<?xml version="1.0" encoding="UTF-8"?>

<!--
    This file is an EXAMPLE configuration file.

    This file specifies relying party dependent configurations for the IdP, for example, whether SAML assertions to a 
    particular relying party should be signed.  It also includes metadata provider and credential definitions used 
    when answering requests to a relying party.
-->

<!-- Added this namespace declaration to the RelyingPartyGroup:
   
   xmlns:samldel="urn:mace:shibboleth:2.0:idp:ext:delegation:relying-party"

and this schemaLocation pair to the schemaLocation element:

urn:mace:shibboleth:2.0:idp:ext:delegation:relying-party classpath:/schema/shibboleth-2.0-idp-ext-delegation-relying-party.xsd

-kgb, 17-Apr-2012
 -->

<rp:RelyingPartyGroup xmlns:rp="urn:mace:shibboleth:2.0:relying-party"
                   xmlns:saml="urn:mace:shibboleth:2.0:relying-party:saml"
                   xmlns:metadata="urn:mace:shibboleth:2.0:metadata"
                   xmlns:resource="urn:mace:shibboleth:2.0:resource"
                   xmlns:security="urn:mace:shibboleth:2.0:security"
                   xmlns:samlsec="urn:mace:shibboleth:2.0:security:saml"
                   xmlns:samlmd="urn:oasis:names:tc:SAML:2.0:metadata"
                   xmlns:samldel="urn:mace:shibboleth:2.0:idp:ext:delegation:relying-party"
                   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                   xsi:schemaLocation="urn:mace:shibboleth:2.0:relying-party classpath:/schema/shibboleth-2.0-relying-party.xsd
                                       urn:mace:shibboleth:2.0:relying-party:saml classpath:/schema/shibboleth-2.0-relying-party-saml.xsd
                                       urn:mace:shibboleth:2.0:metadata classpath:/schema/shibboleth-2.0-metadata.xsd
                                       urn:mace:shibboleth:2.0:resource classpath:/schema/shibboleth-2.0-resource.xsd
                                       urn:mace:shibboleth:2.0:security classpath:/schema/shibboleth-2.0-security.xsd
                                       urn:mace:shibboleth:2.0:security:saml classpath:/schema/shibboleth-2.0-security-policy-saml.xsd
                                       urn:oasis:names:tc:SAML:2.0:metadata classpath:/schema/saml-schema-metadata-2.0.xsd
                                 urn:mace:shibboleth:2.0:idp:ext:delegation:relying-party classpath:/schema/shibboleth-2.0-idp-ext-delegation-relying-party.xsd">
                                       
    <!-- ========================================== -->
    <!--      Relying Party Configurations          -->
    <!-- ========================================== -->
    <rp:AnonymousRelyingParty provider="https://idp.smith.edu/idp/shibboleth"
                           defaultSigningCredentialRef="IdPCredential" />
    
    <rp:DefaultRelyingParty provider="https://idp.smith.edu/idp/shibboleth"
        defaultAuthenticationMethod="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"
                         defaultSigningCredentialRef="IdPCredential">
        <!-- 
            Each attribute in these profiles configuration is set to its default value,
            that is, the values that would be in effect if those attributes were not present.
            We list them here so that people are aware of them (since they seem reluctant to 
            read the documentation).
        -->
        <rp:ProfileConfiguration xsi:type="saml:ShibbolethSSOProfile" 
                              includeAttributeStatement="false"
                              assertionLifetime="PT5M"
                              signResponses="conditional"
                              signAssertions="never" />
                              
        <rp:ProfileConfiguration xsi:type="saml:SAML1AttributeQueryProfile"
                              assertionLifetime="PT5M"
                              signResponses="conditional"
                              signAssertions="never" />
        
        <rp:ProfileConfiguration xsi:type="saml:SAML1ArtifactResolutionProfile"
                              signResponses="conditional"
                              signAssertions="never" />
        
