Add a RP-based key name to credential lookup.

[shibboleth/sp.git] / configs / shibboleth.xml.in

diff --git a/configs/shibboleth.xml.in b/configs/shibboleth.xml.in
index eb59317..93b6bb7 100644 (file)
--- a/configs/shibboleth.xml.in
+++ b/configs/shibboleth.xml.in
@@ -1,5 +1,7 @@
-<SPConfig xmlns="urn:mace:shibboleth:sp:config:2.0"
-       xmlns:conf="urn:mace:shibboleth:sp:config:2.0"
+<SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"
+       xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"
+       xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
+       xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"      
        xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="urn:mace:shibboleth:sp:config:2.0 @-PKGXMLDIR-@/shibboleth-spconfig-2.0.xsd"
@@ -142,27 +144,26 @@
                         * forceAuthn                           insist on user reauthentication at IdP
                         * isPassive                            preclude interaction at IdP or discovery service
                         * authnContextClassRef         URI reference of an AuthnContextClass to request
-                        * authnContextDeclRef          URI reference of an AuthnContextDecl to request
                         * authnContextComparison       comparison operator to apply to AuthnContext reference 
                        -->
 
                        <!-- Default example directs to a specific IdP's SSO service (favoring SAML 2 over Shib 1). -->
                        <SessionInitiator type="Chaining" Location="/Login" isDefault="true" id="example.org"
                                        relayState="cookie" entityID="https://idp.example.org/shibboleth">
-                               <SessionInitiator type="SAML2"/>
+                               <SessionInitiator type="SAML2" template="@-PKGSYSCONFDIR-@/bindingTemplate.html"/>
                                <SessionInitiator type="Shibboleth"/>
                        </SessionInitiator>
                        
                        <!-- An example using an old-style WAYF, which means Shib 1 only unless an entityID is provided. -->
                        <SessionInitiator type="Chaining" Location="/WAYF" id="WAYF" relayState="cookie">
-                               <SessionInitiator type="SAML2"/>
+                               <SessionInitiator type="SAML2" template="@-PKGSYSCONFDIR-@/bindingTemplate.html"/>
                                <SessionInitiator type="Shibboleth"/>
                                <SessionInitiator type="WAYF" URL="https://wayf.example.org/WAYF"/>
                        </SessionInitiator>
 
                        <!-- An example supporting the new-style of discovery service. -->
                        <SessionInitiator type="Chaining" Location="/DS" id="DS" relayState="cookie">
-                               <SessionInitiator type="SAML2"/>
+                               <SessionInitiator type="SAML2" template="@-PKGSYSCONFDIR-@/bindingTemplate.html"/>
                                <SessionInitiator type="Shibboleth"/>
                                <SessionInitiator type="SAMLDS" URL="https://ds.example.org/DS"/>
                        </SessionInitiator>
@@ -173,9 +174,13 @@
                        are used when sessions are initiated to determine how to tell the IdP where and
                        how to return the response.
                        -->
-                       <md:AssertionConsumerService Location="/SAML/POST" isDefault="true" index="1"
+                       <md:AssertionConsumerService Location="/SAML2/POST" index="1" isDefault="true"
+                               Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/>
+                       <md:AssertionConsumerService Location="/SAML2/Artifact" index="2"
+                               Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"/>
+                       <md:AssertionConsumerService Location="/SAML/POST" index="3"
                                Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post"/>
-                       <md:AssertionConsumerService Location="/SAML/Artifact" index="2"
+                       <md:AssertionConsumerService Location="/SAML/Artifact" index="4"
                                Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01"/>
                        
                        <!--
@@ -202,8 +207,13 @@
                        logoLocation="/shibboleth-sp/logo.jpg"
                        styleSheet="/shibboleth-sp/main.css"/>
                
-               <!-- Configure handling of outgoing messages. -->
-               <DefaultRelyingParty authType="TLS" signRequests="false" encryptRequests="true"/>
+               <!-- Configure handling of outgoing messages and SOAP client authentication. -->
+               <DefaultRelyingParty authType="TLS" signRequests="false" encryptRequests="true">
+                       <!-- Uncomment and modify to tweak settings for specific IdPs or groups. -->
+                       <!--
+                       <RelyingParty Name="SpecialFederation" keyName="SpecialKey"/>
+                       -->
+               </DefaultRelyingParty>
 
                <!-- Chains together all your metadata sources. -->
                <MetadataProvider type="Chaining">
@@ -217,10 +227,16 @@
                        <TrustEngine type="PKIX"/>
                </TrustEngine>
 
-               <!-- Built-in attribute resolver to extract data from SAML assertions. -->
-               <AttributeResolver type="Simple" path="@-PKGSYSCONFDIR-@/resolver-simple.xml"/>
+               <!-- Map to extract attributes from SAML assertions. -->
+               <AttributeExtractor type="XML" path="@-PKGSYSCONFDIR-@/attribute-map.xml"/>
+               
+               <!-- Use a SAML query if no attributes are supplied during SSO. -->
+               <AttributeResolver type="Query"/>
+
+               <!-- Default filtering policy for recognized attributes, lets other data pass. -->
+               <AttributeFilter type="XML" path="@-PKGSYSCONFDIR-@/attribute-policy.xml"/>
 
-               <!-- Simple file-based resolver for key/certificate information. -->
+               <!-- Simple file-based resolver for using a single keypair. -->
                <CredentialResolver type="File">
                        <Key>
                                <Path>@-PKGSYSCONFDIR-@/sp-example.key</Path>
@@ -229,6 +245,30 @@
                                <Path>@-PKGSYSCONFDIR-@/sp-example.crt</Path>
                        </Certificate>
                </CredentialResolver>
+
+               <!-- Advanced resolver allowing for multiple keypairs. -->
+               <!--
+               <CredentialResolver type="Chaining">
+                       <CredentialResolver type="File">
+                               <Key>
+                                       <Name>DefaultKey</Name>
+                                       <Path>@-PKGSYSCONFDIR-@/sp-example.key</Path>
+                               </Key>
+                               <Certificate>
+                                       <Path>@-PKGSYSCONFDIR-@/sp-example.crt</Path>
+                               </Certificate>
+                       </CredentialResolver>
+                       <CredentialResolver type="File">
+                               <Key>
+                                       <Name>SpecialKey</Name>
+                                       <Path>@-PKGSYSCONFDIR-@/special.key</Path>
+                               </Key>
+                               <Certificate>
+                                       <Path>@-PKGSYSCONFDIR-@/special.crt</Path>
+                               </Certificate>
+                       </CredentialResolver>
+               </CredentialResolver>
+               -->
        </Applications>
        
        <!-- Each policy defines a set of rules to use to secure SAML and SOAP messages. -->