[cpp-sp] branch master updated: Adjust defaults and comments.
Scott Cantor
cantor.2 at osu.edu
Thu Apr 26 20:49:34 EDT 2018
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository cpp-sp.
View the commit online:
http://git.shibboleth.net/view/?p=cpp-sp.git;a=commit;h=fc2aa9e6f32455b6bdfa2e8346aa919cae7a6af8
The following commit(s) were added to refs/heads/master by this push:
new fc2aa9e Adjust defaults and comments.
fc2aa9e is described below
commit fc2aa9e6f32455b6bdfa2e8346aa919cae7a6af8
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Apr 26 20:49:29 2018 -0400
Adjust defaults and comments.
---
configs/example-shibboleth3.xml | 49 +++++++++++++++++++++++------------------
configs/shibboleth3.xml | 28 ++++-------------------
configs/win-shibboleth3.xml | 26 +++++-----------------
3 files changed, 37 insertions(+), 66 deletions(-)
diff --git a/configs/example-shibboleth3.xml b/configs/example-shibboleth3.xml
index 423006a..11e8d84 100644
--- a/configs/example-shibboleth3.xml
+++ b/configs/example-shibboleth3.xml
@@ -3,7 +3,7 @@
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
- logger="syslog.logger" clockSkew="180">
+ clockSkew="180">
<!-- The OutOfProcess section contains properties affecting the shibd daemon. -->
<OutOfProcess logger="shibd.logger">
@@ -62,12 +62,8 @@
-->
<!--
- To customize behavior for specific resources on Apache, and to link vhosts or
- resources to ApplicationOverride settings below, use web server options/commands.
- See https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPConfigurationElements for help.
-
- For examples with the RequestMap XML syntax instead, see the example-shibboleth2.xml
- file, and the https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPRequestMapHowTo topic.
+ To customize behavior for specific resources on Apache, use web server options/commands
+ instead of this mechanism, which is meant for IIS usage.
-->
<RequestMapper type="Native">
<RequestMap>
@@ -92,10 +88,10 @@
points into to this section (or to the defaults here).
-->
<ApplicationDefaults entityID="https://sp.example.org/shibboleth"
- REMOTE_USER="eppn persistent-id targeted-id"
- metadataAttributePrefix="Meta-"
- sessionHook="/Shibboleth.sso/AttrChecker"
- cipherSuites="DEFAULT:!EXP:!LOW:!aNULL:!eNULL:!DES:!IDEA:!SEED:!RC4:!3DES:!kRSA:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1">
+ REMOTE_USER="eppn persistent-id targeted-id"
+ metadataAttributePrefix="Meta-"
+ sessionHook="/Shibboleth.sso/AttrChecker"
+ cipherSuites="DEFAULT:!EXP:!LOW:!aNULL:!eNULL:!DES:!IDEA:!SEED:!RC4:!3DES:!kRSA:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1">
<!--
Controls session lifetimes, address checks, cookie handling, and the protocol handlers.
@@ -113,22 +109,24 @@
<!--
The "stripped down" files use the shorthand syntax for configuring handlers.
- This uses the old "every handler specified directly" syntax. You can replace
- or supplement the new syntax following these examples.
+ This uses the old "every handler specified directly" syntax. You can supplement
+ the new syntax following these examples but it is NOT advisable to use this
+ approach wholesale.
-->
<!--
SessionInitiators handle session requests and relay them to a Discovery page,
- or to an IdP if possible. Automatic session setup will use the default or first
- element (or requireSessionWith can specify a specific id to use).
+ or to an IdP if possible. Automatic/active session rules will use the default
+ or first element (or requireSessionWith can specify a specific id to use).
-->
- <!-- Default directs to a specific IdP (favoring SAML 2 over Shib 1). -->
+ <!-- Default directs to a specific IdP. -->
<SessionInitiator type="Chaining" Location="/Login" isDefault="true" id="Login"
entityID="https://idp.example.org/idp/shibboleth">
<SessionInitiator type="SAML2" template="bindingTemplate.html"/>
<SessionInitiator type="Shib1"/>
+
<!--
To allow for >1 IdP, remove entityID property from Chaining element and add
*either* of the SAMLDS or WAYF handlers below:
@@ -163,6 +161,9 @@
<LogoutInitiator type="Local"/>
</LogoutInitiator>
+ <!-- Administrative logout, separate from user-driven logout above. -->
+ <LogoutInitiator type="Admin" Location="/Logout/Admin" acl="127.0.0.1 ::1" />
+
<!-- md:SingleLogoutService locations handle single logout (SLO) protocol messages. -->
<md:SingleLogoutService Location="/SLO/SOAP"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"/>
@@ -209,7 +210,8 @@
<!--
Allows overriding of error template information/filenames. You can
- also add attributes with values that can be plugged into the templates.
+ also add your own attributes with values that can be plugged into the
+ templates, e.g., helpLocation below.
-->
<Errors supportContact="root at localhost"
helpLocation="/about.html"
@@ -229,7 +231,7 @@
uri="http://federation.org/federation-metadata.xml"
backingFilePath="federation-metadata.xml" reloadInterval="7200">
<MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/>
- <MetadataFilter type="Signature" certificate="fedsigner.pem"/>
+ <MetadataFilter type="Signature" certificate="fedsigner.pem" veryifyBackup="false"/>
<DiscoveryFilter type="Blacklist" matcher="EntityAttributes" trimTags="true"
attributeName="http://macedir.org/entity-category"
attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
@@ -262,13 +264,16 @@
<CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>
<!--
- The default settings can be overridden by creating ApplicationOverride elements (see
- the https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplicationOverride topic).
+ The default settings can be overridden by creating ApplicationOverride elements.
