configs/shibboleth.xml.in

   1 <ShibbolethTargetConfig xmlns="urn:mace:shibboleth:target:config:1.0"
   2         logger="@-PKGSYSCONFDIR-@/shibboleth.logger" clockSkew="180">
   3
   4     <Extensions>
   5         <Library path="@-LIBEXECDIR-@/xmlproviders.so" fatal="true"/>
   6     </Extensions>
   7
   8     <SHAR logger="@-PKGSYSCONFDIR-@/shar.logger">
   9
  10         <Extensions>
  11             <Library path="@-LIBEXECDIR-@/shib-mysql-ccache.so" fatal="false"/>
  12         </Extensions>
  13
  14         <!-- only one listener can be defined. -->
  15         <UnixListener address="/tmp/shar-socket"/>
  16
  17         <!-- <TCPListener address="127.0.0.1" port="12345" acl="127.0.0.1"/> -->
  18
  19         <!--
  20         See deploy guide for details, but:
  21                 cacheTimeout - how long before expired sessions are purged from the cache
  22                 AATimeout - how long to wait for an AA to respond
  23                 AAConnectTimeout - how long to wait while connecting to an AA
  24                 defaultLifetime - if attributes come back without guidance, how long should they last?
  25                 strictValidity - if we have expired attrs, and can't get new ones, keep using them?
  26                 propagateErrors - suppress errors while getting attrs or let user see them?
  27                 retryInterval - if propagateErrors is false and query fails, how long to wait before trying again
  28         -->
  29         <!--
  30         <MemorySessionCache cleanupInterval="300" cacheTimeout="3600" AATimeout="30" AAConnectTimeout="15"
  31             defaultLifetime="1800" retryInterval="300" strictValidity="false" propagateErrors="true"/>
  32         -->
  33         <MySQLSessionCache cleanupInterval="300" cacheTimeout="3600" AATimeout="30" AAConnectTimeout="15"
  34                defaultLifetime="1800" retryInterval="300" strictValidity="false" propagateErrors="true"
  35                mysqlTimeout="14400">
  36             <Argument>&#x2D;&#x2D;language=@-PREFIX-@/share/english</Argument>
  37             <Argument>&#x2D;&#x2D;datadir=@-PREFIX-@/data</Argument>
  38         </MySQLSessionCache>
  39     </SHAR>
  40
  41     <SHIRE logger="@-PKGSYSCONFDIR-@/shire.logger">
  42         <!--
  43         To customize behavior, map hostnames and path components to applicationId and other settings.
  44         Can be either a pointer to an external file or an inline configuration.
  45         -->
  46         <!--
  47         <RequestMapProvider type="edu.internet2.middleware.shibboleth.target.provider.XMLRequestMap"
  48             uri="@-PKGSYSCONFDIR-@/applications.xml"/>
  49         -->
  50
  51         <RequestMapProvider type="edu.internet2.middleware.shibboleth.target.provider.XMLRequestMap">
  52             <RequestMap applicationId="default">
  53                 <!--
  54                 This requires a session for documents in /secure on the containing host with http and
  55                 https on the default ports. Note that the name and port in the <Host> elements MUST match
  56                 Apache's ServerName and Port directives or the IIS Site mapping in the <ISAPI> element
  57                 below.
  58                 -->
  59                 <Host name="localhost" scheme="https">
  60                     <Path name="secure" requireSession="true" exportAssertion="true">
  61                         <!-- Example shows a subfolder on the SSL port assigned to a separate <Application> -->
  62                             <Path name="admin" applicationId="foo-admin">
  63                         </Path>
  64                 </Host>
  65                 <Host name="localhost" scheme="http">
  66                     <Path name="secure" requireSession="true" exportAssertion="true"/>
  67                 </Host>
  68             </RequestMap>
  69         </RequestMapProvider>
  70
  71         <Implementation>
  72             <ISAPI normalizeRequest="true">
  73                 <!-- Maps IIS IID values to the host scheme/name/port. -->
  74                 <Site id="1" scheme="http" name="localhost" port="80"/>
  75             </ISAPI>
  76         </Implementation>
  77     </SHIRE>
  78
  79     <Applications xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion"
