-<ShibbolethTargetConfig xmlns="urn:mace:shibboleth:target:config:1.0"
- logger="@-PKGSYSCONFDIR-@/shibboleth.logger" clockSkew="180">
+<SPConfig xmlns="urn:mace:shibboleth:sp:config:2.0"
+ xmlns:conf="urn:mace:shibboleth:sp:config:2.0"
+ xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="urn:mace:shibboleth:sp:config:2.0 @-PKGXMLDIR-@/shibboleth-spconfig-2.0.xsd"
+ logger="@-PKGSYSCONFDIR-@/syslog.logger" clockSkew="180">
- <Extensions>
- <Library path="@-LIBEXECDIR-@/xmlproviders.so" fatal="true"/>
- </Extensions>
+ <!--
+ <Extensions>
+ <Library path="@-LIBEXECDIR-@/adfs.so" fatal="true"/>
+ </Extensions>
+ -->
- <SHAR logger="@-PKGSYSCONFDIR-@/shar.logger">
-
- <Extensions>
- <Library path="@-LIBEXECDIR-@/shib-mysql-ccache.so" fatal="false"/>
- </Extensions>
+ <!-- The OutOfProcess section pertains to components that rely on a single long-lived process. -->
+ <OutOfProcess logger="@-PKGSYSCONFDIR-@/shibd.logger">
+
+ <!--
+ <Extensions>
+ <Library path="@-LIBEXECDIR-@/odbc-store.so" fatal="true"/>
+ </Extensions>
+ -->
- <!-- only one listener can be defined. -->
- <UnixListener address="/tmp/shar-socket"/>
+ <!-- Only one listener can be defined. -->
+ <UnixListener address="@-VARRUNDIR-@/shib-shar.sock"/>
+
+ <!-- <TCPListener address="127.0.0.1" port="12345" acl="127.0.0.1"/> -->
+
+ <StorageService type="Memory" id="memory" cleanupInterval="900"/>
- <!--
- <TCPListener address="127.0.0.1" port="12345" acl="127.0.0.1"/>
- -->
-
- <!--
- See deploy guide for details, but:
- cacheTimeout - how long before expired sessions are purged from the cache
- AATimeout - how long to wait for an AA to respond
- AAConnectTimeout - how long to wait while connecting to an AA
- defaultLifetime - if attributes come back without guidance, how long should they last?
- strictValidity - if we have expired attrs, and can't get new ones, keep using them?
- propagateErrors - suppress errors while getting attrs or let user see them?
- retryInterval - if propagateErrors is false and query fails, how long to wait before trying again
- -->
- <!--
- <MemorySessionCache cleanupInterval="300" cacheTimeout="3600" AATimeout="30" AAConnectTimeout="15"
- defaultLifetime="1800" retryInterval="300" strictValidity="false" propagateErrors="false"/>
- -->
- <MySQLSessionCache cleanupInterval="300" cacheTimeout="3600" AATimeout="30" AAConnectTimeout="15"
- defaultLifetime="1800" retryInterval="300" strictValidity="false" propagateErrors="false"
- mysqlTimeout="14400">
- <Argument>--language=@-PREFIX-@/share/english</Argument>
- <Argument>--datadir=@-PREFIX-@/data</Argument>
- </MySQLSessionCache>
- </SHAR>
+ <!--
+ <StorageService type="ODBC" id="db" cleanupInterval="900">
+ <ConnectionString>
+ DRIVER=drivername;SERVER=dbserver;UID=shibboleth;PWD=password;DATABASE=shibboleth;APP=Shibboleth
+ </ConnectionString>
+ </StorageService>
+ -->
+
+ <SessionCache type="StorageService" StorageService="memory" cacheTimeout="3600"/>
+ <ReplayCache StorageService="memory"/>
+
+ </OutOfProcess>
- <SHIRE logger="@-PKGSYSCONFDIR-@/shire.logger">
- <!--
- To customize behavior, map hostnames and path components to application names.
- Can be either a pointer to an external file or an inline configuration.
