Skip to content

Commit d06074d

Browse files
cslzchencslzchen
committed
Update prod shib config to use MDQ
1 parent c729e3a commit d06074d

File tree

1 file changed

+70
-129
lines changed

1 file changed

+70
-129
lines changed

‎etc/cas/config/shibboleth2-prod.xml

Lines changed: 70 additions & 129 deletions
Original file line numberDiff line numberDiff line change
@@ -7,147 +7,70 @@
77

88
<InProcess logger="native.logger" checkSpoofing="true"/>
99

10-
<!--
11-
By default, in-memory StorageService, ReplayCache, ArtifactMap, and SessionCache
12-
are used. See example-shibboleth2.xml for samples of explicitly configuring them.
13-
-->
14-
15-
<!--
16-
To customize behavior for specific resources on Apache, and to link vhosts or
17-
resources to ApplicationOverride settings below, use web server options/commands.
18-
See https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPConfigurationElements for help.
19-
20-
For examples with the RequestMap XML syntax instead, see the example-shibboleth2.xml
21-
file, and the https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPRequestMapHowTo topic.
22-
-->
23-
2410
<!-- The ApplicationDefaults element is where most of Shibboleth's SAML bits are defined. -->
2511
<ApplicationDefaults entityID="https://accounts.osf.io/shibboleth"
2612
REMOTE_USER="institutionalidentity eppn oid" attributePrefix="AUTH-">
27-
28-
<!--
29-
Controls session lifetimes, address checks, cookie handling, and the protocol handlers.
30-
You MUST supply an effectively unique handlerURL value for each of your applications.
31-
The value defaults to /Shibboleth.sso, and should be a relative path, with the SP computing
32-
a relative value based on the virtual host. Using handlerSSL="true", the default, will force
33-
the protocol to be https. You should also set cookieProps to "https" for SSL-only sites.
34-
Note that while we default checkAddress to "false", this has a negative impact on the
35-
security of your site. Stealing sessions via cookie theft is much easier with this disabled.
36-
-->
13+
<!-- Controls session lifetimes, address checks, cookie handling, and the protocol handlers. -->
3714
<Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
3815
checkAddress="false" handlerSSL="false" cookieProps="http">
39-
40-
<!--
41-
Configures SSO for a default IdP. To allow for >1 IdP, remove
42-
entityID property and adjust discoveryURL to point to discovery service.
43-
(Set discoveryProtocol to "WAYF" for legacy Shibboleth WAYF support.)
44-
You can also override entityID on /Login query string, or in RequestMap/htaccess.
45-
-->
46-
<!-- <SSO entityID="https://idp.testshib.org/idp/shibboleth"
47-
discoveryProtocol="SAMLDS" discoveryURL="https://ds.example.org/DS/WAYF">
48-
SAML2 SAML1
49-
</SSO> -->
50-
<!-- <SSO entityID="https://idp.testshib.org/idp/shibboleth">SAML2 SAML1</SSO> -->
51-
<!-- <SSO discoveryProtocol="SAMLDS" discoveryURL="https://wayf.incommonfederation.org/DS/WAYF">SAML2 SAML1</SSO> -->
16+
<!-- Configures SSO for a default IdP. -->
5217
<SSO>SAML2 SAML1</SSO>
53-
5418
<!-- SAML and local-only logout. -->
5519
<Logout>SAML2 Local</Logout>
56-
5720
<!-- Extension service that generates "approximate" metadata based on SP configuration. -->
5821
<Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>
59-
6022
<!-- Status reporting service. -->
61-
<!-- <Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/> -->
6223
<Handler type="Status" Location="/Status"/>
63-
6424
<!-- Session diagnostic service. -->
65-
<!-- <Handler type="Session" Location="/Session" showAttributeValues="false"/> -->
6625
<Handler type="Session" Location="/Session" showAttributeValues="true"/>
67-
6826
<!-- JSON feed of discovery information. -->
6927
<Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
7028
</Sessions>
7129

