Skip to content

Commit ccfab33

Browse files
cslzchencslzchen
authored
Merge pull request #82 from cslzchen/feature/shibboleth-mdq
[ENG-6285] Add shibboleth2.xml for test and prod server
2 parents 533108b + 91359bf commit ccfab33

File tree

2 files changed

+339
-0
lines changed

2 files changed

+339
-0
lines changed

‎etc/cas/config/shibboleth2-prod.xml

Lines changed: 171 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,171 @@
1+
<SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"
2+
xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"
3+
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
4+
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
5+
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
6+
clockSkew="180">
7+
8+
<InProcess logger="native.logger" checkSpoofing="true"/>
9+
10+
<!-- The ApplicationDefaults element is where most of Shibboleth's SAML bits are defined. -->
11+
<ApplicationDefaults entityID="https://accounts.osf.io/shibboleth"
12+
REMOTE_USER="institutionalidentity eppn oid" attributePrefix="AUTH-">
13+
<!-- Controls session lifetimes, address checks, cookie handling, and the protocol handlers. -->
14+
<Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
15+
checkAddress="false" handlerSSL="false" cookieProps="http">
16+
<!-- Configures SSO for a default IdP. -->
17+
<SSO>SAML2 SAML1</SSO>
18+
<!-- SAML and local-only logout. -->
19+
<Logout>SAML2 Local</Logout>
20+
<!-- Extension service that generates "approximate" metadata based on SP configuration. -->
21+
<Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>
22+
<!-- Status reporting service. -->
23+
<Handler type="Status" Location="/Status"/>
24+
<!-- Session diagnostic service. -->
25+
<Handler type="Session" Location="/Session" showAttributeValues="true"/>
26+
<!-- JSON feed of discovery information. -->
27+
<Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
28+
</Sessions>
29+
30+
<!-- Allows overriding of error template information/filenames. -->
31+
<Errors supportContact="support@osf.io" helpLocation="/about.html" styleSheet="/shibboleth-sp/main.css"/>
32+
33+
<!-- Here goes the non-InCommon/eduGAIN IdPs. -->
34+
<!-- This is above InCommon to take precedence for institutions that have Metadata in InCommon but prefer providing their own. -->
35+
36+
<!-- Boys Town (BT) -->
37+
<MetadataProvider type="XML"
38+
uri="https://login.microsoftonline.com/e2ab7419-36ab-4a95-a19f-ee90b6a9b8ac/federationmetadata/2007-06/federationmetadata.xml?appid=5da6af52-f405-43c2-9f33-10327a488ddc"
39+
backingFilePath="bt-prod-idp-metadata.xml"
40+
reloadInterval="180000" >
41+
<MetadataFilter type="Signature" certificate="bt-idp-prod.pem" />
42+
</MetadataProvider>
43+
44+
<!-- Universiteit Gent (UGENT) -->
45+
<MetadataProvider type="XML"
46+
uri="https://identity.ugent.be/simplesaml/saml2/idp/metadata.php"
47+
backingFilePath="ugent-prod-idp-metadata.xml"
48+
reloadInterval="180000" />
49+
50+
<!-- East Carolina University (ECU) -->
51+
<MetadataProvider type="XML"
52+
uri="https://login.microsoftonline.com/17143cbb-385c-4c45-a36a-c65b72e3eae8/federationmetadata/2007-06/federationmetadata.xml?appid=307cd716-765f-4c4d-a8db-be6d3046fa10"
53+
backingFilePath="ecu-prod-idp-metadata.xml"
54+
reloadInterval="180000">
55+
<MetadataFilter type="Signature" certificate="ecu-prod-idp-cert.cer" />
56+
</MetadataProvider>
57+
58+
<!-- Macquarie University (MQ) -->
59+
<MetadataProvider type="XML"
60+
uri="https://mq.okta.com/app/exk2dzwun7KebsDIV2p7/sso/saml/metadata"
61+
backingFilePath="mq-prod-idp-metadata.xml"
62+
reloadInterval="180000" />
63+
64+
<!-- Oklahoma State University (OKSTATE) -->
65+
<MetadataProvider type="XML"
66+
uri="https://stwcas.okstate.edu/cas/idp/metadata"
67+
backingFilePath="okstate-prod-idp-metadata.xml"
68+
reloadInterval="180000" />
69+
70+
<!-- Open Universiteit (OUNL) -->
71+
<MetadataProvider type="XML"
72+
uri="https://login.ou.nl/am/saml2/jsp/exportmetadata.jsp?entityid=https://login.ou.nl/am&amp;realm=/ou"
73+
backingFilePath="ounl-prod-idp-metadata.xml"
74+
reloadInterval="180000" />
75+
76+
<!-- University of British Columbia (UBC) -->
77+
