configs/upgrade.xsl

   1 <?xml version="1.0" encoding="UTF-8"?>
   2 <xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="2.0"
   3     xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
   4     xmlns:oldconf="urn:mace:shibboleth:target:config:1.0"
   5     xmlns:cred="urn:mace:shibboleth:credentials:1.0"
   6     xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"
   7     xmlns="urn:mace:shibboleth:2.0:native:sp:config"
   8     xmlns:saml1="urn:oasis:names:tc:SAML:1.0:assertion"
   9     xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
  10     xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
  11     exclude-result-prefixes="oldconf cred saml1">
  12
  13     <xsl:param name="idp"/>
  14
  15     <!-- Add a comment to the start of the output file. -->
  16     <xsl:template match="/">
  17         <xsl:comment>
  18             <xsl:text>&#160;Generated by upgrade utility: check carefully before deploying.&#160;</xsl:text>
  19         </xsl:comment>
  20         <xsl:apply-templates/>
  21     </xsl:template>
  22
  23     <!--Force UTF-8 encoding for the output.-->
  24     <xsl:output omit-xml-declaration="no" method="xml" encoding="UTF-8" indent="yes"/>
  25
  26     <xsl:template match="oldconf:SPConfig">
  27         <SPConfig logger="{@logger}" clockSkew="{@clockSkew}">
  28             <xsl:text>&#10;</xsl:text>
  29             <xsl:apply-templates select="oldconf:Global"/>
  30             <xsl:text>&#10;</xsl:text>
  31             <xsl:apply-templates select="oldconf:Local"/>
  32             <xsl:text>&#10;</xsl:text>
  33             <xsl:apply-templates select="oldconf:Global/oldconf:UnixListener"/>
  34             <xsl:apply-templates select="oldconf:Global/oldconf:TCPListener"/>
  35             <xsl:text>&#10;</xsl:text>
  36    &#160;<xsl:comment>
  37            <xsl:text>&#160;This set of components stores sessions and other persistent data in daemon memory.&#160;</xsl:text>
  38        </xsl:comment>
  39    &#160;<StorageService type="Memory" id="mem" cleanupInterval="900"/>
  40    &#160;<SessionCache type="StorageService" StorageService="mem" cacheTimeout="{oldconf:Global/oldconf:MemorySessionCache/@cacheTimeout}" inprocTimeout="900" cleanupInterval="900"/>
  41    &#160;<ReplayCache StorageService="mem"/>
  42    &#160;<ArtifactMap artifactTTL="180"/>
  43            <xsl:text>&#10;</xsl:text>
  44    &#160;<xsl:comment>
  45            <xsl:text>&#160;This set of components stores sessions and other persistent data in an ODBC database.&#160;</xsl:text>
  46        </xsl:comment>
  47    &#160;<xsl:comment>
  48             <xsl:text>
  49    &#160;&lt;StorageService type="ODBC" id="db" cleanupInterval="900"&gt;
  50        &#160;&lt;ConnectionString&gt;DRIVER=drivername;SERVER=dbserver;UID=shibboleth;PWD=password;DATABASE=shibboleth;APP=Shibboleth&lt;/ConnectionString&gt;
  51    &#160;&lt;/StorageService&gt;
  52    &#160;&lt;SessionCache type="StorageService" StorageService="db" cacheTimeout="3600" inprocTimeout="900" cleanupInterval="900"/&gt;
  53    &#160;&lt;ReplayCache StorageService="db"/&gt;
  54    &#160;&lt;ArtifactMap StorageService="db" artifactTTL="180"/&gt;
  55     </xsl:text>
  56        </xsl:comment>
  57             <xsl:text>&#10;</xsl:text>
  58             <xsl:apply-templates select="oldconf:Local/oldconf:RequestMapProvider"/>
  59             <xsl:text>&#10;</xsl:text>
  60             <xsl:apply-templates select="oldconf:Applications"/>
  61
  62    &#160;<xsl:comment>
  63        <xsl:text>&#160;Each policy defines a set of rules to use to secure messages.&#160;</xsl:text>
  64     </xsl:comment>
  65    &#160;<SecurityPolicies>
  66        &#160;<xsl:comment>
  67            <xsl:text>&#160;The predefined policy enforces replay/freshness and permits signing and client TLS.&#160;</xsl:text>
  68         </xsl:comment>
