Remove extra files.

[shibboleth/sp.git] / configs / apache.config.in

diff --git a/configs/apache.config.in b/configs/apache.config.in
index a1b6ec2..14f80f9 100644 (file)
--- a/configs/apache.config.in
+++ b/configs/apache.config.in
@@ -5,62 +5,53 @@
 ######
 
 #
-# Load the Resource Manager and SHIRE modules.
-# Note that ORDER MATTERS!  Apache runs the modules in the
-# _reverse_ order that modules were loaded.  The RM module
-# depends on the Shire module, so you need this load-order
-# to make sure they are run properly.
+# Load the Shibboleth module.
 #
-# If you see log messages about "NOOP" configurations, then you
-# have messed this up.
-#
-LoadModule shibrm_module /opt/shibboleth/libexec/mod_shibrm.so
-LoadModule shire_module /opt/shibboleth/libexec/mod_shire.so
+LoadModule mod_shib @-LIBEXECDIR-@/mod_shib_13.so
 
 #
-# Global SHIRE Configuration
-# This is the INI file that contains all the global, non-apache-specific
-# configuration.  Look at this file for most of your configuration
-# parameters.
+# Global Configuration
+# This is the XML file that contains all the global, non-apache-specific
+# configuration.  Look at this file for most of your configuration parameters.
 #
-SHIREConfig /opt/shibboleth/etc/shibboleth/shibboleth.ini
+ShibSchemaDir @-PKGXMLDIR-@
+ShibConfig @-PKGSYSCONFDIR-@/shibboleth.xml
 
 #
-# The SHIRE POST processor URL
-# Most of the time, this should be a path only, so that the schema,
-# host, and port will determined dynamically in each virtual host.  If
-# for some reason the dynamically derived URL is not appropriate, a
-# complete URL can be used, and may be set per-vhost explicitly:
-# SHIREURL https://<server-name>/SHIRE
+# An Apache handler needs to be established for the "handler" location.
+# This applies the handler to any requests for a resource with a ".sso"
+# extension.
 #
-# The SHIREURL and subsequent "Location" handler must match.
+<Files *.sso>
+SetHandler shib-handler
+</Files>
 #
-SHIREURL /SHIRE
-<Location /SHIRE>
-  SetHandler shib-shire-post
-</Location>
+# Another way of addressing this is to apply Shibboleth
+# globally to the site in "lazy" session mode:
+# <Location />
+# AuthType shibboleth
+# require shibboleth
+# </Location>
 
 #
-# Configure a test directory
+# Used for example logo and style sheet in error templates.
+#
+<IfModule mod_alias.c>
+  Alias /shibboleth-sp/main.css @-PREFIX-@/doc/shibboleth/main.css
+  Alias /shibboleth-sp/logo.jpg @-PREFIX-@/doc/shibboleth/logo.jpg
+</IfModule>
+
 #
-# You need _at least_ a "require" option for Shib to take effect for this
-# directory.  You can either set the AuthType to "shibboleth", or you can
-# turn on ShibBasicHijack. For Shib, valid-user is a somewhat vague concept
-# and only means that a trusted origin site has authenticated the user, but
-# doesn't mean that any attributes were received.
+# Configure the module for content
+#
+# You can now do most of this in shibboleth.xml using the RequestMap
+# but you MUST enable AuthType shibboleth for the module to process
+# any requests, and there MUST be a require command as well. To
+# enable Shibboleth but not specify any session/access requirements
+# use "require shibboleth".
 #
 <Location /secure>
   AuthType shibboleth
-  require affiliation ~ ^member@.+$
-  # require valid-user
-
-  # Per-directory SHIRE Configuration
-  #ShibBasicHijack On
-  #ShibSSLOnly On
-  #ShibAuthLifetime 14400
-  #ShibAuthTimeout 3600
-
-  # RM Configuration
-  #AuthGroupFile /foo
-  #ShibExportAssertion On
+  ShibRequireSession On
+  require valid-user
 </Location>