relying-party-system.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:context="http://www.springframework.org/schema/context"
       xmlns:util="http://www.springframework.org/schema/util"
       xmlns:p="http://www.springframework.org/schema/p"
       xmlns:c="http://www.springframework.org/schema/c"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
                           http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
                           http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
                           
       default-init-method="initialize"
       default-destroy-method="destroy">

    <!-- This is one of the few properties we rely on that has no default. -->
    <bean id="entityID" class="java.lang.String" c:_0="%{idp.entityID}" />

    <!-- Pulls together the various components that feed the resolver. -->
    <bean class="net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver"
        p:unverifiedConfiguration-ref="shibboleth.UnverifiedRelyingParty"
        p:defaultConfiguration-ref="shibboleth.DefaultRelyingParty"
        p:relyingPartyConfigurations-ref="shibboleth.RelyingPartyOverrides"
        p:defaultSecurityConfiguration-ref="%{idp.security.config:shibboleth.DefaultSecurityConfiguration}" 
        p:signingCredentials="#{getObject('shibboleth.SigningCredentials')}"
        p:encryptionCredentials="#{getObject('shibboleth.EncryptionCredentials')}" />

    <!-- Parent bean for generic RelyingParty overrides that establishes defaults. -->
    <bean id="RelyingParty" abstract="true" class="net.shibboleth.idp.relyingparty.RelyingPartyConfiguration"
        p:responderId-ref="entityID" p:detailedErrors="%{idp.errors.detailed:false}" />

    <!-- Parent bean for RelyingParty overrides based on activation by name(s). -->
    <bean id="RelyingPartyByName" abstract="true"
        class="net.shibboleth.idp.saml.relyingparty.impl.RelyingPartyConfigurationSupport" factory-method="byName"
        p:responderId-ref="entityID" p:detailedErrors="%{idp.errors.detailed:false}" />

    <!-- Parent bean for RelyingParty overrides based on activation by group. -->
    <bean id="RelyingPartyByGroup" abstract="true"
        class="net.shibboleth.idp.saml.relyingparty.impl.RelyingPartyConfigurationSupport" factory-method="byGroup"
        p:responderId-ref="entityID" p:detailedErrors="%{idp.errors.detailed:false}" />

    <!-- Parent bean for RelyingParty overrides based on activation by tag. -->
    <bean id="RelyingPartyByTag" abstract="true"
        class="net.shibboleth.idp.saml.relyingparty.impl.RelyingPartyConfigurationSupport" factory-method="byTag"
        p:responderId-ref="entityID" p:detailedErrors="%{idp.errors.detailed:false}" c:trim="false" c:matchAll="false" />    

    <bean id="TagCandidate" abstract="true"
        class="org.opensaml.saml.common.profile.logic.EntityAttributesPredicate.Candidate" />
        
    <!-- Default Profile Configurations, also usable as parent beans in overrides. -->
    
    <bean id="Shibboleth.SSO"
        class="net.shibboleth.idp.saml.saml1.profile.config.BrowserSSOProfileConfiguration"
        p:artifactConfiguration-ref="shibboleth.DefaultArtifactConfiguration"
        p:inboundInterceptorFlows="security-policy/shibboleth-sso" />

    <bean id="SAML1.AttributeQuery"
        class="net.shibboleth.idp.saml.saml1.profile.config.AttributeQueryProfileConfiguration"
        p:inboundInterceptorFlows="security-policy/saml-soap" />

    <bean id="SAML1.ArtifactResolution"
        class="net.shibboleth.idp.saml.saml1.profile.config.ArtifactResolutionProfileConfiguration"
        p:inboundInterceptorFlows="security-policy/saml-soap" />

    <bean id="SAML2.SSO"
        class="net.shibboleth.idp.saml.saml2.profile.config.BrowserSSOProfileConfiguration"
        p:artifactConfiguration-ref="shibboleth.DefaultArtifactConfiguration"
        p:inboundInterceptorFlows="security-policy/saml2-sso"
        p:encryptionOptional="%{idp.encryption.optional:false}" />

    <bean id="SAML2.ECP"
        class="net.shibboleth.idp.saml.saml2.profile.config.ECPProfileConfiguration"
        p:inboundInterceptorFlows="security-policy/saml2-ecp"
        p:encryptionOptional="%{idp.encryption.optional:false}" />

    <bean id="SAML2.Logout"
        class="net.shibboleth.idp.saml.saml2.profile.config.SingleLogoutProfileConfiguration"
        p:artifactConfiguration-ref="shibboleth.DefaultArtifactConfiguration"
        p:inboundInterceptorFlows="security-policy/saml2-slo"
        p:encryptionOptional="%{idp.encryption.optional:false}" />

    <bean id="SAML2.AttributeQuery"
        class="net.shibboleth.idp.saml.saml2.profile.config.AttributeQueryProfileConfiguration"
        p:inboundInterceptorFlows="security-policy/saml-soap"
        p:encryptionOptional="%{idp.encryption.optional:false}" />