  69        &#160;<Policy id="default" validate="false">
  70            &#160;<Rule type="MessageFlow" checkReplay="true" expires="60"/>
  71            &#160;<Rule type="ClientCertAuth" errorFatal="true"/>
  72            &#160;<Rule type="XMLSigning" errorFatal="true"/>
  73            &#160;<Rule type="SimpleSigning" errorFatal="true"/>
  74        &#160;</Policy>
  75    &#160;</SecurityPolicies>
  76         </SPConfig>
  77     </xsl:template>
  78
  79     <!-- Turn <Global> into <OutOfProcess> with the ODBC extension commented out. -->
  80     <xsl:template match="oldconf:Global">
  81    &#160;<OutOfProcess logger="{@logger}">
  82        &#160;<xsl:comment>
  83                <xsl:text>
  84        &#160;&lt;Extensions&gt;
  85            &#160;&lt;Library path="odbc-store.so" fatal="true"/&gt;
  86         &lt;/Extensions&gt;
  87         </xsl:text>
  88         </xsl:comment>
  89    &#160;</OutOfProcess>
  90     </xsl:template>
  91
  92     <!-- Turn <Local> into <InProcess> with the <ISAPI> element up a level. -->
  93     <xsl:template match="oldconf:Local">
  94    &#160;<InProcess logger="{@logger}">
  95         <xsl:if test="@unsetHeaderValue">
  96             <xsl:attribute name="unsetHeaderValue"><xsl:value-of select="@unsetHeaderValue"/></xsl:attribute>
  97         </xsl:if>
  98         <xsl:apply-templates select="oldconf:Implementation/oldconf:ISAPI"/>
  99    &#160;</InProcess>
 100     </xsl:template>
 101     <xsl:template match="oldconf:ISAPI">
 102        &#160;<ISAPI>
 103            <xsl:apply-templates select="@*"/>
 104            <xsl:for-each select="oldconf:Site">
 105            &#160;<Site>
 106                <xsl:apply-templates select="@*"/>
 107                <xsl:for-each select="oldconf:Alias">
 108               &#160;<Alias><xsl:value-of select="text()"/></Alias>
 109                </xsl:for-each>
 110            &#160;</Site>
 111            </xsl:for-each>
 112        &#160;</ISAPI>
 113     </xsl:template>
 114
 115     <!-- Pull in listeners up to the top level. -->
 116     <xsl:template match="oldconf:UnixListener">
 117    &#160;<UnixListener address="shibd.sock"/>
 118     </xsl:template>
 119     <xsl:template match="oldconf:TCPListener">
 120    &#160;<TCPListener address="{@address}" port="{@port}" acl="{@acl}"/>
 121     </xsl:template>
 122
 123     <!-- Transplant old RequestMap into the new namespace, but just copy all the settings. -->
 124     <xsl:template match="oldconf:RequestMapProvider">
 125    &#160;<RequestMapper type="Native">
 126        <xsl:apply-templates select="./*"/>
 127    &#160;</RequestMapper>
 128     </xsl:template>
 129
 130     <xsl:template match="oldconf:Applications">
 131    &#160;<ApplicationDefaults id="{@id}" policyId="default"
 132            entityID="{@providerId}" homeURL="{@homeURL}"
 133            REMOTE_USER="eppn persistent-id targeted-id"
 134            signing="false" encryption="false">
 135         <xsl:attribute name="timeout"><xsl:value-of select="../oldconf:Global/oldconf:MemorySessionCache/@AATimeout"/></xsl:attribute>
 136         <xsl:attribute name="connectTimeout"><xsl:value-of select="../oldconf:Global/oldconf:MemorySessionCache/@AAConnectTimeout"/></xsl:attribute>
 137         <xsl:if test="oldconf:CredentialUse/@TLS!=../oldconf:CredentialsProvider/cred:Credentials/cred:FileResolver[1]/@Id">
 138             <xsl:attribute name="keyName"><xsl:value-of select="oldconf:CredentialUse/@TLS"/></xsl:attribute>
 139         </xsl:if>
 140         <xsl:if test="oldconf:CredentialUse/@signedAssertions">
 141             <xsl:attribute name="requireSignedAssertions"><xsl:value-of select="oldconf:CredentialUse/@signedAssertions"/></xsl:attribute>
 142         </xsl:if>
 143         <xsl:text>&#10;</xsl:text>
 144         <xsl:apply-templates select="oldconf:Sessions"/>
 145         <xsl:text>&#10;</xsl:text>
