Change default SQL cache settings.

[shibboleth/sp.git] / configs / shibboleth.xml.in

diff --git a/configs/shibboleth.xml.in b/configs/shibboleth.xml.in
index d24b1de..ee08cb8 100644 (file)
--- a/configs/shibboleth.xml.in
+++ b/configs/shibboleth.xml.in
@@ -8,8 +8,8 @@
                <Library path="@-LIBEXECDIR-@/xmlproviders.so" fatal="true"/>
        </Extensions>
 
-       <!-- The Global section pertains to shared Shibboleth processes like the shibd daemon. -->
-       <Global logger="@-PKGSYSCONFDIR-@/shibd.logger">
+       <!-- The OutOfProcess section pertains to components that rely on a single long-lived process. -->
+       <OutOfProcess logger="@-PKGSYSCONFDIR-@/shibd.logger">
                
                <!--
                <Extensions>
@@ -31,6 +31,7 @@
                        strictValidity - if we have expired attrs, and can't get new ones, keep using them?
                        propagateErrors - suppress errors while getting attrs or let user see them?
                        retryInterval - if propagateErrors is false and query fails, how long to wait before trying again
+                       writeThrough - tells database-backed caches that multiple web servers are sharing the database
                Only one session cache can be defined.
                -->
                <MemorySessionCache cleanupInterval="300" cacheTimeout="3600" AATimeout="30" AAConnectTimeout="15"
@@ -38,7 +39,7 @@
                <!--
                <MySQLSessionCache cleanupInterval="300" cacheTimeout="3600" AATimeout="30" AAConnectTimeout="15"
                        defaultLifetime="1800" retryInterval="300" strictValidity="false" propagateErrors="false"
-                       mysqlTimeout="14400" storeAttributes="false">
+                       mysqlTimeout="14400" storeAttributes="true" writeThrough="false">
                        <Argument>&#x2D;&#x2D;language=@-PREFIX-@/share/english</Argument>
                        <Argument>&#x2D;&#x2D;datadir=@-PREFIX-@/data</Argument>
                </MySQLSessionCache>
@@ -51,10 +52,10 @@
                        <Argument>&#x2D;&#x2D;datadir=@-PREFIX-@/data</Argument>
                </MySQLReplayCache>
                -->
-       </Global>
+       </OutOfProcess>
     
-       <!-- The Local section pertains to resource-serving processes (often process pools) like web servers. -->
-       <Local logger="@-PKGSYSCONFDIR-@/native.logger" localRelayState="true">
+       <!-- The InProcess section pertains to components that support transient process pools like most web servers. -->
+       <InProcess logger="@-PKGSYSCONFDIR-@/native.logger" localRelayState="true">
                <!--
                To customize behavior, map hostnames and path components to applicationId and other settings.
                The following provider types are available with the delivered code:
@@ -81,8 +82,10 @@
                                -->
                                <Host name="sp.example.org">
                                        <Path name="secure" authType="shibboleth" requireSession="true" exportAssertion="true">
-                                               <!-- Example shows a subfolder on the SSL port assigned to a separate <Application> -->
+                                               <!-- Example shows the folder "/secure/admin" assigned to a separate <Application> -->
+                                               <!--
                                                <Path name="admin" applicationId="foo-admin"/>
+                                               -->
                                        </Path>
                                </Host>
                        </RequestMap>
@@ -110,7 +113,7 @@
                                </Site>
                        </ISAPI>
                </Implementation>
-       </Local>
+       </InProcess>
 
        <!--
        The Applications section is where most of Shibboleth's SAML bits are defined.
@@ -127,7 +130,7 @@
                You MUST supply an effectively unique handlerURL value for each of your applications.
                The value can be a relative path, a URL with no hostname (https:///path) or a full URL.
                The system can compute a relative value based on the virtual host. Using handlerSSL="true"
-               will force the protocol to be https. You should also add a cookieProps setting of "; secure"
+               will force the protocol to be https. You should also add a cookieProps setting of "; path=/; secure"
                in that case. Note that while we default checkAddress to "false", this has a negative
                impact on the security of the SP. Stealing cookies/sessions is much easier with this
                disabled.
@@ -190,8 +193,8 @@
                        rm="@-PKGSYSCONFDIR-@/rmError.html"
                        access="@-PKGSYSCONFDIR-@/accessError.html"
                        supportContact="root@localhost"
-                       logoLocation="/shibtarget/logo.jpg"
-                       styleSheet="/shibtarget/main.css"/>
+                       logoLocation="/shibboleth-sp/logo.jpg"
+                       styleSheet="/shibboleth-sp/main.css"/>
 
                <!-- Indicates what credentials to use when communicating -->
                <CredentialUse TLS="defcreds" Signing="defcreds">
@@ -264,10 +267,10 @@
        <CredentialsProvider type="edu.internet2.middleware.shibboleth.common.Credentials">
                <Credentials xmlns="urn:mace:shibboleth:credentials:1.0">
                        <FileResolver Id="defcreds">
-                               <Key format="PEM">
+                               <Key>
                                        <Path>@-PKGSYSCONFDIR-@/sp-example.key</Path>
                                </Key>
-                               <Certificate format="PEM">
+                               <Certificate>
                                        <Path>@-PKGSYSCONFDIR-@/sp-example.crt</Path>
                                </Certificate>
                        </FileResolver>
@@ -279,10 +282,10 @@
                        -->
                        <!--
                        <FileResolver Id="inqueuecreds">
-                               <Key format="PEM">
+                               <Key>
                                        <Path>@-PKGSYSCONFDIR-@/inqueue.key</Path>
                                </Key>
-                               <Certificate format="PEM">
+                               <Certificate>
                                        <Path>@-PKGSYSCONFDIR-@/inqueue.crt</Path>
                                </Certificate>
                        </FileResolver>