configs/shibboleth.xml.in

   1 <ShibbolethTargetConfig xmlns="urn:mace:shibboleth:target:config:1.0"
   2         logger="@-PKGSYSCONFDIR-@/shibboleth.logger" clockSkew="180">
   3
   4     <Extensions>
   5         <Library path="@-LIBEXECDIR-@/xmlproviders.so" fatal="true"/>
   6     </Extensions>
   7
   8     <SHAR logger="@-PKGSYSCONFDIR-@/shar.logger">
   9
  10         <Extensions>
  11             <Library path="@-LIBEXECDIR-@/shib-mysql-ccache.so" fatal="false"/>
  12         </Extensions>
  13
  14         <!-- only one listener can be defined. -->
  15         <UnixListener address="/tmp/shar-socket"/>
  16
  17         <!--
  18         <TCPListener address="127.0.0.1" port="12345" acl="127.0.0.1"/>
  19         -->
  20
  21         <!--
  22         See deploy guide for details, but:
  23                 cacheTimeout - how long before expired sessions are purged from the cache
  24                 AATimeout - how long to wait for an AA to respond
  25                 AAConnectTimeout - how long to wait while connecting to an AA
  26                 defaultLifetime - if attributes come back without guidance, how long should they last?
  27                 strictValidity - if we have expired attrs, and can't get new ones, keep using them?
  28                 propagateErrors - suppress errors while getting attrs or let user see them?
  29                 retryInterval - if propagateErrors is false and query fails, how long to wait before trying again
  30         -->
  31         <!--
  32         <MemorySessionCache cleanupInterval="300" cacheTimeout="3600" AATimeout="30" AAConnectTimeout="15"
  33             defaultLifetime="1800" retryInterval="300" strictValidity="false" propagateErrors="false"/>
  34         -->
  35         <MySQLSessionCache cleanupInterval="300" cacheTimeout="3600" AATimeout="30" AAConnectTimeout="15"
  36                defaultLifetime="1800" retryInterval="300" strictValidity="false" propagateErrors="false"
  37                mysqlTimeout="14400">
  38             <Argument>&#x2D;&#x2D;language=@-PREFIX-@/share/english</Argument>
  39             <Argument>&#x2D;&#x2D;datadir=@-PREFIX-@/data</Argument>
  40         </MySQLSessionCache>
  41     </SHAR>
  42
  43     <SHIRE logger="@-PKGSYSCONFDIR-@/shire.logger">
  44         <!--
  45         To customize behavior, map hostnames and path components to application names.
  46         Can be either a pointer to an external file or an inline configuration.
  47         -->
  48         <!--
  49         <RequestMapProvider type="edu.internet2.middleware.shibboleth.target.provider.XMLRequestMap"
  50             uri="@-PKGSYSCONFDIR-@/applications.xml"/>
  51         -->
  52
  53         <RequestMapProvider type="edu.internet2.middleware.shibboleth.target.provider.XMLRequestMap">
  54             <RequestMap applicationId="default">
  55                 <!--
  56                 If using IIS or apacheConfig is false:
  57                 This requires a session for documents in /secure on the containing host on 80 and 443.
  58                 Note that the name in the <Host> elements MUST match Apache's ServerName directive
  59                 or the IIS host mapping in the <ISAPI> element below.
  60                 -->
  61                 <Host name="localhost" scheme="https">
  62                     <Path name="secure" requireSession="true" exportAssertion="true"/>
  63                 </Host>
  64                 <Host name="localhost" scheme="http">
  65                     <Path name="secure" requireSession="true" exportAssertion="true"/>
  66                 </Host>
  67             </RequestMap>
  68         </RequestMapProvider>
  69
  70         <Implementation>
  71             <ISAPI normalizeRequest="true">
  72                 <Site id="1" host="localhost"/>    <!-- Maps IIS IID values to the vhost name. -->
  73             </ISAPI>
  74         </Implementation>
  75     </SHIRE>
  76
  77     <Applications xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion"
  78         id="default" providerId="https://localhost/shibboleth/target">
  79
  80         <!--
  81         Controls session lifetimes, address checks, cookie handling, WAYF, and the SHIRE location.
  82         You MUST supply a unique shireURL value for each of your applications. The value can be a
  83         relative path, a URL with no hostname (https:///path) or a full URL. The system will compute
  84         the value that applies based on the resource. Using shireSSL="true" will force the protocol
  85         to be https. You should also add "; secure" to the cookieProps in that case.
  86         The default wayfURL is the InQueue federation's service. Change to https://localhost/shibboleth/HS
  87         for internal testing against your own origin.
