configs/shibboleth2.xml

   1 <SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"
   2     xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"
   3     xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
   4     xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
   5     xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
   6     clockSkew="180">
   7
   8     <!--
   9     By default, in-memory StorageService, ReplayCache, ArtifactMap, and SessionCache
  10     are used. See example-shibboleth2.xml for samples of explicitly configuring them.
  11     -->
  12
  13     <!--
  14     To customize behavior for specific resources on Apache, and to link vhosts or
  15     resources to ApplicationOverride settings below, use web server options/commands.
  16     See https://spaces.internet2.edu/display/SHIB2/NativeSPConfigurationElements for help.
  17
  18     For examples with the RequestMap XML syntax instead, see the example-shibboleth2.xml
  19     file, and the https://spaces.internet2.edu/display/SHIB2/NativeSPRequestMapHowTo topic.
  20     -->
  21
  22     <!-- The ApplicationDefaults element is where most of Shibboleth's SAML bits are defined. -->
  23     <ApplicationDefaults policyId="default"
  24         entityID="https://sp.example.org/shibboleth"
  25         REMOTE_USER="eppn persistent-id targeted-id">
  26
  27         <!--
  28         Controls session lifetimes, address checks, cookie handling, and the protocol handlers.
  29         You MUST supply an effectively unique handlerURL value for each of your applications.
  30         The value can be a relative path, a URL with no hostname (https:///path) or a full URL.
  31         The system can compute a relative value based on the virtual host. Using handlerSSL="true"
  32         will force the protocol to be https. You should also add a cookieProps setting of "; path=/; secure"
  33         in that case. Note that while we default checkAddress to "false", this has a negative
  34         impact on the security of the SP. Stealing cookies/sessions is much easier with this disabled.
  35         -->
  36         <Sessions lifetime="28800" timeout="3600" checkAddress="false"
  37             handlerURL="/Shibboleth.sso" handlerSSL="false">
  38
  39             <!--
  40             SessionInitiators handle session requests and relay them to a Discovery page,
  41             or to an IdP if possible. Automatic session setup will use the default or first
  42             element (or requireSessionWith can specify a specific id to use).
  43             -->
  44
  45             <!-- Default directs to a specific IdP (favoring SAML 2 over Shib 1). -->
  46             <SessionInitiator type="Chaining" Location="/Login" isDefault="true" id="Login"
  47                     relayState="cookie" entityID="https://idp.example.org/shibboleth">
  48                 <SessionInitiator type="SAML2" acsIndex="1" template="bindingTemplate.html"/>
  49                 <SessionInitiator type="Shib1" acsIndex="5"/>
  50                 <!--
  51                 To allow for >1 IdP, remove entityID property from Chaining element and add
  52                 *either* of the SAMLDS or WAYF handlers below:
  53
  54                 <SessionInitiator type="SAMLDS" URL="https://ds.example.org/DS/WAYF"/>
  55                 <SessionInitiator type="WAYF" acsIndex="5" URL="https://wayf.example.org/WAYF"/>
  56                 -->
  57             </SessionInitiator>
  58
  59             <!--
  60             md:AssertionConsumerService locations handle specific SSO protocol bindings,
  61             such as SAML 2.0 POST or SAML 1.1 Artifact. The isDefault and index attributes
  62             are used when sessions are initiated to determine how to tell the IdP where and
  63             how to return the response.
