Working version of new handler configuration and supporting files.

[shibboleth/sp.git] / configs / win-shibboleth2.xml

diff --git a/configs/win-shibboleth2.xml b/configs/win-shibboleth2.xml
index cf43f7f..f3f583c 100644 (file)
--- a/configs/win-shibboleth2.xml
+++ b/configs/win-shibboleth2.xml
@@ -77,79 +77,20 @@
         -->\r
         <Sessions lifetime="28800" timeout="3600" checkAddress="false"\r
             handlerURL="/Shibboleth.sso" handlerSSL="false">\r
-            \r
-            <!--\r
-            SessionInitiators handle session requests and relay them to a Discovery page,\r
-            or to an IdP if possible. Automatic session setup will use the default or first\r
-            element (or requireSessionWith can specify a specific id to use).\r
-            -->\r
 \r
-            <!-- Default directs to a specific IdP (favoring SAML 2 over Shib 1). -->\r
-            <SessionInitiator type="Chaining" Location="/Login" isDefault="true" id="Login"\r
-                              relayState="cookie" entityID="https://idp.example.org/shibboleth">\r
-              \r
-                <SessionInitiator type="SAML2" acsIndex="1"/>\r
-                <SessionInitiator type="Shib1" acsIndex="5"/>\r
-                <!--\r
-                To allow for >1 IdP, remove entityID property from Chaining element and add\r
-                *either* of the SAMLDS or WAYF handlers below:\r
-                \r
-                <SessionInitiator type="SAMLDS" URL="https://ds.example.org/DS/WAYF"/>\r
-                <SessionInitiator type="WAYF" acsIndex="5" URL="https://wayf.example.org/WAYF"/>\r
-                -->\r
-            </SessionInitiator>\r
-            \r
             <!--\r
-            md:AssertionConsumerService locations handle specific SSO protocol bindings,\r
-            such as SAML 2.0 POST or SAML 1.1 Artifact. The isDefault and index attributes\r
-            are used when sessions are initiated to determine how to tell the IdP where and\r
-            how to return the response.\r
-            -->\r
-            <md:AssertionConsumerService Location="/SAML2/POST" index="1"\r
-                Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/>\r
-            <md:AssertionConsumerService Location="/SAML2/POST-SimpleSign" index="2"\r
-                Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"/>\r
-            <md:AssertionConsumerService Location="/SAML2/Artifact" index="3"\r
-                Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"/>\r
-            <md:AssertionConsumerService Location="/SAML2/ECP" index="4"\r
-                Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS"/>\r
-            <md:AssertionConsumerService Location="/SAML/POST" index="5"\r
-                Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post"/>\r
-            <md:AssertionConsumerService Location="/SAML/Artifact" index="6"\r
-                Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01"/>\r
-\r
-            <!-- LogoutInitiators enable SP-initiated local or global/single logout of sessions. -->\r
-            <LogoutInitiator type="Chaining" Location="/Logout" relayState="cookie">\r
-                <LogoutInitiator type="SAML2"/>\r
-                <LogoutInitiator type="Local"/>\r
-            </LogoutInitiator>\r
-\r
-            <!-- md:SingleLogoutService locations handle single logout (SLO) protocol messages. -->\r
-            <md:SingleLogoutService Location="/SLO/SOAP"\r
-                Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"/>\r
-            <md:SingleLogoutService Location="/SLO/Redirect"\r
-                Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"/>\r
-            <md:SingleLogoutService Location="/SLO/POST"\r
-                Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/>\r
-            <md:SingleLogoutService Location="/SLO/Artifact"\r
-                Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"/>\r
-\r
-            <!-- md:ManageNameIDService locations handle NameID management (NIM) protocol messages. -->\r
-            <md:ManageNameIDService Location="/NIM/SOAP"\r
-                Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"/>\r
-            <md:ManageNameIDService Location="/NIM/Redirect"\r
-                Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"/>\r
-            <md:ManageNameIDService Location="/NIM/POST"\r
-                Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/>\r
-            <md:ManageNameIDService Location="/NIM/Artifact"\r
-                Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"/>\r
-\r
-            <!--\r
-            md:ArtifactResolutionService locations resolve artifacts issued when using the\r
-            SAML 2.0 HTTP-Artifact binding on outgoing messages, generally uses SOAP.\r
-            -->\r
-            <md:ArtifactResolutionService Location="/Artifact/SOAP" index="1"\r
-                Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"/>\r
+              Configures SSO for a default IdP. To allow for >1 IdP, remove\r
+              entityID property and adjust discoveryURL to point to discovery service.\r
+              (Set discoveryProtocol to "WAYF" for legacy Shibboleth WAYF support.)\r
+              You can also override entityID on /Login query string, or in RequestMap/htaccess.\r
+              -->\r
+            <SSO entityID="https://idp.example.org/shibboleth"\r
+                 discoveryProtocol="SAMLDS" discoveryURL="https://ds.example.org/DS/WAYF">\r
+              SAML2 SAML1\r
+            </SSO>\r
+\r
+            <!-- SAML and local-only logout. -->\r
+            <Logout>SAML2 Local</Logout>\r
 \r
             <!-- Extension service that generates "approximate" metadata based on SP configuration. -->\r
             <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>\r
@@ -216,4 +157,7 @@
     <!-- Policies that determine how to process and authenticate runtime messages. -->\r
     <SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/>\r
 \r
+    <!-- Low-level configuration about protocols and bindings available for use. -->\r
+    <ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/>\r
+\r
 </SPConfig>\r