-<SPConfig xmlns="urn:mace:shibboleth:sp:config:2.0"
- xmlns:conf="urn:mace:shibboleth:sp:config:2.0"
+<SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"
+ xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"
+ xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
+ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="urn:mace:shibboleth:sp:config:2.0 @-PKGXMLDIR-@/shibboleth-spconfig-2.0.xsd"
Resource requests are mapped in the Local section into an applicationId that
points into to this section.
-->
- <Applications id="default" policyId="default" providerId="https://sp.example.org/shibboleth"
+ <Applications id="default" policyId="default" entityID="https://sp.example.org/shibboleth"
homeURL="https://sp.example.org/index.html">
<!--
handlerURL="/Shibboleth.sso" handlerSSL="false" idpHistory="true" idpHistoryDays="7">
<!--
- SessionInitiators handle session requests and relay them to a WAYF or directly
- to an IdP, if possible. Automatic session setup will use the default or first
+ SessionInitiators handle session requests and relay them to a Discovery page,
+ or to an IdP if possible. Automatic session setup will use the default or first
element (or requireSessionWith can specify a specific id to use). Lazy sessions
- can be started with any initiator by redirecting to it. The only Binding supported
- is the "urn:mace:shibboleth:sp:1.3:SessionInit" lazy session profile using query
- string parameters:
- * target the resource to direct back to later (or homeURL will be used)
- * acsIndex optional index of an ACS to use on the way back in
- * providerId optional direct invocation of a specific IdP
+ can be started with any initiator by redirecting to it using query string parameters:
+
+ * entityID optional direct invocation of a specific IdP
+ * target optional resource to direct back to later (or homeURL will be used)
+ * acsIndex optional index of an ACS to use on the way back in
+
+ The following options can be set against content in the RequestMap or supplied on a query string
+ to override default or AuthnRequest template content when using SAML 2.0. They will be ignored
+ if the outgoing SSO protocol doesn't support them.
+
+ * forceAuthn insist on user reauthentication at IdP
+ * isPassive preclude interaction at IdP or discovery service
+ * authnContextClassRef URI reference of an AuthnContextClass to request
+ * authnContextComparison comparison operator to apply to AuthnContext reference
-->
+
+ <!-- Default example directs to a specific IdP's SSO service (favoring SAML 2 over Shib 1). -->
+ <SessionInitiator type="Chaining" Location="/Login" isDefault="true" id="example.org"
+ relayState="cookie" entityID="https://idp.example.org/shibboleth">
+ <SessionInitiator type="SAML2" template="@-PKGSYSCONFDIR-@/bindingTemplate.html"/>
+ <SessionInitiator type="Shibboleth"/>
+ </SessionInitiator>
+
+ <!-- An example using an old-style WAYF, which means Shib 1 only unless an entityID is provided. -->
+ <SessionInitiator type="Chaining" Location="/WAYF" id="WAYF" relayState="cookie">
+ <SessionInitiator type="SAML2" template="@-PKGSYSCONFDIR-@/bindingTemplate.html"/>
+ <SessionInitiator type="Shibboleth"/>
+ <SessionInitiator type="WAYF" URL="https://wayf.example.org/WAYF"/>
+ </SessionInitiator>
+
+ <!-- An example supporting the new-style of discovery service. -->
+ <SessionInitiator type="Chaining" Location="/DS" id="DS" relayState="cookie">
+ <SessionInitiator type="SAML2" template="@-PKGSYSCONFDIR-@/bindingTemplate.html"/>
+ <SessionInitiator type="Shibboleth"/>
+ <SessionInitiator type="SAMLDS" URL="https://ds.example.org/DS"/>
+ </SessionInitiator>
- <!-- This default example directs users to a specific IdP's SSO service. -->
- <SessionInitiator isDefault="true" id="default" Location="/Login"
- Binding="urn:mace:shibboleth:sp:1.3:SessionInit" relayState="cookie"
- wayfURL="https://idp.example.org/shibboleth-idp/SSO"
- wayfBinding="urn:mace:shibboleth:1.0:profiles:AuthnRequest"/>
-
<!--
- md:AssertionConsumerService elements replace the old shireURL function with an
- explicit handler for particular profiles, such as SAML 1.1 POST or Artifact.
