +ejVx7JUJHlblu2Q5p5XdW0BihgFluoECAwEAATANBgkqhkiG9w0BAQUFAAOCAQEA +n/qhYnIviPs4tglCdrw+M7gbqKNWadDC3F9HDYzlJMFeS/ae2turhEUgQPbYPDQQ +eO3oOILtvCXNFUPM58jf8V5YFRrOqrTgx44kexQDaHO5YYNft5tF5TdvBYE2gOVr +GdYrH2iSP8WX+Yy7JH5uqkfwWzEntWHJdey39rCWKAUCCB35+/2b4N53Qmlv2+ug +CpNJYFtXInd4YMmM5HjXLyoWXtjnKiwDqYUCeYPSwAajnCqRqRXUX0gYTFDRiwRP +HbmO9We0nqoc/71nikmGGoSRMO/zWVMFjwmAx1fGiWdU61sjGX8sHifzmVyJVEBI +Z75p+JrWYZJYrx/vpWxL8g== +-----END CERTIFICATE----- diff --git a/demo/shibboleth/configs-and-secrets/shibboleth/sp-key.pem b/demo/shibboleth/configs-and-secrets/shibboleth/sp-key.pem new file mode 100644 index 0000000..1b0b579 --- /dev/null +++ b/demo/shibboleth/configs-and-secrets/shibboleth/sp-key.pem @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDEzSZrDaU6UeDa +wycDoCv6N1GJTXYtXOsQX5bfpYiwLEHNetEEXleHUkhivC2bzefGvwUyLB/HS4UJ +VEPKkFGNgH6JVazcW+1mrpnofzzs2FE0cpZ6BqVN1mxjBD8RPwHYD+VP2nWL8ruF +yOXqb+8I2STk6nFWoNeUmpWPmrKPmQv+ZflM0cZlgWcSk7Ei9cuzxXoWOP2Zd2N6 +BlbFZf87KbeZbXqGUHnlcVF9vUtwH9dch2OMaRKfu67wM2P55bE4hwLFKAhSvzRU +Nnr70kcedgfRZNXFj9TA1Q5tkI0Kg/cQRmEp1+m4UHo1ceyVCR5W5btkOaeV3VtA +YoYBZbqBAgMBAAECggEAA/5t0ypZug9DUu0283niqpdIzlKGHXGPS6vE8hD37ytW +wobFiyMm/5YJ5gcPnePV2lCyGEyQ8Ih10LSnE4tOPGLpLnxQn8A11ymf8fnzEJNr +Qnc42o0b+bJqTLAfX4g5z1qzOqWiUQ7CA3sKP3G6FiHh/8tKNYnaFif09Q8cpJFb +YDDkvm48NJgsrIoCgmaFIQIn+yDzGQKWwTNMIks+RByWpc67j1x1kiyQM1RfrEev +Yyq/ZkP66IYZzmZKpFCWGs5qbRZdxyXNpq85DjwA99lAH7vxtMJHQM4z1h1eDH4L +Ma5hEnmmHu4D5lF2GDQYflvuFdDGH5tThO6MV0IrSQKBgQD+kvEtNxJCMxLOVFyV +NWF3pk/i2nkD+53t/VPXjMPtW7IesouEGzU82I/fT2wUTkNwFdkVpv37qoLypKZm +npJFxr6abQNjiDh2Fsh8/iuJfvdZUFJbCEY6NS58qgjix8XCQKRD06EugK7uekIZ +zJnttF3qVBBD8Z8Uwxz8i+jF1wKBgQDF51y/5XB6Bz47cdxw7P8NsfnTz2V3H0HU +OnlEBANbhmBadjU8dqbM54Nxbn7VOdooXPuSnAKJ9vPDg1n5Y/GO+lgldNzfyK6g +HnbldSu0zBvAaGvmAjLjetEtOkBqYkrHJlT6JAems/Kc/YX5uooAz9/jNJFXP9++ +KbjH3CzHZwKBgQC6ppxEDZPKi83nD/2NvMTIyFzcNFj0LaEepFW7vc7NkiSn0zrt +0lEXWqUqEv5oaPWTEcHH2VdxFRTLuSL0LKGMnWqUqQcKDA9xrcSzuFvNhRTwHC81 +5XwwI1wBNV4sgFKj2WdW/6y2/szDt0oNxnC50zvkmlwOpPKBc4kmNaKmowKBgBmC +uXIDIXyZcmw3QTNNWZNqXcnv8iRo4xN4dilOWyBxMfp3QmWI5feD4G2+0Jqr2nNZ +iRRdB/bA3qtVQ0PinkDQBIzPg6lVNS1uv+TUNc4YgXtL+pyrq+Om8U/jMmqEQR9q +0YltG49houSZyatnYGK6aSHgpNuaYD0jI66fsyYBAoGAMefyD0I/ncArjuf58hVQ +zSjxfcvlja9okrC8ZgqsVluezcm4rQNcSjBnESGTCjJC7O29AofGLHkvnsBQDiGk +hE38IRisd+okXdApr41ifWDhmtASud5q6wlhOpMmQxg+OALf1rTvFYhbnFEXV/KY +e5A4iXLRIbxbmXZDa35Rebw= +-----END PRIVATE KEY----- diff --git a/demo/shibboleth/directory/Dockerfile b/demo/shibboleth/directory/Dockerfile new file mode 100644 index 0000000..6e87782 --- /dev/null +++ b/demo/shibboleth/directory/Dockerfile @@ -0,0 +1,30 @@ +FROM centos:centos7 + +LABEL author="tier-packaging@internet2.edu " + +RUN yum install -y epel-release \ + && yum update -y \ + && yum install -y 389-ds-base 389-admin 389-adminutil \ + && yum clean all \ + && rm -rf /var/cache/yum + +COPY container_files/seed-data/ /seed-data/ + +RUN useradd ldapadmin \ + && rm -fr /var/lock /usr/lib/systemd/system \ + # The 389-ds setup will fail because the hostname can't reliable be determined, so we'll bypass it and then install. \ + && sed -i 's/checkHostname {/checkHostname {\nreturn();/g' /usr/lib64/dirsrv/perl/DSUtil.pm \ + # Not doing SELinux \ + && sed -i 's/updateSelinuxPolicy($inf);//g' /usr/lib64/dirsrv/perl/* \ + # Do not restart at the end \ + && sed -i '/if (@errs = startServer($inf))/,/}/d' /usr/lib64/dirsrv/perl/* \ + && setup-ds.pl --silent --file /seed-data/ds-setup.inf \ + && /usr/sbin/ns-slapd -D /etc/dirsrv/slapd-dir \ + && while ! curl -s ldap://localhost:389 > /dev/null; do echo waiting for ldap to start; sleep 1; done; \ + ldapadd -H ldap:/// -f /seed-data/users.ldif -x -D "cn=Directory Manager" -w password + +EXPOSE 389 + +# temporary! + +CMD rm -rf /var/lock/dirsrv/slapd-dir/server/* && /usr/sbin/ns-slapd -D /etc/dirsrv/slapd-dir && sleep 100000000 diff --git a/demo/shibboleth/directory/container_files/seed-data/ds-setup.inf b/demo/shibboleth/directory/container_files/seed-data/ds-setup.inf new file mode 100644 index 0000000..96c29a1 --- /dev/null +++ b/demo/shibboleth/directory/container_files/seed-data/ds-setup.inf @@ -0,0 +1,28 @@ +[General] +AdminDomain = internet2.edu +ConfigDirectoryAdminID = admin +ConfigDirectoryAdminPwd = admin +ConfigDirectoryLdapURL = ldap://localhost:389/o=NetscapeRoot +FullMachineName = localhost +ServerRoot = /usr/lib64/dirsrv +SuiteSpotGroup = nobody +SuiteSpotUserID = nobody + +[admin] +Port = 9830 +ServerAdminID = admin +ServerAdminPwd = admin +ServerIpAddress = 0.0.0.0 +SysUser = nobody + +[slapd] +AddOrgEntries = No +AddSampleEntries = No +InstallLdifFile = suggest +RootDN = cn=Directory Manager +RootDNPwd = password +ServerIdentifier = dir +ServerPort = 389 +SlapdConfigForMC = yes +Suffix = dc=internet2,dc=edu +UseExistingMC = No diff --git a/demo/shibboleth/directory/container_files/seed-data/users.ldif b/demo/shibboleth/directory/container_files/seed-data/users.ldif new file mode 100644 index 0000000..1d57238 --- /dev/null +++ b/demo/shibboleth/directory/container_files/seed-data/users.ldif @@ -0,0 +1,24 @@ +dn: cn=admin,dc=internet2,dc=edu +objectClass: simpleSecurityObject +objectClass: organizationalRole +cn: admin +userPassword: password +description: LDAP administrator + +dn: cn=users,ou=Groups,dc=internet2,dc=edu +objectClass: groupOfUniqueNames +objectClass: top +uniqueMember: uid=banderson,ou=People,dc=internet2,dc=edu +uniqueMember: uid=jsmith,ou=People,dc=internet2,dc=edu +cn: users + +dn: uid=administrator,ou=People,dc=internet2,dc=edu +objectClass: organizationalPerson +objectClass: person +objectClass: top +objectClass: inetOrgPerson +givenName: Administrator +uid: administrator +sn: Administrator +cn: Administrator +userPassword: password diff --git a/demo/shibboleth/docker-compose.yml b/demo/shibboleth/docker-compose.yml new file mode 100644 index 0000000..4b931ac --- /dev/null +++ b/demo/shibboleth/docker-compose.yml @@ -0,0 +1,37 @@ +version: "3.3" + +services: + directory: + build: ./directory/ + expose: + - "389" + ports: + - "389:389" + networks: + - back + volumes: + - ldap:/var/lib/dirsrv + + idp: + build: ./idp/ + depends_on: + - directory + environment: + - JETTY_MAX_HEAP=64m + - JETTY_BROWSER_SSL_KEYSTORE_PASSWORD=password + - JETTY_BACKCHANNEL_SSL_KEYSTORE_PASSWORD=password + networks: + - front + - back + ports: + - "4443:4443" + +networks: + front: + driver: bridge + back: + driver: bridge + + +volumes: + ldap: diff --git a/demo/shibboleth/idp/Dockerfile b/demo/shibboleth/idp/Dockerfile new file mode 100644 index 0000000..7d0b512 --- /dev/null +++ b/demo/shibboleth/idp/Dockerfile @@ -0,0 +1,5 @@ +FROM unicon/shibboleth-idp:latest + +LABEL author="tier-packaging@internet2.edu " + +COPY shibboleth-idp/ /opt/shibboleth-idp/ diff --git a/demo/shibboleth/idp/shibboleth-idp/conf/attribute-filter.xml b/demo/shibboleth/idp/shibboleth-idp/conf/attribute-filter.xml new file mode 100644 index 0000000..facaa6d --- /dev/null +++ b/demo/shibboleth/idp/shibboleth-idp/conf/attribute-filter.xml @@ -0,0 +1,29 @@ + + + + + + + + + + + + + + diff --git a/demo/shibboleth/idp/shibboleth-idp/conf/attribute-resolver.xml b/demo/shibboleth/idp/shibboleth-idp/conf/attribute-resolver.xml new file mode 100644 index 0000000..ee9519f --- /dev/null +++ b/demo/shibboleth/idp/shibboleth-idp/conf/attribute-resolver.xml @@ -0,0 +1,293 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/demo/shibboleth/idp/shibboleth-idp/conf/idp.properties b/demo/shibboleth/idp/shibboleth-idp/conf/idp.properties new file mode 100644 index 0000000..4396f49 --- /dev/null +++ b/demo/shibboleth/idp/shibboleth-idp/conf/idp.properties @@ -0,0 +1,195 @@ +# Load any additional property resources from a comma-delimited list +idp.additionalProperties= /conf/ldap.properties, /conf/saml-nameid.properties, /conf/services.properties + +# Set the entityID of the IdP +idp.entityID= https://idptestbed/idp/shibboleth + +# Set the scope used in the attribute resolver for scoped attributes +idp.scope= example.org + +# General cookie properties (maxAge only applies to persistent cookies) +#idp.cookie.secure = false +#idp.cookie.httpOnly = true +#idp.cookie.domain = +#idp.cookie.path = +#idp.cookie.maxAge = 31536000 + +# Set the location of user-supplied web flow definitions +#idp.webflows = %{idp.home}/flows + +# Set the location of Velocity view templates +#idp.views = %{idp.home}/views + +# Settings for internal AES encryption key +#idp.sealer.storeType = JCEKS +#idp.sealer.updateInterval = PT15M +#idp.sealer.aliasBase = secret +idp.sealer.storeResource= %{idp.home}/credentials/sealer.jks +idp.sealer.versionResource= %{idp.home}/credentials/sealer.kver +idp.sealer.storePassword= password +idp.sealer.keyPassword= password + +# Settings for public/private signing and encryption key(s) +# During decryption key rollover, point the ".2" properties at a second +# keypair, uncomment in credentials.xml, then publish it in your metadata. +idp.signing.key= %{idp.home}/credentials/idp-signing.key +idp.signing.cert= %{idp.home}/credentials/idp-signing.crt +idp.encryption.key= %{idp.home}/credentials/idp-encryption.key +idp.encryption.cert= %{idp.home}/credentials/idp-encryption.crt +#idp.encryption.key.2 = %{idp.home}/credentials/idp-encryption-old.key +#idp.encryption.cert.2 = %{idp.home}/credentials/idp-encryption-old.crt + +# Sets the bean ID to use as a default security configuration set +#idp.security.config = shibboleth.DefaultSecurityConfiguration + +# To default to SHA-1, set to shibboleth.SigningConfiguration.SHA1 +#idp.signing.config = shibboleth.SigningConfiguration.SHA256 + +# Configures trust evaluation of keys used by services at runtime +# Defaults to supporting both explicit key and PKIX using SAML metadata. +#idp.trust.signatures = shibboleth.ChainingSignatureTrustEngine +# To pick only one set to one of: +# shibboleth.ExplicitKeySignatureTrustEngine, shibboleth.PKIXSignatureTrustEngine +#idp.trust.certificates = shibboleth.ChainingX509TrustEngine +# To pick only one set to one of: +# shibboleth.ExplicitKeyX509TrustEngine, shibboleth.PKIXX509TrustEngine + +# If true, encryption will happen whenever a key to use can be located, but +# failure to encrypt won't result in request failure. +#idp.encryption.optional = false + +# Configuration of client- and server-side storage plugins +#idp.storage.cleanupInterval = PT10M +#idp.storage.htmlLocalStorage = false + +# Set to true to expose more detailed errors in responses to SPs +#idp.errors.detailed = false +# Set to false to skip signing of SAML response messages that signal errors +#idp.errors.signed = true +# Name of bean containing a list of Java exception classes to ignore +#idp.errors.excludedExceptions = ExceptionClassListBean +# Name of bean containing a property set mapping exception names to views +#idp.errors.exceptionMappings = ExceptionToViewPropertyBean +# Set if a different default view name for events and exceptions is needed +#idp.errors.defaultView = error + +# Set to false to disable the IdP session layer +#idp.session.enabled = true + +# Set to "shibboleth.StorageService" for server-side storage of user sessions +#idp.session.StorageService = shibboleth.ClientSessionStorageService +idp.session.StorageService = shibboleth.StorageService + +# Size of session IDs +#idp.session.idSize = 32 +# Bind sessions to IP addresses +#idp.session.consistentAddress = true +# Inactivity timeout +#idp.session.timeout = PT60M +# Extra time to store sessions for logout +#idp.session.slop = PT0S +# Tolerate storage-related errors +#idp.session.maskStorageFailure = false +# Track information about SPs logged into +#idp.session.trackSPSessions = false +# Support lookup by SP for SAML logout +#idp.session.secondaryServiceIndex = false +# Length of time to track SP sessions +#idp.session.defaultSPlifetime = PT2H + +# Regular expression matching login flows to enable, e.g. IPAddress|Password +idp.authn.flows= Password + +# Regular expression of forced "initial" methods when no session exists, +# usually in conjunction with the idp.authn.resolveAttribute property below. +#idp.authn.flows.initial = Password + +# Set to an attribute ID to resolve prior to selecting authentication flows; +# its values are used to filter the flows to allow. +#idp.authn.resolveAttribute = eduPersonAssurance + +# Default lifetime and timeout of various authentication methods +#idp.authn.defaultLifetime = PT60M +#idp.authn.defaultTimeout = PT30M + +# Whether to prioritize "active" results when an SP requests more than +# one possible matching login method (V2 behavior was to favor them) +#idp.authn.favorSSO = true + +# Whether to fail requests when a user identity after authentication +# doesn't match the identity in a pre-existing session. +#idp.authn.identitySwitchIsError = false + +# Set to "shibboleth.StorageService" or custom bean for alternate storage of consent +#idp.consent.StorageService = shibboleth.ClientPersistentStorageService + +# Set to "shibboleth.consent.AttributeConsentStorageKey" to use an attribute +# to key user consent storage records (and set the attribute name) +#idp.consent.userStorageKey = shibboleth.consent.PrincipalConsentStorageKey +#idp.consent.userStorageKeyAttribute = uid + +# Flags controlling how built-in attribute consent feature operates +#idp.consent.allowDoNotRemember = true +#idp.consent.allowGlobal = true +#idp.consent.allowPerAttribute = false + +# Whether attribute values and terms of use text are compared +#idp.consent.compareValues = false +# Maximum number of consent records for space-limited storage (e.g. cookies) +#idp.consent.maxStoredRecords = 10 +# Maximum number of consent records for larger/server-side storage (0 = no limit) +#idp.consent.expandedMaxStoredRecords = 0 + +# Time in milliseconds to expire consent storage records. +#idp.consent.storageRecordLifetime = P1Y + +# Whether to lookup metadata, etc. for every SP involved in a logout +# for use by user interface logic; adds overhead so off by default. +#idp.logout.elaboration = false + +# Whether to require logout requests be signed/authenticated. +#idp.logout.authenticated = true + +# Message freshness and replay cache tuning +#idp.policy.messageLifetime = PT3M +#idp.policy.clockSkew = PT3M + +# Set to custom bean for alternate storage of replay cache +#idp.replayCache.StorageService = shibboleth.StorageService + +# Toggles whether to allow outbound messages via SAML artifact +#idp.artifact.enabled = true +# Suppresses typical signing/encryption when artifact binding used +#idp.artifact.secureChannel = true +# May differ to direct SAML 2 artifact lookups to specific server nodes +#idp.artifact.endpointIndex = 2 +# Set to custom bean for alternate storage of artifact map state +#idp.artifact.StorageService = shibboleth.StorageService + +# Name of access control policy for various admin flows +idp.status.accessPolicy= AccessByIPAddress +idp.resolvertest.accessPolicy= AccessByIPAddress +idp.reload.accessPolicy= AccessByIPAddress + +# Comma-delimited languages to use if not match can be found with the +# browser-supported languages, defaults to an empty list. +idp.ui.fallbackLanguages= en,fr,de + +# Storage service used by CAS protocol +# Defaults to shibboleth.StorageService (in-memory) +# MUST be server-side storage (e.g. in-memory, memcached, database) +# NOTE that idp.session.StorageService requires server-side storage +# when CAS protocol is enabled +idp.cas.StorageService=shibboleth.StorageService + +# CAS service registry implementation class +#idp.cas.serviceRegistryClass=net.shibboleth.idp.cas.service.PatternServiceRegistry + +# Profile flows in which the ProfileRequestContext should be exposed +# in servlet request under the key "opensamlProfileRequestContext" +#idp.profile.exposeProfileRequestContextInServletRequest = SAML2/POST/SSO,SAML2/Redirect/SSO + +# F-TICKS auditing - set salt to include hashed username +#idp.fticks.federation=MyFederation +#idp.fticks.algorithm=SHA-256 +#idp.fticks.salt=somethingsecret diff --git a/demo/shibboleth/idp/shibboleth-idp/conf/ldap.properties b/demo/shibboleth/idp/shibboleth-idp/conf/ldap.properties new file mode 100644 index 0000000..726f145 --- /dev/null +++ b/demo/shibboleth/idp/shibboleth-idp/conf/ldap.properties @@ -0,0 +1,58 @@ +# LDAP authentication configuration, see authn/ldap-authn-config.xml + +## Authenticator strategy, either anonSearchAuthenticator, bindSearchAuthenticator, directAuthenticator, adAuthenticator +#idp.authn.LDAP.authenticator = anonSearchAuthenticator + +## Connection properties ## +idp.authn.LDAP.ldapURL = ldap://directory:389 +idp.authn.LDAP.useStartTLS = false +idp.authn.LDAP.useSSL = false +#idp.authn.LDAP.connectTimeout = 3000 + +## SSL configuration, either jvmTrust, certificateTrust, or keyStoreTrust +#idp.authn.LDAP.sslConfig = certificateTrust +## If using certificateTrust above, set to the trusted certificate's path +idp.authn.LDAP.trustCertificates = %{idp.home}/credentials/ldap-server.crt +## If using keyStoreTrust above, set to the truststore path +idp.authn.LDAP.trustStore = %{idp.home}/credentials/ldap-server.truststore + +## Return attributes during authentication +## NOTE: this is not used during attribute resolution; configure that directly in the +## attribute-resolver.xml configuration via a DataConnector's element +idp.authn.LDAP.returnAttributes = cn,businessCategory,mail + +## DN resolution properties ## + +# Search DN resolution, used by anonSearchAuthenticator, bindSearchAuthenticator +# for AD: CN=Users,DC=example,DC=org +idp.authn.LDAP.baseDN = ou=people,dc=internet2,dc=edu +#idp.authn.LDAP.subtreeSearch = false +idp.authn.LDAP.userFilter = (uid={user}) +# bind search configuration +# for AD: idp.authn.LDAP.bindDN=adminuser@domain.com +idp.authn.LDAP.bindDN = cn=admin,dc=internet2,dc=edu +idp.authn.LDAP.bindDNCredential = password + +# Format DN resolution, used by directAuthenticator, adAuthenticator +# for AD use idp.authn.LDAP.dnFormat=%s@domain.com +idp.authn.LDAP.dnFormat = uid=%s,ou=people,dc=internet2,dc=edu + +# LDAP attribute configuration, see attribute-resolver.xml +idp.attribute.resolver.LDAP.ldapURL = %{idp.authn.LDAP.ldapURL} +idp.attribute.resolver.LDAP.baseDN = %{idp.authn.LDAP.baseDN} +idp.attribute.resolver.LDAP.bindDN = %{idp.authn.LDAP.bindDN} +idp.attribute.resolver.LDAP.bindDNCredential = %{idp.authn.LDAP.bindDNCredential} +idp.attribute.resolver.LDAP.useStartTLS = %{idp.authn.LDAP.useStartTLS:true} +idp.attribute.resolver.LDAP.trustCertificates = %{idp.authn.LDAP.trustCertificates} +idp.attribute.resolver.LDAP.searchFilter = (uid=$requestContext.principalName) + +# LDAP pool configuration, used for both authn and DN resolution +#idp.pool.LDAP.minSize = 3 +#idp.pool.LDAP.maxSize = 10 +#idp.pool.LDAP.validateOnCheckout = false +#idp.pool.LDAP.validatePeriodically = true +#idp.pool.LDAP.validatePeriod = 300 +#idp.pool.LDAP.prunePeriod = 300 +#idp.pool.LDAP.idleTime = 600 +#idp.pool.LDAP.blockWaitTime = 3000 +#idp.pool.LDAP.failFastInitialize = false diff --git a/demo/shibboleth/idp/shibboleth-idp/conf/metadata-providers.xml b/demo/shibboleth/idp/shibboleth-idp/conf/metadata-providers.xml new file mode 100644 index 0000000..684b387 --- /dev/null +++ b/demo/shibboleth/idp/shibboleth-idp/conf/metadata-providers.xml @@ -0,0 +1,80 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/demo/shibboleth/idp/shibboleth-idp/credentials/idp-backchannel.crt b/demo/shibboleth/idp/shibboleth-idp/credentials/idp-backchannel.crt new file mode 100644 index 0000000..c1f8fab --- /dev/null +++ b/demo/shibboleth/idp/shibboleth-idp/credentials/idp-backchannel.crt @@ -0,0 +1,19 @@ +-----BEGIN CERTIFICATE----- +MIIDEzCCAfugAwIBAgIUS9SuTXwsFVVG+LjOEAbLqqT/el0wDQYJKoZIhvcNAQEL +BQAwFTETMBEGA1UEAwwKaWRwdGVzdGJlZDAeFw0xNTEyMTEwMjIwMjZaFw0zNTEy +MTEwMjIwMjZaMBUxEzARBgNVBAMMCmlkcHRlc3RiZWQwggEiMA0GCSqGSIb3DQEB +AQUAA4IBDwAwggEKAoIBAQCMAoDHx8xCIfv/6QKqt9mcHYmEJ8y2dKprUbpdcOjH +YvNPIl/lHPsUyrb+Nc+q2CDeiWjVk1mWYq0UpIwpBMuw1H6+oOqr4VQRi65pin0M +SfE0MWIaFo5FPvpvoptkHD4gvREbm4swyXGMczcMRfqgalFXhUD2wz8W3XAM5Cq2 +03XeJbj6TwjvKatG5XPdeUe2FBGuOO2q54L1hcIGnLMCQrg7D31lR13PJbjnJ0No +5C3k8TPuny6vJsBC03GNLNKfmrKVTdzr3VKp1uay1G3DL9314fgmbl8HA5iRQmy+ +XInUU6/8NXZSF59p3ITAOvZQeZsbJjg5gGDip5OZo9YlAgMBAAGjWzBZMB0GA1Ud +DgQWBBRPlM4VkKZ0U4ec9GrIhFQl0hNbLDA4BgNVHREEMTAvggppZHB0ZXN0YmVk +hiFodHRwczovL2lkcHRlc3RiZWQvaWRwL3NoaWJib2xldGgwDQYJKoZIhvcNAQEL +BQADggEBAIZ0a1ov3my3ljJG588I/PHx+TxAWONWmpKbO9c/qI3Drxk4oRIffiac +ANxdvtabgIzrlk5gMMisD7oyqHJiWgKv5Bgctd8w3IS3lLl7wHX65mTKQRXniG98 +NIjkvfrhe2eeJxecOqnDI8GOhIGCIqZUn8ShdM/yHjhQ2Mh0Hj3U0LlKvnmfGSQl +j0viGwbFCaNaIP3zc5UmCrdE5h8sWL3Fu7ILKM9RyFa2ILHrJScV9t623IcHffHP +IeaY/WtuapsrqRFxuQL9QFWN0FsRIdLmjTq+00+B/XnnKRKFBuWfjhHLF/uu8f+E +t6Lf23Kb8yD6ZR7dihMZAGHnYQ/hlhM= +-----END CERTIFICATE----- diff --git a/demo/shibboleth/idp/shibboleth-idp/credentials/idp-backchannel.p12 b/demo/shibboleth/idp/shibboleth-idp/credentials/idp-backchannel.p12 new file mode 100644 index 0000000000000000000000000000000000000000..112540ac0718da62464ec2f31d7916a923e3c531 GIT binary patch literal 2500 zcmY+EcQ_k}8^q@CpG?EY_)M{|{s#&Y{$Z3_Dts;c<>{_WRK~+^7Vz1O_ zkveMArfSooW~{1l?swvVvt33=;M^na(kh za9}J52lhF`9ta#u;D00*HxQ1+`3yUpl?^N8e_I^vOh6J2bcn!#_7Im?+5eBvjthhM zf`i2O1kg{;Aui6V`ccN;VM=bu0f8U@2nV9+>W~WD-|yXF--O>tM;YF#+BBLz46_ze zy|dqjcQHP$n_@P7dCSC2b2pZzXh~`GkGy7yOQc>8l{dP`*uAl6jlGNx+NXwJ^&t~R zJn9~hxq6OdR2k0WZcscb=}Tx)?x5_bO*r!dS4% z`@6K|Dc<0lgwcYD3A9q)1XfMp7jCg!hRJ&G$S0Fn>*m2HC#wtX(nZwHM#({i{-Ps* zM7p%O#Z~dW;C1Vwo!0!@=xBZvBp{dKpQk*gR<{9{jR-IjhE|W7;$a)s4)^23TU&6( zDgyAG-?~Jkv9038q)SC0T5f8FAmGQn3}v0-LHFT5V5KWCGP}n_M@vKRJ%rKV1cZ~0>dVPW4m%Pp!