6661a9dab7
To standarize variable name across roles, this change renames `keystone_ssl` to `keystone_backend_ssl`. All other roles use `<service>_backend_ssl` format. It also better describes what it does. With `keystone_ssl` it's unclear whether it is about frontend or backend. Backward compatibility will not be implemented because securing haproxy traffic to its backends with TLS is currently not supported by OSA so it is hard to leverage `keystone_ssl` variable anyway. Change-Id: Ibf8607a4cf62ab518a09d64b1054ff7fbc580000
127 lines
5.2 KiB
Django/Jinja
127 lines
5.2 KiB
Django/Jinja
<SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"
|
|
xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"
|
|
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
|
|
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
|
|
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
|
|
clockSkew="180">
|
|
|
|
<OutOfProcess>
|
|
<Extensions>
|
|
<Library path="memcache-store.so" fatal="true"/>
|
|
</Extensions>
|
|
</OutOfProcess>
|
|
|
|
<StorageService type="MEMCACHE" id="mc" prefix="shibboleth2:">
|
|
<Hosts>
|
|
{{ keystone_memcached_servers }}
|
|
</Hosts>
|
|
</StorageService>
|
|
|
|
<StorageService type="MEMCACHE" id="mc-ctx" prefix="shibboleth2:" buildMap="1">
|
|
<Hosts>
|
|
{{ keystone_memcached_servers }}
|
|
</Hosts>
|
|
</StorageService>
|
|
|
|
<SessionCache type="StorageService" cacheTimeout="{{ horizon_session_timeout }}" StorageService="mc-ctx" StorageServiceLite="mc" />
|
|
<ReplayCache StorageService="mc"/>
|
|
<ArtifactMap StorageService="mc" artifactTTL="180"/>
|
|
|
|
<!-- The entityID is the name by which your IdP will know your SP. -->
|
|
<ApplicationDefaults entityID="{{ keystone_service_publicuri }}/shibboleth">
|
|
|
|
<!-- You should use secure cookies if at all possible. See cookieProps in this Wiki article. -->
|
|
<!-- https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSessions -->
|
|
<Sessions lifetime="28800"
|
|
timeout="3600"
|
|
relayState="ss:mc"
|
|
checkAddress="false"
|
|
handlerSSL="{% if keystone_backend_ssl | bool %}true{% else %}false{% endif %}"
|
|
{% if keystone_service_publicuri_proto == "https" %}cookieProps="; path=/; secure"{% endif %}>
|
|
|
|
<!-- Triggers a login request directly to the IdP. -->
|
|
<!-- https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPServiceSSO -->
|
|
<SSO ECP="true" entityID="{{ keystone_sp.trusted_idp_list.0.entity_ids.0 }}">
|
|
SAML2 SAML1
|
|
</SSO>
|
|
|
|
<!-- SAML and local-only logout. -->
|
|
<!-- https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPServiceLogout -->
|
|
<Logout>SAML2 Local</Logout>
|
|
|
|
<!--
|
|
Handlers allow you to interact with the SP and gather more information.
|
|
Attribute values received by the SP through SAML will be visible at:
|
|
{{ keystone_service_publicuri }}/Shibboleth.sso/Session
|
|
-->
|
|
|
|
<!-- Extension service that generates "approximate" metadata based on SP configuration. -->
|
|
<Handler type="MetadataGenerator"
|
|
Location="/Metadata"
|
|
signing="false"/>
|
|
|
|
<!-- Status reporting service. -->
|
|
<Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>
|
|
|
|
<!-- Session diagnostic service. -->
|
|
<Handler type="Session" Location="/Session" showAttributeValues="true"/>
|
|
|
|
<!-- JSON feed of discovery information. -->
|
|
<Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
|
|
</Sessions>
|
|
|
|
<!--
|
|
Allows overriding of error template information/filenames. You can
|
|
also add attributes with values that can be plugged into the templates.
|
|
-->
|
|
<Errors supportContact="root@localhost"
|
|
helpLocation="/about.html"
|
|
styleSheet="/shibboleth-sp/main.css"/>
|
|
|
|
<!--
|
|
Loads and trusts a list of metadata files which describes
|
|
the trusted IdP's and how to communicate with them.
|
|
-->
|
|
{% if keystone_sp.trusted_idp_list is defined -%}
|
|
{% for item in keystone_sp.trusted_idp_list %}
|
|
<MetadataProvider type="XML"
|
|
uri="{{ item.metadata_uri }}"
|
|
backingFilePath="{{ item.metadata_file }}"
|
|
reloadInterval="{{ item.metadata_reload }}" />
|
|
{% endfor %}
|
|
{% endif %}
|
|
|
|
<!-- Map to extract attributes from SAML assertions. -->
|
|
<AttributeExtractor type="XML"
|
|
validate="true"
|
|
reloadChanges="false"
|
|
path="attribute-map.xml"/>
|
|
|
|
<!-- Use a SAML query if no attributes are supplied during SSO. -->
|
|
<AttributeResolver type="Query" subjectMatch="true"/>
|
|
|
|
<!-- Default filtering policy for recognized attributes, lets other data pass. -->
|
|
<AttributeFilter type="XML"
|
|
validate="true"
|
|
path="attribute-policy.xml"/>
|
|
|
|
<!-- Your SP generated these credentials. They're used to talk to IdP's. -->
|
|
<CredentialResolver type="File"
|
|
key="sp-key.pem"
|
|
certificate="sp-cert.pem"/>
|
|
|
|
</ApplicationDefaults>
|
|
|
|
<!-- Policies that determine how to process and authenticate runtime messages. -->
|
|
<SecurityPolicyProvider type="XML"
|
|
validate="true"
|
|
path="security-policy.xml"/>
|
|
|
|
<!-- Low-level configuration about protocols and bindings available for use. -->
|
|
<ProtocolProvider type="XML"
|
|
validate="true"
|
|
reloadChanges="false"
|
|
path="protocols.xml"/>
|
|
|
|
</SPConfig>
|