<MetadataProvider type="XML"
78+
uri="https://authentication.ubc.ca/idp/shibboleth"
79+
backingFilePath="ubc-idp-metadata.xml"
80+
reloadInterval="180000" />
81+
82+
<!-- University of South Carolina (SC) -->
83+
<MetadataProvider type="XML"
84+
uri="https://cas.auth.sc.edu/cas/idp/metadata"
85+
backingFilePath="sc-idp-metadata.xml"
86+
reloadInterval="180000" />
87+
88+
<!-- Vrije Universiteit Amsterdam (VUA) -->
89+
<MetadataProvider type="XML"
90+
uri="https://stsfed.login.vu.nl/FederationMetadata/2007-06/FederationMetadata.xml"
91+
backingFilePath="vua-prod-idp-metadata.xml"
92+
reloadInterval="180000" />
93+
94+
<!-- Here is the end of non-InCommon/eduGAIN IdPs. Current total: 9 unique provider and 9 institutions. -->
95+
96+
<!-- Here goes all InCommon/eduGAIN IdPs, all of which are production IdP server using the MDQ service -->
97+
<!-- This is a list of all servers using a Dynamic Metadata Provider configuration with MDQ -->
98+
<!-- Arizona State University -->
99+
<!-- Brown University -->
100+
<!-- Carnegie Mellon University -->
101+
<!-- Case Western Reserve University -->
102+
<!-- Cornell University -->
103+
<!-- Duke University -->
104+
<!-- Erasmus University Rotterdam -->
105+
<!-- Florida State University -->
106+
<!-- National High Magnetic Field Laboratory (Shared SSO via Florida State University) -->
107+
<!-- George Mason University -->
108+
<!-- George Washington University -->
109+
<!-- Georgia Institute of Technology -->
110+
<!-- Harvard University -->
111+
<!-- James Madison University -->
112+
<!-- KU Leuven -->
113+
<!-- Massachusetts Institute of Technology -->
114+
<!-- New York University -->
115+
<!-- Princeton University -->
116+
<!-- Purdue University -->
117+
<!-- Temple University -->
118+
<!-- The University of Oklahoma -->
119+
<!-- The University of Texas at Dallas -->
120+
<!-- Tufts University -->
121+
<!-- Universidade do Algarve -->
122+
<!-- Universiteit Gent -->
123+
<!-- University of Arizona -->
124+
<!-- University of California, Berkeley -->
125+
<!-- University of California, Los Angles -->
126+
<!-- University of Chicago -->
127+
<!-- University of Cincinnati -->
128+
<!-- University of Colorado Boulder -->
129+
<!-- University of Edinburgh -->
130+
<!-- University of London -->
131+
<!-- University of Manchester -->
132+
<!-- University of Maryland -->
133+
<!-- University of Maryland, Baltimore -->
134+
<!-- University of North Carolina at Chapel Hill -->
135+
<!-- University of Notre Dame -->
136+
<!-- University of Rochester -->
137+
<!-- University of Sussex -->
138+
<!-- University of Virginia -->
139+
<!-- Virginia Commonwealth University -->
140+
<!-- Virginia Tech -->
141+
<!-- Washington University in St. Louis -->
142+
<!-- Yale Law School -->
143+
<MetadataProvider type="Dynamic" ignoreTransport="true" maxCacheDuration="86400" minCacheDuration="60">
144+
<Subst>https://mdq.incommon.org/entities/$entityID</Subst>
145+
<MetadataFilter type="RequireValidUntil" maxValidityInterval="1209600"/>
146+
<MetadataFilter type="Signature" certificate="inc-md-cert-mdq.pem"/>
147+
</MetadataProvider>
148+
149+
<!-- Here is the end of InCommon/eduGAIN IdPs. Current total: 1 dynamic provider for 45 institutions. -->
150+
151+
<!-- Map to extract attributes from SAML assertions. -->
152+
<AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/>
153+
154+
<!-- Use a SAML query if no attributes are supplied during SSO. -->
155+
<AttributeResolver type="Query" subjectMatch="true"/>
156+
157+
<!-- Default filtering policy for recognized attributes, lets other data pass. -->
158+
<AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>
159+
160+
<!-- Simple file-based resolver for using a single keypair. -->
161+
<CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>
162+
163+
</ApplicationDefaults>
164+
165+
<!-- Policies that determine how to process and authenticate runtime messages. -->
166+
<SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/>
167+
168+
<!-- Low-level configuration about protocols and bindings available for use. -->
169+
<ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/>
170+
171+
</SPConfig>

