<!--
If you want to test advanced functionality, start from the distribution shibboleth2.xml and add the
MetadataProvider, the right entityID, and a properly configured SSO element.  More information:
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPConfiguration
-->

<SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
    clockSkew="1800">
  <InProcess logger="native.logger" checkSpoofing="true">
	<Extensions> <Library path="libwafsp.so"/> </Extensions> 
	<ISAPI normalizeRequest="true" safeHeaderNames="true">
	 <Site id="1" name="saml62-sp.barracuda.com" scheme="https" port="443"/>
	 <Site id="42" name="virtual.example.org" scheme="https" port="443"/>
	</ISAPI>
   </InProcess>
    <UnixListener address="shibd.sock"/>
    <RequestMapper type="Native">
	<!-- https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPRequestMap -->
        <RequestMap applicationId="default">
             <Host name="saml62-sp.barracuda.com" port="443" scheme="https">
		<Path name="secure" authType="shibboleth" requireSession="true"/>
              </Host>
        </RequestMap>
    </RequestMapper>
 
    <!-- The entityID is the name TestShib made for your SP. -->
    <ApplicationDefaults id="default" entityID="https://saml62-sp.barracuda.com/shibboleth"
        REMOTE_USER="eppn">

        <!-- You should use secure cookies if at all possible.  See cookieProps in this Wiki article. -->
        <!-- https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSessions -->
        <Sessions lifetime="28800" timeout="3600" checkAddress="false" relayState="ss:mem" handlerSSL="false">

            <!-- Triggers a login request directly to the TestShib IdP. -->
            <!-- https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPServiceSSO -->
            <SSO entityID="http://fsweb.waf.cuda.com/adfs/services/trust">
                SAML2 SAML1
            </SSO>

            <!-- SAML and local-only logout. -->
            <!-- https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPServiceLogout -->
            <Logout>SAML2 Local</Logout>

            <!--
                Handlers allow you to interact with the SP and gather more information.  Try them out!
                Attribute values received by the SP through SAML will be visible at:
                http://saml62-sp.barracuda.com/Shibboleth.sso/Session
            -->

            <!-- Extension service that generates "approximate" metadata based on SP configuration. -->
            <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>

            <!-- Status reporting service. -->
            <Handler type="Status" Location="/Status" acl="127.0.0.1"/>

            <!-- Session diagnostic service. -->
            <Handler type="Session" Location="/Session" showAttributeValues="true"/>

            <!-- JSON feed of discovery information. -->
            <Handler type="DiscoveryFeed" Location="/DiscoFeed"/>

        </Sessions>

        <!-- Error pages to display to yourself if something goes horribly wrong. -->
        <Errors supportContact="athukral@barracuda.com" logoLocation="/shibboleth-sp/logo.jpg" 
                styleSheet="/shibboleth-sp/main.css"/>

        <!-- Loads and trusts a metadata file that describes only the Testshib IdP and how to communicate with it. -->
        <MetadataProvider type="XML" uri="https://fsweb.waf.cuda.com/FederationMetadata/2007-06/FederationMetadata.xml"
             backingFilePath="adfs-metadata.xml" reloadInterval="180000" />

        <!-- Attribute and trust options you shouldn't need to change. -->
        <AttributeExtractor type="XML" validate="true" path="attribute-map.xml"/>
        <AttributeResolver type="Query" subjectMatch="true"/>
        <AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>

        <!-- Your SP generated these credentials.  They're used to talk to IdP's. -->
        <CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>

    </ApplicationDefaults>
    
    <!-- Security policies you shouldn't change unless you know what you're doing. -->
    <SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/>

    <!-- Low-level configuration about protocols and bindings available for use. -->
    <ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/>

</SPConfig>