-<SPConfig xmlns="urn:mace:shibboleth:target:config:1.0"
+<SPConfig xmlns="urn:mace:shibboleth:sp:config:2.0"
+ xmlns:conf="urn:mace:shibboleth:sp:config:2.0"
+ xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="urn:mace:shibboleth:target:config:1.0 @-PKGXMLDIR-@/shibboleth-targetconfig-1.0.xsd"
- logger="@-PKGSYSCONFDIR-@/shibboleth.logger" clockSkew="180">
+ xsi:schemaLocation="urn:mace:shibboleth:sp:config:2.0 @-PKGXMLDIR-@/shibboleth-spconfig-2.0.xsd"
+ logger="@-PKGSYSCONFDIR-@/syslog.logger" clockSkew="180">
- <!-- These extensions are "universal", loaded by all Shibboleth-aware processes. -->
+ <!--
<Extensions>
- <Library path="@-LIBEXECDIR-@/xmlproviders.so" fatal="true"/>
+ <Library path="@-LIBEXECDIR-@/adfs.so" fatal="true"/>
</Extensions>
+ -->
- <!-- The Global section pertains to shared Shibboleth processes like the shibd daemon. -->
- <Global logger="@-PKGSYSCONFDIR-@/shibd.logger">
+ <!-- The OutOfProcess section pertains to components that run in the shibd daemon. -->
+ <OutOfProcess logger="@-PKGSYSCONFDIR-@/shibd.logger">
<!--
<Extensions>
- <Library path="@-LIBEXECDIR-@/shib-mysql-ccache.so" fatal="false"/>
+ <Library path="@-LIBEXECDIR-@/odbc-store.so" fatal="true"/>
</Extensions>
-->
<!-- <TCPListener address="127.0.0.1" port="12345" acl="127.0.0.1"/> -->
+
+ <StorageService type="Memory" id="memory" cleanupInterval="900"/>
+ <SessionCache type="StorageService" StorageService="memory" cacheTimeout="3600"/>
+ <ReplayCache StorageService="memory"/>
+ <ArtifactMap artifactTTL="180"/>
+
<!--
- See deploy guide for details, but:
- cacheTimeout - how long before expired sessions are purged from the cache
- AATimeout - how long to wait for an AA to respond
- AAConnectTimeout - how long to wait while connecting to an AA
- defaultLifetime - if attributes come back without guidance, how long should they last?
- strictValidity - if we have expired attrs, and can't get new ones, keep using them?
- propagateErrors - suppress errors while getting attrs or let user see them?
- retryInterval - if propagateErrors is false and query fails, how long to wait before trying again
- Only one session cache can be defined.
- -->
- <MemorySessionCache cleanupInterval="300" cacheTimeout="3600" AATimeout="30" AAConnectTimeout="15"
- defaultLifetime="1800" retryInterval="300" strictValidity="false" propagateErrors="false"/>
- <!--
- <MySQLSessionCache cleanupInterval="300" cacheTimeout="3600" AATimeout="30" AAConnectTimeout="15"
- defaultLifetime="1800" retryInterval="300" strictValidity="false" propagateErrors="false"
- mysqlTimeout="14400" storeAttributes="false">
- <Argument>--language=@-PREFIX-@/share/english</Argument>
- <Argument>--datadir=@-PREFIX-@/data</Argument>
- </MySQLSessionCache>
- -->
-
- <!-- Default replay cache is in-memory. -->
- <!--
- <MySQLReplayCache>
- <Argument>--language=@-PREFIX-@/share/english</Argument>
- <Argument>--datadir=@-PREFIX-@/data</Argument>
- </MySQLReplayCache>
+ <StorageService type="ODBC" id="db" cleanupInterval="900">
+ <ConnectionString>
+ DRIVER=drivername;SERVER=dbserver;UID=shibboleth;PWD=password;DATABASE=shibboleth;APP=Shibboleth
+ </ConnectionString>
+ </StorageService>
+ <SessionCache type="StorageService" StorageService="db" cacheTimeout="3600"/>
+ <ReplayCache StorageService="db"/>
+ <ArtifactMap StorageService="db" artifactTTL="180"/>
-->
- </Global>
+ </OutOfProcess>
- <!-- The Local section pertains to resource-serving processes (often process pools) like web servers. -->
- <Local logger="@-PKGSYSCONFDIR-@/native.logger" localRelayState="true">
+ <!-- The InProcess section pertains to components that run inside the web server. -->
+ <InProcess logger="@-PKGSYSCONFDIR-@/native.logger">
<!--
To customize behavior, map hostnames and path components to applicationId and other settings.
