Add in signature validation as default metadata filter
[java-idp.git] / resources / conf / relying-party.xml
1 <?xml version="1.0" encoding="UTF-8"?>
2
3 <!--
4     This file is an EXAMPLE configuration file.
5
6     This file specifies relying party dependent configurations for the IdP, for example, whether SAML assertions to a 
7     particular relying party should be signed.  It also includes metadata provider and credential definitions used 
8     when answering requests to a relying party.
9 -->
10
11 <RelyingPartyGroup xmlns="urn:mace:shibboleth:2.0:relying-party"
12                    xmlns:saml="urn:mace:shibboleth:2.0:relying-party:saml"
13                    xmlns:metadata="urn:mace:shibboleth:2.0:metadata"
14                    xmlns:security="urn:mace:shibboleth:2.0:security"
15                    xmlns:samlsec="urn:mace:shibboleth:2.0:security:saml"
16                    xmlns:samlmd="urn:oasis:names:tc:SAML:2.0:metadata"
17                    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
18                    xsi:schemaLocation="urn:mace:shibboleth:2.0:relying-party classpath:/schema/shibboleth-2.0-relying-party.xsd
19                                        urn:mace:shibboleth:2.0:relying-party:saml classpath:/schema/shibboleth-2.0-relying-party-saml.xsd
20                                        urn:mace:shibboleth:2.0:metadata classpath:/schema/shibboleth-2.0-metadata.xsd
21                                        urn:mace:shibboleth:2.0:security classpath:/schema/shibboleth-2.0-security.xsd
22                                        urn:mace:shibboleth:2.0:security:saml classpath:/schema/shibboleth-2.0-security-policy-saml.xsd
23                                        urn:oasis:names:tc:SAML:2.0:metadata classpath:/schema/saml-schema-metadata-2.0.xsd">
24                                        
25     <!-- ========================================== -->
26     <!--      Relying Party Configurations          -->
27     <!-- ========================================== -->
28     <AnonymousRelyingParty provider="$IDP_ENTITY_ID$" />
29     
30     <DefaultRelyingParty provider="$IDP_ENTITY_ID$"
31                          defaultSigningCredentialRef="IdPCredential">
32         <ProfileConfiguration xsi:type="saml:ShibbolethSSOProfile" />
33         <ProfileConfiguration xsi:type="saml:SAML1AttributeQueryProfile" />
34         <ProfileConfiguration xsi:type="saml:SAML1ArtifactResolutionProfile" />
35         <ProfileConfiguration xsi:type="saml:SAML2SSOProfile" />
36         <ProfileConfiguration xsi:type="saml:SAML2AttributeQueryProfile" />
37         <ProfileConfiguration xsi:type="saml:SAML2ArtifactResolutionProfile" />
38     </DefaultRelyingParty>
39         
40     
41     <!-- ========================================== -->
42     <!--      Metadata Configuration                -->
43     <!-- ========================================== -->
44     <!-- MetadataProvider the combining other MetadataProviders -->
45     <MetadataProvider id="ShibbolethMetadata" xsi:type="ChainingMetadataProvider" xmlns="urn:mace:shibboleth:2.0:metadata">
46             
47             <MetadataFilter xsi:type="ChainingFilter" xmlns="urn:mace:shibboleth:2.0:metadata">
48                 <MetadataFilter xsi:type="SignatureValidation" trustEngineRef="shibboleth.MetadataTrustEngine" />
49             </MetadataFilter>
50         
51         <!-- MetadataProvider reading metadata from a URL. -->
52         <!-- Fill in metadataURL and backingFile attributes with deployment specific information -->
53         <!--
54         <MetadataProvider id="URLMD" xsi:type="FileBackedHTTPMetadataProvider" xmlns="urn:mace:shibboleth:2.0:metadata"
55                           metadataURL="http://example.org/my/metadata/file.xml" 
56                           backingFile="$IDP_HOME$/temp/metadata/somefile.xml" />
57         -->
58
59         <!-- MetadataProvider reading metadata from the filesystem -->
60         <!-- Fill in metadataFile attribute with deployment specific information -->
61         <!--
62         <MetadataProvider id="FSMD" xsi:type="FilesystemMetadataProvider" xmlns="urn:mace:shibboleth:2.0:metadata"
