X-Git-Url: http://www.project-moonshot.org/gitweb/?a=blobdiff_plain;f=configs%2Fshibboleth2.xml.in;h=1bf9bb310ec0e7cb7eecf7f7890e982f2f5867d3;hb=a92f1a857da28cf3e0d865477a4ecd68d6b23226;hp=8a4a4f3482e43342f5ff8404d76b423b5c6c004f;hpb=8f65abe7fc93532fb5abac34228ad1e9c4cfd244;p=shibboleth%2Fsp.git

diff --git a/configs/shibboleth2.xml.in b/configs/shibboleth2.xml.in
index 8a4a4f3..1bf9bb3 100644
--- a/configs/shibboleth2.xml.in
+++ b/configs/shibboleth2.xml.in
@@ -1,279 +1,272 @@
 <SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"
-	xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"
-	xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
-	xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"	
-	xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="urn:mace:shibboleth:2.0:native:sp:config @-PKGXMLDIR-@/shibboleth-2.0-native-sp-config.xsd"
-	logger="@-PKGSYSCONFDIR-@/syslog.logger" clockSkew="180">
+    xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"
+    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
+    xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"    
+    xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="urn:mace:shibboleth:2.0:native:sp:config @-PKGXMLDIR-@/shibboleth-2.0-native-sp-config.xsd"
+    logger="@-PKGSYSCONFDIR-@/syslog.logger" clockSkew="180">
 
-	<!--
-	<Extensions>
-		<Library path="@-LIBEXECDIR-@/adfs.so" fatal="true"/>
-	</Extensions>
-	-->
+    <!-- The OutOfProcess section contains properties affecting the shibd daemon. -->
+    <OutOfProcess logger="@-PKGSYSCONFDIR-@/shibd.logger">
+        <!--
+        <Extensions>
+            <Library path="@-PKGLIBDIR-@/odbc-store.so" fatal="true"/>
+        </Extensions>
+        -->
+    </OutOfProcess>
+    
+    <!-- The InProcess section conrains settings affecting web server modules/filters. -->
+    <InProcess logger="@-PKGSYSCONFDIR-@/native.logger">
+        <ISAPI normalizeRequest="true">
+            <!--
+            Maps IIS Instance ID values to the host scheme/name/port/sslport. The name is
+            required so that the proper <Host> in the request map above is found without
+            having to cover every possible DNS/IP combination the user might enter.
+            The port and scheme can    usually be omitted, so the HTTP request's port and
+            scheme will be used.
+            -->
+            <Site id="1" name="sp.example.org"/>
+        </ISAPI>
+    </InProcess>
 
-	<!-- The OutOfProcess section pertains to components that run in the shibd daemon. -->
-	<OutOfProcess logger="@-PKGSYSCONFDIR-@/shibd.logger">
-		
-		<!--
-		<Extensions>
-			<Library path="@-LIBEXECDIR-@/odbc-store.so" fatal="true"/>
-		</Extensions>
-		-->
+    <!-- Only one listener can be defined, to connect in process modules to shibd. -->
+    <UnixListener address="@-PKGRUNDIR-@/shibd.sock"/>
+    <!-- <TCPListener address="127.0.0.1" port="12345" acl="127.0.0.1"/> -->
     
-		<!-- Only one listener can be defined. -->
-		   <UnixListener address="@-VARRUNDIR-@/shib-shar.sock"/>
-		
-		<!-- <TCPListener address="127.0.0.1" port="12345" acl="127.0.0.1"/> -->
-		
+    <!-- This set of components stores sessions and other persistent data in daemon memory. -->
+    <StorageService type="Memory" id="mem" cleanupInterval="900"/>
+    <SessionCache type="StorageService" StorageService="mem" cacheTimeout="3600" inprocTimeout="900" cleanupInterval="900"/>
+    <ReplayCache StorageService="mem"/>
+    <ArtifactMap artifactTTL="180"/>
 