72-
<!--
73-
Allows overriding of error template information/filenames. You can
74-
also add attributes with values that can be plugged into the templates.
75-
-->
30+
<!-- Allows overriding of error template information/filenames. -->
7631
<Errors supportContact="support@osf.io" helpLocation="/about.html" styleSheet="/shibboleth-sp/main.css"/>
77-
<!-- <Errors supportContact="EMAIL" logoLocation="/shibboleth-sp/logo.jpg" styleSheet="/shibboleth-sp/main.css"/> -->
78-
79-
<!-- Example of remotely supplied batch of signed metadata. -->
80-
<!--
81-
<MetadataProvider type="XML" uri="http://federation.org/federation-metadata.xml"
82-
backingFilePath="federation-metadata.xml" reloadInterval="7200">
83-
<MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/>
84-
<MetadataFilter type="Signature" certificate="fedsigner.pem"/>
85-
</MetadataProvider>
86-
-->
8732

88-
<!-- Example of locally maintained metadata. -->
89-
<!--
90-
<MetadataProvider type="XML" file="partner-metadata.xml"/>
91-
-->
33+
<!-- Here goes the non-InCommon/eduGAIN IdPs. -->
34+
<!-- This is above InCommon to take precedence for institutions that have Metadata in InCommon but prefer providing their own. -->
9235

93-
<!-- Albion Collge -->
94-
<MetadataProvider type="XML" path="albion-idp-metadata.xml" />
95-
96-
<!-- Boys Town -->
36+
<!-- Boys Town (BT) -->
9737
<MetadataProvider type="XML"
9838
uri="https://login.microsoftonline.com/e2ab7419-36ab-4a95-a19f-ee90b6a9b8ac/federationmetadata/2007-06/federationmetadata.xml?appid=5da6af52-f405-43c2-9f33-10327a488ddc"
99-
backingFilePath="bt-idp-prod-metadata.xml"
39+
backingFilePath="bt-prod-idp-metadata.xml"
10040
reloadInterval="180000" >
10141
<MetadataFilter type="Signature" certificate="bt-idp-prod.pem" />
10242
</MetadataProvider>
10343

104-
<!-- California Lutheran University (CALLUTHERAN) -->
44+
<!-- Universiteit Gent (UGENT) -->
10545
<MetadataProvider type="XML"
106-
uri="https://login.callutheran.edu/sso/metadata.ashx"
107-
backingFilePath="callutheran-idp-metadata.xml"
46+
uri="https://identity.ugent.be/simplesaml/saml2/idp/metadata.php"
47+
backingFilePath="ugent-prod-idp-metadata.xml"
10848
reloadInterval="180000" />
10949

110-
<!-- Institut Teknologi Bandung (ITB) -->
111-
<MetadataProvider type="XML" uri="https://idp.itb.ac.id/idp/shibboleth"
112-
backingFilePath="itb-idp-metadata.xml" reloadInterval="180000" />
113-
114-
<!-- Universiteit Gent (UGENT) -->
115-
<MetadataProvider type="XML" uri="https://identity.ugent.be/simplesaml/saml2/idp/metadata.php"
116-
backingFilePath="ugent-idp-metadata.xml" reloadInterval="180000" />
117-
11850
<!-- East Carolina University (ECU) [Prod] -->
11951
<MetadataProvider type="XML"
12052
uri="https://login.microsoftonline.com/17143cbb-385c-4c45-a36a-c65b72e3eae8/federationmetadata/2007-06/federationmetadata.xml?appid=307cd716-765f-4c4d-a8db-be6d3046fa10"
12153
backingFilePath="ecu-prod-idp-metadata.xml"
122-
reloadInterval="86400">
54+
reloadInterval="180000">
12355
<MetadataFilter type="Signature" certificate="ecu-prod-idp-cert.cer" />
12456
</MetadataProvider>
12557