        <rp:ProfileConfiguration xsi:type="samldel:SAML2SSOProfile" 
                              includeAttributeStatement="true"
                              assertionLifetime="PT5M"
                              assertionProxyCount="0" 
                              signResponses="never"
                              signAssertions="always" 
                              encryptAssertions="conditional"
                              encryptNameIds="never" />
        
        <rp:ProfileConfiguration xsi:type="saml:SAML2AttributeQueryProfile" 
                              assertionLifetime="PT5M"
                              assertionProxyCount="0" 
                              signResponses="conditional"
                              signAssertions="never"
                              encryptAssertions="conditional"
                              encryptNameIds="never" />
        
        <rp:ProfileConfiguration xsi:type="saml:SAML2ArtifactResolutionProfile" 
                              signResponses="never"
                              signAssertions="always"
                              encryptAssertions="conditional"
                              encryptNameIds="never"/>
        
    </rp:DefaultRelyingParty>
        
<!-- This section applies only to portal.smith.edu. Part of delegation config. Added 17-Apr-2012, kgb -->   

<RelyingParty id="https://portal.smith.edu/shibboleth" 
     provider="https://idp.smith.edu/idp/shibboleth"  
     defaultAuthenticationMethod="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" 
     defaultSigningCredentialRef="IdPCredential">

  <ProfileConfiguration xsi:type="samldel:LibertyIDWSFSSOSProfile"
    securityPolicyRef="shibboleth.ext.delegation.LibertySSOSPolicy"
    maximumTokenDelegationChainLength="1"
    allowTokenDelegation="true"
    signAssertions="always"
    encryptNameIds="never" >
<!-- These services are allowed to function in the SP SAML requester role to issue AuthnRequests through this ECP acting in the SAML AuthnRequest presenter role. -->

<!--  Leaving this out for now because wsp not defined yet. Eventually, wsp is service requesting -->
<!--  the delegation. -kgb, 17-Apr-2012. -->

<!-- Examples of services allowed to issue these requests.  
                
                <samldel:DelegationRestriction>$WSPEntityId</samldel:DelegationRestriction>
                <samldel:DelegationRestriction>https://service1.example.com/shibboleth</samldel:DelegationRestriction>
                <samldel:DelegationRestriction>https://service2.example.com/shibboleth</samldel:DelegationRestriction>
                <samldel:DelegationRestriction>https://service3.example.com/shibboleth</samldel:DelegationRestriction>
-->
  </ProfileConfiguration>

        <rp:ProfileConfiguration xsi:type="saml:ShibbolethSSOProfile"
                              includeAttributeStatement="false"
                              assertionLifetime="PT5M"
                              signResponses="conditional"
                              signAssertions="never" />

        <rp:ProfileConfiguration xsi:type="saml:SAML1AttributeQueryProfile"
                              assertionLifetime="PT5M"
                              signResponses="conditional"
                              signAssertions="never" />

        <rp:ProfileConfiguration xsi:type="saml:SAML1ArtifactResolutionProfile"
                              signResponses="conditional"
                              signAssertions="never" />

        <rp:ProfileConfiguration xsi:type="samldel:SAML2SSOProfile"
                              includeAttributeStatement="true"
                              assertionLifetime="PT5M"
                              assertionProxyCount="0"
                              signResponses="never"
                              signAssertions="always"
                              encryptAssertions="conditional"
                              encryptNameIds="never" />

        <rp:ProfileConfiguration xsi:type="saml:SAML2AttributeQueryProfile"
                              assertionLifetime="PT5M"
                              assertionProxyCount="0"
                              signResponses="conditional"
                              signAssertions="never"
                              encryptAssertions="conditional"
                              encryptNameIds="never" />

        <rp:ProfileConfiguration xsi:type="saml:SAML2ArtifactResolutionProfile"
                              signResponses="never"
                              signAssertions="always"
                              encryptAssertions="conditional"
                              encryptNameIds="never"/>
</RelyingParty>
 
    <!-- ========================================== -->
    <!--      Metadata Configuration                -->
    <!-- ========================================== -->
    <!-- MetadataProvider the combining other MetadataProviders -->
    <metadata:MetadataProvider id="ShibbolethMetadata" xsi:type="metadata:ChainingMetadataProvider" xmlns="urn:mace:shibboleth:2.0:metadata">
    