- -->
- <!--
- <RequestMapProvider type="edu.internet2.middleware.shibboleth.target.provider.XMLRequestMap"
- uri="@-PKGSYSCONFDIR-@/applications.xml"/>
- -->
+ <!-- The InProcess section pertains to components that support transient process pools like most web servers. -->
+ <InProcess logger="@-PKGSYSCONFDIR-@/native.logger" localRelayState="true">
+ <!--
+ To customize behavior, map hostnames and path components to applicationId and other settings.
+ The following provider types are available with the delivered code:
+ type="Native"
+ - Web-server-specific plugin that allows native commands (like Apache's
+ ShibRequireSession) to override or supplement the XML syntax. The Apache
+ version also supplies an htaccess authz plugin for all content.
- <RequestMapProvider type="edu.internet2.middleware.shibboleth.target.provider.XMLRequestMap">
- <RequestMap applicationId="default">
- <!--
- If using IIS or apacheConfig is false:
- This requires a session for documents in /secure on the containing host on 80 and 443.
- Note that the name in the <Host> elements MUST match Apache's ServerName directive
- or the IIS host mapping in the <ISAPI> element below.
- -->
- <Host name="localhost" scheme="https">
- <Path name="secure" requireSession="true" exportAssertion="true"/>
- </Host>
- <Host name="localhost" scheme="http">
- <Path name="secure" requireSession="true" exportAssertion="true"/>
- </Host>
- </RequestMap>
- </RequestMapProvider>
-
- <Implementation>
- <ISAPI normalizeRequest="true">
- <Site id="1" host="localhost"/> <!-- Maps IIS IID values to the vhost name. -->
- </ISAPI>
- </Implementation>
- </SHIRE>
+ type="XML"
+ - portable plugin that does not support the older Apache-specific commands and works
+ the same on all web platforms, this plugin does NOT support htaccess files
+ for authz unless you also place an <htaccess/> element somewhere in the map
- <Applications xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion"
- id="default" providerId="https://localhost/shibboleth/target">
+ By default, the "native" plugin (the first one above) is used, since it matches older
+ behavior on both Apache and IIS.
+ -->
+ <RequestMapper type="Native">
+ <RequestMap applicationId="default">
+ <!--
+ This requires a session for documents in /secure on the containing host with http and
+ https on the default ports. Note that the name and port in the <Host> elements MUST match
+ Apache's ServerName and Port directives or the IIS Site name in the <ISAPI> element
+ below.
+ -->
+ <Host name="sp.example.org">
+ <Path name="secure" authType="shibboleth" requireSession="true" exportAssertion="true">
+ <!-- Example shows the folder "/secure/admin" assigned to a separate <Application> -->
+ <!--
+ <Path name="admin" applicationId="foo-admin"/>
+ -->
+ </Path>
+ </Host>
+ </RequestMap>
+ </RequestMapper>
+
+ <Implementation>
+ <ISAPI normalizeRequest="true">
+ <!--
+ Maps IIS Instance ID values to the host scheme/name/port/sslport. The name is
+ required so that the proper <Host> in the request map above is found without
+ having to cover every possible DNS/IP combination the user might enter.
+ The port and scheme can usually be omitted, so the HTTP request's port and
+ scheme will be used.
+
+ <Alias> elements can specify alternate permissible client-specified server names.
+ If a client request uses such a name, normalized redirects will use it, but the
+ request map processing is still based on the default name attribute for the
+ site. This reduces duplicate data entry in the request map for every legal
+ hostname a site might permit. In the example below, only sp.example.org needs a
+ <Host> element in the map, but spalias.example.org could be used by a client
+ and those requests will map to sp.example.org for configuration settings.
+ -->
+ <Site id="1" name="sp.example.org">
+ <Alias>spalias.example.org</Alias>
+ </Site>
+ </ISAPI>
+ </Implementation>
+ </InProcess>
- <!--
- Controls session lifetimes, address checks, cookie handling, WAYF, and the SHIRE location.