Resource requests are mapped by web server commands, or the RequestMapper, to an
applicationId setting.
- Example of a second application (for a second vhost) that has a different entityID.
- Resources on the vhost would map to an applicationId of "admin":
+ This "canonical" use case of overriding the SP's entityID alone is now obsolete;
+ you can apply selfEntityID as a content setting based on host or path to control
+ the SP's own identity.
+
+ Avoid overrides: ask on the list or refer to the wiki for examples of how to do
+ whatever you want to do without them.
-->
<!--
<ApplicationOverride id="admin" entityID="https://admin.example.org/shibboleth"/>
diff --git a/configs/shibboleth3.xml b/configs/shibboleth3.xml
index f19ac06..609791a 100644
--- a/configs/shibboleth3.xml
+++ b/configs/shibboleth3.xml
@@ -7,16 +7,7 @@
<!--
By default, in-memory StorageService, ReplayCache, ArtifactMap, and SessionCache
- are used. See example-shibboleth2.xml for samples of explicitly configuring them.
- -->
-
- <!--
- To customize behavior for specific resources on Apache, and to link vhosts or
- resources to ApplicationOverride settings below, use web server options/commands.
- See https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPConfigurationElements for help.
-
- For examples with the RequestMap XML syntax instead, see the example-shibboleth2.xml
- file, and the https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPRequestMapHowTo topic.
+ are used. See example-shibboleth3.xml for samples of explicitly configuring them.
-->
<!-- The ApplicationDefaults element is where most of Shibboleth's SAML bits are defined. -->
@@ -67,7 +58,8 @@
<!--
Allows overriding of error template information/filenames. You can
- also add attributes with values that can be plugged into the templates.
+ also add your own attributes with values that can be plugged into the
+ templates, e.g., helpLocation below.
-->
<Errors supportContact="root at localhost"
helpLocation="/about.html"
@@ -79,7 +71,7 @@
uri="http://example.org/federation-metadata.xml"
backingFilePath="federation-metadata.xml" reloadInterval="7200">
<MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/>
- <MetadataFilter type="Signature" certificate="fedsigner.pem"/>
+ <MetadataFilter type="Signature" certificate="fedsigner.pem" veryifyBackup="false"/>
<DiscoveryFilter type="Blacklist" matcher="EntityAttributes" trimTags="true"
attributeName="http://macedir.org/entity-category"
attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
@@ -101,18 +93,6 @@
<!-- Simple file-based resolver for using a single keypair. -->
<CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>
- <!--
- The default settings can be overridden by creating ApplicationOverride elements (see
- the https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplicationOverride topic).
- Resource requests are mapped by web server commands, or the RequestMapper, to an
- applicationId setting.
-
- Example of a second application (for a second vhost) that has a different entityID.
- Resources on the vhost would map to an applicationId of "admin":
- -->
- <!--
- <ApplicationOverride id="admin" entityID="https://admin.example.org/shibboleth"/>
- -->
</ApplicationDefaults>
<!-- Policies that determine how to process and authenticate runtime messages. -->
diff --git a/configs/win-shibboleth3.xml b/configs/win-shibboleth3.xml
index 0e9bc3e..c09b04b 100644
--- a/configs/win-shibboleth3.xml
+++ b/configs/win-shibboleth3.xml
@@ -9,7 +9,7 @@
The InProcess section contains settings affecting web server modules.
Required for IIS, but can be removed when using other web servers.
-->
- <InProcess logger="native.logger">
+ <InProcess>
<ISAPI normalizeRequest="true" safeHeaderNames="true">
<!--
Maps IIS Instance ID values to the host scheme/name/port. The name is
@@ -34,12 +34,9 @@
-->
<!--
- To customize behavior for specific resources on IIS, and to link vhosts or
- resources to ApplicationOverride settings below, use the XML syntax below.
- See https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPRequestMapHowTo for help.
-
+ To customize behavior for specific resources on IIS, use the XML syntax below.
Apache users should rely on web server options/commands in most cases, and can remove the
- RequestMapper element. See https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApacheConfig
+ RequestMapper element.
-->
<RequestMapper type="Native">
<RequestMap>
@@ -110,7 +107,8 @@
<!--
Allows overriding of error template information/filenames. You can
- also add attributes with values that can be plugged into the templates.
+ also add your own attributes with values that can be plugged into the
+ templates, e.g., helpLocation below.
-->
<Errors supportContact="root at localhost"
helpLocation="/about.html"
@@ -121,7 +119,7 @@
<MetadataProvider type="XML" uri="http://federation.org/federation-metadata.xml"
backingFilePath="federation-metadata.xml" reloadInterval="7200">
<MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/>
- <MetadataFilter type="Signature" certificate="fedsigner.pem"/>
+ <MetadataFilter type="Signature" certificate="fedsigner.pem" veryifyBackup="false"/>
<DiscoveryFilter type="Blacklist" matcher="EntityAttributes" trimTags="true"
attributeName="http://macedir.org/entity-category"
attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
@@ -143,18 +141,6 @@
<!-- Simple file-based resolver for using a single keypair. -->
<CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>
- <!--
- The default settings can be overridden by creating ApplicationOverride elements (see
- the https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplicationOverride topic).
- Resource requests are mapped by web server commands, or the RequestMapper, to an
- applicationId setting.
-
- Example of a second application (for a second vhost) that has a different entityID.
- Resources on the vhost would map to an applicationId of "admin":
- -->
- <!--
- <ApplicationOverride id="admin" entityID="https://admin.example.org/shibboleth"/>
- -->
</ApplicationDefaults>
<!-- Policies that determine how to process and authenticate runtime messages. -->
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list