  80         id="default" providerId="https://example.org/shibboleth/target">
  81
  82         <!--
  83         Controls session lifetimes, address checks, cookie handling, WAYF, and the SHIRE location.
  84         You MUST supply a unique shireURL value (and a wayfURL that can be the same) for each of your
  85         applications. The value can be a relative path, a URL with no hostname (https:///path) or a
  86         full URL. The system will compute the value that applies based on the resource. Using
  87         shireSSL="true" will force the protocol to be https. You should also add a cookieProps
  88         setting of "; secure" in that case. The default wayfURL is the InQueue federation's service.
  89         Change to https://localhost/shibboleth/HS for internal testing against your own origin.
  90         -->
  91         <Sessions lifetime="7200" timeout="3600" checkAddress="true"
  92                 wayfURL="https://wayf.internet2.edu/InQueue/WAYF"
  93             shireURL="/Shibboleth.shire" shireSSL="false"/>
  94
  95         <!-- You should customize the pages! You can add attributes with values that can be plugged in. -->
  96         <Errors shire="@-PKGSYSCONFDIR-@/shireError.html"
  97             rm="@-PKGSYSCONFDIR-@/rmError.html"
  98             access="@-PKGSYSCONFDIR-@/accessError.html"
  99             supportContact="root@localhost"
 100             logoLocation="/shibtarget/logo.jpg"
 101             styleSheet="/shibtarget/main.css"/>
 102
 103         <Policy>
 104             <!-- use designators to request specific attributes or none to ask for all -->
 105             <!--
 106             <saml:AttributeDesignator AttributeName="urn:mace:dir:attribute-def:eduPersonScopedAffiliation"
 107                 AttributeNamespace="urn:mace:shibboleth:1.0:attributeNamespace:uri"/>
 108             <saml:AttributeDesignator AttributeName="urn:mace:dir:attribute-def:eduPersonTargetedID"
 109                 AttributeNamespace="urn:mace:shibboleth:1.0:attributeNamespace:uri"/>
 110             -->
 111
 112             <!-- AAP can be inline or in a separate file -->
 113             <AAPProvider type="edu.internet2.middleware.shibboleth.target.provider.XMLAAP" uri="@-PKGSYSCONFDIR-@/AAP.xml"/>
 114             <!--
 115             <AAPProvider type="edu.internet2.middleware.shibboleth.target.provider.XMLAAP"
 116                 <AttributeAcceptancePolicy xmlns="urn:mace:shibboleth:aap:1.0">
 117                     <AttributeRule Name="urn:mace:dir:attribute-def:eduPersonPrincipalName" Header="REMOTE_USER" Alias="user">
 118                         <AnySite>
 119                             <AnyValue/>
 120                         </AnySite>
 121                     </AttributeRule>
 122                 </AttributeAcceptancePolicy>
 123             </AAPProvider>
 124             -->
 125
 126             <!-- Metadata consists of site/operational metadata, trust, revocation providers. Can be external or inline. -->
 127             <FederationProvider type="edu.internet2.middleware.shibboleth.common.provider.XMLMetadata"
 128                 uri="@-PKGSYSCONFDIR-@/IQ-sites.xml"/>
 129             <FederationProvider type="edu.internet2.middleware.shibboleth.common.provider.XMLMetadata">
 130                                 <SiteGroup Name="https://example.org/shibboleth" xmlns="urn:mace:shibboleth:1.0">
 131                                         <OriginSite Name="https://example.org/shibboleth/origin">
 132                                                 <Alias>Localhost Test Deployment</Alias>
 133                                                 <Contact Type="technical" Name="Your Name Here" Email="root@localhost"/>
 134                                                 <HandleService Location="https://localhost/shibboleth/HS" Name="CN=localhost, O=Shibboleth Project, C=US"/>
 135                                                 <AttributeAuthority Location="https://localhost/shibboleth/AA" Name="CN=localhost, O=Shibboleth Project, C=US"/>
 136                                                 <Domain>localhost</Domain>
 137                                         </OriginSite>
 138                                 </SiteGroup>
 139             </FederationProvider>
 140
 141             <TrustProvider type="edu.internet2.middleware.shibboleth.common.provider.XMLTrust"
 142                 uri="@-PKGSYSCONFDIR-@/IQ-trust.xml"/>
 143
 144                         <!--
 145                         Revocation using X.509 CRLs is an optional feature in some trust metadata or you may
 146                         supply your own revocation information locally.