-		<StorageService type="Memory" id="memory" cleanupInterval="900"/>
-		<SessionCache type="StorageService" StorageService="memory" cacheTimeout="3600"/>
-		<ReplayCache StorageService="memory"/>
-		<ArtifactMap artifactTTL="180"/>
+    <!-- This set of components stores sessions and other persistent data in an ODBC database. -->
+    <!--
+    <StorageService type="ODBC" id="db" cleanupInterval="900">
+        <ConnectionString>
+        DRIVER=drivername;SERVER=dbserver;UID=shibboleth;PWD=password;DATABASE=shibboleth;APP=Shibboleth
+        </ConnectionString>
+    </StorageService>
+    <SessionCache type="StorageService" StorageService="db" cacheTimeout="3600" inprocTimeout="900" cleanupInterval="900"/>
+    <ReplayCache StorageService="db"/>
+    <ArtifactMap StorageService="db" artifactTTL="180"/>
+    -->
 
-		<!--
-		<StorageService type="ODBC" id="db" cleanupInterval="900">
-			<ConnectionString>
-			DRIVER=drivername;SERVER=dbserver;UID=shibboleth;PWD=password;DATABASE=shibboleth;APP=Shibboleth
-			</ConnectionString>
-		</StorageService>
-		<SessionCache type="StorageService" StorageService="db" cacheTimeout="3600"/>
-		<ReplayCache StorageService="db"/>
-		<ArtifactMap StorageService="db" artifactTTL="180"/>
-		-->
-	</OutOfProcess>
-    
-	<!-- The InProcess section pertains to components that run inside the web server. -->
-	<InProcess logger="@-PKGSYSCONFDIR-@/native.logger">
-		<!--
-		To customize behavior, map hostnames and path components to applicationId and other settings.
-		-->
-		<RequestMapper type="Native">
-			<RequestMap applicationId="default">
-				<!--
-				The example requires a session for documents in /secure on the containing host with http and
-				https on the default ports. Note that the name and port in the <Host> elements MUST match
-				Apache's ServerName and Port directives or the IIS Site name in the <ISAPI> element
-				below.
-				-->
-				<Host name="sp.example.org">
-					<Path name="secure" authType="shibboleth" requireSession="true">
-						<!-- Example shows the folder "/secure/admin" assigned to a separate <Application> -->
-						<!--
-						<Path name="admin" applicationId="foo-admin"/>
-						-->
-					</Path>
-				</Host>
-			</RequestMap>
-		</RequestMapper>
-		
-		<Implementation>
-			<ISAPI normalizeRequest="true">
-				<!--
-				Maps IIS Instance ID values to the host scheme/name/port/sslport. The name is
-				required so that the proper <Host> in the request map above is found without
-				having to cover every possible DNS/IP combination the user might enter.
-				The port and scheme can	usually be omitted, so the HTTP request's port and
-				scheme will be used.
-				-->
-				<Site id="1" name="sp.example.org"/>
-			</ISAPI>
-		</Implementation>
-	</InProcess>
+    <!-- To customize behavior, map hostnames and path components to applicationId and other settings. -->
+    <RequestMapper type="Native">
+        <RequestMap applicationId="default">
+            <!--
+            The example requires a session for documents in /secure on the containing host with http and
+            https on the default ports. Note that the name and port in the <Host> elements MUST match
+            Apache's ServerName and Port directives or the IIS Site name in the <ISAPI> element
+            below.
+            -->
+            <Host name="sp.example.org">
+                <Path name="secure" authType="shibboleth" requireSession="true">
+                    <!-- Example shows the folder "/secure/admin" assigned to a separate <Application> -->
+                    <!--
+                    <Path name="admin" applicationId="foo-admin"/>
+                    -->
+                </Path>
+            </Host>
+        </RequestMap>
+    </RequestMapper>
+
+    <!--
+    The ApplicationDefaults element is where most of Shibboleth's SAML bits are defined.
+    Resource requests are mapped by the RequestMapper to an applicationId that
+    points into to this section.
+    -->
+    <ApplicationDefaults id="default" policyId="default" entityID="https://sp.example.org/shibboleth"
+        homeURL="https://sp.example.org/index.html"
+        REMOTE_USER="eppn persistent-id targeted-id"
+        localLogout="@-PKGSYSCONFDIR-@/localLogout.html"
+        globalLogout="@-PKGSYSCONFDIR-@/globalLogout.html"
+        authType="TLS"
+        artifactEndpointIndex="1"
+        signing="false"
+        encryption="false"
+        requireConfidentiality="true"
+        requireTransportAuth="true"
+        signedAssertions="false"
+        chunkedEncoding="false"
+        connectTimeout="15" timeout="30"
+        >
+
+        <!--
+        Controls session lifetimes, address checks, cookie handling, and the protocol handlers.
+        You MUST supply an effectively unique handlerURL value for each of your applications.
+        The value can be a relative path, a URL with no hostname (https:///path) or a full URL.
+        The system can compute a relative value based on the virtual host. Using handlerSSL="true"
+        will force the protocol to be https. You should also add a cookieProps setting of "; path=/; secure"
+        in that case. Note that while we default checkAddress to "false", this has a negative
+        impact on the security of the SP. Stealing cookies/sessions is much easier with this disabled.
+        -->
+        <Sessions lifetime="28800" timeout="3600" checkAddress="false"
+            handlerURL="/Shibboleth.sso" handlerSSL="false"
+            exportLocation="http://localhost/Shibboleth.sso/GetAssertion"
+            idpHistory="false" idpHistoryDays="7">
+            
+            <!--
+            SessionInitiators handle session requests and relay them to a Discovery page,
+            or to an IdP if possible. Automatic session setup will use the default or first
+            element (or requireSessionWith can specify a specific id to use).
+            -->
 