}^pz#&|O5Pm%jZr#Rc=q!1^r zogM)kaQD^{oPFPbI$=OU93sR!jJ9jabsdP9 z#f+1ifg_Zb6N~F`(eCL#k@yqq?LnAdp3sr11r`TkmFy4f4nD=uXc8DEcTYVi+ ztvEYTr1{HC+kOPZjk7jZD!xC&Ap0Tyx@`}Dbh>jPr+P$ZXg_y(7V7lL8>#5J^c>*g zu|XE0My)RG%OALQ`eNv4@}J!A60A+xbh>p=4`f@%goVHw^4E&hR-M0^c1kC9pVWBF zLJ#X5+zWQ!Xqb!ADAKT4V%271wJ(MnFMYnLZ%AmDDx;V~O1^SRn6vRAcnHaD*VOWC zPG252y?^LY7K$+B&PUZ=ZQ`%P%Y&+a4ilTTR5Q|EU>+R1+r9>K^X9R?*E}Y&MtlRL zwMzOSrN2kSyo&TJ$CFh`yjrk0X#QGuTi+C<)om50=4j0bD~q<1>hZxS?I@L7JO=#jU^ zJYCtx-ft|G`YV`U;A6+nX=zglW^!c-Sz13emhi6k7H@sn9m>F*x?BtLd6}i=EhqB) zWp+bWdN-Eb@|rNoS5g+&B=z|Yqidj!B|I2ObRLCBwMKAKdy2Dtd*+oQJw#dXBHsyR zcF;uwm(f5UIvisrL6sTV@>}TfiGKR+CQu8Djfgx#Yq@8~)GQ569{Dg)>!Bs|zG_<8 zUP8`f9Vgr)9QEd6f?u0DSwznWGd^i5Jj2lrCk0ax=sp{?U`-pff?>&j;`Wcme_ecK}|1;Ir<2Ha!s+{x$I<`9QqZegR(MNE8aKia?+glvNN& z1de(2AJaKj5{`ND41EAH0nWzIzY5cTf|m8~pyf%eZJLI@9oufWYtqcAIm#`(Quue! z#^9KV$2zAh?|irpx1`EZud%TE5A67p0dC`Zu!o+rSrtJ~H>F^SHZtJ2F>=Wwh+Y(% z7f-5yD=o0vFxE@VF*mHa^KfwZssUU*P0C@-v1oCV`byV+8sxH@p>Gn(0|}=bjMRor zX*NWmi72(o(o6;>ZUI-#R-eSEjVw6BjB$PMzns3ViC)nd7blo4LN0tj5-x zpA}4i^=+lS-H}g!BxHDD-HNX2b)grSKcvuKL(ptOg<>x&Qz8wCuI<0w&m4eou;=|I zmPRWcF82= zAKC~EAnn7x>^x(#)2wuZnCoapt!>g?FACxkX9IDHe}zs=L9OMw)VNgIP!_jswitl1 z7~$j!!8Sz&ym9^c(FTffbYCyD;>F2orJ9rWt-R)na4$>xFsr@)ja24sWJbh8u?NXr z3n}dPmr-_I9X8VNzFHBIc8!;atV1ItJA6<~x|#Xn$W6=y=aN25_9yHkQ~*j`&qk%L z@Hob6Nku!wF5%;p@9mW*=?Ax`fC+4Fj$Bn@79?AaB!x*1h=A9606#|o^uTO;li2-2 ztN6Mp>){~rwN?4Zq3joP=iq0D!uO#8wPd?883R{H{2mcXYm)1NDrrWf;ts7PrPLbcoPETtI+XS>(8wfx;{R z5Fblv5Mk^lI~isyDd8d)McEl)?7L*& zxt3(FY!yO^46l36d+)yY$9KMSe!p|R|9&5m2zfyVq(>4Vcm{|p*?|0=703w8BSLP2 zh!ERf*a}Ic-}y%|wZd|zCj73f_=3(9MqnC;LCXd=Gww>y`E(SIv zhYega;J7k_>#)<2l+6T!mEmL0GOf#)J@aJ|0-p9b!-0Nm94#F9P0*i7!f8D0X_F+~ zN^N(o-BNXgL}IL5aZgijy3dzBcXSVpI_;8DvP;S^J0Aah&7!nfkhW#$wSr_G@49QkM7-3 zwdca~kJ`Dc^SymMZQO*9Kx;=SlariIaxMPlg&A&@PUww;szxtx{2rAY**3+fhB_6s zm&{UQ?QUuFBKSP^7Twe@om1A(wJ&uGJBt^n0%B#KJCYZEse_TPypWH-%n85YV>`b9h&aeyZWV z^D``1s%MD)p$Iz|Rq1GwW}4@%n$t@LqN{};$DypcOs)NShEz0*5iw@2$k970h*zZQ zJ;8*pe}R-yvo1*P*-{?6_?2FRpz4`7s;Iv%>i7m@OnGgJ9X``U6`Ut8?%9n<0a1ZlCBUa4fW4H};_ zq0}=!?%masJU2|a!{+9&Se2c_HshP&ldZcYh-7Kmh={cf`77h<-GPv^sG&zA^Bv7% zi3vViR1S$}1<1rS@5tz(676t)P~@$Q;d2VVyk}yC#ae=KpV3Rz44V=;8~fTGPDjmh zv6_e}*=MUC6g!um=Qv!=Xt+1#S(q)KmzHg?-|7|JjpCVdVAjHm>Mxh7GTR$}o4~Cu zYxp*I_3eyN8D|NhLoKY_Sifio$wL1|+#Pl0IQM}=k4*Gd!6Zc42<0Bvl47@b5#@>e z#&*at@y%1>$%;<1ZT@WBT(npEyT^4wmKEn-bJ^VlO$=pi*o9X&2A7+o!hJH6{-|Nw z7)b;>{!iC=M6el%2>u%z{2B}c^gop|1L^XJpf5-wXzTytr~f;CU{iUHVs)F+ulPYk zP(PnlM(;Jb_oph$Soflp{P;s5Gke98N zde&JHbw`cCEodvMRx-hWTWl|4Tu0l8K<4NjalraA1u$Pxa1}5JAqX^D#XM%u>rAOA zxo+#r9`h}EaBDxLT@~Ym>v z_+J!k!#BW#`B6%@rnEvSa<^Q^CisG@4MT;;O`2#HItQysMzgQKjF>BYe92kd?Q;ol zRWZipa|CwYF=oY--B6I*(#>*(OanN_iqYE5qtZ(;Ql8&sxJIqm%ebaZg~}=I;T=o+ zeUqj3yv0vH`#P%D*RGrb1E)*iT62`mK?$=%y7#w_E5z?!nj(4l4BvL((a64Rp#4_7 zz~sR!i$lL9jN3o!ok+mT*2Y)l3XEE?nsEM1X(epybKrqg16K}%_EbCdzIx{oyQ5^+ zW<2~!7yH>^+z8As5-f{NjlKM8yiG50U{@wsJ$PGo9DysME#&&(&&ShmCRKw6PoZuq zIdUl^bEwq|fsZRncxw-7qRF@Y@eQhjsqxxzQP$%M3y(223Wsa4PNOf$oK{rj2&Z@@ zeI0MA?Kmm)Z9G?(77V$@LK9b+M9KKg1VQsS7H_Dl69ykB-H2jVR)6odDqcwzs??W> zUivQJkt7eRnfQ(0YB(w@=z=)zN8>|;rB^NRqR=Qgas)XqDLGdLnvbLE~<*WdCi2j`lPDJidl3_eeD>6Xs5C%iYa zPF;a1#CzeP`Mnf1C`FL>p|#P6Q;gO!iQYJ!jE(mzKjAtafqs6s%fgZ-s+7{ z!Ryv()w_j4QnyPRv|?+L0y3O7G&rFhA76vfp38yc-Btjm^+VVvxSv8uQ<)Q2l4`8%#Z2B zOnDvidVT>jTF`z^pOm1r&Jqo;yP65no$q1J)Ab!UC)3#!v~I+g1w9-h-LS%Nx!m)J zFcEJeWOY{oIz6zT@w|LllsVKqDTZ%6bWGf%dyeZ!NC9!&xDF1i?<>| bRz*ME-RT7Qd9hsvQm>v-13XOQ!4|C@=Ji6{Gzkrry`#l><$JRUQxs# znUz?USOL?Itj*5McG=ryDXA#|iA9OI#U%_((N56}0zg5Ky{ReA z`FSO&c_oDmbqq{C44egERgO97B@9A7APe+!67$magG-7s^U|$-K)y-L0ZN0^GglOp z7J~nExqXSGq6qaT3RRODoIzr5dghn(HMT`3qXw-&ZnR=U{rWeaBa0 zj@Rc?n{AELzUY0^+HBA@e{IKY>ABk{>|UEPm*v!h|8}L0B@AK#POjmZB^kahrjB_j kAw`)5IjJtL!8j!vrkMFnww+t>abHZ&wUZ^vTC!nU0KJL18UO$Q literal 0 HcmV?d00001 diff --git a/demo/shibboleth/idp/shibboleth-idp/credentials/sealer.kver b/demo/shibboleth/idp/shibboleth-idp/credentials/sealer.kver new file mode 100644 index 0000000..d64b0e4 --- /dev/null +++ b/demo/shibboleth/idp/shibboleth-idp/credentials/sealer.kver @@ -0,0 +1,2 @@ +#Fri Dec 11 02:20:32 UTC 2015 +CurrentVersion=1 diff --git a/demo/shibboleth/idp/shibboleth-idp/metadata/idp-metadata.xml b/demo/shibboleth/idp/shibboleth-idp/metadata/idp-metadata.xml new file mode 100644 index 0000000..35914b7 --- /dev/null +++ b/demo/shibboleth/idp/shibboleth-idp/metadata/idp-metadata.xml @@ -0,0 +1,207 @@ + + + + + + + + example.org + + + + + + + +MIIDEzCCAfugAwIBAgIUS9SuTXwsFVVG+LjOEAbLqqT/el0wDQYJKoZIhvcNAQEL +BQAwFTETMBEGA1UEAwwKaWRwdGVzdGJlZDAeFw0xNTEyMTEwMjIwMjZaFw0zNTEy +MTEwMjIwMjZaMBUxEzARBgNVBAMMCmlkcHRlc3RiZWQwggEiMA0GCSqGSIb3DQEB +AQUAA4IBDwAwggEKAoIBAQCMAoDHx8xCIfv/6QKqt9mcHYmEJ8y2dKprUbpdcOjH +YvNPIl/lHPsUyrb+Nc+q2CDeiWjVk1mWYq0UpIwpBMuw1H6+oOqr4VQRi65pin0M +SfE0MWIaFo5FPvpvoptkHD4gvREbm4swyXGMczcMRfqgalFXhUD2wz8W3XAM5Cq2 +03XeJbj6TwjvKatG5XPdeUe2FBGuOO2q54L1hcIGnLMCQrg7D31lR13PJbjnJ0No +5C3k8TPuny6vJsBC03GNLNKfmrKVTdzr3VKp1uay1G3DL9314fgmbl8HA5iRQmy+ +XInUU6/8NXZSF59p3ITAOvZQeZsbJjg5gGDip5OZo9YlAgMBAAGjWzBZMB0GA1Ud +DgQWBBRPlM4VkKZ0U4ec9GrIhFQl0hNbLDA4BgNVHREEMTAvggppZHB0ZXN0YmVk +hiFodHRwczovL2lkcHRlc3RiZWQvaWRwL3NoaWJib2xldGgwDQYJKoZIhvcNAQEL +BQADggEBAIZ0a1ov3my3ljJG588I/PHx+TxAWONWmpKbO9c/qI3Drxk4oRIffiac +ANxdvtabgIzrlk5gMMisD7oyqHJiWgKv5Bgctd8w3IS3lLl7wHX65mTKQRXniG98 +NIjkvfrhe2eeJxecOqnDI8GOhIGCIqZUn8ShdM/yHjhQ2Mh0Hj3U0LlKvnmfGSQl +j0viGwbFCaNaIP3zc5UmCrdE5h8sWL3Fu7ILKM9RyFa2ILHrJScV9t623IcHffHP +IeaY/WtuapsrqRFxuQL9QFWN0FsRIdLmjTq+00+B/XnnKRKFBuWfjhHLF/uu8f+E +t6Lf23Kb8yD6ZR7dihMZAGHnYQ/hlhM= + + + + + + + + + +MIIDFDCCAfygAwIBAgIVAN3vv+b7KN5Se9m1RZsCllp/B/hdMA0GCSqGSIb3DQEB +CwUAMBUxEzARBgNVBAMMCmlkcHRlc3RiZWQwHhcNMTUxMjExMDIyMDE0WhcNMzUx +MjExMDIyMDE0WjAVMRMwEQYDVQQDDAppZHB0ZXN0YmVkMIIBIjANBgkqhkiG9w0B +AQEFAAOCAQ8AMIIBCgKCAQEAh91caeY0Q85uhaUyqFwP2bMjwMFxMzRlAoqBHd7g +u6eo4duaeLz1BaoR2XTBpNNvFR5oHH+TkKahVDGeH5+kcnIpxI8JPdsZml1srvf2 +Z6dzJsulJZUdpqnngycTkGtZgEoC1vmYVky2BSAIIifmdh6s0epbHnMGLsHzMKfJ +Cb/Q6dYzRWTCPtzE2VMuQqqWgeyMr7u14x/Vqr9RPEFsgY8GIu5jzB6AyUIwrLg+ +MNkv6aIdcHwxYTGL7ijfy6rSWrgBflQoYRYNEnseK0ZHgJahz4ovCag6wZAoPpBs +uYlY7lEr89Ucb6NHx3uqGMsXlDFdE4QwfDLLhCYHPvJ0uwIDAQABo1swWTAdBgNV +HQ4EFgQUAkOgED3iYdmvQEOMm6u/JmD/UTQwOAYDVR0RBDEwL4IKaWRwdGVzdGJl +ZIYhaHR0cHM6Ly9pZHB0ZXN0YmVkL2lkcC9zaGliYm9sZXRoMA0GCSqGSIb3DQEB +CwUAA4IBAQBIdd4YWlnvJjql8+zKKgmWgIY7U8DA8e6QcbAf8f8cdE33RSnjI63X +sv/y9GfmbAVAD6RIAXPFFeRYJ08GOxGI9axfNaKdlsklJ9bk4ducHqgCSWYVer3s +RQBjxyOfSTvk9YCJvdJVQRJLcCvxwKakFCsOSnV3t9OvN86Ak+fKPVB5j2fM/0fZ +Kqjn3iqgdNPTLXPsuJLJO5lITRiBa4onmVelAiCstI9PQiaEck+oAHnMTnC9JE/B +DHv3e4rwq3LznlqPw0GSd7xqNTdMDwNOWjkuOr3sGpWS8ms/ZHHXV1Vd22uPe70i +s00xrv14zLifcc8oj5DYzOhYRifRXgHX + + + + + + + + + +MIIDEzCCAfugAwIBAgIUG6Nn1rlERS1vsi88tcdzSYX0oqAwDQYJKoZIhvcNAQEL +BQAwFTETMBEGA1UEAwwKaWRwdGVzdGJlZDAeFw0xNTEyMTEwMjIwMTRaFw0zNTEy +MTEwMjIwMTRaMBUxEzARBgNVBAMMCmlkcHRlc3RiZWQwggEiMA0GCSqGSIb3DQEB +AQUAA4IBDwAwggEKAoIBAQCBXv0o3fmT8iluyLjJ4lBAVCW+ZRVyEXPYQuRi7vfD +cO4a6d1kxiJLsaK0W88VNxjFQRr8PgDkWr28vwoH1rgk4pLsszLD48DBzD942peJ +l/S6FnsIJjmaHcBh4pbNhU4yowu63iKkvttrcZAEbpEro6Z8CziWEx8sywoaYEQG +ifPkr9ORV6Cn3txq+9gMBePG41GrtZrUGIu+xrndL0Shh4Pq0eq/9MAsVlIIXEa8 +9WfH8J2kFcTOfoWtIc70b7TLZQsx4YnNcnrGLSUEcstFyPLX+Xtv5SNZF89OOIxX +VNjNvgE5DbJb9hMM4UAFqI+1bo9QqtxwThjc/sOvIxzNAgMBAAGjWzBZMB0GA1Ud +DgQWBBStTyogRPuAVG6q7yPyav1uvE+7pTA4BgNVHREEMTAvggppZHB0ZXN0YmVk +hiFodHRwczovL2lkcHRlc3RiZWQvaWRwL3NoaWJib2xldGgwDQYJKoZIhvcNAQEL +BQADggEBAFMfoOv+oISGjvamq7+Y4G7ep5vxlAPeK3RATYPYvAmyH946qZXh98ni +QXyuqZW5P5eEt86toY45IwDU5r09SKwHughEe99iiEkxh0mb2qo84qX9/qcg+kyN +jeLd/OSyolpUCEFNwOFcog7pj7Eer+6AHbwTn1Mjb5TBsKwtDMJsaxPvdj0u7M5r +xL/wHkFhn1rCo2QiojzjSlV3yLTh49iTyhE3cG+RxaNKDCxhp0jSSLX1BW/ZoPA8 ++PMJEA+Q0QbyRD8aJOHN5O8jGxCa/ZzcOnYVL6AsEXoDiY3vAUYh1FUonOWw0m9H +p+tGUbGS2l873J5PrsbpeKEVR/IIoKo= + + + + + + + urn:mace:shibboleth:1.0:nameIdentifier + urn:oasis:names:tc:SAML:2.0:nameid-format:transient + + + + + + + + + + + + + localhost + + + + + + +MIIDEzCCAfugAwIBAgIUS9SuTXwsFVVG+LjOEAbLqqT/el0wDQYJKoZIhvcNAQEL +BQAwFTETMBEGA1UEAwwKaWRwdGVzdGJlZDAeFw0xNTEyMTEwMjIwMjZaFw0zNTEy +MTEwMjIwMjZaMBUxEzARBgNVBAMMCmlkcHRlc3RiZWQwggEiMA0GCSqGSIb3DQEB +AQUAA4IBDwAwggEKAoIBAQCMAoDHx8xCIfv/6QKqt9mcHYmEJ8y2dKprUbpdcOjH +YvNPIl/lHPsUyrb+Nc+q2CDeiWjVk1mWYq0UpIwpBMuw1H6+oOqr4VQRi65pin0M +SfE0MWIaFo5FPvpvoptkHD4gvREbm4swyXGMczcMRfqgalFXhUD2wz8W3XAM5Cq2 +03XeJbj6TwjvKatG5XPdeUe2FBGuOO2q54L1hcIGnLMCQrg7D31lR13PJbjnJ0No +5C3k8TPuny6vJsBC03GNLNKfmrKVTdzr3VKp1uay1G3DL9314fgmbl8HA5iRQmy+ +XInUU6/8NXZSF59p3ITAOvZQeZsbJjg5gGDip5OZo9YlAgMBAAGjWzBZMB0GA1Ud +DgQWBBRPlM4VkKZ0U4ec9GrIhFQl0hNbLDA4BgNVHREEMTAvggppZHB0ZXN0YmVk +hiFodHRwczovL2lkcHRlc3RiZWQvaWRwL3NoaWJib2xldGgwDQYJKoZIhvcNAQEL +BQADggEBAIZ0a1ov3my3ljJG588I/PHx+TxAWONWmpKbO9c/qI3Drxk4oRIffiac +ANxdvtabgIzrlk5gMMisD7oyqHJiWgKv5Bgctd8w3IS3lLl7wHX65mTKQRXniG98 +NIjkvfrhe2eeJxecOqnDI8GOhIGCIqZUn8ShdM/yHjhQ2Mh0Hj3U0LlKvnmfGSQl +j0viGwbFCaNaIP3zc5UmCrdE5h8sWL3Fu7ILKM9RyFa2ILHrJScV9t623IcHffHP +IeaY/WtuapsrqRFxuQL9QFWN0FsRIdLmjTq+00+B/XnnKRKFBuWfjhHLF/uu8f+E +t6Lf23Kb8yD6ZR7dihMZAGHnYQ/hlhM= + + + + + + + + + +MIIDFDCCAfygAwIBAgIVAN3vv+b7KN5Se9m1RZsCllp/B/hdMA0GCSqGSIb3DQEB +CwUAMBUxEzARBgNVBAMMCmlkcHRlc3RiZWQwHhcNMTUxMjExMDIyMDE0WhcNMzUx +MjExMDIyMDE0WjAVMRMwEQYDVQQDDAppZHB0ZXN0YmVkMIIBIjANBgkqhkiG9w0B +AQEFAAOCAQ8AMIIBCgKCAQEAh91caeY0Q85uhaUyqFwP2bMjwMFxMzRlAoqBHd7g +u6eo4duaeLz1BaoR2XTBpNNvFR5oHH+TkKahVDGeH5+kcnIpxI8JPdsZml1srvf2 +Z6dzJsulJZUdpqnngycTkGtZgEoC1vmYVky2BSAIIifmdh6s0epbHnMGLsHzMKfJ +Cb/Q6dYzRWTCPtzE2VMuQqqWgeyMr7u14x/Vqr9RPEFsgY8GIu5jzB6AyUIwrLg+ +MNkv6aIdcHwxYTGL7ijfy6rSWrgBflQoYRYNEnseK0ZHgJahz4ovCag6wZAoPpBs +uYlY7lEr89Ucb6NHx3uqGMsXlDFdE4QwfDLLhCYHPvJ0uwIDAQABo1swWTAdBgNV +HQ4EFgQUAkOgED3iYdmvQEOMm6u/JmD/UTQwOAYDVR0RBDEwL4IKaWRwdGVzdGJl +ZIYhaHR0cHM6Ly9pZHB0ZXN0YmVkL2lkcC9zaGliYm9sZXRoMA0GCSqGSIb3DQEB +CwUAA4IBAQBIdd4YWlnvJjql8+zKKgmWgIY7U8DA8e6QcbAf8f8cdE33RSnjI63X +sv/y9GfmbAVAD6RIAXPFFeRYJ08GOxGI9axfNaKdlsklJ9bk4ducHqgCSWYVer3s +RQBjxyOfSTvk9YCJvdJVQRJLcCvxwKakFCsOSnV3t9OvN86Ak+fKPVB5j2fM/0fZ +Kqjn3iqgdNPTLXPsuJLJO5lITRiBa4onmVelAiCstI9PQiaEck+oAHnMTnC9JE/B +DHv3e4rwq3LznlqPw0GSd7xqNTdMDwNOWjkuOr3sGpWS8ms/ZHHXV1Vd22uPe70i +s00xrv14zLifcc8oj5DYzOhYRifRXgHX + + + + + + + + + +MIIDEzCCAfugAwIBAgIUG6Nn1rlERS1vsi88tcdzSYX0oqAwDQYJKoZIhvcNAQEL +BQAwFTETMBEGA1UEAwwKaWRwdGVzdGJlZDAeFw0xNTEyMTEwMjIwMTRaFw0zNTEy +MTEwMjIwMTRaMBUxEzARBgNVBAMMCmlkcHRlc3RiZWQwggEiMA0GCSqGSIb3DQEB +AQUAA4IBDwAwggEKAoIBAQCBXv0o3fmT8iluyLjJ4lBAVCW+ZRVyEXPYQuRi7vfD +cO4a6d1kxiJLsaK0W88VNxjFQRr8PgDkWr28vwoH1rgk4pLsszLD48DBzD942peJ +l/S6FnsIJjmaHcBh4pbNhU4yowu63iKkvttrcZAEbpEro6Z8CziWEx8sywoaYEQG +ifPkr9ORV6Cn3txq+9gMBePG41GrtZrUGIu+xrndL0Shh4Pq0eq/9MAsVlIIXEa8 +9WfH8J2kFcTOfoWtIc70b7TLZQsx4YnNcnrGLSUEcstFyPLX+Xtv5SNZF89OOIxX +VNjNvgE5DbJb9hMM4UAFqI+1bo9QqtxwThjc/sOvIxzNAgMBAAGjWzBZMB0GA1Ud +DgQWBBStTyogRPuAVG6q7yPyav1uvE+7pTA4BgNVHREEMTAvggppZHB0ZXN0YmVk +hiFodHRwczovL2lkcHRlc3RiZWQvaWRwL3NoaWJib2xldGgwDQYJKoZIhvcNAQEL +BQADggEBAFMfoOv+oISGjvamq7+Y4G7ep5vxlAPeK3RATYPYvAmyH946qZXh98ni +QXyuqZW5P5eEt86toY45IwDU5r09SKwHughEe99iiEkxh0mb2qo84qX9/qcg+kyN +jeLd/OSyolpUCEFNwOFcog7pj7Eer+6AHbwTn1Mjb5TBsKwtDMJsaxPvdj0u7M5r +xL/wHkFhn1rCo2QiojzjSlV3yLTh49iTyhE3cG+RxaNKDCxhp0jSSLX1BW/ZoPA8 ++PMJEA+Q0QbyRD8aJOHN5O8jGxCa/ZzcOnYVL6AsEXoDiY3vAUYh1FUonOWw0m9H +p+tGUbGS2l873J5PrsbpeKEVR/IIoKo= + + + + + + + + + + + + + + diff --git a/demo/shibboleth/idp/shibboleth-idp/metadata/midpoint-sp.xml b/demo/shibboleth/idp/shibboleth-idp/metadata/midpoint-sp.xml new file mode 100644 index 0000000..54f0577 --- /dev/null +++ b/demo/shibboleth/idp/shibboleth-idp/metadata/midpoint-sp.xml @@ -0,0 +1,80 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + midpoint.sp.example.org + + CN=midpoint.sp.example.org,O=Internet2/TIER,L=Ann Arbor,ST=MI,C=US + MIIDqDCCApCgAwIBAgIJAKUZrfriIt9cMA0GCSqGSIb3DQEBCwUAMGkxCzAJBgNV +BAYTAlVTMQswCQYDVQQIDAJNSTESMBAGA1UEBwwJQW5uIEFyYm9yMRcwFQYDVQQK +DA5JbnRlcm5ldDIvVElFUjEgMB4GA1UEAwwXZXZvbHZldW0uc3AuZXhhbXBsZS5v +cmcwHhcNMTgwOTE0MDU0NjU3WhcNMTkwOTE0MDU0NjU3WjBpMQswCQYDVQQGEwJV +UzELMAkGA1UECAwCTUkxEjAQBgNVBAcMCUFubiBBcmJvcjEXMBUGA1UECgwOSW50 +ZXJuZXQyL1RJRVIxIDAeBgNVBAMMF2V2b2x2ZXVtLnNwLmV4YW1wbGUub3JnMIIB +IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw5v1zxlM94yaBssgNNbIUJwW +XxbGxgSs2AWBeg2aEi/VQd2UE5ivZakNJlqWSJyHo2xE4kxeSyBBxinjSyhmpNao +xIcqQsgW0gxo4SEHo3kUXWPo+of/pj6CslutsSJZWGTRV0dHITvaWX+NM8eXMfgu +mJFwy3RMdLaWQhY1Dyi2jNoO+DZnfNgPyPeEZcmORaoeEID9QdZfHtcgTf2QfSHq ++xsTwHB6Ro5t7YD2ma8Krb/XcDTfsq3qJemd7LhPj5lGmhYSMgDbgwEkZgZ1kBOP +lfsP2BvX5nipv7Vd1C5YXmv+NDR8V3yAWBC7ZAenxGmrnkaSVXnpUplUsGGm1QID +AQABo1MwUTAdBgNVHQ4EFgQUuxSZwW6V1P/b0tsTM32OU/v/n+UwHwYDVR0jBBgw +FoAUuxSZwW6V1P/b0tsTM32OU/v/n+UwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG +9w0BAQsFAAOCAQEAJWLXEfZkPeUyiGvsIUjczzdF3ptqXoP9aETS2pOV9sTri19R +TsQZW6XQRHGtuEOsqEGH8yiTdGR5hbGC+ynH/xTJnK+tBn/R3KrgxLKyMvoUzAPl +mhVq1dh+ZEtbsRpQRRubP6nm9kXNma0cXrkJSzuWM0W+l/xSOOYiSRRk3XWJfVjn +9jQlcJRh5SOkKN08oZHrCYKxToEuOfV8PtRj3T80DhsBTv2SHqhg4cBhzQPb0Kjm +9m4IkYOz8c5ZtuHDGnqMHw60Nyt+jyik4mMFP2frcOVP0W0sgwcfHllYzHoA/Khq +Yk3TBVs1BjPuNDJWHct8Eo68YP2/ZvzqfVM87Q== + + + + + + + + + + + + + + + + + + + + + + + + +