- The isDefault and index attributes are used when sessions are initiated
- to determine how to tell the IdP where and how to return the response.
+ md:AssertionConsumerService elements handle specific SSO protocol bindings,
+ such as SAML 2.0 POST or SAML 1.1 Artifact. The isDefault and index attributes
+ are used when sessions are initiated to determine how to tell the IdP where and
+ how to return the response.
-->
- <md:AssertionConsumerService Location="/SAML/POST" isDefault="true" index="1"
+ <md:AssertionConsumerService Location="/SAML2/POST" index="1" isDefault="true"
+ Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/>
+ <md:AssertionConsumerService Location="/SAML2/Artifact" index="2"
+ Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"/>
+ <md:AssertionConsumerService Location="/SAML/POST" index="3"
Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post"/>
- <md:AssertionConsumerService Location="/SAML/Artifact" index="2"
+ <md:AssertionConsumerService Location="/SAML/Artifact" index="4"
Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01"/>
<!--
logoLocation="/shibboleth-sp/logo.jpg"
styleSheet="/shibboleth-sp/main.css"/>
- <!-- Configure handling of outgoing messages. -->
- <DefaultRelyingParty authType="TLS" signRequests="false" encryptRequests="true"/>
+ <!-- Configure handling of outgoing messages and SOAP client authentication. -->
+ <DefaultRelyingParty authType="TLS" signRequests="false" encryptRequests="true">
+ <!-- Uncomment and modify to tweak settings for specific IdPs or groups. -->
+ <!--
+ <RelyingParty Name="SpecialFederation" keyName="SpecialKey"/>
+ -->
+ </DefaultRelyingParty>
<!-- Chains together all your metadata sources. -->
<MetadataProvider type="Chaining">
<TrustEngine type="PKIX"/>
</TrustEngine>
- <!-- Built-in attribute resolver to extract data from SAML assertions. -->
- <AttributeResolver type="Simple" path="@-PKGSYSCONFDIR-@/resolver-simple.xml"/>
+ <!-- Map to extract attributes from SAML assertions. -->
+ <AttributeExtractor type="XML" path="@-PKGSYSCONFDIR-@/attribute-map.xml"/>
+
+ <!-- Use a SAML query if no attributes are supplied during SSO. -->
+ <AttributeResolver type="Query"/>
+
+ <!-- Default filtering policy for recognized attributes, lets other data pass. -->
+ <AttributeFilter type="XML" path="@-PKGSYSCONFDIR-@/attribute-policy.xml"/>
- <!-- Simple file-based resolver for key/certificate information. -->
+ <!-- Simple file-based resolver for using a single keypair. -->
<CredentialResolver type="File">
<Key>
<Path>@-PKGSYSCONFDIR-@/sp-example.key</Path>
<Path>@-PKGSYSCONFDIR-@/sp-example.crt</Path>
</Certificate>
</CredentialResolver>
+
+ <!-- Advanced resolver allowing for multiple keypairs. -->
+ <!--
+ <CredentialResolver type="Chaining">
+ <CredentialResolver type="File">
+ <Key>
+ <Name>DefaultKey</Name>
+ <Path>@-PKGSYSCONFDIR-@/sp-example.key</Path>
+ </Key>
+ <Certificate>
+ <Path>@-PKGSYSCONFDIR-@/sp-example.crt</Path>
+ </Certificate>
+ </CredentialResolver>
+ <CredentialResolver type="File">
+ <Key>
+ <Name>SpecialKey</Name>
+ <Path>@-PKGSYSCONFDIR-@/special.key</Path>
+ </Key>
+ <Certificate>
+ <Path>@-PKGSYSCONFDIR-@/special.crt</Path>
+ </Certificate>
+ </CredentialResolver>
+ </CredentialResolver>
+ -->
</Applications>
<!-- Each policy defines a set of rules to use to secure SAML and SOAP messages. -->
projects / shibboleth / sp.git / blobdiff