...
If you have followed the installation guides in this wiki so far, you should rename the downloaded file, edit it and rename it to shibboleth2.xml and put it in the SHIB_HOME directory (/etc/shibboleth on linux c:\opt\shibboleth-sp\etc\shibboleth on Windows, if you haven't changed that during installation).
You can see the contents of the files in the code block below. All comments that is in the files above are filtered out.
swamid-apache-shibboleth2.xml
...
The latest published SWAMID example main configuration file for Shibboleth Service Provider 3 is published at mds.swamid.se/entity-configurations/Shibboleth-SP/v3/. Below is the latest versions included from the publication repository.
...
swamid-apache-shibboleth2.xml without standard installation comments and examples
| Html-bobswift |
|---|
| output | wiki |
|---|
| source | https://mds.swamid.se/entity-configurations/Shibboleth-IdP/v4/attribute-filter.xml |
|---|
| script | #https://mds.swamid.se/entity-configurations/Shibboleth-SP/v3/swamid-apache-shibboleth2.xml |
|---|
|
| linenumbers | true |
|---|
<SPConfig xmlns="urn:mace:shibboleth:3.0:native:sp:config"
xmlns:conf="urn:mace:shibboleth:3.0:native:sp:config"
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
clockSkew="180">
<ApplicationDefaults entityID="https://swamidsp.example.org/shibboleth"
REMOTE_USER="eppn persistent-id targeted-id"
metadataAttributePrefix="Meta-">
<Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
redirectLimit="exact"
checkAddress="false" handlerSSL="true" cookieProps="http" sameSiteFallback="true">
<Logout>SAML2 Local</Logout>
<SessionInitiator type="Chaining" Location="/DS/Login" id="swamid-ds-default" relayState="cookie">
<SessionInitiator type="SAML2" acsIndex="1" acsByIndex="false" template="bindingTemplate.html"/>
<SessionInitiator type="Shib1" acsIndex="5"/>
<SessionInitiator type="SAMLDS" URL="https://service.seamlessaccess.org/ds/"/>
</SessionInitiator>
<md:AssertionConsumerService Location="/SAML2/POST" index="1"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
conf:ignoreNoPassive="true"/>
<Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>
<Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>
<Handler type="Session" Location="/Session" showAttributeValues="false"/>
<Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
<md:ArtifactResolutionService Location="/Artifact/SOAP" index="1"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"/>
</Sessions>
<Errors supportContact="webmaster@example.org"
helpLocation="/about.html"
styleSheet="/shibboleth-sp/main.css"/>
<MetadataProvider
type="XML"
url="https://mds.swamid.se/md/swamid-idp-transitive.xml"
backingFilePath="swamid-idp-transitive.xml" reloadInterval="7200">
<MetadataFilter type="Signature" certificate="md-signer2.crt" verifyBackup="false" />
</MetadataProvider>
<AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/>
<AttributeExtractor type="Metadata" errorURL="errorURL" DisplayName="displayName"/>
<AttributeResolver type="Query" subjectMatch="true"/>
<AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>
<CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>
</ApplicationDefaults>
<SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/>
<ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/>
</SPConfig> | |
swamid-IIS-shibboleth2.xml
...
| language | xml |
|---|
| firstline | 1 |
|---|
| title | swamid-IIS-shibboleth2.xml |
|---|
| linenumbers | true |
|---|
...
without standard installation comments and examples
| Html-bobswift |
|---|
| output | wiki |
|---|
| source | https://mds.swamid.se/entity-configurations/Shibboleth-IdP/v4/attribute-filter.xml |
|---|
| script | #https://mds.swamid.se/entity-configurations/Shibboleth-SP/v3/swamid-IIS-shibboleth2.xml |
|---|
|
|
Errorhandling
The "<Errors .... /> assumes that that http://example.org/about.html leads to some form of help page and that webmaster@example.org is the right contact address for your service. Change according to taste.
Additional setup steps
After you save this file as /etc/shibboleth/shibboleth2.xml, download https://mds.swamid.se/md/md-signer2.crt and save as /etc/shibboleth/md-signer.crt (or your windows equivalent). Take care to verify the fingerprint of this certificate as published on https://mds.swamid.se/md/. Finally you must generate a keypair for your SP. This keypair is not the same as the certificate of your service and is used to secure SAML protocol messages between SWAMID IdPs and your service. Usually you do this by running the following command
...