src/installer/resources/conf-tmpl/relying-party.xml

   1 <?xml version="1.0" encoding="UTF-8"?>
   2
   3 <!--
   4     This file is an EXAMPLE configuration file.
   5
   6     This file specifies relying party dependent configurations for the IdP, for example, whether SAML assertions to a
   7     particular relying party should be signed.  It also includes metadata provider and credential definitions used
   8     when answering requests to a relying party.
   9 -->
  10
  11 <rp:RelyingPartyGroup xmlns:rp="urn:mace:shibboleth:2.0:relying-party"
  12                    xmlns:saml="urn:mace:shibboleth:2.0:relying-party:saml"
  13                    xmlns:metadata="urn:mace:shibboleth:2.0:metadata"
  14                    xmlns:resource="urn:mace:shibboleth:2.0:resource"
  15                    xmlns:security="urn:mace:shibboleth:2.0:security"
  16                    xmlns:samlsec="urn:mace:shibboleth:2.0:security:saml"
  17                    xmlns:samlmd="urn:oasis:names:tc:SAML:2.0:metadata"
  18                    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  19                    xsi:schemaLocation="urn:mace:shibboleth:2.0:relying-party classpath:/schema/shibboleth-2.0-relying-party.xsd
  20                                        urn:mace:shibboleth:2.0:relying-party:saml classpath:/schema/shibboleth-2.0-relying-party-saml.xsd
  21                                        urn:mace:shibboleth:2.0:metadata classpath:/schema/shibboleth-2.0-metadata.xsd
  22                                        urn:mace:shibboleth:2.0:resource classpath:/schema/shibboleth-2.0-resource.xsd
  23                                        urn:mace:shibboleth:2.0:security classpath:/schema/shibboleth-2.0-security.xsd
  24                                        urn:mace:shibboleth:2.0:security:saml classpath:/schema/shibboleth-2.0-security-policy-saml.xsd
  25                                        urn:oasis:names:tc:SAML:2.0:metadata classpath:/schema/saml-schema-metadata-2.0.xsd">
  26
  27     <!-- ========================================== -->
  28     <!--      Relying Party Configurations          -->
  29     <!-- ========================================== -->
  30     <rp:AnonymousRelyingParty provider="$IDP_ENTITY_ID$"
  31                            defaultSigningCredentialRef="IdPCredential" />
  32
  33     <rp:DefaultRelyingParty provider="$IDP_ENTITY_ID$"
  34                          defaultSigningCredentialRef="IdPCredential">
  35         <!--
  36             Each attribute in these profiles configuration is set to its default value,
  37             that is, the values that would be in effect if those attributes were not present.
  38             We list them here so that people are aware of them (since they seem reluctant to
  39             read the documentation).
  40         -->
  41         <rp:ProfileConfiguration xsi:type="saml:ShibbolethSSOProfile"
  42                               includeAttributeStatement="false"
  43                               assertionLifetime="PT5M"
  44                               signResponses="conditional"
  45                               signAssertions="never" />
  46
  47         <rp:ProfileConfiguration xsi:type="saml:SAML1AttributeQueryProfile"
  48                               assertionLifetime="PT5M"
  49                               signResponses="conditional"
  50                               signAssertions="never" />
  51
  52         <rp:ProfileConfiguration xsi:type="saml:SAML1ArtifactResolutionProfile"
  53                               signResponses="conditional"
  54                               signAssertions="never" />
  55
  56         <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile"
  57                               includeAttributeStatement="true"
  58                               assertionLifetime="PT5M"
  59                               assertionProxyCount="0"
  60                               signResponses="never"
  61                               signAssertions="always"
  62                               encryptAssertions="conditional"
  63                               encryptNameIds="never" />
  64
  65         <rp:ProfileConfiguration xsi:type="saml:SAML2AttributeQueryProfile"
  66                               assertionLifetime="PT5M"
  67                               assertionProxyCount="0"
  68                               signResponses="conditional"