 147                         -->
 148             <!--
 149             <RevocationProvider type="edu.internet2.middleware.shibboleth.common.provider.XMLRevocation"
 150                 uri="@-PKGSYSCONFDIR-@/IQ-trust.xml"/>
 151             -->
 152
 153             <!-- zero or more SAML Audience condition matches -->
 154             <saml:Audience>urn:mace:inqueue</saml:Audience>
 155         </Policy>
 156
 157         <CredentialUse TLS="defcreds" Signing="defcreds">
 158             <!-- RelyingParty elements customize credentials for specific origins or federations -->
 159             <!--
 160             <RelyingParty Name="urn:mace:inqueue" TLS="inqueuecreds" Signing="inqueuecreds"/>
 161             -->
 162         </CredentialUse>
 163
 164
 165         <!--
 166         You can customize behavior of specific applications here. You must supply a complete <Sessions>
 167         element to inidicate a distinct shireURL and wayfURL for this application, along with any other
 168         non-default settings you require. None will be inherited. The wayfURL can be the same as the
 169         default above, but the shireURL MUST be different and MUST map to this application in the
 170         RequestMap. The default elements inside the outer <Applications> element generally have to be
 171         overridden in an all or nothing fashion. That is, if you supply an <Errors> override, you MUST
 172         include all attributes you want to apply, as they will not be inherited. Similarly, if you
 173         specify elements within <Policy> such as <FederationProvider>, they are not additive with the
 174         defaults, but replace them.
 175
 176         The example below shows a special application that requires use of SSL when establishing
 177         sessions, restricts the session cookie to SSL and a specific folder, and inherits most other
 178         behavior except that it requests only EPPN from the origin instead of asking for all attributes.
 179         -->
 180         <!--
 181         <Application id="foo-admin">
 182                 <Sessions lifetime="7200" timeout="3600" checkAddress="true"
 183                     shireURL="/secure/admin/Shibboleth.shire" shireSSL="true" cookieProps="; path=/secure/admin; secure"
 184                     wayfURL="https://wayf.internet2.edu/InQueue/WAYF"/>
 185             <Policy>
 186                 <saml:AttributeDesignator AttributeName="urn:mace:dir:attribute-def:eduPersonPrincipalName"
 187                     AttributeNamespace="urn:mace:shibboleth:1.0:attributeNamespace:uri"/>
 188             </Policy>
 189         </Application>
 190         -->
 191
 192     </Applications>
 193
 194     <!-- Define all the private keys and certificates here that you reference from <CredentialUse>. -->
 195     <CredentialsProvider type="edu.internet2.middleware.shibboleth.common.Credentials">
 196         <Credentials xmlns="urn:mace:shibboleth:credentials:1.0">
 197             <FileResolver Id="defcreds">
 198                 <Key format="PEM">
 199                     <Path>@-PKGSYSCONFDIR-@/shar.key</Path>
 200                 </Key>
 201                 <Certificate format="PEM">
 202                     <Path>@-PKGSYSCONFDIR-@/shar.crt</Path>
 203                 </Certificate>
 204             </FileResolver>
 205
 206             <!--
 207             <FileResolver Id="inqueuecreds">
 208                 <Key format="PEM" password="handsoff">
 209                     <Path>@-PKGSYSCONFDIR-@/inqueue.key</Path>
 210                 </Key>
 211                 <Certificate format="PEM">
 212                     <Path>@-PKGSYSCONFDIR-@/inqueue.crt</Path>
 213                 </Certificate>
 214             </FileResolver>
 215             -->
 216         </Credentials>
 217     </CredentialsProvider>
 218
 219 </ShibbolethTargetConfig>
 220