  88         -->
  89         <Sessions lifetime="7200" timeout="3600" checkAddress="true" checkReplay="true"
  90             shireURL="/Shibboleth.shire" shireSSL="false" cookieName="shib-default-app" cookieProps="; path=/"
  91             wayfURL="https://wayf.internet2.edu/InQueue/WAYF"/>
  92
  93         <!-- You should customize the pages! You can add attributes with values that can be plugged in. -->
  94         <Errors shire="@-PKGSYSCONFDIR-@/shireError.html"
  95             rm="@-PKGSYSCONFDIR-@/rmError.html"
  96             access="@-PKGSYSCONFDIR-@/accessError.html"
  97             supportContact="root@localhost"
  98             logoLocation="/logo.gif"/>
  99
 100         <Policy signRequest="false" signedResponse="false" signedAssertions="false">
 101             <!-- use designators to request specific attributes or none to ask for all -->
 102             <!--
 103             <saml:AttributeDesignator AttributeName="urn:mace:dir:attribute-def:eduPersonScopedAffiliation"
 104                 AttributeNamespace="urn:mace:shibboleth:1.0:attributeNamespace:uri"/>
 105             <saml:AttributeDesignator AttributeName="urn:mace:dir:attribute-def:eduPersonTargetedID"
 106                 AttributeNamespace="urn:mace:shibboleth:1.0:attributeNamespace:uri"/>
 107             -->
 108
 109             <!-- AAP can be inline or in a separate file -->
 110             <AAPProvider type="edu.internet2.middleware.shibboleth.target.provider.XMLAAP" uri="@-PKGSYSCONFDIR-@/AAP.xml"/>
 111             <!--
 112             <AAPProvider type="edu.internet2.middleware.shibboleth.target.provider.XMLAAP"
 113                 <AttributeAcceptancePolicy xmlns="urn:mace:shibboleth:aap:1.0">
 114                     <AttributeRule Name="urn:mace:dir:attribute-def:eduPersonPrincipalName" Header="REMOTE_USER" Alias="user">
 115                         <AnySite>
 116                             <AnyValue/>
 117                         </AnySite>
 118                     </AttributeRule>
 119                 </AttributeAcceptancePolicy>
 120             </AAPProvider>
 121             -->
 122
 123             <!-- Metadata consists of site/operational metadata, trust, revocation providers. Can be external or inline. -->
 124             <FederationProvider type="edu.internet2.middleware.shibboleth.common.provider.XMLMetadata"
 125                 uri="@-PKGSYSCONFDIR-@/sites.xml"/>
 126             <FederationProvider type="edu.internet2.middleware.shibboleth.common.provider.XMLMetadata">
 127                                 <SiteGroup Name="https://example.org/shibboleth" xmlns="urn:mace:shibboleth:1.0">
 128                                         <OriginSite Name="https://example.org/shibboleth/origin">
 129                                                 <Alias>Localhost Test Deployment</Alias>
 130                                                 <Contact Type="technical" Name="Your Name Here" Email="root@localhost"/>
 131                                                 <HandleService Location="https://localhost/shibboleth/HS" Name="CN=localhost,O=Shibboleth Project,C=US"/>
 132                                                 <AttributeAuthority Location="https://localhost/shibboleth/AA" Name="CN=localhost,O=Shibboleth Project,C=US"/>
 133                                                 <Domain>localhost</Domain>
 134                                         </OriginSite>
 135                                 </SiteGroup>
 136             </FederationProvider>
 137
 138             <TrustProvider type="edu.internet2.middleware.shibboleth.common.provider.XMLTrust"
 139                 uri="@-PKGSYSCONFDIR-@/trust.xml"/>
 140             <!--
 141             <RevocationProvider type="edu.internet2.middleware.shibboleth.common.provider.XMLRevocation"
 142                 uri="@-PKGSYSCONFDIR-@/trust.xml"/>
 143             -->
 144
 145             <!-- zero or more SAML Audience condition matches -->
 146             <saml:Audience>urn:mace:inqueue</saml:Audience>
 147         </Policy>
 148
 149         <CredentialUse TLS="defcreds" Signing="defcreds">
 150             <!-- RelyingParty elements customize credentials for specific origins or federations -->
 151             <!--
 152             <RelyingParty Name="urn:mace:inqueue" TLS="inqueuecreds" Signing="inqueuecreds"/>
 153             -->
 154         </CredentialUse>
 155
 156
 157         <!-- customize behavior of specific applications -->
 158         <!--
 159         <Application id="foo-admin">
 160             <Sessions shireURL="https:///admin/Shibboleth.shire" cookieName="shib-foo-admin"/>
 161             <Policy>
 162                 <saml:AttributeDesignator AttributeName="urn:mace:dir:attribute-def:eduPersonPrincipalName"
 163                     AttributeNamespace="urn:mace:shibboleth:1.0:attributeNamespace:uri"/>
 164             </Policy>
 165         </Application>
 166         -->
 167
 168     </Applications>
 169
 170     <!-- Define all your private keys and certificates here. -->
 171     <CredentialsProvider type="edu.internet2.middleware.shibboleth.common.Credentials">
 172         <Credentials xmlns="urn:mace:shibboleth:credentials:1.0">
 173             <FileResolver Id="defcreds">
 174                 <Key format="PEM">
 175                     <Path>@-PKGSYSCONFDIR-@/shar.key</Path>
 176                 </Key>
 177                 <Certificate format="PEM">
 178                     <Path>@-PKGSYSCONFDIR-@/shar.crt</Path>
 179                 </Certificate>
 180             </FileResolver>
 181
 182             <!--
 183             <FileResolver Id="inqueuecreds">
 184                 <Key format="PEM">
 185                     <Path>@-PKGSYSCONFDIR-@/inqueue.key</Path>
 186                 </Key>
 187                 <Certificate format="PEM">
 188                     <Path>@-PKGSYSCONFDIR-@/inqueue.crt</Path>
 189                 </Certificate>
 190             </FileResolver>
 191             -->
 192         </Credentials>
 193     </CredentialsProvider>
 194
 195 </ShibbolethTargetConfig>
 196