The following provider types are available with the delivered code:
- type="edu.internet2.middleware.shibboleth.sp.provider.NativeRequestMapProvider"
+ type="Native"
- Web-server-specific plugin that allows native commands (like Apache's
ShibRequireSession) to override or supplement the XML syntax. The Apache
version also supplies an htaccess authz plugin for all content.
- type="edu.internet2.middleware.shibboleth.sp.provider.XMLRequestMapProvider"
+ type="XML"
- portable plugin that does not support the older Apache-specific commands and works
the same on all web platforms, this plugin does NOT support htaccess files
for authz unless you also place an <htaccess/> element somewhere in the map
By default, the "native" plugin (the first one above) is used, since it matches older
behavior on both Apache and IIS.
-->
- <RequestMapProvider type="edu.internet2.middleware.shibboleth.sp.provider.NativeRequestMapProvider">
+ <RequestMapper type="Native">
<RequestMap applicationId="default">
<!--
This requires a session for documents in /secure on the containing host with http and
-->
<Host name="sp.example.org">
<Path name="secure" authType="shibboleth" requireSession="true" exportAssertion="true">
- <!-- Example shows a subfolder on the SSL port assigned to a separate <Application> -->
+ <!-- Example shows the folder "/secure/admin" assigned to a separate <Application> -->
+ <!--
<Path name="admin" applicationId="foo-admin"/>
+ -->
</Path>
</Host>
</RequestMap>
- </RequestMapProvider>
+ </RequestMapper>
<Implementation>
<ISAPI normalizeRequest="true">
</Site>
</ISAPI>
</Implementation>
- </Local>
+ </InProcess>
<!--
The Applications section is where most of Shibboleth's SAML bits are defined.
Resource requests are mapped in the Local section into an applicationId that
points into to this section.
-->
- <Applications id="default" providerId="https://sp.example.org/shibboleth"
- homeURL="https://sp.example.org/index.html"
- xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion"
- xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">
+ <Applications id="default" policyId="default" entityID="https://sp.example.org/shibboleth"
+ homeURL="https://sp.example.org/index.html">
<!--
Controls session lifetimes, address checks, cookie handling, and the protocol handlers.
You MUST supply an effectively unique handlerURL value for each of your applications.
The value can be a relative path, a URL with no hostname (https:///path) or a full URL.
The system can compute a relative value based on the virtual host. Using handlerSSL="true"
- will force the protocol to be https. You should also add a cookieProps setting of "; secure"
+ will force the protocol to be https. You should also add a cookieProps setting of "; path=/; secure"
in that case. Note that while we default checkAddress to "false", this has a negative
impact on the security of the SP. Stealing cookies/sessions is much easier with this
disabled.
-->
- <Sessions lifetime="7200" timeout="3600" checkAddress="false"
+ <Sessions lifetime="28800" timeout="3600" checkAddress="false"
handlerURL="/Shibboleth.sso" handlerSSL="false" idpHistory="true" idpHistoryDays="7">
<!--
- SessionInitiators handle session requests and relay them to a WAYF or directly
- to an IdP, if possible. Automatic session setup will use the default or first
+ SessionInitiators handle session requests and relay them to a Discovery page,
+ or to an IdP if possible. Automatic session setup will use the default or first
element (or requireSessionWith can specify a specific id to use). Lazy sessions
- can be started with any initiator by redirecting to it. The only Binding supported
- is the "urn:mace:shibboleth:sp:1.3:SessionInit" lazy session profile using query
- string parameters:
- * target the resource to direct back to later (or homeURL will be used)
+ can be started with any initiator by redirecting to it using query string parameters:
+
+ * entityID optional direct invocation of a specific IdP
+ * target optional resource to direct back to later (or homeURL will be used)
* acsIndex optional index of an ACS to use on the way back in
- * providerId optional direct invocation of a specific IdP
-->
+
+ <!-- Default example directs to a specific IdP's Shibboleth 1.x SSO service. -->
+ <SessionInitiator type="Shibboleth" Location="/Login" isDefault="true" id="example.org"
+ relayState="cookie" entityID="https://idp.example.org/shibboleth"/>
- <!-- This default example directs users to a specific IdP's SSO service. -->
- <SessionInitiator isDefault="true" id="example" Location="/WAYF/idp.example.org"
- Binding="urn:mace:shibboleth:sp:1.3:SessionInit"
- wayfURL="https://idp.example.org/shibboleth-idp/SSO"
- wayfBinding="urn:mace:shibboleth:1.0:profiles:AuthnRequest"/>
+ <!-- An example using the Shibboleth 1.x protocol but with an external WAYF. -->
+ <SessionInitiator type="Shibboleth" Location="/WAYF" id="wayf"
+ relayState="cookie" wayfURL="https://wayf.example.org/WAYF"/>
- <!-- This example directs users to a specific federation's WAYF service. -->
- <SessionInitiator id="IQ" Location="/WAYF/InQueue"
- Binding="urn:mace:shibboleth:sp:1.3:SessionInit"
- wayfURL="https://wayf.internet2.edu/InQueue/WAYF"
- wayfBinding="urn:mace:shibboleth:1.0:profiles:AuthnRequest"/>
-
<!--
- md:AssertionConsumerService elements replace the old shireURL function with an
- explicit handler for particular profiles, such as SAML 1.1 POST or Artifact.