-	<!--
-	The Applications section is where most of Shibboleth's SAML bits are defined.
-	Resource requests are mapped in the Local section into an applicationId that
-	points into to this section.
-	-->
-	<Applications id="default" policyId="default" entityID="https://sp.example.org/shibboleth"
-		homeURL="https://sp.example.org/index.html" REMOTE_USER="eppn persistent-id"
-		localLogout="@-PKGSYSCONFDIR-@/localLogout.html"
-		globalLogout="@-PKGSYSCONFDIR-@/globalLogout.html">
+            <!-- Default example directs to a specific IdP's SSO service (favoring SAML 2 over Shib 1). -->
+            <SessionInitiator type="Chaining" Location="/Login" isDefault="true" id="Intranet"
+                    relayState="cookie" entityID="https://idp.example.org/shibboleth">
+                <SessionInitiator type="SAML2" defaultACSIndex="1" template="@-PKGSYSCONFDIR-@/bindingTemplate.html"/>
+                <SessionInitiator type="Shib1" defaultACSIndex="5"/>
+            </SessionInitiator>
+            
+            <!-- An example using an old-style WAYF, which means Shib 1 only unless an entityID is provided. -->
+            <SessionInitiator type="Chaining" Location="/WAYF" id="WAYF" relayState="cookie">
+                <SessionInitiator type="SAML2" defaultACSIndex="1" template="@-PKGSYSCONFDIR-@/bindingTemplate.html"/>
+                <SessionInitiator type="Shib1" defaultACSIndex="5"/>
+                <SessionInitiator type="WAYF" defaultACSIndex="5" URL="https://wayf.example.org/WAYF"/>
+            </SessionInitiator>
 