    	<!-- Load the IdP's own metadata.  This is necessary for artifact support. -->
        <metadata:MetadataProvider id="IdPMD" xsi:type="metadata:FileBackedHTTPMetadataProvider" metadataURL="https://idp.smith.edu/idp/profile/Metadata/SAML" backingFile="/opt/shibboleth-idp/metadata/idp-metadata.xml">
        </metadata:MetadataProvider>

<!--        <metadata:MetadataProvider id="IdPMD" xsi:type="metadata:ResourceBackedMetadataProvider" xmlns="urn:mace:shibboleth:2.0:metadata">
            <metadata:MetadataResource xsi:type="resource:FilesystemResource" file="/opt/shibboleth-idp/metadata/idp-metadata.xml" />
        </metadata:MetadataProvider>
-->

<!-- Five College metadata -->
<!-- Smith SP metadata -->
     <metadata:MetadataProvider id="smith-sp" xsi:type="metadata:FileBackedHTTPMetadataProvider" metadataURL="https://sp.smith.edu/Shibboleth.sso/Metadata" backingFile="/opt/shibboleth-idp/metadata/smith-sp-metadata.xml">
       </metadata:MetadataProvider> 

<!-- Smith portal.smith.edu SP metadata -->
     <metadata:MetadataProvider id="smith-portal" xsi:type="metadata:FileBackedHTTPMetadataProvider" metadataURL="https://portal.smith.edu/Shibboleth.sso/Metadata" backingFile="/opt/shibboleth-idp/metadata/smith-portal-metadata.xml">
     </metadata:MetadataProvider>


<!-- Smith ezproxy.smith.edu SP metadata -->
<!-- commented out ezproxy to troubleshoot -kgb, 22-3-2012
     <metadata:MetadataProvider id="smith-ezproxy" xsi:type="metadata:FileBackedHTTPMetadataProvider" metadataURL="https://ezproxy.smith.edu/Shibboleth.sso/Metadata" backingFile="/opt/shibboleth-idp/metadata/smith-ezproxy-metadata.xml">
     </metadata:MetadataProvider>
-->

<!-- Smith twoodle.smith.edu SP metadata (moodle2 test server) -->
     <metadata:MetadataProvider id="smith-twoodle" xsi:type="metadata:FileBackedHTTPMetadataProvider" metadataURL="https://twoodle.smith.edu/Shibboleth.sso/Metadata" backingFile="/opt/shibboleth-idp/metadata/smith-twoodle-metadata.xml">
       </metadata:MetadataProvider> 


<!-- Amherst IdP metadata -->
     <metadata:MetadataProvider id="amherstIdP" xsi:type="metadata:FileBackedHTTPMetadataProvider" metadataURL="https://shibidp.amherst.edu/idp/profile/Metadata/SAML" backingFile="/opt/shibboleth-idp/metadata/amherst-idp-metadata.xml">
       </metadata:MetadataProvider>

<!-- Mt Holyoke IdP metadata -->
     <metadata:MetadataProvider id="mtholyokeIdP" xsi:type="metadata:FileBackedHTTPMetadataProvider" metadataURL="https://idp.mtholyoke.edu/idp/profile/Metadata/SAML" backingFile="/opt/shibboleth-idp/metadata/mtholyoke-idp-metadata.xml">
       </metadata:MetadataProvider>

<!-- Hampshire IdP metadata -->
     <metadata:MetadataProvider id="hampshireIdP" xsi:type="metadata:FileBackedHTTPMetadataProvider" metadataURL="https://idp.hampshire.edu/idp/profile/Metadata/SAML" backingFile="/opt/shibboleth-idp/metadata/hampshire-idp-metadata.xml">
       </metadata:MetadataProvider>