‎etc/cas/config/shibboleth2-test.xml

Lines changed: 168 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,168 @@
1+
<SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"
2+
xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"
3+
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
4+
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
5+
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
6+
clockSkew="180">
7+
8+
<InProcess logger="native.logger" checkSpoofing="true"/>
9+
10+
<!-- The ApplicationDefaults element is where most of Shibboleth's SAML bits are defined. -->
11+
<ApplicationDefaults entityID="https://accounts.test.osf.io/shibboleth"
12+
REMOTE_USER="institutionalidentity eppn oid" attributePrefix="AUTH-">
13+
<!-- Controls session lifetimes, address checks, cookie handling, and the protocol handlers. -->
14+
<Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
15+
checkAddress="false" handlerSSL="false" cookieProps="http">
16+
<!-- Configures SSO for a default IdP. -->
17+
<SSO>SAML2 SAML1</SSO>
18+
<!-- SAML and local-only logout. -->
19+
<Logout>SAML2 Local</Logout>
20+
<!-- Extension service that generates "approximate" metadata based on SP configuration. -->
21+
<Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>
22+
<!-- Status reporting service. -->
23+
<Handler type="Status" Location="/Status"/>
24+
<!-- Session diagnostic service. -->
25+
<Handler type="Session" Location="/Session" showAttributeValues="true"/>
26+
<!-- JSON feed of discovery information. -->
27+
<Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
28+
</Sessions>
29+
30+
<!-- Allows overriding of error template information/filenames. -->
31+
<Errors supportContact="support@cos.io" helpLocation="/about.html" styleSheet="/shibboleth-sp/main.css"/>
32+
33+
<!-- Here goes the non-InCommon/eduGAIN IdPs. -->
34+
<!-- This is above InCommon to take precedence for institutions that have Metadata in InCommon but prefer providing their own. -->
35+
36+
<!-- Boys Town [Test] -->
37+
<MetadataProvider type="XML"
38+
uri="https://login.microsoftonline.com/e2ab7419-36ab-4a95-a19f-ee90b6a9b8ac/federationmetadata/2007-06/federationmetadata.xml?appid=76c28b50-eb66-449c-a803-a0129b2c14c7"
39+
backingFilePath="bt-test-idp-metadata.xml"
40+
reloadInterval="180000" >
41+
<MetadataFilter type="Signature" certificate="bt-test-idp.pem" />
42+
</MetadataProvider>
43+
44+
<!-- East Carolina University [Test] -->
45+
<MetadataProvider type="XML"
46+
uri="https://login.microsoftonline.com/17143cbb-385c-4c45-a36a-c65b72e3eae8/federationmetadata/2007-06/federationmetadata.xml?appid=b35fa85e-451e-490e-a8a4-ea3c68de0eb8"
47+
backingFilePath="ecu-test-idp-metadata.xml"
48+
reloadInterval="180000" />
49+
50+
<!-- Macquarie University [Test] -->
51+
<MetadataProvider type="XML" path="mq-test-idp-metadata.xml"
52+
reloadInterval="180000"/>
53+
54+
<!-- Oklahoma State University [Test] -->
55+
<MetadataProvider type="XML"
56+
uri="https://stwcas.okstate.edu/cas/idp/metadata"
57+
backingFilePath="okstate-test-idp-metadata.xml"
58+
reloadInterval="180000" />
59+
60+
<!-- University of British Columbia [Test] -->
61+
<MetadataProvider type="XML"
62+
uri="https://authentication.stg.id.ubc.ca/idp/shibboleth"
63+
backingFilePath="ubc-test-idp-metadata.xml"
64+
reloadInterval="180000" />
65+
66+
<!-- University of South Carolina [Test] -->
67+
<MetadataProvider type="XML"
68+
uri="https://cas.auth.sc.edu/cas/idp/metadata"
69+
backingFilePath="sc-test-idp-metadata.xml"
70+
reloadInterval="180000" />
71+
72+
<!-- Universiteit Gent [Test] -->
73+
<MetadataProvider type="XML"
74+
uri="https://ideq.ugent.be/simplesaml/saml2/idp/metadata.php"
75+
backingFilePath="ugent-test-idp-metadata.xml"
76+
reloadInterval="180000" />
77+
78+
<!-- Vrije Universiteit Amsterdam [Test] -->
79+
<MetadataProvider type="XML"
80+
uri="https://stsfed.test.vu.nl/FederationMetadata/2007-06/FederationMetadata.xml"