- You MUST supply a unique shireURL value for each of your applications. The value can be a
- relative path, a URL with no hostname (https:///path) or a full URL. The system will compute
- the value that applies based on the resource. Using shireSSL="true" will force the protocol
- to be https. You should also add "; secure" to the cookieProps in that case.
- The default wayfURL is the InQueue federation's service. Change to https://localhost/shibboleth/HS
- for internal testing against your own origin.
- -->
- <Sessions lifetime="7200" timeout="3600" checkAddress="true" checkReplay="true"
- shireURL="/Shibboleth.shire" shireSSL="false" cookieName="shib-default-app" cookieProps="; path=/"
- wayfURL="https://wayf.internet2.edu/InQueue/WAYF"/>
+ <!--
+ The Applications section is where most of Shibboleth's SAML bits are defined.
+ Resource requests are mapped in the Local section into an applicationId that
+ points into to this section.
+ -->
+ <Applications id="default" policyId="default" providerId="https://sp.example.org/shibboleth"
+ homeURL="https://sp.example.org/index.html">
- <!-- You should customize the pages! You can add attributes with values that can be plugged in. -->
- <Errors shire="@-PKGSYSCONFDIR-@/shireError.html"
- rm="@-PKGSYSCONFDIR-@/rmError.html"
- access="@-PKGSYSCONFDIR-@/accessError.html"
- supportContact="root@localhost"
- logoLocation="/logo.gif"/>
-
- <Policy signRequest="false" signedResponse="false" signedAssertions="false">
- <!-- use designators to request specific attributes or none to ask for all -->
- <!--
- <saml:AttributeDesignator AttributeName="urn:mace:dir:attribute-def:eduPersonScopedAffiliation"
- AttributeNamespace="urn:mace:shibboleth:1.0:attributeNamespace:uri"/>
- <saml:AttributeDesignator AttributeName="urn:mace:dir:attribute-def:eduPersonTargetedID"
- AttributeNamespace="urn:mace:shibboleth:1.0:attributeNamespace:uri"/>
- -->
+ <!--
+ Controls session lifetimes, address checks, cookie handling, and the protocol handlers.
+ You MUST supply an effectively unique handlerURL value for each of your applications.
+ The value can be a relative path, a URL with no hostname (https:///path) or a full URL.
+ The system can compute a relative value based on the virtual host. Using handlerSSL="true"
+ will force the protocol to be https. You should also add a cookieProps setting of "; path=/; secure"
+ in that case. Note that while we default checkAddress to "false", this has a negative
+ impact on the security of the SP. Stealing cookies/sessions is much easier with this
+ disabled.
+ -->
+ <Sessions lifetime="28800" timeout="3600" checkAddress="false"
+ handlerURL="/Shibboleth.sso" handlerSSL="false" idpHistory="true" idpHistoryDays="7">
+
+ <!--
+ SessionInitiators handle session requests and relay them to a WAYF or directly
+ to an IdP, if possible. Automatic session setup will use the default or first
+ element (or requireSessionWith can specify a specific id to use). Lazy sessions
+ can be started with any initiator by redirecting to it. The only Binding supported
+ is the "urn:mace:shibboleth:sp:1.3:SessionInit" lazy session profile using query
+ string parameters:
+ * target the resource to direct back to later (or homeURL will be used)
+ * acsIndex optional index of an ACS to use on the way back in
+ * providerId optional direct invocation of a specific IdP
+ -->
+
+ <!-- This default example directs users to a specific IdP's SSO service. -->
+ <SessionInitiator isDefault="true" id="example" Location="/WAYF/idp.example.org"
+ Binding="urn:mace:shibboleth:sp:1.3:SessionInit"
+ wayfURL="https://idp.example.org/shibboleth-idp/SSO"
+ wayfBinding="urn:mace:shibboleth:1.0:profiles:AuthnRequest"/>
+
+ <!--
+ md:AssertionConsumerService elements replace the old shireURL function with an
+ explicit handler for particular profiles, such as SAML 1.1 POST or Artifact.