<!-- UMass IdP metadata -->
     <metadata:MetadataProvider id="umassIdP" xsi:type="metadata:FileBackedHTTPMetadataProvider" metadataURL="https://shibboleth.oit.umass.edu/idp/profile/Metadata/SAML" backingFile="/opt/shibboleth-idp/metadata/umass-idp-metadata.xml">
       </metadata:MetadataProvider>

<!-- FiveColleges CMS metadata -->
     <metadata:MetadataProvider id="fivecollcms" xsi:type="metadata:FileBackedHTTPMetadataProvider" metadataURL="https://cms.fivecolleges.edu/Shibboleth.sso/Metadata" backingFile="/opt/shibboleth-idp/metadata/fivecolleges-cms-metadata.xml">
       </metadata:MetadataProvider>

<!-- Amherst dev2 server metadata -->
     <metadata:MetadataProvider id="amherst-dev2" xsi:type="metadata:FileBackedHTTPMetadataProvider" metadataURL="https://dev2.ats.amherst.edu/Shibboleth.sso/Metadata" backingFile="/opt/shibboleth-idp/metadata/amherst-dev2-metadata.xml">
       </metadata:MetadataProvider>


<!-- Amherst VCL project pilot metadata -->
     <metadata:MetadataProvider id="amherst-vcl" xsi:type="metadata:FileBackedHTTPMetadataProvider" metadataURL="https://vcl.ats.amherst.edu/Shibboleth.sso/Metadata" backingFile="/opt/shibboleth-idp/metadata/amherst-vcl-metadata.xml">
       </metadata:MetadataProvider>

<!-- Amherst ShibSP test metadata -->
     <metadata:MetadataProvider id="amherst-testSP" xsi:type="metadata:FileBackedHTTPMetadataProvider" metadataURL="https://shibsp.amherst.edu/Shibboleth.sso/Metadata" backingFile="/opt/shibboleth-idp/metadata/amherst-testsp-metadata.xml">
       </metadata:MetadataProvider>
        
<!-- Hampshire Shibtest SP metadata -->
     <metadata:MetadataProvider id="hampshire-testSP" xsi:type="metadata:FileBackedHTTPMetadataProvider" metadataURL="https://shibtest.hampshire.edu/Shibboleth.sso/Metadata" backingFile="/opt/shibboleth-idp/metadata/hampshire-testsp-metadata.xml">
       </metadata:MetadataProvider>

<!--
        <metadata:MetadataProvider id="IdPMD" xsi:type="metadata:ResourceBackedMetadataProvider" xmlns="urn:mace:shibboleth:2.0:metadata">
            <metadata:MetadataResource xsi:type="resource:FilesystemResource" file="/opt/shibboleth-idp/metadata/idp-metadata.xml" />
        </metadata:MetadataProvider>

-->


<!-- Hampshire Moodle SP metadata -->
<!--  NOTE: This metadata was edited by hand, so it must be a resource-backed provider aka file only -->
     <metadata:MetadataProvider id="hampshire-moodle" xsi:type="metadata:ResourceBackedMetadataProvider" xmlns="urn:mace:shibboleth:2.0:metadata">
    <metadata:MetadataResource xsi:type="resource:FilesystemResource" file="/opt/shibboleth-idp/metadata/hampshire-moodle-metadata.xml" />
       </metadata:MetadataProvider>

<!-- Hampshire LMSDEV SP metadata -->
<!--  NOTE: This metadata was edited by hand, so it must be a resource-backed provider aka file only -->
     <metadata:MetadataProvider id="hampshire-lmsdev" xsi:type="metadata:ResourceBackedMetadataProvider" xmlns="urn:mace:shibboleth:2.0:metadata">
    <metadata:MetadataResource xsi:type="resource:FilesystemResource" file="/opt/shibboleth-idp/metadata/hampshire-lmsdev-metadata.xml" />
       </metadata:MetadataProvider>


<!-- Hampshire VCL SP metadata -->
<!--  NOTE: This metadata was edited by hand, so it must be a resource-backed provider aka file only -->
     <metadata:MetadataProvider id="hampshire-vcl" xsi:type="metadata:ResourceBackedMetadataProvider" xmlns="urn:mace:shibboleth:2.0:metadata">
    <metadata:MetadataResource xsi:type="resource:FilesystemResource" file="/opt/shibboleth-idp/metadata/hampshire-vcl-metadata.xml" />
       </metadata:MetadataProvider>