  69                               signAssertions="never"
  70                               encryptAssertions="conditional"
  71                               encryptNameIds="never" />
  72
  73         <rp:ProfileConfiguration xsi:type="saml:SAML2ArtifactResolutionProfile"
  74                               signResponses="never"
  75                               signAssertions="always"
  76                               encryptAssertions="conditional"
  77                               encryptNameIds="never"/>
  78
  79     </rp:DefaultRelyingParty>
  80
  81
  82     <!-- ========================================== -->
  83     <!--      Metadata Configuration                -->
  84     <!-- ========================================== -->
  85     <!-- MetadataProvider the combining other MetadataProviders -->
  86     <metadata:MetadataProvider id="ShibbolethMetadata" xsi:type="metadata:ChainingMetadataProvider">
  87
  88         <!-- Load the IdP's own metadata.  This is necessary for artifact support. -->
  89         <metadata:MetadataProvider id="IdPMD" xsi:type="metadata:ResourceBackedMetadataProvider">
  90             <metadata:MetadataResource xsi:type="resource:FilesystemResource" file="$IDP_HOME$/metadata/idp-metadata.xml" />
  91         </metadata:MetadataProvider>
  92
  93         <!-- Example metadata provider. -->
  94         <!-- Reads metadata from a URL and store a backup copy on the file system. -->
  95         <!-- Validates the signature of the metadata and filters out all by SP entities in order to save memory -->
  96         <!-- To use: fill in 'metadataURL' and 'backingFile' properties on MetadataResource element -->
  97         <!--
  98         <metadata:MetadataProvider id="URLMD" xsi:type="metadata:FileBackedHTTPMetadataProvider"
  99                           metadataURL="http://example.org/metadata.xml"
 100                           backingFile="$IDP_HOME$/metadata/some-metadata.xml">
 101             <metadata:MetadataFilter xsi:type="metadata:ChainingFilter">
 102                 <metadata:MetadataFilter xsi:type="metadata:RequiredValidUntil"
 103                                 maxValidityInterval="P7D" />
 104                 <metadata:MetadataFilter xsi:type="metadata:SignatureValidation"
 105                                 trustEngineRef="shibboleth.MetadataTrustEngine"
 106                                 requireSignedMetadata="true" />
 107                     <metadata:MetadataFilter xsi:type="metadata:EntityRoleWhiteList">
 108                     <metadata:RetainedRole>samlmd:SPSSODescriptor</metadata:RetainedRole>
 109                 </metadata:MetadataFilter>
 110             </metadata:MetadataFilter>
 111         </metadata:MetadataProvider>
 112         -->
 113
 114     </metadata:MetadataProvider>
 115
 116
 117     <!-- ========================================== -->
 118     <!--     Security Configurations                -->
 119     <!-- ========================================== -->
 120     <security:Credential id="IdPCredential" xsi:type="security:X509Filesystem">
 121         <security:PrivateKey>$IDP_HOME$/credentials/idp.key</security:PrivateKey>
 122         <security:Certificate>$IDP_HOME$/credentials/idp.crt</security:Certificate>
 123     </security:Credential>
 124
 125     <!-- Trust engine used to evaluate the signature on loaded metadata. -->
 126     <!--
 127     <security:TrustEngine id="shibboleth.MetadataTrustEngine" xsi:type="security:StaticExplicitKeySignature">
 128         <security:Credential id="MyFederation1Credentials" xsi:type="security:X509Filesystem">
 129             <security:Certificate>$IDP_HOME$/credentials/federation1.crt</security:Certificate>
 130         </security:Credential>
 131     </security:TrustEngine>
 132      -->
 133
 134     <!-- DO NOT EDIT BELOW THIS POINT -->
 135     <!--
 136         The following trust engines and rules control every aspect of security related to incoming messages.
 137         Trust engines evaluate various tokens (like digital signatures) for trust worthiness while the
 138         security policies establish a set of checks that an incoming message must pass in order to be considered
 139         secure.  Naturally some of these checks require the validation of the tokens evaluated by the trust
 140         engines and so you'll see some rules that reference the declared trust engines.