- The isDefault and index attributes are used when sessions are initiated
- to determine how to tell the IdP where and how to return the response.
+ md:AssertionConsumerService elements handle specific SSO protocol bindings,
+ such as SAML 2.0 POST or SAML 1.1 Artifact. The isDefault and index attributes
+ are used when sessions are initiated to determine how to tell the IdP where and
+ how to return the response.
-->
<md:AssertionConsumerService Location="/SAML/POST" isDefault="true" index="1"
Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post"/>
metadata="@-PKGSYSCONFDIR-@/metadataError.html"
rm="@-PKGSYSCONFDIR-@/rmError.html"
access="@-PKGSYSCONFDIR-@/accessError.html"
+ ssl="@-PKGSYSCONFDIR-@/sslError.html"
supportContact="root@localhost"
logoLocation="/shibboleth-sp/logo.jpg"
styleSheet="/shibboleth-sp/main.css"/>
-
- <!-- Indicates what credentials to use when communicating -->
- <CredentialUse TLS="defcreds" Signing="defcreds">
- <!-- RelyingParty elements can customize credentials for specific IdPs/sets. -->
- <!--
- <RelyingParty Name="urn:mace:inqueue" TLS="inqueuecreds" Signing="inqueuecreds"/>
- -->
- </CredentialUse>
-
- <!-- Use designators to request specific attributes or none to ask for all -->
- <!--
- <saml:AttributeDesignator AttributeName="urn:mace:dir:attribute-def:eduPersonScopedAffiliation"
- AttributeNamespace="urn:mace:shibboleth:1.0:attributeNamespace:uri"/>
- -->
-
- <!-- AAP can be inline or in a separate file -->
- <AAPProvider type="edu.internet2.middleware.shibboleth.aap.provider.XMLAAP" uri="@-PKGSYSCONFDIR-@/AAP.xml"/>
- <!-- Operational config consists of metadata and trust providers. Can be external or inline. -->
-
- <!-- Dummy metadata for private testing, delete for production deployments. -->
- <MetadataProvider type="edu.internet2.middleware.shibboleth.metadata.provider.XMLMetadata"
- uri="@-PKGSYSCONFDIR-@/example-metadata.xml"/>
-
- <!-- InQueue pilot federation, delete for production deployments. -->
- <MetadataProvider type="edu.internet2.middleware.shibboleth.metadata.provider.XMLMetadata"
- uri="@-PKGSYSCONFDIR-@/IQ-metadata.xml"/>
-
- <!-- The standard trust provider supports SAMLv2 metadata with path validation extensions. -->
- <TrustProvider type="edu.internet2.middleware.shibboleth.common.provider.ShibbolethTrust"/>
-
- <!--
- Zero or more SAML Audience condition matches (mainly for Shib 1.1 compatibility).
- If you get "policy mismatch errors, you probably need to supply metadata about
- your SP to the IdP if it's running 1.2. Adding an element here is only a partial fix.
- -->
- <saml:Audience>urn:mace:inqueue</saml:Audience>
-
- <!--
- You can customize behavior of specific applications here. The default elements inside the
- outer <Applications> element generally have to be overridden in an all or nothing fashion.
- That is, if you supply a <Sessions> or <Errors> override, you MUST include all attributes
- you want to apply, as they will not be inherited. Similarly, if you specify an element such as
- <MetadataProvider>, it is not additive with the defaults, but replaces them.
-
- Note that each application must have a handlerURL that maps uniquely to it and no other
- application in the <RequestMap>. Otherwise no sessions will reach the application.
- If each application lives on its own vhost, then a single handler at "/Shibboleth.sso"
- is sufficient, since the hostname will distinguish the application.