63                           metadataFile="$IDP_HOME$/metadata/somefile.xml" maintainExpiredMetadata="true" />
64         -->
65         
66         <!--  IDP's Metadata -->
67         <MetadataProvider id="FSMD" xsi:type="FilesystemMetadataProvider" xmlns="urn:mace:shibboleth:2.0:metadata"
68                           metadataFile="$IDP_HOME$/metadata/idp-metadata.xml" maintainExpiredMetadata="true" />
69     </MetadataProvider>
70
71     
72     <!-- ========================================== -->
73     <!--     Security Configurations                -->
74     <!-- ========================================== -->
75     <security:Credential id="IdPCredential" xsi:type="security:X509Filesystem">
76         <security:PrivateKey password="changeit">$IDP_HOME$/credentials/idp.key</security:PrivateKey>
77         <security:Certificate>$IDP_HOME$/credentials/idp.crt</security:Certificate>
78     </security:Credential>
79     
80     <!-- Shibboleth metadata. -->
81     <security:TrustEngine id="shibboleth.MetadataTrustEngine" xsi:type="security:StaticExplicitKeySignature">
82         <security:Credential id="IdPMetadataCredentials" xsi:type="security:X509Filesystem">
83             <security:Certificate>$IDP_HOME$/credentials/idp.crt</security:Certificate>
84         </security:Credential>
85         <!-- Add additional credentials for each federation signing key -->
86         <!--
87         <security:Credential id="IdPMetadataCredentials" xsi:type="security:X509Filesystem">
88             <security:Certificate>$IDP_HOME$/credentials/federation1.crt</security:Certificate>
89         </security:Credential>
90         -->
91     </security:TrustEngine>
92     
93     <!-- DO NOT EDIT BELOW THIS POINT -->
94     <!-- 
95         The following trust engines and rules control every aspect of security related to incoming messages. 
96         Trust engines evaluate various tokens (like digital signatures) for trust worthiness while the 
97         security policies establish a set of checks that an incoming message must pass in order to be considered
98         secure.  Naturally some of these checks require the validation of the tokens evaluated by the trust 
99         engines and so you'll see some rules that reference the declared trust engines.
100     -->
101     <security:TrustEngine id="shibboleth.SignatureTrustEngine" xsi:type="security:MetadataExplicitKeySignature"
102                           metadataProviderRef="ShibbolethMetadata" />
103                           
104     <security:TrustEngine id="shibboleth.CredentialTrustEngine" xsi:type="security:MetadataExplicitKey"
105                           metadataProviderRef="ShibbolethMetadata" />
106     
107     <security:SecurityPolicy id="shibboleth.ShibbolethSSOSecurityPolicy" xsi:type="security:SecurityPolicyType">
108         <security:Rule xsi:type="samlsec:IssueInstant" required="false"/>
109         <security:Rule xsi:type="samlsec:MandatoryIssuer"/>
110     </security:SecurityPolicy>
111     
112     <security:SecurityPolicy id="shibboleth.SAML1AttributeQuerySecurityPolicy" xsi:type="security:SecurityPolicyType">
113         <security:Rule xsi:type="samlsec:Replay"/>
114         <security:Rule xsi:type="samlsec:IssueInstant"/>
115         <security:Rule xsi:type="samlsec:ProtocolWithXMLSignature" trustEngineRef="shibboleth.SignatureTrustEngine" />
116         <security:Rule xsi:type="samlsec:SAML2HTTPRedirectSimpleSign" trustEngineRef="shibboleth.SignatureTrustEngine" />
117         <security:Rule xsi:type="samlsec:SAML2HTTPPostSimpleSign" trustEngineRef="shibboleth.SignatureTrustEngine" />
118         <security:Rule xsi:type="security:ClientCertAuth" trustEngineRef="shibboleth.CredentialTrustEngine" />
119         <security:Rule xsi:type="samlsec:MandatoryIssuer"/>
120         <security:Rule xsi:type="security:MandatoryMessageAuthentication" />
121     </security:SecurityPolicy>
122     
123     <security:SecurityPolicy id="shibboleth.SAML1ArtifactResolutionSecurityPolicy" xsi:type="security:SecurityPolicyType">
124         <security:Rule xsi:type="samlsec:Replay"/>
125         <security:Rule xsi:type="samlsec:IssueInstant"/>