 141     -->
 142     <security:TrustEngine id="shibboleth.SignatureTrustEngine" xsi:type="security:SignatureChaining">
 143         <security:TrustEngine id="shibboleth.SignatureMetadataExplicitKeyTrustEngine" xsi:type="security:MetadataExplicitKeySignature"
 144                               metadataProviderRef="ShibbolethMetadata" />
 145         <security:TrustEngine id="shibboleth.SignatureMetadataPKIXTrustEngine" xsi:type="security:MetadataPKIXSignature"
 146                               metadataProviderRef="ShibbolethMetadata" />
 147     </security:TrustEngine>
 148
 149     <security:TrustEngine id="shibboleth.CredentialTrustEngine" xsi:type="security:Chaining">
 150         <security:TrustEngine id="shibboleth.CredentialMetadataExplictKeyTrustEngine" xsi:type="security:MetadataExplicitKey"
 151                               metadataProviderRef="ShibbolethMetadata" />
 152         <security:TrustEngine id="shibboleth.CredentialMetadataPKIXTrustEngine" xsi:type="security:MetadataPKIXX509Credential"
 153                               metadataProviderRef="ShibbolethMetadata" />
 154     </security:TrustEngine>
 155
 156     <security:SecurityPolicy id="shibboleth.ShibbolethSSOSecurityPolicy" xsi:type="security:SecurityPolicyType">
 157         <security:Rule xsi:type="samlsec:IssueInstant" required="false"/>
 158         <security:Rule xsi:type="samlsec:MandatoryIssuer"/>
 159     </security:SecurityPolicy>
 160
 161     <security:SecurityPolicy id="shibboleth.SAML1AttributeQuerySecurityPolicy" xsi:type="security:SecurityPolicyType">
 162         <security:Rule xsi:type="samlsec:Replay"/>
 163         <security:Rule xsi:type="samlsec:IssueInstant"/>
 164         <security:Rule xsi:type="samlsec:ProtocolWithXMLSignature" trustEngineRef="shibboleth.SignatureTrustEngine" />
 165         <security:Rule xsi:type="security:ClientCertAuth" trustEngineRef="shibboleth.CredentialTrustEngine" />
 166         <security:Rule xsi:type="samlsec:MandatoryIssuer"/>
 167         <security:Rule xsi:type="security:MandatoryMessageAuthentication" />
 168     </security:SecurityPolicy>
 169
 170     <security:SecurityPolicy id="shibboleth.SAML1ArtifactResolutionSecurityPolicy" xsi:type="security:SecurityPolicyType">
 171         <security:Rule xsi:type="samlsec:Replay"/>
 172         <security:Rule xsi:type="samlsec:IssueInstant"/>
 173         <security:Rule xsi:type="samlsec:ProtocolWithXMLSignature" trustEngineRef="shibboleth.SignatureTrustEngine" />
 174         <security:Rule xsi:type="security:ClientCertAuth" trustEngineRef="shibboleth.CredentialTrustEngine" />
 175         <security:Rule xsi:type="samlsec:MandatoryIssuer"/>
 176         <security:Rule xsi:type="security:MandatoryMessageAuthentication" />
 177     </security:SecurityPolicy>
 178
 179     <security:SecurityPolicy id="shibboleth.SAML2SSOSecurityPolicy" xsi:type="security:SecurityPolicyType">
 180         <security:Rule xsi:type="samlsec:Replay"/>
 181         <security:Rule xsi:type="samlsec:IssueInstant"/>
 182         <security:Rule xsi:type="samlsec:SAML2AuthnRequestsSigned"/>
 183         <security:Rule xsi:type="samlsec:ProtocolWithXMLSignature" trustEngineRef="shibboleth.SignatureTrustEngine" />
