[cpp-sp] branch master updated: Update metadata examples, some comments.
Scott Cantor
cantor.2 at osu.edu
Thu Jun 7 21:40:32 EDT 2018
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository cpp-sp.
View the commit online:
http://git.shibboleth.net/view/?p=cpp-sp.git;a=commit;h=1155b137bce31d264d51a5fa52b2dc456c48a69a
The following commit(s) were added to refs/heads/master by this push:
new 1155b13 Update metadata examples, some comments.
1155b13 is described below
commit 1155b137bce31d264d51a5fa52b2dc456c48a69a
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Jun 7 21:40:28 2018 -0400
Update metadata examples, some comments.
---
configs/example-shibboleth2.xml | 30 +++++++++++++++++++-----------
configs/shibboleth2.xml | 30 +++++++++++++++++++-----------
configs/win-shibboleth2.xml | 35 ++++++++++++++++++++++-------------
3 files changed, 60 insertions(+), 35 deletions(-)
diff --git a/configs/example-shibboleth2.xml b/configs/example-shibboleth2.xml
index 8840241..a4ceeae 100644
--- a/configs/example-shibboleth2.xml
+++ b/configs/example-shibboleth2.xml
@@ -93,12 +93,11 @@
<!--
Controls session lifetimes, address checks, cookie handling, and the protocol handlers.
- You MUST supply an effectively unique handlerURL value for each of your applications.
- The value defaults to /Shibboleth.sso, and should be a relative path, with the SP computing
- a relative value based on the virtual host. Using handlerSSL="true", the default, will force
- the protocol to be https. You should also set cookieProps to "https" for SSL-only sites.
- Note that while we default checkAddress to "false", this has a negative impact on the
- security of your site. Stealing sessions via cookie theft is much easier with this disabled.
+ Each Application has an effectively unique handlerURL, which defaults to "/Shibboleth.sso"
+ and should be a relative path, with the SP computing the full value based on the virtual
+ host. Using handlerSSL="true" will force the protocol to be https. You should also set
+ cookieProps to "https" for SSL-only sites. Note that while we default checkAddress to
+ "false", this makes an assertion stolen in transit easier for attackers to misuse.
-->
<Sessions lifetime="28800" timeout="3600" checkAddress="false"
handlerURL="/Shibboleth.sso" handlerSSL="false" cookieProps="http" relayState="ss:mem"
@@ -223,23 +222,32 @@
<RelyingParty Name="SpecialFederation" keyName="SpecialKey"/>
-->
+ <!-- Example of locally maintained metadata. -->
+ <!--
+ <MetadataProvider type="XML" validate="true" path="partner-metadata.xml"/>
+ -->
+
<!-- Example of remotely supplied batch of signed metadata. -->
<!--
<MetadataProvider type="XML" validate="true"
- uri="http://federation.org/federation-metadata.xml"
- backingFilePath="federation-metadata.xml" reloadInterval="7200">
+ url="http://federation.org/federation-metadata.xml"
+ backingFilePath="federation-metadata.xml" maxRefreshDelay="7200">
<MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/>
<MetadataFilter type="Signature" certificate="fedsigner.pem" veryifyBackup="false"/>
<DiscoveryFilter type="Blacklist" matcher="EntityAttributes" trimTags="true"
attributeName="http://macedir.org/entity-category"
attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
attributeValue="http://refeds.org/category/hide-from-discovery" />
- </MetadataProvider>
+ </MetadataProvider>
-->
- <!-- Example of locally maintained metadata. -->
+ <!-- Example of remotely supplied "on-demand" signed metadata. -->
<!--
- <MetadataProvider type="XML" validate="true" file="partner-metadata.xml"/>
+ <MetadataProvider type="MDQ" validate="true" cacheDirectory="mdq"
+ baseUrl="http://mdq.federation.org" ignoreTransport="true">
+ <MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/>
+ <MetadataFilter type="Signature" certificate="mdqsigner.pem" />
+ </MetadataProvider>
-->
<!-- TrustEngines run in order to evaluate peer keys and certificates. -->
diff --git a/configs/shibboleth2.xml b/configs/shibboleth2.xml
index e55fcdc..e111d12 100644
--- a/configs/shibboleth2.xml
+++ b/configs/shibboleth2.xml
@@ -16,12 +16,11 @@
<!--
Controls session lifetimes, address checks, cookie handling, and the protocol handlers.
- You MUST supply an effectively unique handlerURL value for each of your applications.
- The value defaults to /Shibboleth.sso, and should be a relative path, with the SP computing
- a relative value based on the virtual host. Using handlerSSL="true", the default, will force
- the protocol to be https. You should also set cookieProps to "https" for SSL-only sites.
- Note that while we default checkAddress to "false", this has a negative impact on the
- security of your site. Stealing sessions via cookie theft is much easier with this disabled.
+ Each Application has an effectively unique handlerURL, which defaults to "/Shibboleth.sso"
+ and should be a relative path, with the SP computing the full value based on the virtual
+ host. Using handlerSSL="true" will force the protocol to be https. You should also set
+ cookieProps to "https" for SSL-only sites. Note that while we default checkAddress to
+ "false", this makes an assertion stolen in transit easier for attackers to misuse.