    <bean id="SAML2.ArtifactResolution"
        class="net.shibboleth.idp.saml.saml2.profile.config.ArtifactResolutionProfileConfiguration"
        p:inboundInterceptorFlows="security-policy/saml-soap"
        p:encryptionOptional="%{idp.encryption.optional:false}" />

    <bean id="Liberty.SSOS"
        class="net.shibboleth.idp.saml.idwsf.profile.config.SSOSProfileConfiguration" 
            p:inboundInterceptorFlows="security-policy/saml2-idwsf-ssos" 
            p:encryptionOptional="%{idp.encryption.optional:false}" />

    <bean id="CAS.LoginConfiguration"
          class="net.shibboleth.idp.cas.config.impl.LoginConfiguration" />

    <bean id="CAS.ProxyConfiguration"
          class="net.shibboleth.idp.cas.config.impl.ProxyConfiguration" />

    <!-- Ticket validity period applies to proxy-granting tickets created upon successful proxy callback validation -->
    <bean id="CAS.ValidateConfiguration"
          class="net.shibboleth.idp.cas.config.impl.ValidateConfiguration"
          p:ticketValidityPeriod="PT12H" />

    <!-- Artifact Configuration Defaults -->
    
    <bean id="shibboleth.DefaultArtifactConfiguration"
        class="net.shibboleth.idp.saml.profile.config.BasicSAMLArtifactConfiguration"
        p:artifactResolutionServiceIndex="%{idp.artifact.endpointIndex:2}" />
    
    <!--
    Security Configuration Defaults
    
    These settings establish the default security configurations for signatures and encryption
    and loads the default credentials used.
    -->

    <bean id="shibboleth.DefaultSecurityConfiguration" class="net.shibboleth.idp.profile.config.SecurityConfiguration">
    
        <property name="signatureSigningConfiguration">
            <ref bean="#{'%{idp.signing.config:shibboleth.SigningConfiguration.SHA256}'.trim()}" />
        </property>
        
        <property name="signatureValidationConfiguration">
            <bean parent="shibboleth.BasicSignatureValidationConfiguration" 
                p:signatureTrustEngine-ref="#{'%{idp.trust.signatures:shibboleth.ChainingSignatureTrustEngine}'.trim()}" />
        </property>

        <property name="clientTLSValidationConfiguration">
            <bean parent="shibboleth.BasicClientTLSValidationConfiguration"
                p:x509TrustEngine-ref="#{'%{idp.trust.certificates:shibboleth.ChainingX509TrustEngine}'.trim()}" />
        </property>
        
        <property name="encryptionConfiguration">
            <bean parent="shibboleth.BasicEncryptionConfiguration">
                <property name="dataEncryptionAlgorithms">
                    <list>
                        <util:constant
                            static-field="org.opensaml.xmlsec.encryption.support.EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128" />
                    </list>
                </property>
                <property name="keyTransportEncryptionAlgorithms">
                    <list>
                        <util:constant
                            static-field="org.opensaml.xmlsec.encryption.support.EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP" />
                    </list>
                </property>
            </bean>
        </property>

        <property name="decryptionConfiguration">
            <bean parent="shibboleth.BasicDecryptionConfiguration"
                p:KEKKeyInfoCredentialResolver-ref="defaultKeyEncryptionCredentialResolver"
                p:encryptedKeyResolver-ref="defaultEncryptedKeyResolver" />
        </property>

    </bean>

    <bean id="shibboleth.SigningConfiguration.SHA256" parent="shibboleth.BasicSignatureSigningConfiguration"
            p:signingCredentials-ref="shibboleth.DefaultSigningCredential">
        <property name="signatureAlgorithms">
            <list>
                <util:constant
                    static-field="org.opensaml.xmlsec.signature.support.SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256" />
                <util:constant
                    static-field="org.opensaml.xmlsec.signature.support.SignatureConstants.ALGO_ID_SIGNATURE_ECDSA_SHA256" />
            </list>
        </property>
        <property name="signatureReferenceDigestMethods">
            <list>
                <util:constant
                    static-field="org.opensaml.xmlsec.signature.support.SignatureConstants.ALGO_ID_DIGEST_SHA256" />
            </list>
        </property>
    </bean>

    <bean id="shibboleth.SigningConfiguration.SHA1" parent="shibboleth.BasicSignatureSigningConfiguration"
            p:signingCredentials-ref="shibboleth.DefaultSigningCredential">
        <property name="signatureAlgorithms">
            <list>
                <util:constant
                    static-field="org.opensaml.xmlsec.signature.support.SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1" />
                <util:constant
                    static-field="org.opensaml.xmlsec.signature.support.SignatureConstants.ALGO_ID_SIGNATURE_ECDSA_SHA1" />
            </list>
        </property>
        <property name="signatureReferenceDigestMethods">
            <list>
                <util:constant
                    static-field="org.opensaml.xmlsec.signature.support.SignatureConstants.ALGO_ID_DIGEST_SHA1" />
            </list>
        </property>
    </bean>