 146         <xsl:apply-templates select="oldconf:Errors"/>
 147         <xsl:text>&#10;</xsl:text>
 148         <xsl:apply-templates select="oldconf:CredentialUse"/>
 149         <xsl:text>&#10;</xsl:text>
 150        &#160;<MetadataProvider type="Chaining">
 151         <xsl:for-each select="oldconf:MetadataProvider|oldconf:FederationProvider">
 152            &#160;<MetadataProvider type="XML" file="{@uri}"/>
 153         </xsl:for-each>
 154        &#160;</MetadataProvider>
 155
 156        &#160;<xsl:comment>
 157            <xsl:text>&#160;Chain the two built-in trust engines together.&#160;</xsl:text>
 158         </xsl:comment>
 159        &#160;<TrustEngine type="Chaining">
 160            &#160;<TrustEngine type="ExplicitKey"/>
 161            &#160;<TrustEngine type="PKIX"/>
 162        &#160;</TrustEngine>
 163
 164        &#160;<xsl:comment>
 165            <xsl:text>&#160;Map to extract attributes from SAML assertions.&#160;</xsl:text>
 166        </xsl:comment>
 167        &#160;<AttributeExtractor type="XML" path="attribute-map.xml"/>
 168
 169        &#160;<xsl:comment>
 170            <xsl:text>&#160;Use a SAML query if no attributes are supplied during SSO.&#160;</xsl:text>
 171        </xsl:comment>
 172        &#160;<AttributeResolver type="Query"/>
 173
 174        &#160;<xsl:comment>
 175            <xsl:text>&#160;Default filtering policy for recognized attributes, lets other data pass.&#160;</xsl:text>
 176        </xsl:comment>
 177        &#160;<AttributeFilter type="XML" path="attribute-policy.xml"/>
 178
 179         <xsl:text>&#10;</xsl:text>
 180
 181         <!-- Step up and pull in credentials from the top level. -->
 182         <xsl:apply-templates select="../oldconf:CredentialsProvider"/>
 183
 184         <xsl:for-each select="oldconf:Application">
 185            &#160;<ApplicationOverride>
 186             <xsl:apply-templates select="@*"/>
 187             <xsl:apply-templates select="oldconf:Sessions"/>
 188             <xsl:apply-templates select="oldconf:Errors"/>
 189             <xsl:apply-templates select="oldconf:CredentialUse"/>
 190             <xsl:if test="count(oldconf:MetadataProvider) + count(oldconf:FederationProvider) > 0">
 191                &#160;<MetadataProvider type="Chaining">
 192                 <xsl:for-each select="oldconf:MetadataProvider|oldconf:FederationProvider">
 193                    &#160;<MetadataProvider type="XML" file="{@uri}"/>
 194                 </xsl:for-each>
 195                 &#160;</MetadataProvider>
 196             </xsl:if>
 197            &#160;</ApplicationOverride>
 198         </xsl:for-each>
 199
 200    &#160;</ApplicationDefaults>
 201     </xsl:template>
 202
 203     <xsl:template match="oldconf:Sessions">
 204        &#160;<Sessions exportLocation="http://localhost/{@handlerURL}/GetAssertion">
 205         <xsl:apply-templates select="@*"/>
 206
 207            &#160;<xsl:comment>
 208             <xsl:text>
 209            &#160;SessionInitiators handle session requests and relay them to a Discovery page,
 210            &#160;or to an IdP if possible. Automatic session setup will use the default or first
 211            &#160;element (or requireSessionWith can specify a specific one to use).
 212             </xsl:text>
 213            </xsl:comment>
 214         <xsl:for-each select="oldconf:SessionInitiator">
 215             <xsl:text>&#10;</xsl:text>
 216             <xsl:apply-templates select="."/>
 217         </xsl:for-each>
 218
 219            &#160;<xsl:comment>
 220             <xsl:text>
 221            &#160;md:AssertionConsumerService locations handle specific SSO protocol bindings,
 222            &#160;such as SAML 2.0 POST or SAML 1.1 Artifact. The isDefault and index attributes
 223            &#160;are used when sessions are initiated to determine how to tell the IdP where and
 224            &#160;how to return the response.
