1 <ShibbolethTargetConfig xmlns="urn:mace:shibboleth:target:config:1.0"
2 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
3 xsi:schemaLocation="urn:mace:shibboleth:target:config:1.0 @-PKGXMLDIR-@/shibboleth-targetconfig-1.0.xsd"
4 logger="@-PKGSYSCONFDIR-@/shibboleth.logger" clockSkew="180">
7 <Library path="@-LIBEXECDIR-@/xmlproviders.so" fatal="true"/>
10 <SHAR logger="@-PKGSYSCONFDIR-@/shar.logger">
14 <Library path="@-LIBEXECDIR-@/shib-mysql-ccache.so" fatal="false"/>
18 <!-- only one listener can be defined. -->
19 <UnixListener address="/tmp/shar-socket"/>
21 <!-- <TCPListener address="127.0.0.1" port="12345" acl="127.0.0.1"/> -->
24 See deploy guide for details, but:
25 cacheTimeout - how long before expired sessions are purged from the cache
26 AATimeout - how long to wait for an AA to respond
27 AAConnectTimeout - how long to wait while connecting to an AA
28 defaultLifetime - if attributes come back without guidance, how long should they last?
29 strictValidity - if we have expired attrs, and can't get new ones, keep using them?
30 propagateErrors - suppress errors while getting attrs or let user see them?
31 retryInterval - if propagateErrors is false and query fails, how long to wait before trying again
33 <MemorySessionCache cleanupInterval="300" cacheTimeout="3600" AATimeout="30" AAConnectTimeout="15"
34 defaultLifetime="1800" retryInterval="300" strictValidity="false" propagateErrors="true"/>
36 <MySQLSessionCache cleanupInterval="300" cacheTimeout="3600" AATimeout="30" AAConnectTimeout="15"
37 defaultLifetime="1800" retryInterval="300" strictValidity="false" propagateErrors="true"
39 <Argument>--language=@-PREFIX-@/share/english</Argument>
40 <Argument>--datadir=@-PREFIX-@/data</Argument>
45 <SHIRE logger="@-PKGSYSCONFDIR-@/shire.logger">
47 To customize behavior, map hostnames and path components to applicationId and other settings.
48 Can be either a pointer to an external file or an inline configuration.
51 <RequestMapProvider type="edu.internet2.middleware.shibboleth.target.provider.XMLRequestMap"
52 uri="@-PKGSYSCONFDIR-@/applications.xml"/>
55 <RequestMapProvider type="edu.internet2.middleware.shibboleth.target.provider.XMLRequestMap">
56 <RequestMap applicationId="default">
58 This requires a session for documents in /secure on the containing host with http and
59 https on the default ports. Note that the name and port in the <Host> elements MUST match
60 Apache's ServerName and Port directives or the IIS Site mapping in the <ISAPI> element
63 <Host name="localhost">
64 <Path name="secure" requireSession="true" exportAssertion="true">
65 <!-- Example shows a subfolder on the SSL port assigned to a separate <Application> -->
66 <Path name="admin" applicationId="foo-admin"/>
73 <ISAPI normalizeRequest="true">
75 Maps IIS IID values to the host scheme/name/port. The name is required so that
76 the proper <Host> in the request map above is found without having to cover every
77 possible DNS/IP combination the user might enter. The port and scheme can
78 usually be omitted, so the HTTP request's port and scheme will be used.
80 <Site id="1" name="localhost"/>
85 <Applications xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion"
86 id="default" providerId="https://example.org/shibboleth/target">
89 Controls session lifetimes, address checks, cookie handling, WAYF, and the SHIRE location.
90 You MUST supply a unique shireURL value (and a wayfURL that can be the same) for each of your
91 applications. The value can be a relative path, a URL with no hostname (https:///path) or a
92 full URL. The system will compute the value that applies based on the resource. Using
93 shireSSL="true" will force the protocol to be https. You should also add a cookieProps
94 setting of "; secure" in that case. The default wayfURL is the InQueue federation's service.
