<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" version="3.0">
 
    <display-name>Shibboleth Identity Provider</display-name>

    <!--
    The context parameters below control V5+ auto-registration support.
    Those desiring complete control over all of these steps can disable them
    but this is not generally recommended, apart from toggling the optional
    servlets that may not be needed.
    -->

    <!-- Registers Spring support. -->
    <context-param>
        <param-name>net.shibboleth.idp.registerSpringConfig</param-name>
        <param-value>true</param-value>
    </context-param>

    <!-- Auto-registers Java filter chain required by IdP. -->
    <context-param>
        <param-name>net.shibboleth.idp.registerFilterChain</param-name>
        <param-value>true</param-value>
    </context-param>

    <!-- Auto-registers IdP dispatcher servlet. -->
    <context-param>
        <param-name>net.shibboleth.idp.registerIdPServlet</param-name>
        <param-value>true</param-value>
    </context-param>
    
    <!-- Registers optional servlets used for RemoteUser and X509 login flows. -->
    <context-param>
        <param-name>net.shibboleth.idp.registerRemoteUserServlet</param-name>
        <param-value>true</param-value>
    </context-param>
    <context-param>
        <param-name>net.shibboleth.idp.registerX509Servlet</param-name>
        <param-value>true</param-value>
    </context-param>
    
    <!-- Registers /shibboleth to return metadata file. -->
    <context-param>
        <param-name>net.shibboleth.idp.registerMetadataServlet</param-name>
        <param-value>true</param-value>
    </context-param>
    
    <!-- Send servlet errors through the IdP's MVC error handling. -->
    <error-page>
        <exception-type>net.shibboleth.idp.authn.ExternalAuthenticationException</exception-type>
        <location>/profile/RaiseError</location>
    </error-page>

    <session-config>
        <session-timeout>15</session-timeout>
        <cookie-config>
            <!-- Comment name and path to revert __Host- protection. -->
            <name>__Host-JSESSIONID</name>
            <path>/</path>
            <secure>true</secure>
            <http-only>true</http-only>
        </cookie-config>
        <tracking-mode>COOKIE</tracking-mode>
    </session-config>

    <!-- Allow intended methods by using an absent auth-constraint. -->
    <security-constraint>
        <web-resource-collection>
            <web-resource-name>Non-API Content</web-resource-name>
            <url-pattern>/*</url-pattern>
            <http-method>GET</http-method>
            <http-method>HEAD</http-method>
            <http-method>OPTIONS</http-method>
            <http-method>POST</http-method>
        </web-resource-collection>
        <!-- no auth-constraint tag here -->
    </security-constraint>

    <!-- Disallow other methods by using an empty auth-constraint. -->
    <security-constraint>
        <web-resource-collection>
            <web-resource-name>Non-API Content</web-resource-name>
            <url-pattern>/*</url-pattern>
            <http-method-omission>GET</http-method-omission>
            <http-method-omission>HEAD</http-method-omission>
            <http-method-omission>OPTIONS</http-method-omission>
            <http-method-omission>POST</http-method-omission>
        </web-resource-collection>
        <auth-constraint/>
    </security-constraint>

    <!-- Allow any HTTP methods to the API flows. -->
    <security-constraint>
        <web-resource-collection>
            <web-resource-name>Administrative APIs</web-resource-name>
            <url-pattern>/profile/admin/*</url-pattern>
        </web-resource-collection>
        <!-- no auth-constraint tag here -->
    </security-constraint>

    <!--
    Uncomment to use container managed authentication. The new servlet spec (3.1)
    supports "**" as a wildcard syntax to avoid role usage, which is normally desirable.
    Older containers usually support "*" when proprietary options are used (e.g., Jetty
    requires setting the Strict property on the SecurityManager.)
    -->
    <!--
    <security-constraint>
        <display-name>Web Login Service</display-name>
        <web-resource-collection>
            <web-resource-name>user authentication</web-resource-name>
            <url-pattern>/Authn/RemoteUser</url-pattern>
            <url-pattern>/profile/SAML2/SOAP/ECP</url-pattern>
            <http-method>POST</http-method> 
        </web-resource-collection>
        <auth-constraint>
            <role-name>**</role-name>
        </auth-constraint>
        <user-data-constraint>
            <transport-guarantee>CONFIDENTIAL</transport-guarantee> 
        </user-data-constraint>
    </security-constraint>
    -->

    <!-- Uncomment if you want BASIC auth managed by the container. -->
    <!--
    <login-config>
        <auth-method>BASIC</auth-method>
        <realm-name>Web Login Service</realm-name>
    </login-config>
    -->
     
    <!--
    Uncomment if you want form-based auth managed by the container.
    NOTE that the default form-login UI in the IdP is not compatible
    with this option, and you will need to supply your own JSP form
    and error page. This is not a recommended approach and is severely
    limited in functionality as compared to using the IdP's own UI.
    -->
    <!--
    <login-config>
        <auth-method>FORM</auth-method>
        <realm-name>Web Login Service</realm-name>
        <form-login-config> 
            <form-login-page>/login.jsp</form-login-page>
            <form-error-page>/login-error.jsp</form-error-page>
        </form-login-config>
    </login-config>
    -->
</web-app>