<!-- Mt Holyoke fctest SP metadata -->
     <metadata:MetadataProvider id="mtholyoke-testSP" xsi:type="metadata:FileBackedHTTPMetadataProvider" metadataURL="https://sp.mtholyoke.edu/Shibboleth.sso/Metadata" backingFile="/opt/shibboleth-idp/metadata/mtholyoke-testsp-metadata.xml">
       </metadata:MetadataProvider>

        <!-- Example metadata provider. -->
        <!-- Reads metadata from a URL and store a backup copy on the file system. -->
        <!-- Validates the signature of the metadata and filters out all by SP entities in order to save memory -->
        <!-- To use: fill in 'metadataURL' and 'backingFile' properties on MetadataResource element -->
        <!--
        <metadata:MetadataProvider id="URLMD" xsi:type="metadata:FileBackedHTTPMetadataProvider"
                          metadataURL="http://example.org/metadata.xml"
                          backingFile="/opt/shibboleth-idp/metadata/some-metadata.xml">
            <metadata:MetadataFilter xsi:type="metadata:ChainingFilter">
                <metadata:MetadataFilter xsi:type="metadata:RequiredValidUntil" 
                                maxValidityInterval="P7D" />
                <metadata:MetadataFilter xsi:type="metadata:SignatureValidation"
                                trustEngineRef="shibboleth.MetadataTrustEngine"
                                requireSignedMetadata="true" />
	            <metadata:MetadataFilter xsi:type="metadata:EntityRoleWhiteList">
                    <metadata:RetainedRole>samlmd:SPSSODescriptor</metadata:RetainedRole>
                </metadata:MetadataFilter>
            </metadata:MetadataFilter>
        </metadata:MetadataProvider>
        -->

       
    </metadata:MetadataProvider>

    
    <!-- ========================================== -->
    <!--     Security Configurations                -->
    <!-- ========================================== -->
    <security:Credential id="IdPCredential" xsi:type="security:X509Filesystem">
        <security:PrivateKey>/opt/shibboleth-idp/credentials/idp.key</security:PrivateKey>
        <security:Certificate>/opt/shibboleth-idp/credentials/idp.crt</security:Certificate>
    </security:Credential>

<!-- Added trust engine and security policy for Liberty SSOS configuration. -kgb, 17-Apr-2012  -->

            <security:TrustEngine id="shibboleth.ext.delegation.IdPAssertionTrustEngine" xsi:type="security:StaticExplicitKeySignature">
                <security:Credential id="IdPValidationOnlyCredential" xsi:type="security:X509Filesystem">
                    <security:Certificate>/opt/shibboleth-idp/credentials/idp.crt</security:Certificate>
                </security:Credential>
            </security:TrustEngine>

 <security:SecurityPolicy id="shibboleth.ext.delegation.LibertySSOSPolicy" xsi:type="security:SecurityPolicyType">
            <security:Rule xsi:type="samlsec:Replay"/>
            <security:Rule xsi:type="samlsec:IssueInstant"/>
            <security:Rule xsi:type="samlsec:SAML2AuthnRequestsSigned"/>
            <security:Rule xsi:type="samlsec:ProtocolWithXMLSignature" trustEngineRef="shibboleth.SignatureTrustEngine" />
            <security:Rule xsi:type="samldel:ClientCertAuth" trustEngineRef="shibboleth.CredentialTrustEngine" />
            <security:Rule xsi:type="samldel:WSSSAML20AssertionTokenRule" trustEngineRef="shibboleth.ext.delegation.IdPAssertionTrustEngine" />
            <security:Rule xsi:type="samlsec:MandatoryIssuer"/>
        </security:SecurityPolicy>
    