-		<!--
-		Controls session lifetimes, address checks, cookie handling, and the protocol handlers.
-		You MUST supply an effectively unique handlerURL value for each of your applications.
-		The value can be a relative path, a URL with no hostname (https:///path) or a full URL.
-		The system can compute a relative value based on the virtual host. Using handlerSSL="true"
-		will force the protocol to be https. You should also add a cookieProps setting of "; path=/; secure"
-		in that case. Note that while we default checkAddress to "false", this has a negative
-		impact on the security of the SP. Stealing cookies/sessions is much easier with this
-		disabled.
-		-->
-		<Sessions lifetime="28800" timeout="3600" checkAddress="false"
-			handlerURL="/Shibboleth.sso" handlerSSL="false" exportLocation="/GetAssertion"
-			idpHistory="true" idpHistoryDays="7">
-			
-			<!--
-			SessionInitiators handle session requests and relay them to a Discovery page,
-			or to an IdP if possible. Automatic session setup will use the default or first
-			element (or requireSessionWith can specify a specific id to use).
-			-->
+            <!-- An example supporting the new-style of discovery service. -->
+            <SessionInitiator type="Chaining" Location="/DS" id="DS" relayState="cookie">
+                <SessionInitiator type="SAML2" defaultACSIndex="1" template="@-PKGSYSCONFDIR-@/bindingTemplate.html"/>
+                <SessionInitiator type="Shib1" defaultACSIndex="5"/>
+                <SessionInitiator type="SAMLDS" URL="https://ds.example.org/DS"/>
+            </SessionInitiator>
+            
+            <!--
+            md:AssertionConsumerService locations handle specific SSO protocol bindings,
+            such as SAML 2.0 POST or SAML 1.1 Artifact. The isDefault and index attributes
+            are used when sessions are initiated to determine how to tell the IdP where and
+            how to return the response.
+            -->
+            <md:AssertionConsumerService Location="/SAML2/POST" index="1"
+                Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/>
+            <md:AssertionConsumerService Location="/SAML2/POST-SimpleSign" index="2"
+                Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"/>
+            <md:AssertionConsumerService Location="/SAML2/Artifact" index="3"
+                Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"/>
+            <md:AssertionConsumerService Location="/SAML2/ECP" index="4"
+                Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS"/>
+            <md:AssertionConsumerService Location="/SAML/POST" index="5"
+                Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post"/>
+            <md:AssertionConsumerService Location="/SAML/Artifact" index="6"
+                Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01"/>
 
-			<!-- Default example directs to a specific IdP's SSO service (favoring SAML 2 over Shib 1). -->
-			<SessionInitiator type="Chaining" Location="/Login" isDefault="true" id="idp.example.org"
-					relayState="cookie" entityID="https://idp.example.org/shibboleth">
-				<SessionInitiator type="SAML2" defaultACSIndex="1" template="@-PKGSYSCONFDIR-@/bindingTemplate.html"/>
-				<SessionInitiator type="Shib1" defaultACSIndex="4"/>
-			</SessionInitiator>
-			
-			<!-- An example using an old-style WAYF, which means Shib 1 only unless an entityID is provided. -->
-			<SessionInitiator type="Chaining" Location="/WAYF" id="WAYF" relayState="cookie">
-				<SessionInitiator type="SAML2" defaultACSIndex="1" template="@-PKGSYSCONFDIR-@/bindingTemplate.html"/>
-				<SessionInitiator type="Shib1" defaultACSIndex="4"/>
-				<SessionInitiator type="WAYF" defaultACSIndex="4" URL="https://wayf.example.org/WAYF"/>
-			</SessionInitiator>
+            <!-- LogoutInitiators enable SP-initiated local or global/single logout of sessions. -->
+            <LogoutInitiator type="Chaining" Location="/Logout" relayState="cookie">
+                <LogoutInitiator type="SAML2" template="@-PKGSYSCONFDIR-@/bindingTemplate.html"/>
+                <LogoutInitiator type="Local"/>
+            </LogoutInitiator>
 