95 Change to https://localhost/shibboleth/HS for internal testing against your own origin.
97 <Sessions lifetime="7200" timeout="3600" checkAddress="true"
98 wayfURL="https://wayf.internet2.edu/InQueue/WAYF"
99 shireURL="/Shibboleth.shire" shireSSL="false"/>
102 You should customize these pages! You can add attributes with values that can be plugged
105 <Errors shire="@-PKGSYSCONFDIR-@/shireError.html"
106 rm="@-PKGSYSCONFDIR-@/rmError.html"
107 access="@-PKGSYSCONFDIR-@/accessError.html"
108 supportContact="root@localhost"
109 logoLocation="/shibtarget/logo.jpg"
110 styleSheet="/shibtarget/main.css"/>
112 <!-- Indicates what credentials to use when communicating -->
113 <CredentialUse TLS="defcreds" Signing="defcreds">
114 <!-- RelyingParty elements customize credentials for specific origins or federations -->
116 <RelyingParty Name="urn:mace:inqueue" TLS="inqueuecreds" Signing="inqueuecreds"/>
120 <!-- Use designators to request specific attributes or none to ask for all -->
122 <saml:AttributeDesignator AttributeName="urn:mace:dir:attribute-def:eduPersonScopedAffiliation"
123 AttributeNamespace="urn:mace:shibboleth:1.0:attributeNamespace:uri"/>
124 <saml:AttributeDesignator AttributeName="urn:mace:dir:attribute-def:eduPersonTargetedID"
125 AttributeNamespace="urn:mace:shibboleth:1.0:attributeNamespace:uri"/>
128 <!-- AAP can be inline or in a separate file -->
129 <AAPProvider type="edu.internet2.middleware.shibboleth.target.provider.XMLAAP" uri="@-PKGSYSCONFDIR-@/AAP.xml"/>
131 <!-- Metadata consists of site/operational metadata, trust, revocation providers. Can be external or inline. -->
133 <!-- Dummy metadata for private testing, delete when deploying. -->
134 <FederationProvider type="edu.internet2.middleware.shibboleth.common.provider.XMLMetadata">
135 <EntityDescriptor entityID="https://example.org/shibboleth" xmlns="urn:oasis:names:tc:SAML:2.0:metadata">
136 <IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol urn:mace:shibboleth:1.0">
138 <shib:Scope xmlns:shib="urn:mace:shibboleth:metadata:1.0">example.org</shib:Scope>
140 <KeyDescriptor use="signing">
141 <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
142 <ds:KeyName>idp.example.org</ds:KeyName>
145 <NameIDFormat>urn:mace:shibboleth:1.0:nameIdentifier</NameIDFormat>
146 <SingleSignOnService Binding="urn:mace:shibboleth:1.0:profiles:AuthnRequest"
147 Location="https://idp.example.org/shibboleth/HS"/>
149 <AttributeAuthorityDescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol">
151 <shib:Scope xmlns:shib="urn:mace:shibboleth:metadata:1.0">example.org</shib:Scope>
154 <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
155 <ds:KeyName>idp.example.org</ds:KeyName>
158 <AttributeService Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding"
159 Location="https://idp.example.org/shibboleth/AA"/>
160 <NameIDFormat>urn:mace:shibboleth:1.0:nameIdentifier</NameIDFormat>
161 </AttributeAuthorityDescriptor>
163 </FederationProvider>
165 <!-- InQueue pilot federation, delete for production deployments. -->
166 <FederationProvider type="edu.internet2.middleware.shibboleth.common.provider.XMLMetadata"
167 uri="@-PKGSYSCONFDIR-@/IQ-sites.xml"/>
168 <TrustProvider type="edu.internet2.middleware.shibboleth.common.provider.XMLTrust"
169 uri="@-PKGSYSCONFDIR-@/IQ-trust.xml"/>
171 Revocation using X.509 CRLs is an optional feature in some trust metadata or you may
172 supply your own revocation information locally.
175 <RevocationProvider type="edu.internet2.middleware.shibboleth.common.provider.XMLRevocation"
176 uri="@-PKGSYSCONFDIR-@/IQ-trust.xml"/>
179 <!-- zero or more SAML Audience condition matches -->
180 <saml:Audience>urn:mace:inqueue</saml:Audience>
183 You can customize behavior of specific applications here. You must supply a complete <Sessions>
184 element to inidicate a distinct shireURL and wayfURL for this application, along with any other
185 non-default settings you require. None will be inherited. The wayfURL can be the same as the
186 default above, but the shireURL MUST be different and MUST map to this application in the
187 RequestMap. The default elements inside the outer <Applications> element generally have to be
188 overridden in an all or nothing fashion. That is, if you supply an <Errors> override, you MUST
189 include all attributes you want to apply, as they will not be inherited. Similarly, if you
190 specify an element such as <FederationProvider>, it is not additive with the defaults, but
193 The example below shows a special application that requires use of SSL when establishing
194 sessions, restricts the session cookie to SSL and a specific folder, and inherits most other
195 behavior except that it requests only EPPN from the origin instead of asking for all attributes.
198 <Application id="foo-admin">
199 <Sessions lifetime="7200" timeout="3600" checkAddress="true"
200 shireURL="/secure/admin/Shibboleth.shire" shireSSL="true" cookieProps="; path=/secure/admin; secure"
201 wayfURL="https://wayf.internet2.edu/InQueue/WAYF"/>
202 <saml:AttributeDesignator AttributeName="urn:mace:dir:attribute-def:eduPersonPrincipalName"
203 AttributeNamespace="urn:mace:shibboleth:1.0:attributeNamespace:uri"/>
209 <!-- Define all the private keys and certificates here that you reference from <CredentialUse>. -->
210 <CredentialsProvider type="edu.internet2.middleware.shibboleth.common.Credentials">
211 <Credentials xmlns="urn:mace:shibboleth:credentials:1.0">
212 <FileResolver Id="defcreds">
214 <Path>@-PKGSYSCONFDIR-@/shar.key</Path>
216 <Certificate format="PEM">
217 <Path>@-PKGSYSCONFDIR-@/shar.crt</Path>
222 <FileResolver Id="inqueuecreds">
223 <Key format="PEM" password="handsoff">
224 <Path>@-PKGSYSCONFDIR-@/inqueue.key</Path>
226 <Certificate format="PEM">
227 <Path>@-PKGSYSCONFDIR-@/inqueue.crt</Path>
232 </CredentialsProvider>
234 </ShibbolethTargetConfig>