    <bean id="shibboleth.MetadataPKIXValidationInformationResolver"
        class="net.shibboleth.idp.saml.security.impl.MetadataPKIXValidationInformationResolver"
        c:resolver-ref="shibboleth.RoleDescriptorResolver" />

    <!-- Trust Engine options for message signature evaluation. -->
        
    <bean id="shibboleth.ExplicitKeySignatureTrustEngine"
        class="org.opensaml.xmlsec.signature.support.impl.ExplicitKeySignatureTrustEngine"
        c:resolver-ref="shibboleth.MetadataCredentialResolver"
        c:keyInfoResolver-ref="shibboleth.KeyInfoCredentialResolver" />

    <bean id="shibboleth.PKIXSignatureTrustEngine"
        class="org.opensaml.xmlsec.signature.support.impl.PKIXSignatureTrustEngine" 
        c:resolver-ref="shibboleth.MetadataPKIXValidationInformationResolver"
        c:keyInfoResolver-ref="shibboleth.KeyInfoCredentialResolver" />

    <bean id="shibboleth.ChainingSignatureTrustEngine"
            class="org.opensaml.xmlsec.signature.support.impl.ChainingSignatureTrustEngine">
        <constructor-arg>
            <list>
                <ref bean="shibboleth.ExplicitKeySignatureTrustEngine" />
                <ref bean="shibboleth.PKIXSignatureTrustEngine" />
            </list>
        </constructor-arg>
    </bean>

    <!-- Trust Engine options for X.509 certificate evaluation (e.g., TLS). -->

    <bean id="shibboleth.ExplicitX509TrustEngine"
        class="org.opensaml.security.trust.impl.ExplicitKeyTrustEngine"
        c:resolver-ref="shibboleth.MetadataCredentialResolver" />

    <bean id="shibboleth.PKIXX509TrustEngine"
        class="org.opensaml.security.x509.impl.PKIXX509CredentialTrustEngine"
        c:resolver-ref="shibboleth.MetadataPKIXValidationInformationResolver" />

    <bean id="shibboleth.ChainingX509TrustEngine" class="org.opensaml.security.trust.impl.ChainingTrustEngine">
        <constructor-arg>
            <list>
                <ref bean="shibboleth.ExplicitX509TrustEngine" />
                <ref bean="shibboleth.PKIXX509TrustEngine" />
            </list>
        </constructor-arg>
    </bean>

    <!-- Defines decryption keys, along with support for optimizing lookup based on KeyInfo hints. -->
    <bean id="defaultKeyEncryptionCredentialResolver" class="org.opensaml.xmlsec.keyinfo.impl.ChainingKeyInfoCredentialResolver">
        <constructor-arg>
            <list>
                <bean class="org.opensaml.xmlsec.keyinfo.impl.LocalKeyInfoCredentialResolver">
                    <constructor-arg name="localCredentialResolver">
                        <bean class="org.opensaml.xmlsec.keyinfo.impl.CollectionKeyInfoCredentialResolver"
                            c:credentials-ref="shibboleth.DefaultEncryptionCredentials" />
                    </constructor-arg>
                    <constructor-arg name="keyInfoProviders">
                        <list>
                            <bean class="org.opensaml.xmlsec.keyinfo.impl.provider.RSAKeyValueProvider" />
                            <bean class="org.opensaml.xmlsec.keyinfo.impl.provider.DSAKeyValueProvider" />
                            <bean class="org.opensaml.xmlsec.keyinfo.impl.provider.DEREncodedKeyValueProvider" />
                            <bean class="org.opensaml.xmlsec.keyinfo.impl.provider.InlineX509DataProvider" />
                        </list>
                    </constructor-arg>
                </bean>
                <bean class="org.opensaml.xmlsec.keyinfo.impl.StaticKeyInfoCredentialResolver"
                    c:credentials-ref="shibboleth.DefaultEncryptionCredentials" />
            </list>
        </constructor-arg>
    </bean>
    
    <!-- Defines how the system locates EncryptedKey elements sent in messages containing encrypted objects. -->
    <bean id="defaultEncryptedKeyResolver" class="org.opensaml.xmlsec.encryption.support.ChainingEncryptedKeyResolver"
            c:recipient-ref="entityID">
        <constructor-arg name="encKeyResolvers">
            <list>
                <bean class="org.opensaml.xmlsec.encryption.support.InlineEncryptedKeyResolver" />
                <bean class="org.opensaml.saml.saml2.encryption.EncryptedElementTypeEncryptedKeyResolver" />
                <bean class="org.opensaml.xmlsec.encryption.support.SimpleRetrievalMethodEncryptedKeyResolver" />
                <bean class="org.opensaml.xmlsec.encryption.support.SimpleKeyInfoReferenceEncryptedKeyResolver" />
            </list>
        </constructor-arg>
    </bean>

</beans>