+ The isDefault and index attributes are used when sessions are initiated
+ to determine how to tell the IdP where and how to return the response.
+ -->
+ <md:AssertionConsumerService Location="/SAML/POST" isDefault="true" index="1"
+ Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post"/>
+ <md:AssertionConsumerService Location="/SAML/Artifact" index="2"
+ Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01"/>
+
+ <!--
+ md:SingleLogoutService elements are mostly a placeholder for 2.0, but a simple
+ cookie-clearing option with a ResponseLocation or a return URL parameter is
+ supported via the "urn:mace:shibboleth:sp:1.3:Logout" Binding value.
+ -->
+ <md:SingleLogoutService Location="/Logout" Binding="urn:mace:shibboleth:sp:1.3:Logout"/>
- <!-- AAP can be inline or in a separate file -->
- <AAPProvider type="edu.internet2.middleware.shibboleth.target.provider.XMLAAP" uri="@-PKGSYSCONFDIR-@/AAP.xml"/>
- <!--
- <AAPProvider type="edu.internet2.middleware.shibboleth.target.provider.XMLAAP"
- <AttributeAcceptancePolicy xmlns="urn:mace:shibboleth:aap:1.0">
- <AttributeRule Name="urn:mace:dir:attribute-def:eduPersonPrincipalName" Header="REMOTE_USER" Alias="user">
- <AnySite>
- <AnyValue/>
- </AnySite>
- </AttributeRule>
- </AttributeAcceptancePolicy>
- </AAPProvider>
- -->
-
- <!-- Metadata consists of site/operational metadata, trust, revocation providers. Can be external or inline. -->
- <FederationProvider type="edu.internet2.middleware.shibboleth.common.provider.XMLMetadata"
- uri="@-PKGSYSCONFDIR-@/sites.xml"/>
- <FederationProvider type="edu.internet2.middleware.shibboleth.common.provider.XMLMetadata">
- <SiteGroup Name="https://example.org/shibboleth" xmlns="urn:mace:shibboleth:1.0">
- <OriginSite Name="https://example.org/shibboleth/origin">
- <Alias>Localhost Test Deployment</Alias>
- <Contact Type="technical" Name="Your Name Here" Email="root@localhost"/>
- <HandleService Location="https://localhost/shibboleth/HS" Name="CN=localhost,O=Shibboleth Project,C=US"/>
- <AttributeAuthority Location="https://localhost/shibboleth/AA" Name="CN=localhost,O=Shibboleth Project,C=US"/>
- <Domain>localhost</Domain>
- </OriginSite>
- </SiteGroup>
- </FederationProvider>
-
- <TrustProvider type="edu.internet2.middleware.shibboleth.common.provider.XMLTrust"
- uri="@-PKGSYSCONFDIR-@/trust.xml"/>
- <!--
- <RevocationProvider type="edu.internet2.middleware.shibboleth.common.provider.XMLRevocation"
- uri="@-PKGSYSCONFDIR-@/trust.xml"/>
- -->
-
- <!-- zero or more SAML Audience condition matches -->
- <saml:Audience>urn:mace:inqueue</saml:Audience>
- </Policy>
-
- <CredentialUse TLS="defcreds" Signing="defcreds">
- <!-- RelyingParty elements customize credentials for specific origins or federations -->
- <!--
- <RelyingParty Name="urn:mace:inqueue" TLS="inqueuecreds" Signing="inqueuecreds"/>
- -->
- </CredentialUse>
-
+ </Sessions>
- <!-- customize behavior of specific applications -->
- <!--
- <Application id="foo-admin">
- <Sessions shireURL="https:///admin/Shibboleth.shire" cookieName="shib-foo-admin"/>
- <Policy>
- <saml:AttributeDesignator AttributeName="urn:mace:dir:attribute-def:eduPersonPrincipalName"
- AttributeNamespace="urn:mace:shibboleth:1.0:attributeNamespace:uri"/>
- </Policy>
- </Application>
- -->
+ <!--
+ You should customize these pages! You can add attributes with values that can be plugged
+ into your templates. You can remove the access attribute to cause the module to return a
+ standard 403 Forbidden error code if authorization fails, and then customize that condition
+ using your web server.