 225             </xsl:text>
 226            </xsl:comment>
 227            &#160;<md:AssertionConsumerService Location="/SAML2/POST" index="1"
 228                 Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/>
 229            &#160;<md:AssertionConsumerService Location="/SAML2/POST-SimpleSign" index="2"
 230                 Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"/>
 231            &#160;<md:AssertionConsumerService Location="/SAML2/Artifact" index="3"
 232                 Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"/>
 233            &#160;<md:AssertionConsumerService Location="/SAML2/ECP" index="4"
 234                 Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS"/>
 235            &#160;<md:AssertionConsumerService Location="/SAML/POST" index="5"
 236                 Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post"/>
 237            &#160;<md:AssertionConsumerService Location="/SAML/Artifact" index="6"
 238                 Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01"/>
 239
 240            <!-- Turn the old local SLO location into the new LogoutInitiator location. -->
 241            <xsl:variable name="LogoutLocation">
 242                <xsl:choose>
 243                    <xsl:when test="md:SingleLogoutService[1]">
 244                        <xsl:value-of select="md:SingleLogoutService[1]/@Location"/>
 245                    </xsl:when>
 246                    <xsl:otherwise>/Logout</xsl:otherwise>
 247                </xsl:choose>
 248            </xsl:variable>
 249
 250            &#160;<xsl:comment>
 251            <xsl:text>&#160;LogoutInitiators enable SP-initiated local or global/single logout of sessions.&#160;</xsl:text>
 252            </xsl:comment>
 253            &#160;<LogoutInitiator type="Chaining" Location="{$LogoutLocation}" relayState="cookie">
 254                &#160;<LogoutInitiator type="SAML2" template="bindingTemplate.html"/>
 255                &#160;<LogoutInitiator type="Local"/>
 256            &#160;</LogoutInitiator>
 257
 258            &#160;<xsl:comment>
 259            <xsl:text>&#160;md:SingleLogoutService locations handle single logout (SLO) protocol messages.&#160;</xsl:text>
 260            </xsl:comment>
 261            &#160;<md:SingleLogoutService Location="/SLO/SOAP"
 262                 Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"/>
 263            &#160;<md:SingleLogoutService Location="/SLO/Redirect" conf:template="bindingTemplate.html"
 264                 Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"/>
 265            &#160;<md:SingleLogoutService Location="/SLO/POST" conf:template="bindingTemplate.html"
 266                 Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/>
 267            &#160;<md:SingleLogoutService Location="/SLO/Artifact" conf:template="bindingTemplate.html"
 268                 Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"/>
 269
 270            &#160;<xsl:comment>
 271            <xsl:text>&#160;md:ManageNameIDService locations handle NameID management (NIM) protocol messages.&#160;</xsl:text>
 272            </xsl:comment>
 273            &#160;<md:ManageNameIDService Location="/NIM/SOAP"
 274                 Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"/>
 275            &#160;<md:ManageNameIDService Location="/NIM/Redirect" conf:template="bindingTemplate.html"
 276                 Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"/>
 277            &#160;<md:ManageNameIDService Location="/NIM/POST" conf:template="bindingTemplate.html"
 278                 Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/>
 279            &#160;<md:ManageNameIDService Location="/NIM/Artifact" conf:template="bindingTemplate.html"
 280                 Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"/>
 281
 282            &#160;<xsl:comment>
 283             <xsl:text>
 284            &#160;md:ArtifactResolutionService locations resolve artifacts issued when using the
 285            &#160;SAML 2.0 HTTP-Artifact binding on outgoing messages, generally uses SOAP.