  64             -->
  65             <md:AssertionConsumerService Location="/SAML2/POST" index="1"
  66                 Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/>
  67             <md:AssertionConsumerService Location="/SAML2/POST-SimpleSign" index="2"
  68                 Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"/>
  69             <md:AssertionConsumerService Location="/SAML2/Artifact" index="3"
  70                 Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"/>
  71             <md:AssertionConsumerService Location="/SAML2/ECP" index="4"
  72                 Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS"/>
  73             <md:AssertionConsumerService Location="/SAML/POST" index="5"
  74                 Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post"/>
  75             <md:AssertionConsumerService Location="/SAML/Artifact" index="6"
  76                 Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01"/>
  77
  78             <!-- LogoutInitiators enable SP-initiated local or global/single logout of sessions. -->
  79             <LogoutInitiator type="Chaining" Location="/Logout" relayState="cookie">
  80                 <LogoutInitiator type="SAML2" template="bindingTemplate.html"/>
  81                 <LogoutInitiator type="Local"/>
  82             </LogoutInitiator>
  83
  84             <!-- md:SingleLogoutService locations handle single logout (SLO) protocol messages. -->
  85             <md:SingleLogoutService Location="/SLO/SOAP"
  86                 Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"/>
  87             <md:SingleLogoutService Location="/SLO/Redirect" conf:template="bindingTemplate.html"
  88                 Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"/>
  89             <md:SingleLogoutService Location="/SLO/POST" conf:template="bindingTemplate.html"
  90                 Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/>
  91             <md:SingleLogoutService Location="/SLO/Artifact" conf:template="bindingTemplate.html"
  92                 Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"/>
  93
  94             <!-- md:ManageNameIDService locations handle NameID management (NIM) protocol messages. -->
  95             <md:ManageNameIDService Location="/NIM/SOAP"
  96                 Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"/>
  97             <md:ManageNameIDService Location="/NIM/Redirect" conf:template="bindingTemplate.html"
  98                 Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"/>
  99             <md:ManageNameIDService Location="/NIM/POST" conf:template="bindingTemplate.html"
 100                 Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/>
 101             <md:ManageNameIDService Location="/NIM/Artifact" conf:template="bindingTemplate.html"
 102                 Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"/>
 103
 104             <!--
 105             md:ArtifactResolutionService locations resolve artifacts issued when using the
 106             SAML 2.0 HTTP-Artifact binding on outgoing messages, generally uses SOAP.
 107             -->
 108             <md:ArtifactResolutionService Location="/Artifact/SOAP" index="1"
 109                 Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"/>
 110
 111             <!-- Extension service that generates "approximate" metadata based on SP configuration. -->
 112             <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>
 113
 114             <!-- Status reporting service. -->
 115             <Handler type="Status" Location="/Status" acl="127.0.0.1"/>
 116
 117             <!-- Session diagnostic service. -->
 118             <Handler type="Session" Location="/Session" showAttributeValues="false"/>
 119
 120         </Sessions>
 121
 122         <!--
 123         Allows overriding of error template filenames. You can also add attributes with values
 124         that can be plugged into the templates.
 125         -->
 126         <Errors supportContact="root@localhost"
 127             logoLocation="/shibboleth-sp/logo.jpg"
 128             styleSheet="/shibboleth-sp/main.css"/>
 129
 130         <!-- Chains together all your metadata sources. -->
 131         <MetadataProvider type="Chaining">
 132             <!-- Example of remotely supplied batch of signed metadata. -->
 133             <!--
 134             <MetadataProvider type="XML" uri="http://federation.org/federation-metadata.xml"
 135                  backingFilePath="federation-metadata.xml" reloadInterval="7200">
 136                <MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/>
 137                <MetadataFilter type="Signature" certificate="fedsigner.pem"/>
 138             </MetadataProvider>
 139             -->
 140
 141             <!-- Example of locally maintained metadata. -->
 142             <!--
 143             <MetadataProvider type="XML" file="partner-metadata.xml"/>
 144             -->
 145         </MetadataProvider>
 146
 147         <!-- Map to extract attributes from SAML assertions. -->
 148         <AttributeExtractor type="XML" validate="true" path="attribute-map.xml"/>
 149
 150         <!-- Use a SAML query if no attributes are supplied during SSO. -->
 151         <AttributeResolver type="Query" subjectMatch="true"/>
 152
 153         <!-- Default filtering policy for recognized attributes, lets other data pass. -->
 154         <AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>
 155
 156         <!-- Simple file-based resolver for using a single keypair. -->
 157         <CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>
 158
 159         <!--
 160         The default settings can be overridden by creating ApplicationOverride elements (see
 161         the https://spaces.internet2.edu/display/SHIB2/NativeSPApplicationOverride topic).
 162         Resource requests are mapped by web server commands, or the RequestMapper, to an
 163         applicationId setting.
 164
 165         Example of a second application (for a second vhost) that has a different entityID.
 166         Resources on the vhost would map to an applicationId of "admin":
 167         -->
 168         <!--
 169         <ApplicationOverride id="admin" entityID="https://admin.example.org/shibboleth"/>
 170         -->
 171     </ApplicationDefaults>
 172
 173     <!-- Policies that determine how to process and authenticate runtime messages. -->
 174     <SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/>
 175
 176 </SPConfig>