Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Showing
5 changed files
with
252 additions
and
93 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,140 @@ | ||
| <SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config" | ||
| xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config" | ||
| xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" | ||
| xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" | ||
| xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" | ||
| clockSkew="180"> | ||
|
|
||
| <!-- | ||
| By default, in-memory StorageService, ReplayCache, ArtifactMap, and SessionCache | ||
| are used. See example-shibboleth2.xml for samples of explicitly configuring them. | ||
| --> | ||
|
|
||
| <!-- | ||
| To customize behavior for specific resources on Apache, and to link vhosts or | ||
| resources to ApplicationOverride settings below, use web server options/commands. | ||
| See https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPConfigurationElements for help. | ||
|
|
||
| For examples with the RequestMap XML syntax instead, see the example-shibboleth2.xml | ||
| file, and the https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPRequestMapHowTo topic. | ||
| --> | ||
| <TCPListener address="127.0.0.1" port="1600"/> | ||
|
|
||
|
|
||
| <!-- The ApplicationDefaults element is where most of Shibboleth's SAML bits are defined. --> | ||
| <ApplicationDefaults entityID="https://sptest.example.edu/shibboleth" | ||
| REMOTE_USER="uid"> | ||
|
|
||
| <!-- | ||
| Controls session lifetimes, address checks, cookie handling, and the protocol handlers. | ||
| You MUST supply an effectively unique handlerURL value for each of your applications. | ||
| The value defaults to /Shibboleth.sso, and should be a relative path, with the SP computing | ||
| a relative value based on the virtual host. Using handlerSSL="true", the default, will force | ||
| the protocol to be https. You should also set cookieProps to "https" for SSL-only sites. | ||
| Note that while we default checkAddress to "false", this has a negative impact on the | ||
| security of your site. Stealing sessions via cookie theft is much easier with this disabled. | ||
| --> | ||
| <Sessions lifetime="28800" timeout="28800" relayState="ss:mem" | ||
| checkAddress="false" handlerSSL="true" cookieProps="https"> | ||
|
|
||
| <!-- | ||
| Configures SSO for a default IdP. To allow for >1 IdP, remove | ||
| entityID property and adjust discoveryURL to point to discovery service. | ||
| (Set discoveryProtocol to "WAYF" for legacy Shibboleth WAYF support.) | ||
| You can also override entityID on /Login query string, or in RequestMap/htaccess. | ||
| --> | ||
| <SSO entityID="https://idp.example.edu/idp/shibboleth"> | ||
| SAML2 | ||
| </SSO> | ||
|
|
||
| <!-- SAML and local-only logout. --> | ||
| <Logout>SAML2 Local</Logout> | ||
|
|
||
| <!-- Extension service that generates "approximate" metadata based on SP configuration. --> | ||
| <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/> | ||
|
|
||
| <!-- Status reporting service. --> | ||
| <Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/> | ||
|
|
||
| <!-- Session diagnostic service. --> | ||
| <Handler type="Session" Location="/Session" showAttributeValues="true"/> | ||
|
|
||
| <!-- JSON feed of discovery information. --> | ||
| <Handler type="DiscoveryFeed" Location="/DiscoFeed"/> | ||
| </Sessions> | ||
|
|
||
| <!-- | ||
| Allows overriding of error template information/filenames. You can | ||
| also add attributes with values that can be plugged into the templates. | ||
| --> | ||
| <Errors supportContact="root@localhost" | ||
| helpLocation="/about.html" | ||
| styleSheet="/shibboleth-sp/main.css"/> | ||
|
|
||
| <!-- Example of remotely supplied batch of signed metadata. --> | ||
| <!-- | ||
| <MetadataProvider type="XML" validate="true" | ||
| url="http://example.org/federation-metadata.xml" | ||
| backingFilePath="federation-metadata.xml" reloadInterval="7200"> | ||
| <MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/> | ||
| <MetadataFilter type="Signature" certificate="fedsigner.pem"/> | ||
| <DiscoveryFilter type="Blacklist" matcher="EntityAttributes" trimTags="true" | ||
| attributeName="http://macedir.org/entity-category" | ||
| attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" | ||
| attributeValue="http://refeds.org/category/hide-from-discovery" /> | ||
| </MetadataProvider> | ||
| --> | ||
|
|
||
| <MetadataProvider type="XML" validate="true" path="/etc/shibboleth/idp-metadata.xml"/> | ||
|
|
||
| <!-- | ||
| InCommon | ||
| <MetadataProvider type="XML" validate="true" | ||
| url="http://md.incommon.org/InCommon/InCommon-metadata.xml" | ||
| backingFilePath="federation-metadata.xml" reloadInterval="7200"> | ||
| <MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/> | ||
| <MetdataFilter type="Signature" certificate="inc-md-cert.pem"/> | ||
| <DiscoveryFilter type="Blacklist" matcher="EntityAttributes" trimTags="true" | ||
| attributeName="http://macedir.org/entity-category" | ||
| attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" | ||
| attributeValue="http://refeds.org/category/hide-from-discovery" /> | ||
| </MetadataProvider> | ||
| --> | ||
|
|
||
| <!-- Map to extract attributes from SAML assertions. --> | ||
| <AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/> | ||
|
|
||
| <!-- Use a SAML query if no attributes are supplied during SSO. --> | ||
| <AttributeResolver type="Query" subjectMatch="true"/> | ||
|
|
||
| <!-- Default filtering policy for recognized attributes, lets other data pass. --> | ||
| <AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/> | ||
|
|
||
| <!-- Simple file-based resolvers for separate signing/encryption keys. --> | ||
| <CredentialResolver type="File" use="signing" | ||
| key="sp-signing-key.pem" certificate="sp-signing-cert.pem"/> | ||
| <CredentialResolver type="File" use="encryption" | ||
| key="sp-encrypt-key.pem" certificate="sp-encrypt-cert.pem"/> | ||
|
|
||
| <!-- | ||
| The default settings can be overridden by creating ApplicationOverride elements (see | ||
| the https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplicationOverride topic). | ||
| Resource requests are mapped by web server commands, or the RequestMapper, to an | ||
| applicationId setting. | ||
|
|
||
| Example of a second application (for a second vhost) that has a different entityID. | ||
| Resources on the vhost would map to an applicationId of "admin": | ||
| --> | ||
| <!-- | ||
| <ApplicationOverride id="admin" entityID="https://admin.example.org/shibboleth"/> | ||
| --> | ||
| </ApplicationDefaults> | ||
|
|
||
| <!-- Policies that determine how to process and authenticate runtime messages. --> | ||
| <SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/> | ||
|
|
||
| <!-- Low-level configuration about protocols and bindings available for use. --> | ||
| <ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/> | ||
|
|
||
| </SPConfig> | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters