shibboleth2.xml 7.41 KB
Newer Older
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
<SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"
    xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"
    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
    xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
    xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
    clockSkew="180">
    <!--
    By default, in-memory StorageService, ReplayCache, ArtifactMap, and SessionCache
    are used. See example-shibboleth2.xml for samples of explicitly configuring them.
    -->

    <!--
    To customize behavior for specific resources on Apache, and to link vhosts or
    resources to ApplicationOverride settings below, use web server options/commands.
    See https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPConfigurationElements for help.
    
    For examples with the RequestMap XML syntax instead, see the example-shibboleth2.xml
    file, and the https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPRequestMapHowTo topic.
    -->

    <!-- The ApplicationDefaults element is where most of Shibboleth's SAML bits are defined. -->
Alex Barchiesi's avatar
Alex Barchiesi committed
22
    <ApplicationDefaults entityID="{{ shibsp_idp_entity_id }}"
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
                         REMOTE_USER="eppn persistent-id targeted-id"
			 metadataAttributePrefix="Meta-">

        <!--
        Controls session lifetimes, address checks, cookie handling, and the protocol handlers.
        You MUST supply an effectively unique handlerURL value for each of your applications.
        The value defaults to /Shibboleth.sso, and should be a relative path, with the SP computing
        a relative value based on the virtual host. Using handlerSSL="true", the default, will force
        the protocol to be https. You should also set cookieProps to "https" for SSL-only sites.
        Note that while we default checkAddress to "false", this has a negative impact on the
        security of your site. Stealing sessions via cookie theft is much easier with this disabled.
        -->
        <Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
                  checkAddress="false" handlerSSL="false" cookieProps="http">

            <!--
            Configures SSO for a default IdP. To allow for >1 IdP, remove
            entityID property and adjust discoveryURL to point to discovery service.
            (Set discoveryProtocol to "WAYF" for legacy Shibboleth WAYF support.)
            You can also override entityID on /Login query string, or in RequestMap/htaccess.
            -->
Alex Barchiesi's avatar
Alex Barchiesi committed
44
	    {% if shibsp_discovery_url %}
Alex Barchiesi's avatar
Alex Barchiesi committed
45
	    <SSO discoveryProtocol="SAMLDS" discoveryURL="{{ shibsp_discovery_url }}">
46
47
              SAML2
            </SSO>
Alex Barchiesi's avatar
Alex Barchiesi committed
48
	    {% endif %}
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72

            <!-- SAML and local-only logout. -->
            <Logout>SAML2 Local</Logout>
            
            <!-- Extension service that generates "approximate" metadata based on SP configuration. -->
            <Handler type="MetadataGenerator" Location="/Metadata" signing="false" />

            <!-- Status reporting service. -->
            <Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>

            <!-- Session diagnostic service. -->
            <Handler type="Session" Location="/Session" showAttributeValues="false"/>

            <!-- JSON feed of discovery information. -->
            <Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
        </Sessions>

        <!--
        Allows overriding of error template information/filenames. You can
        also add attributes with values that can be plugged into the templates.
        -->
        <Errors supportContact="{{ shibsp_support_contact }}" />
        
        <!-- Example of remotely supplied batch of signed metadata. -->
Alex Barchiesi's avatar
Alex Barchiesi committed
73
        <!--
74
75
76
77
78
79
80
81
82
83
84
        <MetadataProvider type="XML" uri="http://federation.org/federation-metadata.xml"
              backingFilePath="federation-metadata.xml" reloadInterval="7200">
            <MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/>
            <MetadataFilter type="Signature" certificate="fedsigner.pem"/>
        </MetadataProvider>
        -->

        <!-- Example of locally maintained metadata. -->
        <!--
        <MetadataProvider type="XML" file="partner-metadata.xml"/>
        -->
Alex Barchiesi's avatar
Alex Barchiesi committed
85
	{% if saml2_metadata_url %}
86
87
88
89
	<MetadataProvider type="XML" 
			  uri="{{ saml2_metadata_url }}" 
			  backingFilePath="{{ saml2_metadata_bck_file }}" 
			  reloadInterval="7200">
90
        <!--
91
	  <MetadataFilter type="Signature" certificate="metadata/{{ saml2_metadata_signer_bck_file }}"/>
92
        -->
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
	  <MetadataFilter type="EntityRoleWhiteList">
	    <RetainedRole>md:IDPSSODescriptor</RetainedRole>
	    <RetainedRole>md:AttributeAuthorityDescriptor</RetainedRole>
	  </MetadataFilter>
	</MetadataProvider>
	{% endif %}
        <!-- Map to extract attributes from SAML assertions. -->
        <AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/>

	<AttributeExtractor type="Metadata"
			    errorURL="errorURL"
	  		    DisplayName="displayName"
			    OrganizationName="organizationName"
			    InformationURL="informationURL"
			    PrivacyStatementURL="privacyStatementURL"
			    OrganizationURL="organizationURL">
		<ContactPerson id="Support-Contact"
			       contactType="support"
			       formatter="$EmailAddress" />
		<ContactPerson id="Technical-Contact"
			       contactType="technical"
			       formatter="$EmailAddress" />
	        <Logo id="Small-Logo" height="16" width="16" formatter="$_string"/>
	</AttributeExtractor>

	<!-- Use a SAML query if no attributes are supplied during SSO. -->
        <AttributeResolver type="Query" subjectMatch="true"/>

        <!-- Default filtering policy for recognized attributes, lets other data pass. -->
        <AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>

        <!-- Simple file-based resolver for using a single keypair. -->
        <CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>

        <!--
        The default settings can be overridden by creating ApplicationOverride elements (see
        the https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplicationOverride topic).
        Resource requests are mapped by web server commands, or the RequestMapper, to an
        applicationId setting.
        
        Example of a second application (for a second vhost) that has a different entityID.
        Resources on the vhost would map to an applicationId of "admin":
        -->
        <!--
        <ApplicationOverride id="admin" entityID="https://admin.example.org/shibboleth"/>
        -->
Alex Barchiesi's avatar
Alex Barchiesi committed
139
	<ApplicationOverride id="{{ shibsp_identity_provider }}" entityID="{{ shibsp_idp_entity_id }}"
140
141
142
143
		REMOTE_USER="eppn persistent-id targeted-id">
		
	   <Sessions lifetime="28800" timeout="3600" checkAddress="false"
	             relayState="ss:mem" handlerSSL="false" cookieProps="http">
Alex Barchiesi's avatar
Alex Barchiesi committed
144
	     {% if shibsp_discovery_url %}
Alex Barchiesi's avatar
Alex Barchiesi committed
145
	     <SSO discoveryProtocol="SAMLDS" discoveryURL="{{ shibsp_discovery_url }}">
146
147
               SAML2
             </SSO>
Alex Barchiesi's avatar
Alex Barchiesi committed
148
             {% endif %}
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164

             <!-- SAML and local-only logout. -->
             <Logout>SAML2 Local</Logout>

	   </Sessions>
	 </ApplicationOverride>	    
	  
      </ApplicationDefaults>
    
    <!-- Policies that determine how to process and authenticate runtime messages. -->
    <SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/>

    <!-- Low-level configuration about protocols and bindings available for use. -->
    <ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/>

</SPConfig>