<?xml version="1.0" encoding="UTF-8"?>

<!-- kgb, 17-Apr-2012 Added two lines for delegation extension:
1 - xmlns:del="urn:mace:shibboleth:2.0:idp:ext:delegation:profile-handler"
2 - xsi:schemaLocation="urn:mace:shibboleth:2.0:idp:ext:delegation:profile-handler classpath:/schema/shibboleth-2.0-idp-ext-delegation-profile-handler.xsd
-->

<ph:ProfileHandlerGroup xmlns:ph="urn:mace:shibboleth:2.0:idp:profile-handler"
                     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                     xmlns:del="urn:mace:shibboleth:2.0:idp:ext:delegation:profile-handler"
                   xsi:schemaLocation="urn:mace:shibboleth:2.0:idp:profile-handler classpath:/schema/shibboleth-2.0-idp-profile-handler.xsd
                  urn:mace:shibboleth:2.0:idp:ext:delegation:profile-handler classpath:/schema/shibboleth-2.0-idp-ext-delegation-profile-handler.xsd">

    <!-- Error Handler -->
    <ph:ErrorHandler xsi:type="ph:JSPErrorHandler" jspPagePath="/error.jsp" />

    <!-- Profile Handlers -->
    <!-- 
        All profile handlers defined below are accessed via the Servlet path "/profile" so if your profile 
        handler's request path is "/Status" then the full path is "<servletContextName>/profile/Status"
     -->
    <ph:ProfileHandler xsi:type="ph:Status">
        <ph:RequestPath>/Status</ph:RequestPath>
    </ph:ProfileHandler>
    
    <ph:ProfileHandler xsi:type="ph:SAMLMetadata" metadataFile="/opt/shibboleth-idp/metadata/idp-metadata.xml">
        <ph:RequestPath>/Metadata/SAML</ph:RequestPath>
    </ph:ProfileHandler>    

    <ph:ProfileHandler xsi:type="ph:ShibbolethSSO"
                    inboundBinding="urn:mace:shibboleth:1.0:profiles:AuthnRequest"
                    outboundBindingEnumeration="urn:oasis:names:tc:SAML:1.0:profiles:browser-post 
                                                urn:oasis:names:tc:SAML:1.0:profiles:artifact-01">
        <ph:RequestPath>/Shibboleth/SSO</ph:RequestPath>
    </ph:ProfileHandler>
    
    <ph:ProfileHandler xsi:type="ph:SAML1AttributeQuery" 
                    inboundBinding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding"
                    outboundBindingEnumeration="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding">
        <ph:RequestPath>/SAML1/SOAP/AttributeQuery</ph:RequestPath>
    </ph:ProfileHandler>
    
    <ph:ProfileHandler xsi:type="ph:SAML1ArtifactResolution" 
                    inboundBinding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding"
                    outboundBindingEnumeration="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding">
        <ph:RequestPath>/SAML1/SOAP/ArtifactResolution</ph:RequestPath>
    </ph:ProfileHandler>
    
<!-- Changing every ph:SAML2SSO to del:SAML2SSO. Don't know if del should be added instead of
replacing ph: but we'll see. -kgb 17-Apr-2012  -->

<!-- NOTE: Supposedly, if delegation is not requested, normal SAML2SSO will happen.  -->

    <ph:ProfileHandler xsi:type="del:SAML2SSO" 
                    inboundBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                    outboundBindingEnumeration="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign
                                                urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST 
                                                urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact">
        <ph:RequestPath>/SAML2/POST/SSO</ph:RequestPath>
    </ph:ProfileHandler>

    <ph:ProfileHandler xsi:type="del:SAML2SSO" 
                    inboundBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"
                    outboundBindingEnumeration="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign
                                                urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST 
                                                urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact">
        <ph:RequestPath>/SAML2/POST-SimpleSign/SSO</ph:RequestPath>
    </ph:ProfileHandler>

    <ph:ProfileHandler xsi:type="del:SAML2SSO" 
                    inboundBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
                    outboundBindingEnumeration="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign
                                                urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST 
                                                urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact">
        <ph:RequestPath>/SAML2/Redirect/SSO</ph:RequestPath>
    </ph:ProfileHandler>
    
    <ph:ProfileHandler xsi:type="ph:SAML2AttributeQuery"
                    inboundBinding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"
                    outboundBindingEnumeration="urn:oasis:names:tc:SAML:2.0:bindings:SOAP">
        <ph:RequestPath>/SAML2/SOAP/AttributeQuery</ph:RequestPath>
    </ph:ProfileHandler>
    
    <ph:ProfileHandler xsi:type="ph:SAML2ArtifactResolution" 
                    inboundBinding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"
                    outboundBindingEnumeration="urn:oasis:names:tc:SAML:2.0:bindings:SOAP">
        <ph:RequestPath>/SAML2/SOAP/ArtifactResolution</ph:RequestPath>
    </ph:ProfileHandler>

<!--  Profile handler declaration for Libraty ID-WSF SSOS handler. Added as part of delegation
configuration. - kgb, 17-Apr-2012 -->

      <ProfileHandler xsi:type="del:LibertyIDWSFSSOS">
                <RequestPath>/IDWSF/SSOS</RequestPath>
            </ProfileHandler>  
    
    <!-- Login Handlers -->
    <!--
    <ph:LoginHandler xsi:type="ph:RemoteUser">
        <ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</ph:AuthenticationMethod>
    </ph:LoginHandler>
    -->
    
    <!--  Username/password login handler -->
    <ph:LoginHandler xsi:type="ph:UsernamePassword" 
                  jaasConfigurationLocation="file:///opt/shibboleth-idp/conf/login.config">
        <ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</ph:AuthenticationMethod>
    </ph:LoginHandler>
    
    <!-- 
        Removal of this login handler will disable SSO support, that is it will require the user to authenticate 
        on every request.
    -->
    <ph:LoginHandler xsi:type="ph:PreviousSession">
        <ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:PreviousSession</ph:AuthenticationMethod>
    </ph:LoginHandler>

</ph:ProfileHandlerGroup>