126-
<!-- Ferris State Univeristy (FERRIS) -->
127-
<MetadataProvider type="XML" path="ferris-metadata.xml"/>
128-
129-
<!-- Illinois Institute of Technology (IIT) -->
130-
<MetadataProvider type="XML" file="iit-metadata.xml"/>
131-
13258
<!-- Macquarie University (MQ) -->
13359
<MetadataProvider type="XML"
13460
uri="https://mq.okta.com/app/exk2dzwun7KebsDIV2p7/sso/saml/metadata"
135-
backingFilePath="mq-idp-metadata.xml"
136-
reloadInterval="180000"/>
137-
138-
<!-- Nesta -->
139-
<MetadataProvider type="XML" path="nesta-jumpcloud.xml" />
61+
backingFilePath="mq-prod-idp-metadata.xml"
62+
reloadInterval="180000" />
14063

14164
<!-- Oklahoma State University (OKSTATE) -->
14265
<MetadataProvider type="XML"
14366
uri="https://stwcas.okstate.edu/cas/idp/metadata"
144-
backingFilePath="okstate-idp-metadata.xml"
67+
backingFilePath="okstate-prod-idp-metadata.xml"
14568
reloadInterval="180000" />
14669

14770
<!-- Open Universiteit (OUNL) -->
14871
<MetadataProvider type="XML"
14972
uri="https://login.ou.nl/am/saml2/jsp/exportmetadata.jsp?entityid=https://login.ou.nl/am&amp;realm=/ou"
150-
backingFilePath="ounl-idp-metadata.xml"
73+
backingFilePath="ounl-prod-idp-metadata.xml"
15174
reloadInterval="180000" />
15275

15376
<!-- University of British Columbia (UBC) -->
@@ -156,44 +79,74 @@
15679
backingFilePath="ubc-idp-metadata.xml"
15780
reloadInterval="180000" />
15881

159-
<!-- University of Cape Town (UCT) -->
160-
<MetadataProvider type="XML"
161-
uri="https://adfs.uct.ac.za/FederationMetadata/2007-06/FederationMetadata.xml"
162-
backingFilePath="uct-idp-metadata.xml"
163-
reloadInterval="180000" />
164-
165-
<!-- University of Kent (UNIVERSITYOFKENT) -->
166-
<MetadataProvider type="XML"
167-
uri="https://sso.id.kent.ac.uk/idp/saml2/idp/metadata.php"
168-
backingFilePath="universityofkent-idp-metadata.xml"
169-
reloadInterval="180000" />
170-
171-
<!-- University of South Carolina Libraries (SC) -->
82+
<!-- University of South Carolina (SC) -->
17283
<MetadataProvider type="XML"
17384
uri="https://cas.auth.sc.edu/cas/idp/metadata"
17485
backingFilePath="sc-idp-metadata.xml"
17586
reloadInterval="180000" />
17687

177-
<!-- Univeristy of Southern California (USC) -->
178-
<MetadataProvider type="XML" uri="https://shibboleth.usc.edu/USC-metadata.xml"
179-
backingFilePath="usc-idp-metadata.xml" reloadInterval="180000"/>
180-
18188
<!-- Vrije Universiteit Amsterdam (VUA) [Prod] -->
18289
<MetadataProvider type="XML"
18390
uri="https://stsfed.login.vu.nl/FederationMetadata/2007-06/FederationMetadata.xml"
18491
backingFilePath="vua-prod-idp-metadata.xml"
18592
reloadInterval="180000" />
18693