+ -->
+ <Errors session="@-PKGSYSCONFDIR-@/sessionError.html"
+ metadata="@-PKGSYSCONFDIR-@/metadataError.html"
+ rm="@-PKGSYSCONFDIR-@/rmError.html"
+ access="@-PKGSYSCONFDIR-@/accessError.html"
+ ssl="@-PKGSYSCONFDIR-@/sslError.html"
+ supportContact="root@localhost"
+ logoLocation="/shibboleth-sp/logo.jpg"
+ styleSheet="/shibboleth-sp/main.css"/>
- </Applications>
-
- <!-- Define all your private keys and certificates here. -->
- <CredentialsProvider type="edu.internet2.middleware.shibboleth.common.Credentials">
- <Credentials xmlns="urn:mace:shibboleth:credentials:1.0">
- <FileResolver Id="defcreds">
- <Key format="PEM">
- <Path>@-PKGSYSCONFDIR-@/shar.key</Path>
- </Key>
- <Certificate format="PEM">
- <Path>@-PKGSYSCONFDIR-@/shar.crt</Path>
- </Certificate>
- </FileResolver>
-
- <!--
- <FileResolver Id="inqueuecreds">
- <Key format="PEM">
- <Path>@-PKGSYSCONFDIR-@/inqueue.key</Path>
- </Key>
- <Certificate format="PEM">
- <Path>@-PKGSYSCONFDIR-@/inqueue.crt</Path>
- </Certificate>
- </FileResolver>
- -->
- </Credentials>
- </CredentialsProvider>
+ <!-- Indicates what credentials to use when communicating -->
+ <CredentialUse TLS="defcreds" Signing="defcreds"/>
+
+ <!-- When adding multiple metadata sources, uncomment the chained provider around them. -->
+ <!-- <MetadataProvider type="Chaining"> -->
+ <!-- Dummy metadata for private testing, delete for production deployments. -->
+ <MetadataProvider type="XML" path="@-PKGSYSCONFDIR-@/example-metadata.xml"/>
+ <!-- </MetadataProvider> -->
+
+ <!-- Chain the two built-in trust engines together. -->
+ <TrustEngine type="Chaining">
+ <TrustEngine type="ExplicitKey"/>
+ <TrustEngine type="PKIX"/>
+ </TrustEngine>
+
+ <AttributeResolver type="Simple" path="@-PKGSYSCONFDIR-@/resolver-simple.xml"/>
+ </Applications>
+
+ <!-- Define all the private keys and certificates here that you reference from <CredentialUse>. -->
+ <Credentials>
+ <CredentialResolver id="defcreds">
+ <Key>
+ <Path>@-PKGSYSCONFDIR-@/sp-example.key</Path>
+ </Key>
+ <Certificate>
+ <Path>@-PKGSYSCONFDIR-@/sp-example.crt</Path>
+ </Certificate>
+ </CredentialResolver>
+ </Credentials>
+
+ <!-- Each policy defines a set of rules to use to secure SAML and SOAP messages. -->
+ <SecurityPolicies>
+ <!-- The predefined policy handles SAML 1 and 2 protocols and permits signing and client TLS. -->
+ <Policy id="default"
+ validate="false"
+ signedAssertions="false"
+ requireConfidentiality="true"
+ requireTransportAuth="true"
+ chunkedEncoding="true"
+ connectTimeout="15" timeout="30"
+ >
+ <Rule type="SAML1Message"/>
+ <Rule type="SAML2Message"/>
+ <Rule type="MessageFlow" checkReplay="true" expires="60"/>
+ <Rule type="ClientCertAuth" errorFatal="true"/>
+ <Rule type="XMLSigning" errorFatal="true"/>
+ <Rule type="SimpleSigning" errorFatal="true"/>
+ </Policy>
+ </SecurityPolicies>
-</ShibbolethTargetConfig>
+</SPConfig>
projects / shibboleth / sp.git / blobdiff