    <!-- Trust engine used to evaluate the signature on loaded metadata. -->
    <!--
    <security:TrustEngine id="shibboleth.MetadataTrustEngine" xsi:type="security:StaticExplicitKeySignature">
        <security:Credential id="MyFederation1Credentials" xsi:type="security:X509Filesystem">
            <security:Certificate>/opt/shibboleth-idp/credentials/federation1.crt</security:Certificate>
        </security:Credential>
    </security:TrustEngine>
     -->
     
    <!-- DO NOT EDIT BELOW THIS POINT -->
    <!-- 
        The following trust engines and rules control every aspect of security related to incoming messages. 
        Trust engines evaluate various tokens (like digital signatures) for trust worthiness while the 
        security policies establish a set of checks that an incoming message must pass in order to be considered
        secure.  Naturally some of these checks require the validation of the tokens evaluated by the trust 
        engines and so you'll see some rules that reference the declared trust engines.
    -->
    <security:TrustEngine id="shibboleth.SignatureTrustEngine" xsi:type="security:SignatureChaining">
        <security:TrustEngine id="shibboleth.SignatureMetadataExplicitKeyTrustEngine" xsi:type="security:MetadataExplicitKeySignature"
                              metadataProviderRef="ShibbolethMetadata" />                              
        <security:TrustEngine id="shibboleth.SignatureMetadataPKIXTrustEngine" xsi:type="security:MetadataPKIXSignature"
                              metadataProviderRef="ShibbolethMetadata" />
    </security:TrustEngine>
    
    <security:TrustEngine id="shibboleth.CredentialTrustEngine" xsi:type="security:Chaining">
        <security:TrustEngine id="shibboleth.CredentialMetadataExplictKeyTrustEngine" xsi:type="security:MetadataExplicitKey"
                              metadataProviderRef="ShibbolethMetadata" />
        <security:TrustEngine id="shibboleth.CredentialMetadataPKIXTrustEngine" xsi:type="security:MetadataPKIXX509Credential"
                              metadataProviderRef="ShibbolethMetadata" />
    </security:TrustEngine>
     
    <security:SecurityPolicy id="shibboleth.ShibbolethSSOSecurityPolicy" xsi:type="security:SecurityPolicyType">
        <security:Rule xsi:type="samlsec:Replay" required="false" />
        <security:Rule xsi:type="samlsec:IssueInstant" required="false"/>
        <security:Rule xsi:type="samlsec:MandatoryIssuer"/>
    </security:SecurityPolicy>
    
    <security:SecurityPolicy id="shibboleth.SAML1AttributeQuerySecurityPolicy" xsi:type="security:SecurityPolicyType">
        <security:Rule xsi:type="samlsec:Replay"/>
        <security:Rule xsi:type="samlsec:IssueInstant"/>
        <security:Rule xsi:type="samlsec:ProtocolWithXMLSignature" trustEngineRef="shibboleth.SignatureTrustEngine" />
        <security:Rule xsi:type="security:ClientCertAuth" trustEngineRef="shibboleth.CredentialTrustEngine" />
        <security:Rule xsi:type="samlsec:MandatoryIssuer"/>
        <security:Rule xsi:type="security:MandatoryMessageAuthentication" />
    </security:SecurityPolicy>
    
    <security:SecurityPolicy id="shibboleth.SAML1ArtifactResolutionSecurityPolicy" xsi:type="security:SecurityPolicyType">
        <security:Rule xsi:type="samlsec:Replay"/>
        <security:Rule xsi:type="samlsec:IssueInstant"/>
        <security:Rule xsi:type="samlsec:ProtocolWithXMLSignature" trustEngineRef="shibboleth.SignatureTrustEngine" />
        <security:Rule xsi:type="security:ClientCertAuth" trustEngineRef="shibboleth.CredentialTrustEngine" />
        <security:Rule xsi:type="samlsec:MandatoryIssuer"/>
        <security:Rule xsi:type="security:MandatoryMessageAuthentication" />
    </security:SecurityPolicy>

