https://bugs.internet2.edu/jira/browse/SSPCPP-293

[shibboleth/sp.git] / configs / shibboleth2.xml

diff --git a/configs/shibboleth2.xml b/configs/shibboleth2.xml
index d935c7f..f64d1a4 100644 (file)
--- a/configs/shibboleth2.xml
+++ b/configs/shibboleth2.xml
@@ -105,25 +105,18 @@
             element (or requireSessionWith can specify a specific id to use).
             -->
 
-            <!-- Default example directs to a specific IdP's SSO service (favoring SAML 2 over Shib 1). -->
-            <SessionInitiator type="Chaining" Location="/Login" isDefault="true" id="Intranet"
+            <!-- Default directs to a specific IdP (favoring SAML 2 over Shib 1). -->
+            <SessionInitiator type="Chaining" Location="/Login" isDefault="true" id="Login"
                     relayState="cookie" entityID="https://idp.example.org/shibboleth">
                 <SessionInitiator type="SAML2" acsIndex="1" template="bindingTemplate.html"/>
                 <SessionInitiator type="Shib1" acsIndex="5"/>
-            </SessionInitiator>
-            
-            <!-- An example using an old-style WAYF, which means Shib 1 only unless an entityID is provided. -->
-            <SessionInitiator type="Chaining" Location="/WAYF" id="WAYF" relayState="cookie">
-                <SessionInitiator type="SAML2" acsIndex="1" template="bindingTemplate.html"/>
-                <SessionInitiator type="Shib1" acsIndex="5"/>
-                <SessionInitiator type="WAYF" acsIndex="5" URL="https://wayf.example.org/WAYF"/>
-            </SessionInitiator>
-
-            <!-- An example supporting the new-style of discovery service. -->
-            <SessionInitiator type="Chaining" Location="/DS" id="DS" relayState="cookie">
-                <SessionInitiator type="SAML2" acsIndex="1" template="bindingTemplate.html"/>
-                <SessionInitiator type="Shib1" acsIndex="5"/>
+                <!--
+                To allow for >1 IdP, remove entityID property from Chaining element and add
+                *either* of the SAMLDS or WAYF handlers below:
+                
                 <SessionInitiator type="SAMLDS" URL="https://ds.example.org/DS/WAYF"/>
+                <SessionInitiator type="WAYF" acsIndex="5" URL="https://wayf.example.org/WAYF"/>
+                -->
             </SessionInitiator>
             
             <!--
@@ -227,7 +220,7 @@
         <AttributeExtractor type="XML" validate="true" path="attribute-map.xml"/>
         
         <!-- Use a SAML query if no attributes are supplied during SSO. -->
-        <AttributeResolver type="Query"/>
+        <AttributeResolver type="Query" subjectMatch="true"/>
 
         <!-- Default filtering policy for recognized attributes, lets other data pass. -->
         <AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>
@@ -240,23 +233,7 @@
 
     </ApplicationDefaults>
     
-    <!-- Each policy defines a set of rules to use to secure messages. -->
-    <SecurityPolicies>
-        <!--
-        The predefined policy enforces replay/freshness, standard
-        condition processing, and permits signing and client TLS.
-        -->
-        <Policy id="default" validate="false">
-            <PolicyRule type="MessageFlow" checkReplay="true" expires="60"/>
-            <PolicyRule type="Conditions">
-                <PolicyRule type="Audience"/>
-                <!-- Enable Delegation rule to permit delegated access. -->
-                <!-- <PolicyRule type="Delegation"/> -->
-            </PolicyRule>
-            <PolicyRule type="ClientCertAuth" errorFatal="true"/>
-            <PolicyRule type="XMLSigning" errorFatal="true"/>
-            <PolicyRule type="SimpleSigning" errorFatal="true"/>
-        </Policy>
-    </SecurityPolicies>
+    <!-- Policies that determine how to process and authenticate runtime messages. -->
+    <SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/>
 
 </SPConfig>