126         <security:Rule xsi:type="samlsec:ProtocolWithXMLSignature" trustEngineRef="shibboleth.SignatureTrustEngine" />
127         <security:Rule xsi:type="samlsec:SAML2HTTPRedirectSimpleSign" trustEngineRef="shibboleth.SignatureTrustEngine" />
128         <security:Rule xsi:type="samlsec:SAML2HTTPPostSimpleSign" trustEngineRef="shibboleth.SignatureTrustEngine" />
129         <security:Rule xsi:type="security:ClientCertAuth" trustEngineRef="shibboleth.CredentialTrustEngine" />
130         <security:Rule xsi:type="samlsec:MandatoryIssuer"/>
131         <security:Rule xsi:type="security:MandatoryMessageAuthentication" />
132     </security:SecurityPolicy>
133
134     <security:SecurityPolicy id="shibboleth.SAML2SSOSecurityPolicy" xsi:type="security:SecurityPolicyType">
135         <security:Rule xsi:type="samlsec:Replay"/>
136         <security:Rule xsi:type="samlsec:IssueInstant"/>
137         <security:Rule xsi:type="samlsec:ProtocolWithXMLSignature" trustEngineRef="shibboleth.SignatureTrustEngine" />
138         <security:Rule xsi:type="samlsec:SAML2HTTPRedirectSimpleSign" trustEngineRef="shibboleth.SignatureTrustEngine" />
139         <security:Rule xsi:type="samlsec:SAML2HTTPPostSimpleSign" trustEngineRef="shibboleth.SignatureTrustEngine" />
140         <security:Rule xsi:type="security:ClientCertAuth" trustEngineRef="shibboleth.CredentialTrustEngine" />
141         <security:Rule xsi:type="samlsec:MandatoryIssuer"/>
142     </security:SecurityPolicy>
143
144     <security:SecurityPolicy id="shibboleth.SAML2AttributeQuerySecurityPolicy" xsi:type="security:SecurityPolicyType">
145         <security:Rule xsi:type="samlsec:Replay"/>
146         <security:Rule xsi:type="samlsec:IssueInstant"/>
147         <security:Rule xsi:type="samlsec:ProtocolWithXMLSignature" trustEngineRef="shibboleth.SignatureTrustEngine" />
148         <security:Rule xsi:type="samlsec:SAML2HTTPRedirectSimpleSign" trustEngineRef="shibboleth.SignatureTrustEngine" />
149         <security:Rule xsi:type="samlsec:SAML2HTTPPostSimpleSign" trustEngineRef="shibboleth.SignatureTrustEngine" />
150         <security:Rule xsi:type="security:ClientCertAuth" trustEngineRef="shibboleth.CredentialTrustEngine" />
151         <security:Rule xsi:type="samlsec:MandatoryIssuer"/>
152         <security:Rule xsi:type="security:MandatoryMessageAuthentication" />
153     </security:SecurityPolicy>
154     
155     <security:SecurityPolicy id="shibboleth.SAML2ArtifactResolutionSecurityPolicy" xsi:type="security:SecurityPolicyType">
156         <security:Rule xsi:type="samlsec:Replay"/>
157         <security:Rule xsi:type="samlsec:IssueInstant"/>
158         <security:Rule xsi:type="samlsec:ProtocolWithXMLSignature" trustEngineRef="shibboleth.SignatureTrustEngine" />
159         <security:Rule xsi:type="samlsec:SAML2HTTPRedirectSimpleSign" trustEngineRef="shibboleth.SignatureTrustEngine" />
160         <security:Rule xsi:type="samlsec:SAML2HTTPPostSimpleSign" trustEngineRef="shibboleth.SignatureTrustEngine" />
161         <security:Rule xsi:type="security:ClientCertAuth" trustEngineRef="shibboleth.CredentialTrustEngine" />
162         <security:Rule xsi:type="samlsec:MandatoryIssuer"/>
163         <security:Rule xsi:type="security:MandatoryMessageAuthentication" />
164     </security:SecurityPolicy>
165     
166     <security:SecurityPolicy id="shibboleth.SAML2SLOSecurityPolicy" xsi:type="security:SecurityPolicyType">
167         <security:Rule xsi:type="samlsec:Replay"/>
168         <security:Rule xsi:type="samlsec:IssueInstant"/>
169         <security:Rule xsi:type="samlsec:ProtocolWithXMLSignature" trustEngineRef="shibboleth.SignatureTrustEngine" />
170         <security:Rule xsi:type="samlsec:SAML2HTTPRedirectSimpleSign" trustEngineRef="shibboleth.SignatureTrustEngine" />
171         <security:Rule xsi:type="samlsec:SAML2HTTPPostSimpleSign" trustEngineRef="shibboleth.SignatureTrustEngine" />
172         <security:Rule xsi:type="security:ClientCertAuth" trustEngineRef="shibboleth.CredentialTrustEngine" />
173         <security:Rule xsi:type="samlsec:MandatoryIssuer"/>
174         <security:Rule xsi:type="security:MandatoryMessageAuthentication" />
175     </security:SecurityPolicy>
176     
177 </RelyingPartyGroup>