 184         <security:Rule xsi:type="samlsec:SAML2HTTPRedirectSimpleSign" trustEngineRef="shibboleth.SignatureTrustEngine" />
 185         <security:Rule xsi:type="samlsec:SAML2HTTPPostSimpleSign" trustEngineRef="shibboleth.SignatureTrustEngine" />
 186         <security:Rule xsi:type="samlsec:MandatoryIssuer"/>
 187     </security:SecurityPolicy>
 188
 189     <security:SecurityPolicy id="shibboleth.SAML2AttributeQuerySecurityPolicy" xsi:type="security:SecurityPolicyType">
 190         <security:Rule xsi:type="samlsec:Replay"/>
 191         <security:Rule xsi:type="samlsec:IssueInstant"/>
 192         <security:Rule xsi:type="samlsec:ProtocolWithXMLSignature" trustEngineRef="shibboleth.SignatureTrustEngine" />
 193         <security:Rule xsi:type="samlsec:SAML2HTTPRedirectSimpleSign" trustEngineRef="shibboleth.SignatureTrustEngine" />
 194         <security:Rule xsi:type="samlsec:SAML2HTTPPostSimpleSign" trustEngineRef="shibboleth.SignatureTrustEngine" />
 195         <security:Rule xsi:type="security:ClientCertAuth" trustEngineRef="shibboleth.CredentialTrustEngine" />
 196         <security:Rule xsi:type="samlsec:MandatoryIssuer"/>
 197         <security:Rule xsi:type="security:MandatoryMessageAuthentication" />
 198     </security:SecurityPolicy>
 199
 200     <security:SecurityPolicy id="shibboleth.SAML2ArtifactResolutionSecurityPolicy" xsi:type="security:SecurityPolicyType">
 201         <security:Rule xsi:type="samlsec:Replay"/>
 202         <security:Rule xsi:type="samlsec:IssueInstant"/>
 203         <security:Rule xsi:type="samlsec:ProtocolWithXMLSignature" trustEngineRef="shibboleth.SignatureTrustEngine" />
 204         <security:Rule xsi:type="samlsec:SAML2HTTPRedirectSimpleSign" trustEngineRef="shibboleth.SignatureTrustEngine" />
 205         <security:Rule xsi:type="samlsec:SAML2HTTPPostSimpleSign" trustEngineRef="shibboleth.SignatureTrustEngine" />
 206         <security:Rule xsi:type="security:ClientCertAuth" trustEngineRef="shibboleth.CredentialTrustEngine" />
 207         <security:Rule xsi:type="samlsec:MandatoryIssuer"/>
 208         <security:Rule xsi:type="security:MandatoryMessageAuthentication" />
 209     </security:SecurityPolicy>
 210
 211     <security:SecurityPolicy id="shibboleth.SAML2SLOSecurityPolicy" xsi:type="security:SecurityPolicyType">
 212         <security:Rule xsi:type="samlsec:Replay"/>
 213         <security:Rule xsi:type="samlsec:IssueInstant"/>
 214         <security:Rule xsi:type="samlsec:ProtocolWithXMLSignature" trustEngineRef="shibboleth.SignatureTrustEngine" />
 215         <security:Rule xsi:type="samlsec:SAML2HTTPRedirectSimpleSign" trustEngineRef="shibboleth.SignatureTrustEngine" />
 216         <security:Rule xsi:type="samlsec:SAML2HTTPPostSimpleSign" trustEngineRef="shibboleth.SignatureTrustEngine" />
 217         <security:Rule xsi:type="security:ClientCertAuth" trustEngineRef="shibboleth.CredentialTrustEngine" />
 218         <security:Rule xsi:type="samlsec:MandatoryIssuer"/>
 219         <security:Rule xsi:type="security:MandatoryMessageAuthentication" />
 220     </security:SecurityPolicy>
 221
 222 </rp:RelyingPartyGroup>