-			<!-- An example supporting the new-style of discovery service. -->
-			<SessionInitiator type="Chaining" Location="/DS" id="DS" relayState="cookie">
-				<SessionInitiator type="SAML2" defaultACSIndex="1" template="@-PKGSYSCONFDIR-@/bindingTemplate.html"/>
-				<SessionInitiator type="Shib1" defaultACSIndex="4"/>
-				<SessionInitiator type="SAMLDS" URL="https://ds.example.org/DS"/>
-			</SessionInitiator>
-			
-			<!--
-			md:AssertionConsumerService locations handle specific SSO protocol bindings,
-			such as SAML 2.0 POST or SAML 1.1 Artifact. The isDefault and index attributes
-			are used when sessions are initiated to determine how to tell the IdP where and
-			how to return the response.
-			-->
-			<md:AssertionConsumerService Location="/SAML2/POST" index="1"
-				Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/>
-			<md:AssertionConsumerService Location="/SAML2/POST-SimpleSign" index="2"
-				Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"/>
-			<md:AssertionConsumerService Location="/SAML2/Artifact" index="3"
-				Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"/>
-			<md:AssertionConsumerService Location="/SAML/POST" index="4"
-				Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post"/>
-			<md:AssertionConsumerService Location="/SAML/Artifact" index="5"
-				Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01"/>
+            <!-- md:SingleLogoutService locations handle single logout (SLO) protocol messages. -->
+            <md:SingleLogoutService Location="/SLO/SOAP"
+                Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"/>
+            <md:SingleLogoutService Location="/SLO/Redirect" conf:template="@-PKGSYSCONFDIR-@/bindingTemplate.html"
+                Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"/>
+            <md:SingleLogoutService Location="/SLO/POST" conf:template="@-PKGSYSCONFDIR-@/bindingTemplate.html"
+                Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/>
+            <md:SingleLogoutService Location="/SLO/Artifact" conf:template="@-PKGSYSCONFDIR-@/bindingTemplate.html"
+                Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"/>
 
-			<!-- LogoutInitiators enable SP-initiated local or global/single logout of sessions. -->
-			<LogoutInitiator type="Chaining" Location="/Logout">
-				<LogoutInitiator type="SAML2" template="@-PKGSYSCONFDIR-@/bindingTemplate.html"/>
-				<LogoutInitiator type="Local"/>
-			</LogoutInitiator>
+            <!-- md:ManageNameIDService locations handle NameID management (NIM) protocol messages. -->
+            <md:ManageNameIDService Location="/NIM/SOAP"
+                Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"/>
+            <md:ManageNameIDService Location="/NIM/Redirect" conf:template="@-PKGSYSCONFDIR-@/bindingTemplate.html"
+                Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"/>
+            <md:ManageNameIDService Location="/NIM/POST" conf:template="@-PKGSYSCONFDIR-@/bindingTemplate.html"
+                Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/>
+            <md:ManageNameIDService Location="/NIM/Artifact" conf:template="@-PKGSYSCONFDIR-@/bindingTemplate.html"
+                Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"/>
 
-			<!-- md:SingleLogoutService locations handle single logout (SLO) protocol messages. -->
-			<md:SingleLogoutService Location="/SLO/SOAP"
-				Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"/>
-			<md:SingleLogoutService Location="/SLO/Redirect" conf:template="@-PKGSYSCONFDIR-@/bindingTemplate.html"
-				Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"/>
-			<md:SingleLogoutService Location="/SLO/POST" conf:template="@-PKGSYSCONFDIR-@/bindingTemplate.html"
-				Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/>
-			<md:SingleLogoutService Location="/SLO/Artifact" conf:template="@-PKGSYSCONFDIR-@/bindingTemplate.html"
-				Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"/>
+            <!--
+            md:ArtifactResolutionService locations resolve artifacts issued when using the
+            SAML 2.0 HTTP-Artifact binding on outgoing messages, generally uses SOAP.
+            -->
+            <md:ArtifactResolutionService Location="/Artifact/SOAP" index="1"
+                Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"/>
 
-			<!--
-			md:ArtifactResolutionService locations resolve artifacts issued when using the
-			SAML 2.0 HTTP-Artifact binding on outgoing messages, generally uses SOAP.
-			-->
-			<md:ArtifactResolutionService Location="/Artifact/SOAP" index="1"
-				Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"/>
+            <!-- Extension service that generates "approximate" metadata based on SP configuration. -->
+            <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>
 
-		</Sessions>
+            <!-- Status reporting service. -->
+            <Handler type="Status" Location="/Status" acl="127.0.0.1"/>
 