81+
backingFilePath="vua-test-idp-metadata.xml"
82+
reloadInterval="180000" />
83+
84+
<!-- Yale Law (yls) [Test] -->
85+
<MetadataProvider type="XML"
86+
uri="https://auth-test.yale.edu/idp/shibboleth"
87+
backingFilePath="yalelaw-test-idp-metadata.xml"
88+
reloadInterval="180000" />
89+
90+
<!-- Here is the end of non-InCommon/eduGAIN IdPs. Current total: 9 unique provider and 9 institutions. -->
91+
92+
<!-- Here goes all InCommon/eduGAIN IdPs, all of which are production IdP server using the MDQ service -->
93+
94+
<!-- This is a list of all servers using a Dynamic Metadata Provider configuration with MDQ -->
95+
<!-- Arizona State University -->
96+
<!-- Brown University -->
97+
<!-- Carnegie Mellon University -->
98+
<!-- Case Western Reserve University -->
99+
<!-- Cornell University -->
100+
<!-- Duke University -->
101+
<!-- Erasmus University Rotterdam -->
102+
<!-- Florida State University -->
103+
<!-- National High Magnetic Field Laboratory (Shared SSO via Florida State University) -->
104+
<!-- George Mason University -->
105+
<!-- George Washington University -->
106+
<!-- Georgia Institute of Technology -->
107+
<!-- Harvard University -->
108+
<!-- James Madison University -->
109+
<!-- KU Leuven -->
110+
<!-- Massachusetts Institute of Technology -->
111+
<!-- New York University -->
112+
<!-- Princeton University -->
113+
<!-- Purdue University -->
114+
<!-- Temple University -->
115+
<!-- The University of Oklahoma -->
116+
<!-- The University of Texas at Dallas -->
117+
<!-- Tufts University -->
118+
<!-- Universidade do Algarve -->
119+
<!-- Universiteit Gent -->
120+
<!-- University of Arizona -->
121+
<!-- University of California, Berkeley -->
122+
<!-- University of California, Los Angles -->
123+
<!-- University of Chicago -->
124+
<!-- University of Cincinnati -->
125+
<!-- University of Colorado Boulder -->
126+
<!-- University of Edinburgh -->
127+
<!-- University of London -->
128+
<!-- University of Manchester -->
129+
<!-- University of Maryland -->
130+
<!-- University of Maryland, Baltimore -->
131+
<!-- University of North Carolina at Chapel Hill -->
132+
<!-- University of Notre Dame -->
133+
<!-- University of Rochester -->
134+
<!-- University of Sussex -->
135+
<!-- University of Virginia -->
136+
<!-- Virginia Commonwealth University -->
137+
<!-- Virginia Tech -->
138+
<!-- Washington University in St. Louis -->
139+
<!-- Yale Law School -->
140+
<MetadataProvider type="Dynamic" ignoreTransport="true" maxCacheDuration="86400" minCacheDuration="60">
141+
<Subst>https://mdq.incommon.org/entities/$entityID</Subst>
142+
<MetadataFilter type="RequireValidUntil" maxValidityInterval="1209600"/>
143+
<MetadataFilter type="Signature" certificate="inc-md-cert-mdq.pem"/>
144+
</MetadataProvider>
145+
146+
<!-- Here is the end of InCommon/eduGAIN IdPs. Current total: 1 dynamic provider for 45 institutions. -->
147+
148+
<!-- Map to extract attributes from SAML assertions. -->
149+
<AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/>
150+
151+
<!-- Use a SAML query if no attributes are supplied during SSO. -->
152+
<AttributeResolver type="Query" subjectMatch="true"/>
153+
154+
<!-- Default filtering policy for recognized attributes, lets other data pass. -->
155+
<AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>
156+
157+
<!-- Simple file-based resolver for using a single keypair. -->
158+
<CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>
159+
160+
</ApplicationDefaults>
161+
162+
<!-- Policies that determine how to process and authenticate runtime messages. -->
163+
<SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/>
164+
165+
<!-- Low-level configuration about protocols and bindings available for use. -->
166+
<ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/>
167+
168+
</SPConfig>

0 commit comments

Comments
 (0)