-->
<Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
checkAddress="false" handlerSSL="false" cookieProps="http">
@@ -63,12 +62,17 @@
<Errors supportContact="root at localhost"
helpLocation="/about.html"
styleSheet="/shibboleth-sp/main.css"/>
-
+
+ <!-- Example of locally maintained metadata. -->
+ <!--
+ <MetadataProvider type="XML" validate="true" path="partner-metadata.xml"/>
+ -->
+
<!-- Example of remotely supplied batch of signed metadata. -->
<!--
<MetadataProvider type="XML" validate="true"
- uri="http://example.org/federation-metadata.xml"
- backingFilePath="federation-metadata.xml" reloadInterval="7200">
+ url="http://federation.org/federation-metadata.xml"
+ backingFilePath="federation-metadata.xml" maxRefreshDelay="7200">
<MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/>
<MetadataFilter type="Signature" certificate="fedsigner.pem" veryifyBackup="false"/>
<DiscoveryFilter type="Blacklist" matcher="EntityAttributes" trimTags="true"
@@ -78,9 +82,13 @@
</MetadataProvider>
-->
- <!-- Example of locally maintained metadata. -->
+ <!-- Example of remotely supplied "on-demand" signed metadata. -->
<!--
- <MetadataProvider type="XML" validate="true" file="partner-metadata.xml"/>
+ <MetadataProvider type="MDQ" validate="true" cacheDirectory="mdq"
+ baseUrl="http://mdq.federation.org" ignoreTransport="true">
+ <MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/>
+ <MetadataFilter type="Signature" certificate="mdqsigner.pem" />
+ </MetadataProvider>
-->
<!-- Map to extract attributes from SAML assertions. -->
diff --git a/configs/win-shibboleth2.xml b/configs/win-shibboleth2.xml
index 532d499..199d18c 100644
--- a/configs/win-shibboleth2.xml
+++ b/configs/win-shibboleth2.xml
@@ -56,7 +56,7 @@
<!--
The ApplicationDefaults element is where most of Shibboleth's SAML bits are defined.
- Resource requests are mapped by the RequestMapper to an applicationId that
+ With IIS, resource requests are mapped by the RequestMapper to an applicationId that
points into to this section (or to the defaults here).
-->
<ApplicationDefaults entityID="https://sp.example.org/shibboleth"
@@ -65,12 +65,11 @@
<!--
Controls session lifetimes, address checks, cookie handling, and the protocol handlers.
- You MUST supply an effectively unique handlerURL value for each of your applications.
- The value defaults to /Shibboleth.sso, and should be a relative path, with the SP computing
- a relative value based on the virtual host. Using handlerSSL="true", the default, will force
- the protocol to be https. You should also set cookieProps to "https" for SSL-only sites.
- Note that while we default checkAddress to "false", this has a negative impact on the
- security of your site. Stealing sessions via cookie theft is much easier with this disabled.
+ Each Application has an effectively unique handlerURL, which defaults to "/Shibboleth.sso"
+ and should be a relative path, with the SP computing the full value based on the virtual
+ host. Using handlerSSL="true" will force the protocol to be https. You should also set
+ cookieProps to "https" for SSL-only sites. Note that while we default checkAddress to
+ "false", this makes an assertion stolen in transit easier for attackers to misuse.
-->
<Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
checkAddress="false" handlerSSL="false" cookieProps="http">
@@ -112,11 +111,17 @@
<Errors supportContact="root at localhost"
helpLocation="/about.html"
styleSheet="/shibboleth-sp/main.css"/>
-
+
+ <!-- Example of locally maintained metadata. -->
+ <!--
+ <MetadataProvider type="XML" validate="true" path="partner-metadata.xml"/>
+ -->
+
<!-- Example of remotely supplied batch of signed metadata. -->
<!--
- <MetadataProvider type="XML" uri="http://federation.org/federation-metadata.xml"
- backingFilePath="federation-metadata.xml" reloadInterval="7200">
+ <MetadataProvider type="XML" validate="true"
+ url="http://federation.org/federation-metadata.xml"
+ backingFilePath="federation-metadata.xml" maxRefreshDelay="7200">
<MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/>
<MetadataFilter type="Signature" certificate="fedsigner.pem" veryifyBackup="false"/>
<DiscoveryFilter type="Blacklist" matcher="EntityAttributes" trimTags="true"
@@ -126,12 +131,16 @@
</MetadataProvider>
-->
- <!-- Example of locally maintained metadata. -->
+ <!-- Example of remotely supplied "on-demand" signed metadata. -->
<!--
- <MetadataProvider type="XML" file="partner-metadata.xml"/>
+ <MetadataProvider type="MDQ" validate="true" cacheDirectory="mdq"
+ baseUrl="http://mdq.federation.org" ignoreTransport="true">
+ <MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/>
+ <MetadataFilter type="Signature" certificate="mdqsigner.pem" />
+ </MetadataProvider>
-->
- <!-- Map to extract attributes from SAML assertions. -->
+ <!-- Map to extract attributes from SAML assertions. -->
<AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/>
<!-- Default filtering policy for recognized attributes, lets other data pass. -->
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list