-		<!--
-		You should customize these pages! You can add attributes with values that can be plugged
-		into your templates. You can remove the access attribute to cause the module to return a
-		standard 403 Forbidden error code if authorization fails, and then customize that condition
-		using your web server.
-		-->
-		<Errors session="@-PKGSYSCONFDIR-@/sessionError.html"
-			metadata="@-PKGSYSCONFDIR-@/metadataError.html"
-			access="@-PKGSYSCONFDIR-@/accessError.html"
-			ssl="@-PKGSYSCONFDIR-@/sslError.html"
-			supportContact="root@localhost"
-			logoLocation="/shibboleth-sp/logo.jpg"
-			styleSheet="/shibboleth-sp/main.css"/>
-		
-		<!-- Configure handling of outgoing messages and SOAP authentication. -->
-		<DefaultRelyingParty authType="TLS" artifactEndpointIndex="1"
-			signRequests="front" encryptRequests="front" signResponses="true" encryptResponses="true">
-			<!-- Uncomment and modify to tweak settings for specific IdPs or groups. -->
-			<!--
-			<RelyingParty Name="SpecialFederation" keyName="SpecialKey"/>
-			-->
-		</DefaultRelyingParty>
+            <!-- Session diagnostic service. -->
+            <Handler type="Session" Location="/Session"/>
 
-		<!-- Chains together all your metadata sources. -->
-		<MetadataProvider type="Chaining">
-			<!-- Dummy metadata for private testing, delete for production deployments. -->
-			<MetadataProvider type="XML" path="@-PKGSYSCONFDIR-@/example-metadata.xml"/>
-		</MetadataProvider>
+        </Sessions>
 
-		<!-- Chain the two built-in trust engines together. -->
-		<TrustEngine type="Chaining">
-			<TrustEngine type="ExplicitKey"/>
-			<TrustEngine type="PKIX"/>
-		</TrustEngine>
+        <!--
+        You should customize these pages! You can add attributes with values that can be plugged
+        into your templates. You can remove the access attribute to cause the module to return a
+        standard 403 Forbidden error code if authorization fails, and then customize that condition
+        using your web server.
+        -->
+        <Errors session="@-PKGSYSCONFDIR-@/sessionError.html"
+            metadata="@-PKGSYSCONFDIR-@/metadataError.html"
+            access="@-PKGSYSCONFDIR-@/accessError.html"
+            ssl="@-PKGSYSCONFDIR-@/sslError.html"
+            supportContact="root@localhost"
+            logoLocation="/shibboleth-sp/logo.jpg"
+            styleSheet="/shibboleth-sp/main.css"/>
+        
+        <!-- Uncomment and modify to tweak settings for specific IdPs or groups. -->
+        <!-- <RelyingParty Name="SpecialFederation" keyName="SpecialKey"/> -->
 
-		<!-- Map to extract attributes from SAML assertions. -->
-		<AttributeExtractor type="XML" path="@-PKGSYSCONFDIR-@/attribute-map.xml"/>
-		
-		<!-- Use a SAML query if no attributes are supplied during SSO. -->
-		<AttributeResolver type="Query"/>
+        <!-- Chains together all your metadata sources. -->
+        <MetadataProvider type="Chaining">
+            <!-- Example of remotely supplied batch of signed metadata. -->
+            <!--
+            <MetadataProvider type="XML" uri="http://federation.org/federation-metadata.xml"
+                 backingFilePath="@-PKGRUNDIR-@/federation-metadata.xml" reloadInterval="7200">
+               <SignatureMetadataFilter certificate="@-PKGSYSCONFDIR-@/fedsigner.pem"/>
+            </MetadataProvider>
+            -->
 
-		<!-- Default filtering policy for recognized attributes, lets other data pass. -->
-		<AttributeFilter type="XML" path="@-PKGSYSCONFDIR-@/attribute-policy.xml"/>
+            <!-- Example of locally maintained metadata. -->
+            <!--
+            <MetadataProvider type="XML" file="@-PKGSYSCONFDIR-@/partner-metadata.xml"/>
+            -->
+        </MetadataProvider>
 