-
- The example below shows a special application that requires use of SSL when establishing
- sessions, restricts the session cookie to SSL and a specific folder, and inherits most other
- behavior except that it requests only EPPN from the origin instead of asking for all attributes.
- Note that it will inherit all of the handler endpoints defined for the default application
- but will append them to the handlerURL defined here.
- -->
- <!--
- <Application id="foo-admin">
- <Sessions lifetime="7200" timeout="3600" checkAddress="true"
- handlerURL="/secure/admin/Shibboleth.sso" handlerSSL="true"
- cookieProps="; path=/secure/admin; secure"/>
- <saml:AttributeDesignator AttributeName="urn:mace:dir:attribute-def:eduPersonPrincipalName"
- AttributeNamespace="urn:mace:shibboleth:1.0:attributeNamespace:uri"/>
- </Application>
- -->
-
+ <!-- Configure handling of outgoing messages. -->
+ <DefaultRelyingParty authType="TLS" signRequests="false" encryptRequests="true"/>
+
+ <!-- Chains together all your metadata sources. -->
+ <MetadataProvider type="Chaining">
+ <!-- Dummy metadata for private testing, delete for production deployments. -->
+ <MetadataProvider type="XML" path="@-PKGSYSCONFDIR-@/example-metadata.xml"/>
+ </MetadataProvider>
+
+ <!-- Chain the two built-in trust engines together. -->
+ <TrustEngine type="Chaining">
+ <TrustEngine type="ExplicitKey"/>
+ <TrustEngine type="PKIX"/>
+ </TrustEngine>
+
+ <!-- Built-in attribute resolver to extract data from SAML assertions. -->
+ <AttributeResolver type="Simple" path="@-PKGSYSCONFDIR-@/resolver-simple.xml"/>
+
+ <!-- Simple file-based resolver for key/certificate information. -->
+ <CredentialResolver type="File">
+ <Key>
+ <Path>@-PKGSYSCONFDIR-@/sp-example.key</Path>
+ </Key>
+ <Certificate>
+ <Path>@-PKGSYSCONFDIR-@/sp-example.crt</Path>
+ </Certificate>
+ </CredentialResolver>
</Applications>
- <!-- Define all the private keys and certificates here that you reference from <CredentialUse>. -->
- <CredentialsProvider type="edu.internet2.middleware.shibboleth.common.Credentials">
- <Credentials xmlns="urn:mace:shibboleth:credentials:1.0">
- <FileResolver Id="defcreds">
- <Key>
- <Path>@-PKGSYSCONFDIR-@/sp-example.key</Path>
- </Key>
- <Certificate>
- <Path>@-PKGSYSCONFDIR-@/sp-example.crt</Path>
- </Certificate>
- </FileResolver>
-
- <!--
- Mostly you can define a single keypair above, but you can define and name a second
- keypair to be used only in specific cases and then specify when to use it inside a
- <CredentialUse> element.
- -->
- <!--
- <FileResolver Id="inqueuecreds">
- <Key>
- <Path>@-PKGSYSCONFDIR-@/inqueue.key</Path>
- </Key>
- <Certificate>
- <Path>@-PKGSYSCONFDIR-@/inqueue.crt</Path>
- </Certificate>
- </FileResolver>
- -->
- </Credentials>
- </CredentialsProvider>
-
- <!-- Specialized attribute handling for cases with complex syntax. -->
- <AttributeFactory AttributeName="urn:oid:1.3.6.1.4.1.5923.1.1.1.10"
- type="edu.internet2.middleware.shibboleth.common.provider.TargetedIDFactory"/>
+ <!-- Each policy defines a set of rules to use to secure SAML and SOAP messages. -->
+ <SecurityPolicies>
+ <!-- The predefined policy handles SAML 1 and 2 protocols and permits signing and client TLS. -->
+ <Policy id="default"
+ validate="false"
+ signedAssertions="false"
+ requireConfidentiality="true"
+ requireTransportAuth="true"
+ chunkedEncoding="true"
+ connectTimeout="15" timeout="30"
+ >
+ <Rule type="SAML1Message"/>
+ <Rule type="SAML2Message"/>
+ <Rule type="MessageFlow" checkReplay="true" expires="60"/>
+ <Rule type="ClientCertAuth" errorFatal="true"/>
+ <Rule type="XMLSigning" errorFatal="true"/>
+ <Rule type="SimpleSigning" errorFatal="true"/>
+ </Policy>
+ </SecurityPolicies>
</SPConfig>
projects / shibboleth / sp.git / blobdiff