A minimal configuration
<SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"
xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
clockSkew="180">
<ApplicationDefaults entityID="https://example.com/shibboleth"
REMOTE_USER="eppn persistent-id targeted-id">
<Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
checkAddress="false" handlerSSL="true" cookieProps="https">
<Logout>SAML2 Local</Logout>
<Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>
<Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>
<Handler type="Session" Location="/Session" showAttributeValues="false"/>
<Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
<md:AssertionConsumerService Location="/SAML2/POST"
index="1"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
conf:ignoreNoPassive="true" />
<SessionInitiator type="Chaining" Location="/Login" isDefault="true" id="default_ds" relayState="cookie">
<SessionInitiator type="SAML2" defaultACSIndex="1" acsByIndex="false" template="bindingTemplate.html"/>
<SessionInitiator type="Shib1" defaultACSIndex="5"/>
<SessionInitiator type="SAMLDS" URL="https://md.nordu.net/role/idp.ds"/>
</SessionInitiator>
</Sessions>
<Errors supportContact="${SP_CONTACT}"
helpLocation="/about"
styleSheet="/shibboleth-sp/main.css"/>
<MetadataProvider type="XML" uri="http://md.swamid.se/md/swamid-idp-transitive.xml"
backingFilePath="swamid-1.0.xml" reloadInterval="300">
<SignatureMetadataFilter certificate="md-signer.crt"/>
</MetadataProvider>
<AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/>
<AttributeResolver type="Query" subjectMatch="true"/>
<AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>
<CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>
</ApplicationDefaults>
<SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/>
<ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/>
</SPConfig>
This file represents reasonable defaults for connecting an SP to SWAMID. You should only need to change example.com in the example above to the public FQDN of your host. Note that registering a fully functional SP with SWAMID usually requires you to have a fully qualified domain name for your service in DNS that is visible on the public Internet. It is possible to register internal development instances in the SWAMID testing metadata that points to localhost or other internal DNS names but this is discouraged for production services.
After you save this file as /etc/shibboleth/shibboleth2.xml, download https://md.swamid.se/md/md-signer.crt and save as /etc/shibboleth/md-signer.crt. Take care to verify the fingerprint of this certificate as published on https://md.swamid.se/md. Finally you must generate a keypair for your SP. This keypair is not the same as the certificate of your service and is used to secure SAML protocol messages between SWAMID IdPs and your service. Usually you do this by running the following command
# shib-keygen -h example.com
At this point you should be able to restart the shibd process. If you get errors or if shibd refuses to start, make sure you don't have syntax error in any of your XML files. The system logs should provide clues about what may have gone wrong. If necessary increase the shibboleth log level to DEBUG.
If shibd restarts ok, you should be able to point a browser at (or use curl to download) https://example.com/Shibboleth.sso/Metadata which should contain a PEM encoded version of your newly generated SP keypair. At this point you are read to register this metadata with SWAMID.