-		<!-- Simple file-based resolver for using a single keypair. -->
-		<CredentialResolver type="File">
-			<Key>
-				<Path>@-PKGSYSCONFDIR-@/sp-example.key</Path>
-			</Key>
-			<Certificate>
-				<Path>@-PKGSYSCONFDIR-@/sp-example.crt</Path>
-			</Certificate>
-		</CredentialResolver>
+        <!-- Chain the two built-in trust engines together. -->
+        <TrustEngine type="Chaining">
+            <TrustEngine type="ExplicitKey"/>
+            <TrustEngine type="PKIX"/>
+        </TrustEngine>
 
-		<!-- Advanced resolver allowing for multiple keypairs. -->
-		<!--
-		<CredentialResolver type="Chaining">
-			<CredentialResolver type="File">
-				<Key>
-					<Name>DefaultKey</Name>
-					<Path>@-PKGSYSCONFDIR-@/sp-example.key</Path>
-				</Key>
-				<Certificate>
-					<Path>@-PKGSYSCONFDIR-@/sp-example.crt</Path>
-				</Certificate>
-			</CredentialResolver>
-			<CredentialResolver type="File">
-				<Key>
-					<Name>SpecialKey</Name>
-					<Path>@-PKGSYSCONFDIR-@/special.key</Path>
-				</Key>
-				<Certificate>
-					<Path>@-PKGSYSCONFDIR-@/special.crt</Path>
-				</Certificate>
-			</CredentialResolver>
-		</CredentialResolver>
-		-->
-	</Applications>
-	
-	<!-- Each policy defines a set of rules to use to secure SAML and SOAP messages. -->
-	<SecurityPolicies>
-		<!-- The predefined policy handles SAML 1 and 2 protocols and permits signing and client TLS. -->
-		<Policy id="default"
-			validate="false"
-			signedAssertions="false"
-			requireConfidentiality="true"
-			requireTransportAuth="true"
-			chunkedEncoding="true"
-			connectTimeout="15" timeout="30"
-			>
-			<Rule type="SAML1Message"/>
-			<Rule type="SAML2Message"/>
-			<Rule type="MessageFlow" checkReplay="true" expires="60"/>
-			<Rule type="ClientCertAuth" errorFatal="true"/>
-			<Rule type="XMLSigning" errorFatal="true"/>
-			<Rule type="SimpleSigning" errorFatal="true"/>
-		</Policy>
-	</SecurityPolicies>
+        <!-- Map to extract attributes from SAML assertions. -->
+        <AttributeExtractor type="XML" path="@-PKGSYSCONFDIR-@/attribute-map.xml"/>
+        
+        <!-- Use a SAML query if no attributes are supplied during SSO. -->
+        <AttributeResolver type="Query"/>
+
+        <!-- Default filtering policy for recognized attributes, lets other data pass. -->
+        <AttributeFilter type="XML" path="@-PKGSYSCONFDIR-@/attribute-policy.xml"/>
+
+        <!-- Simple file-based resolver for using a single keypair. -->
+        <CredentialResolver type="File">
+            <Key>
+                <Path>@-PKGSYSCONFDIR-@/sp-example.key</Path>
+            </Key>
+            <Certificate>
+                <Path>@-PKGSYSCONFDIR-@/sp-example.crt</Path>
+            </Certificate>
+        </CredentialResolver>
+
+    </Applications>
+    
+    <!-- Each policy defines a set of rules to use to secure messages. -->
+    <SecurityPolicies>
+        <!-- The predefined policy enforces replay/freshness and permits signing and client TLS. -->
+        <Policy id="default" validate="false">
+            <Rule type="MessageFlow" checkReplay="true" expires="60"/>
+            <Rule type="ClientCertAuth" errorFatal="true"/>
+            <Rule type="XMLSigning" errorFatal="true"/>
+            <Rule type="SimpleSigning" errorFatal="true"/>
+        </Policy>
+    </SecurityPolicies>
 
 </SPConfig>