<SPConfig xmlns="urn:mace:shibboleth:3.0:native:sp:config"
    xmlns:conf="urn:mace:shibboleth:3.0:native:sp:config"
    clockSkew="180">

    <OutOfProcess tranLogFormat="%u|%s|%IDP|%i|%ac|%t|%attr|%n|%b|%E|%S|%SS|%L|%UA|%a" />
  
    <!--
    The InProcess section contains settings affecting web server modules.
    Required for IIS, but can be removed when using other web servers.
    -->
    <InProcess>
        <ISAPI normalizeRequest="true" safeHeaderNames="true">
            <!--
            Maps IIS Instance ID values to the host scheme/name/port. The name is
            required so that the proper <Host> in the request map below is found without
            having to cover every possible DNS/IP combination the user might enter.
            -->
            <Site id="3" name="shibtest.cit.cornell.edu"/>
            <Site id="5" name="shibtest1.cit.cornell.edu"/>
        </ISAPI>
    </InProcess>

    <RequestMapper type="Native">
        <RequestMap>
          
            <!-- Note that the name in the Host element MUST match the site name defined in <ISAPI> element above -->

            <!-- Example of all authenticated users are allowed to access the entire website -->
            
            <!-- This site also supports http, we have to redirect all http request to https -->
            <Host name="shibtest.cit.cornell.edu" authType="shibboleth" requireSession="true" redirectToSSL="443" />
            
            <!-- Example of a site that has different authorization rules for different path.
 All the other paths not defined below do no require authentication. -->
            <Host name="shibtest1.cit.cornell.edu" >
                
                <!-- The example requires an authentication session for documents in /special dir on the containing host. It grant access to netid jy98 mop29 -->
               <Path name="special" authType="shibboleth" requireSession="true">
                    <AccessControl>    
                       <Rule require="uid">jy98 mop29</Rule>
                    </AccessControl>
                </Path>

                 <!-- The example requires an authentication session for documents in /doc dir on the containing host. 
                    It grant access to user who is in either of those two group.
                    Group name is case sensitive. Cornell IDP do NOT support nested group. If you have to use nested group, you need
 to convert it to dynamic group -->
              <Path name="doc" authType="shibboleth" requireSession="true">
                    <AccessControl>  
                        <Rule require="groups" >cit.idm CIT-IDM-test</Rule>
                    </AccessControl>
              </Path>
               
            </Host>
            
            
        </RequestMap>
    </RequestMapper>

    <!--
    The ApplicationDefaults element is where most of Shibboleth's SAML bits are defined.
    With IIS, resource requests are mapped by the RequestMapper to an applicationId that
    points into to this section (or to the defaults here).
    -->
    <ApplicationDefaults entityID="https://shibtestsites.cit.cornell.edu/shibboleth"
        signing="true" REMOTE_USER="uid eduPersonPrincipalName" 
        cipherSuites="DEFAULT:!EXP:!LOW:!aNULL:!eNULL:!DES:!IDEA:!SEED:!RC4:!3DES:!kRSA:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1">

        <!--
        Controls session lifetimes, address checks, cookie handling, and the protocol handlers.
        Each Application has an effectively unique handlerURL, which defaults to "/Shibboleth.sso"
        and should be a relative path, with the SP computing the full value based on the virtual
        host. Using handlerSSL="true" will force the protocol to be https. You should also set
        cookieProps to "https" for SSL-only sites. Note that while we default checkAddress to
        "false", this makes an assertion stolen in transit easier for attackers to misuse.
        -->
        

        <Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
                  checkAddress="false" handlerSSL="true" cookieProps="https" redirectLimit="exact">

            <!--
            Configures SSO for Cornell IDP. 
            -->
            <SSO entityID="https://shibidp.cit.cornell.edu/idp/shibboleth">
              SAML2
            </SSO>

            <!-- Extension service that generates "approximate" metadata based on SP configuration. -->
            <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>

            <!-- Status reporting service. -->
            <Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>

            <!-- Session diagnostic service. -->
            <Handler type="Session" Location="/Session" showAttributeValues="true"/>

        </Sessions>

        <!--
        Allows overriding of error template information/filenames. You can
        also add your own attributes with values that can be plugged into the
        templates, e.g., helpLocation below.
        -->
        <Errors supportContact="root@localhost"
            helpLocation="/about.html"
            styleSheet="/shibboleth-sp/main.css"/>

        <!--Metadata for Cornell Shibboleth prod IDP. --> 
 
        <MetadataProvider type="XML" validate="true"
	            url="https://shibidp.cit.cornell.edu/idp/shibboleth"
              backingFilePath="cornell-idp.xml" maxRefreshDelay="7200" />

      <!-- Map to extract attributes from SAML assertions. -->
        <AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/>
        
        <!-- Default filtering policy for recognized attributes, lets other data pass. -->
        <AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>

        <!-- Simple file-based resolvers for separate signing/encryption keys. -->
        <CredentialResolver type="File" use="signing"
            key="sp-signing-key.pem" certificate="sp-signing-cert.pem"/>
        <CredentialResolver type="File" use="encryption"
            key="sp-encrypt-key.pem" certificate="sp-encrypt-cert.pem"/>
        
    </ApplicationDefaults>
    
    <!-- Policies that determine how to process and authenticate runtime messages. -->
    <SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/>

    <!-- Low-level configuration about protocols and bindings available for use. -->
    <ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/>

</SPConfig>