187-
<!-- University-provided metadata takes precedence over InCommon -->
188-
189-
<!-- InCommon -->
190-
<MetadataProvider type="XML" uri="http://md.incommon.org/InCommon/InCommon-metadata.xml"
191-
backingFilePath="incommon-idp-metadata.xml" reloadInterval="86400">
192-
<MetadataFilter type="Signature" certificate="incommon-idp-signature.pem"/>
94+
<!-- Here is the end of non-InCommon/eduGAIN IdPs. Current total: 9 unique provider and 9 institutions. -->
95+
96+
<!-- Here goes all InCommon/eduGAIN IdPs, all of which are production IdP server using the MDQ service -->
97+
<!-- This is a list of all servers using a Dynamic Metadata Provider configuration with MDQ -->
98+
<!-- Arizona State University -->
99+
<!-- Brown University -->
100+
<!-- Carnegie Mellon University -->
101+
<!-- Case Western Reserve University -->
102+
<!-- Cornell University -->
103+
<!-- Duke University -->
104+
<!-- Erasmus University Rotterdam -->
105+
<!-- Florida State University -->
106+
<!-- National High Magnetic Field Laboratory (Shared SSO via Florida State University) -->
107+
<!-- George Mason University -->
108+
<!-- George Washington University -->
109+
<!-- Georgia Institute of Technology -->
110+
<!-- Harvard University -->
111+
<!-- James Madison University -->
112+
<!-- KU Leuven -->
113+
<!-- Massachusetts Institute of Technology -->
114+
<!-- New York University -->
115+
<!-- Princeton University -->
116+
<!-- Purdue University -->
117+
<!-- Temple University -->
118+
<!-- The University of Oklahoma -->
119+
<!-- The University of Texas at Dallas -->
120+
<!-- Tufts University -->
121+
<!-- Universidade do Algarve -->
122+
<!-- Universiteit Gent -->
123+
<!-- University of Arizona -->
124+
<!-- University of California, Berkeley -->
125+
<!-- University of California, Los Angles -->
126+
<!-- University of Chicago -->
127+
<!-- University of Cincinnati -->
128+
<!-- University of Colorado Boulder -->
129+
<!-- University of Edinburgh -->
130+
<!-- University of London -->
131+
<!-- University of Manchester -->
132+
<!-- University of Maryland -->
133+
<!-- University of Maryland, Baltimore -->
134+
<!-- University of North Carolina at Chapel Hill -->
135+
<!-- University of Notre Dame -->
136+
<!-- University of Rochester -->
137+
<!-- University of Sussex -->
138+
<!-- University of Virginia -->
139+
<!-- Virginia Commonwealth University -->
140+
<!-- Virginia Tech -->
141+
<!-- Washington University in St. Louis -->
142+
<!-- Yale Law School -->
143+
<MetadataProvider type="Dynamic" ignoreTransport="true" maxCacheDuration="86400" minCacheDuration="60">
144+
<Subst>https://mdq.incommon.org/entities/$entityID</Subst>
145+
<MetadataFilter type="RequireValidUntil" maxValidityInterval="1209600"/>
146+
<MetadataFilter type="Signature" certificate="inc-md-cert-mdq.pem"/>
193147
</MetadataProvider>
194148

195-
<!-- <MetadataProvider type="XML" uri="http://www.testshib.org/metadata/testshib-providers.xml"
196-
backingFilePath="testshib-two-idp-metadata2.xml" reloadInterval="180000"/> -->
149+
<!-- Here is the end of InCommon/eduGAIN IdPs. Current total: 1 dynamic provider for 45 institutions. -->
197150

198151
<!-- Map to extract attributes from SAML assertions. -->
199152
<AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/>
@@ -207,18 +160,6 @@
207160
<!-- Simple file-based resolver for using a single keypair. -->
208161
<CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>
209162

210-
<!--
211-
The default settings can be overridden by creating ApplicationOverride elements (see
212-
the https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplicationOverride topic).
213-
Resource requests are mapped by web server commands, or the RequestMapper, to an
214-
applicationId setting.
215-
216-
Example of a second application (for a second vhost) that has a different entityID.
217-
Resources on the vhost would map to an applicationId of "admin":
218-
-->
219-
<!--
220-
<ApplicationOverride id="admin" entityID="https://admin.example.org/shibboleth"/>
221-
-->
222163
</ApplicationDefaults>
223164

224165
<!-- Policies that determine how to process and authenticate runtime messages. -->

0 commit comments

Comments
 (0)