<SPConfig xmlns="urn:mace:shibboleth:3.0:native:sp:config"
    xmlns:conf="urn:mace:shibboleth:3.0:native:sp:config"
    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
    xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"   
    xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
    xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui"
    clockSkew="180">
 
    <OutOfProcess tranLogFormat="%u|%s|%IDP|%i|%ac|%t|%attr|%n|%b|%E|%S|%SS|%L|%UA|%a" />
 
    <!--
    By default, in-memory StorageService, ReplayCache, ArtifactMap, and SessionCache
    are used. See example-shibboleth2.xml for samples of explicitly configuring them.
    -->
 
    <!--
    To customize behavior for specific resources on Apache, and to link vhosts or
    resources to ApplicationOverride settings below, use web server options/commands.
    See https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPConfigurationElements for help.
     
    For examples with the RequestMap XML syntax instead, see the example-shibboleth2.xml
    file, and the https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPRequestMapHowTo topic.
    -->
 
    <!-- The ApplicationDefaults element is where most of Shibboleth's SAML bits are defined. -->
    <ApplicationDefaults id="default" policyId="default" entityID="https://sp.example.com"
        REMOTE_USER="eppn subject-id pairwise-id persistent-id"
        cipherSuites="DEFAULT:!EXP:!LOW:!aNULL:!eNULL:!DES:!IDEA:!SEED:!RC4:!3DES:!kRSA:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1">
 
        <!--
        Controls session lifetimes, address checks, cookie handling, and the protocol handlers.
        Each Application has an effectively unique handlerURL, which defaults to "/Shibboleth.sso"
        and should be a relative path, with the SP computing the full value based on the virtual
        host. Using handlerSSL="true" will force the protocol to be https. You should also set
        cookieProps to "https" for SSL-only sites. Note that while we default checkAddress to
        "false", this makes an assertion stolen in transit easier for attackers to misuse.
        -->
        <Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
                  checkAddress="true" handlerSSL="true" cookieProps="https">
 
            <!--
            Configures SSO for a default IdP. To allow for >1 IdP, remove
            entityID property and adjust discoveryURL to point to discovery service.
            (Set discoveryProtocol to "WAYF" for legacy Shibboleth WAYF support.)
            You can also override entityID on /Login query string, or in RequestMap/htaccess.
            -->
            <SSO entityID="https://login.rz.rwth-aachen.de/shibboleth">
              SAML2
            </SSO>
 
            <!-- SAML and local-only logout. -->
            <Logout>SAML2 Local</Logout>
             
            <!-- Administrative logout. -->
            <LogoutInitiator type="Admin" Location="/Logout/Admin" acl="127.0.0.1 ::1" />
 
        <!-- Extension service that generates "approximate" metadata based on SP configuration. -->
        <Handler type="MetadataGenerator" Location="/Metadata" signing="false">
            <mdui:UIInfo>
                <mdui:DisplayName xml:lang="de">Beispiel SP</mdui:DisplayName>
                <mdui:DisplayName xml:lang="en">Example SP</mdui:DisplayName>
                <mdui:Description xml:lang="de">Eine Beschreibung für den SP</mdui:Description>
                <mdui:Description xml:lang="en">An description for the SP</mdui:Description>
            </mdui:UIInfo>
            <md:Organization>
                <md:OrganizationName xml:lang="de">RWTH Aachen University</md:OrganizationName>
                <md:OrganizationName xml:lang="en">RWTH Aachen University</md:OrganizationName>
                <md:OrganizationDisplayName xml:lang="de">RWTH Aachen University</md:OrganizationDisplayName>
                <md:OrganizationDisplayName xml:lang="en">RWTH Aachen University</md:OrganizationDisplayName>
                <md:OrganizationURL xml:lang="de">http://www.rwth-aachen.de</md:OrganizationURL>
                <md:OrganizationURL xml:lang="en">http://www.rwth-aachen.de</md:OrganizationURL>
            </md:Organization>
            <md:ContactPerson contactType="support">
                <md:GivenName>Support</md:GivenName>
                <md:SurName>Adresse</md:SurName>
                <md:EmailAddress>support@sp.example.com</md:EmailAddress>
            </md:ContactPerson>
            <md:ContactPerson contactType="technical">
                <md:GivenName>Technischer</md:GivenName>
                <md:SurName>Ansprechpartner</md:SurName>
                <md:EmailAddress>technik@sp.example.com</md:EmailAddress>
            </md:ContactPerson>
            <md:ContactPerson contactType="administrative">
                <md:GivenName>Adminstrativer</md:GivenName>
                <md:SurName>Ansprechpartner</md:SurName>
                <md:EmailAddress>admin@sp.example.com</md:EmailAddress>
            </md:ContactPerson>
        </Handler>
 
            <!-- Status reporting service. -->
            <Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>
 
            <!-- Session diagnostic service. -->
            <Handler type="Session" Location="/Session" showAttributeValues="false"/>
 
            <!-- JSON feed of discovery information. -->
            <Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
        </Sessions>
 
        <!--
        Allows overriding of error template information/filenames. You can
        also add attributes with values that can be plugged into the templates.
        -->
        <Errors supportContact="sp@example.com"
            helpLocation="/about.html"
            styleSheet="/shibboleth-sp/main.css"/>
         
        <MetadataProvider type="XML" url="https://sso.rwth-aachen.de/metadata/rwth.metadata.xml"
            backingFilePath="rwth.metadata.xml" maxRefreshDelay="7200">
            <MetadataFilter type="Signature" certificate="/pfad/zum/zertifikat.pem"/>
        </MetadataProvider>
 
        <!-- Map to extract attributes from SAML assertions. -->
        <AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/>
         
        <!-- Use a SAML query if no attributes are supplied during SSO. -->
        <AttributeResolver type="Query" subjectMatch="true"/>
 
        <!-- Default filtering policy for recognized attributes, lets other data pass. -->
        <AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>
 
        <!-- Simple file-based resolver for using a single keypair. -->
        <CredentialResolver type="File" key="/pfad/zum/private.key" certificate="/pfad/zum/zertifikat.cert"/>
 
        <!--
        The default settings can be overridden by creating ApplicationOverride elements (see
        the https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplicationOverride topic).
        Resource requests are mapped by web server commands, or the RequestMapper, to an
        applicationId setting.
         
        Example of a second application (for a second vhost) that has a different entityID.
        Resources on the vhost would map to an applicationId of "admin":
        -->
        <!--
        <ApplicationOverride id="admin" entityID="https://admin.example.org/shibboleth"/>
        -->
    </ApplicationDefaults>
     
    <!-- Policies that determine how to process and authenticate runtime messages. -->
    <SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/>
 
    <!-- Low-level configuration about protocols and bindings available for use. -->
    <ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/>
 
</SPConfig>