 286             </xsl:text>
 287            </xsl:comment>
 288            &#160;<md:ArtifactResolutionService Location="/Artifact/SOAP" index="1"
 289                 Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"/>
 290
 291            &#160;<xsl:comment>
 292            <xsl:text>&#160;Extension service that generates "approximate" metadata based on SP configuration.&#160;</xsl:text>
 293            </xsl:comment>
 294            &#160;<Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>
 295
 296            &#160;<xsl:comment>
 297            <xsl:text>&#160;Status reporting service.&#160;</xsl:text>
 298            </xsl:comment>
 299            &#160;<Handler type="Status" Location="Status" acl="127.0.0.1"/>
 300
 301            &#160;<xsl:comment>
 302            <xsl:text>&#160;Session diagnostic service.&#160;</xsl:text>
 303            </xsl:comment>
 304            &#160;<Handler type="Session" Location="/Session"/>
 305
 306        &#160;</Sessions>
 307     </xsl:template>
 308
 309     <xsl:template match="oldconf:SessionInitiator">
 310            &#160;<SessionInitiator type="Chaining" Location="{@Location}" acsByIndex="false" relayState="cookie">
 311                <xsl:if test="@id">
 312                    <xsl:attribute name="id"><xsl:value-of select="@id"/></xsl:attribute>
 313                </xsl:if>
 314                <xsl:if test="@isDefault">
 315                    <xsl:attribute name="isDefault"><xsl:value-of select="@isDefault"/></xsl:attribute>
 316                </xsl:if>
 317                <xsl:if test="@Location=../oldconf:SessionInitiator[1]/@Location">
 318                    <xsl:if test="$idp">
 319                        <xsl:attribute name="entityID"><xsl:value-of select="$idp"/></xsl:attribute>
 320                    </xsl:if>
 321                </xsl:if>
 322                &#160;<SessionInitiator type="SAML2" defaultACSIndex="1" ECP="true" template="bindingTemplate.html"/>
 323                &#160;<SessionInitiator type="Shib1" defaultACSIndex="4"/>
 324                <xsl:if test="@wayfURL">
 325                    <xsl:if test="@wayfBinding='urn:mace:shibboleth:1.0:profiles:AuthnRequest'">
 326                &#160;<SessionInitiator type="WAYF" URL="{@wayfURL}"/>
 327                    </xsl:if>
 328                </xsl:if>
 329            &#160;</SessionInitiator>
 330     </xsl:template>
 331
 332     <!-- Map <Errors> element across, adding logout templates. -->
 333     <xsl:template match="oldconf:Errors">
 334        &#160;<Errors>
 335        <xsl:apply-templates select="@*"/>
 336        <xsl:attribute name="localLogout">localLogout.html</xsl:attribute>
 337        <xsl:attribute name="globalLogout">globalLogout.html</xsl:attribute>
 338        &#160;</Errors>
 339     </xsl:template>
 340
 341     <!-- Map <CredentialUse> element content into relying party overrides. -->
 342     <xsl:template match="oldconf:CredentialUse">
 343         <xsl:for-each select="oldconf:RelyingParty">
 344        &#160;<RelyingParty Name="{@Name}">
 345            <xsl:if test="@TLS">
 346                <xsl:attribute name="keyName"><xsl:value-of select="@TLS"/></xsl:attribute>
 347            </xsl:if>
 348        &#160;</RelyingParty>
 349         </xsl:for-each>
 350     </xsl:template>
 351
 352     <!-- Map legacy <FileResolver> elements to CredentialResolver plugins. -->
 353     <xsl:template match="oldconf:CredentialsProvider">
 354         <xsl:choose>
 355             <xsl:when test="count(//cred:FileResolver) > 1">
 356        &#160;<CredentialResolver type="Chaining">
 357                 <xsl:apply-templates select="//cred:FileResolver"/>
 358        &#160;</CredentialResolver>
 359             </xsl:when>
 360             <xsl:otherwise>
 361                <xsl:apply-templates select="//cred:FileResolver"/>
 362             </xsl:otherwise>
 363         </xsl:choose>
 364     </xsl:template>
 365     <xsl:template match="cred:FileResolver">
 366        &#160;<CredentialResolver type="File" key="{cred:Key/cred:Path/text()}" certificate="{cred:Certificate/cred:Path/text()}" keyName="{@Id}"/>
 367     </xsl:template>
 368
 369     <!-- Generic rule to pass through all element node content while converting the namespace. -->
 370     <xsl:template match="oldconf:RequestMap|oldconf:Host|oldconf:HostRegex|oldconf:Path|oldconf:PathRegex|oldconf:htaccess|oldconf:AccessControl|oldconf:AND|oldconf:OR|oldconf:NOT">
 371        &#160;<xsl:element name="{name()}">
 372             <xsl:apply-templates select="@*"/>
 373             <xsl:apply-templates select="./*"/>
 374        &#160;</xsl:element>
 375     </xsl:template>
 376
 377     <!-- Generic rule to pass through all attributes plus text content while converting the namespace. -->
 378     <xsl:template match="oldconf:Rule">
 379        &#160;<xsl:element name="{name()}">
 380             <xsl:apply-templates select="@*"/>
 381             <xsl:value-of select="text()"/>
 382        &#160;</xsl:element>
 383     </xsl:template>
 384
 385     <!-- Generic rule to pass through an attribute unmodified. -->
 386     <xsl:template match="@*">
 387         <xsl:attribute name="{name()}"><xsl:value-of select="."/></xsl:attribute>
 388     </xsl:template>
 389
 390     <!-- Strips additional text nodes out of document. -->
 391     <xsl:template match="text()"/>
 392
 393 </xsl:stylesheet>