    <security:SecurityPolicy id="shibboleth.SAML2SSOSecurityPolicy" xsi:type="security:SecurityPolicyType">
        <security:Rule xsi:type="samlsec:Replay"/>
        <security:Rule xsi:type="samlsec:IssueInstant"/>
        <security:Rule xsi:type="samlsec:SAML2AuthnRequestsSigned"/>
        <security:Rule xsi:type="samlsec:ProtocolWithXMLSignature" trustEngineRef="shibboleth.SignatureTrustEngine" />
        <security:Rule xsi:type="samlsec:SAML2HTTPRedirectSimpleSign" trustEngineRef="shibboleth.SignatureTrustEngine" />
        <security:Rule xsi:type="samlsec:SAML2HTTPPostSimpleSign" trustEngineRef="shibboleth.SignatureTrustEngine" />
        <security:Rule xsi:type="samlsec:MandatoryIssuer"/>
    </security:SecurityPolicy>

    <security:SecurityPolicy id="shibboleth.SAML2AttributeQuerySecurityPolicy" xsi:type="security:SecurityPolicyType">
        <security:Rule xsi:type="samlsec:Replay"/>
        <security:Rule xsi:type="samlsec:IssueInstant"/>
        <security:Rule xsi:type="samlsec:ProtocolWithXMLSignature" trustEngineRef="shibboleth.SignatureTrustEngine" />
        <security:Rule xsi:type="samlsec:SAML2HTTPRedirectSimpleSign" trustEngineRef="shibboleth.SignatureTrustEngine" />
        <security:Rule xsi:type="samlsec:SAML2HTTPPostSimpleSign" trustEngineRef="shibboleth.SignatureTrustEngine" />
        <security:Rule xsi:type="security:ClientCertAuth" trustEngineRef="shibboleth.CredentialTrustEngine" />
        <security:Rule xsi:type="samlsec:MandatoryIssuer"/>
        <security:Rule xsi:type="security:MandatoryMessageAuthentication" />
    </security:SecurityPolicy>
    
    <security:SecurityPolicy id="shibboleth.SAML2ArtifactResolutionSecurityPolicy" xsi:type="security:SecurityPolicyType">
        <security:Rule xsi:type="samlsec:Replay"/>
        <security:Rule xsi:type="samlsec:IssueInstant"/>
        <security:Rule xsi:type="samlsec:ProtocolWithXMLSignature" trustEngineRef="shibboleth.SignatureTrustEngine" />
        <security:Rule xsi:type="samlsec:SAML2HTTPRedirectSimpleSign" trustEngineRef="shibboleth.SignatureTrustEngine" />
        <security:Rule xsi:type="samlsec:SAML2HTTPPostSimpleSign" trustEngineRef="shibboleth.SignatureTrustEngine" />
        <security:Rule xsi:type="security:ClientCertAuth" trustEngineRef="shibboleth.CredentialTrustEngine" />
        <security:Rule xsi:type="samlsec:MandatoryIssuer"/>
        <security:Rule xsi:type="security:MandatoryMessageAuthentication" />
    </security:SecurityPolicy>
    
    <security:SecurityPolicy id="shibboleth.SAML2SLOSecurityPolicy" xsi:type="security:SecurityPolicyType">
        <security:Rule xsi:type="samlsec:Replay"/>
        <security:Rule xsi:type="samlsec:IssueInstant"/>
        <security:Rule xsi:type="samlsec:ProtocolWithXMLSignature" trustEngineRef="shibboleth.SignatureTrustEngine" />
        <security:Rule xsi:type="samlsec:SAML2HTTPRedirectSimpleSign" trustEngineRef="shibboleth.SignatureTrustEngine" />
        <security:Rule xsi:type="samlsec:SAML2HTTPPostSimpleSign" trustEngineRef="shibboleth.SignatureTrustEngine" />
        <security:Rule xsi:type="security:ClientCertAuth" trustEngineRef="shibboleth.CredentialTrustEngine" />
        <security:Rule xsi:type="samlsec:MandatoryIssuer"/>
        <security:Rule xsi:type="security:MandatoryMessageAuthentication" />
    </security:SecurityPolicy>
    
</rp:RelyingPartyGroup>