Page Comparison

<SPConfig xmlns="urn:mace:shibboleth:3.0:native:sp:config"
          xmlns:conf="urn:mace:shibboleth:3.0:native:sp:config"
          clockSkew="180">

    <OutOfProcess tranLogFormat="%u|%s|%IDP|%i|%ac|%t|%attr|%n|%b|%E|%S|%SS|%L|%UA|%a" />


    <!-- The ApplicationDefaults Byelement default, in-memory StorageService, ReplayCache, ArtifactMap, and SessionCacheis where most of Shibboleth's SAML bits are useddefined. See example-shibboleth2.xml for samples of explicitly configuring them.
-->

<!-- The ApplicationDefaults element is where most of Shibboleth's SAML bits are defined. -->
<ApplicationDefaults entityID="https://pcr360.sfsu.edu/shibboleth-sp"-->
    <ApplicationDefaults entityID="https://pcr360.<customer.url>/shibboleth-sp"
                         REMOTE_USER="eppn subject-id pairwise-id persistent-id"
                         cipherSuites="DEFAULT:!EXP:!LOW:!aNULL:!eNULL:!DES:!IDEA:!SEED:!RC4:!3DES:!kRSA:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1">

<!-- Controls session lifetimes, address checks, cookie handling, and the protocol handlers.
Each Application has an effectively unique handlerURL, which defaults to "/Shibboleth.sso"
and should be a relative path, with the SP computing the full value based on the virtual
host. Using handlerSSL="true" will force the protocol to be https. You should also set
cookieProps to "https" for SSL-only sites. Note that while we default checkAddress to
"false", this makes an assertion stolen in transit easier for attackers to misuse.
-->
<Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
checkAddress="false" handlerSSL="false" cookieProps="http"
redirectLimit="exact">

<!--
Configures SSO for a default IdP. To properly allow for >1 IdP, remove<Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
                  checkAddress="false" handlerSSL="true" cookieProps="https"
                  redirectLimit="exact">

            <!--
            Configures SSO for a default IdP. To properly allow for >1 IdP, remove
            entityID property and adjust discoveryURL to point to discovery service.
            You can also override entityID on /Login query string, or in RequestMap/htaccess.
            -->
  <SSO entityID="https://idp.sfsu.edu/idp/shibboleth"
          <SSO entityID="<CUSTOMER_ENTITY_SERVER>"
                 discoveryProtocol="SAMLDS" 
                 discoveryURL="https://idpds.sfsuexample.eduorg/DS/WAYF">
              SAML2
            </SSO>

            <!-- SAML and local-only logout. -->
            <Logout>SAML2 Local</Logout>

<!-- Administrative logout. -->
<LogoutInitiator          <Handler type="AdminMetadataGenerator" Location="/Logout/AdminMetadata" aclsigning="127.0.0.1 ::1" false"/>
   <!-- Extension service that generates "approximate" metadata based on SP configuration. -->
<Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>         
            <!-- StatusAdministrative reporting servicelogout. -->
<Handler
            <LogoutInitiator type="StatusAdmin" Location="/Logout/StatusAdmin" acl="127.0.0.1 ::1" />

            <!-- SessionStatus diagnosticreporting service. -->
<Handler type="Session            <Handler type="Status" Location="/SessionStatus" showAttributeValuesacl="false127.0.0.1 ::1"/>

<!-- JSON feed of discovery information. --> <Handler type="DiscoveryFeed" Location="/DiscoFeed"/> </Sessions>  <!-- Allows overriding of error template information/filenames. You can
also add your own attributes with values that can be plugged into the
templates, e.g., helpLocation below.
-->
<Errors supportContact="help@pcr.com"
helpLocation="/about.html"
styleSheet="/shibboleth-sp/main.css"/>Session diagnostic service. -->
            <Handler type="Session" Location="/Session" showAttributeValues="false"/>

            <!-- JSON Examplefeed of locallydiscovery maintained metadatainformation. -->
<!--
<MetadataProvider
            <Handler type="XMLDiscoveryFeed" validateLocation="true" path="partner-metadata.xml/DiscoFeed"/>
-->
        <!--/Sessions>
Example
of remotely supplied batch of signed metadata. -->  <!--MetadataProvider type="XML" validate="true"
url="http://federation.org/federation-metadata.xml"
backingFilePath="federation-metadata.xml" maxRefreshDelay="7200">
<MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/>
<MetadataFilter type="Signature" certificate="fedsigner.pem" verifyBackup="false"/>
<DiscoveryFilter type="Blacklist" matcher="EntityAttributes" trimTags="true"
attributeName="http://macedir.org/entity-category"
attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
attributeValue="http://refeds.org/category/hide-from-discovery" />
</MetadataProvider-->

<MetadataProvider type="XML" validate="true"
url="http://md.incommon.org/InCommon/InCommon-metadata.xml"
backingFilePath="sfsu-metadata.xml" maxRefreshDelay="7200">
<!--MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/-->
<!--MetadataFilter type="Signature" certificate="fedsigner.pem" verifyBackup="false"/-->
<DiscoveryFilter type="Blacklist" matcher="EntityAttributes" trimTags="true"
attributeName="http://macedir.org/entity-category"
attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
attributeValue="http://refeds.org/category/hide-from-discovery" />
</MetadataProvider>

<!-- Example of remotely supplied "on-demand" signed metadata. -->
<!--MetadataProvider type="MDQ" validate="true" cacheDirectory="mdq"
baseUrl="https://pcr360.sfsu.edu/shibboleth-sp" ignoreTransport="true">
<MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/>
<MetadataFilter type="Signature" certificate="mdqsigner.pem" />
</MetadataProvider-->

<!-- Map to extract attributes from SAML assertions. -->
<AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/>

<!-- Default filtering policy for recognized attributes, lets other data pass. -->
<AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>

<!-- Simple file-based resolvers for separate signing/encryption keys. -->
<CredentialResolver type="File" use="signing"
key="sp-signing-key.pem" certificate="sp-signing-cert.pem"/>
<CredentialResolver type="File" use="encryption"
key="sp-encrypt-key.pem" certificate="sp-encrypt-cert.pem"/>

</ApplicationDefaults>

<!-- Policies that determine how to process and authenticate runtime messages. -->
<SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/>

<!-- Low-level configuration about protocols and bindings available for use. -->
<ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/>

</SPConfig>

        Allows overriding of error template information/filenames. You can
        also add your own attributes with values that can be plugged into the
        templates, e.g., helpLocation below.
        -->
        <Errors supportContact="help@pcr.com"
                helpLocation="/about.html"
                styleSheet="/shibboleth-sp/main.css"/>

        <!-- Example of locally maintained metadata. -->
        <!-- MetadataProvider type="XML" validate="true" path="partner-metadata.xml"/-->

        <!-- Example of remotely supplied metadata with a local backup. -->
        <MetadataProvider type="XML" validate="true"
            url="http://md.incommon.org/InCommon/InCommon-metadata.xml"
            backingFilePath="customer-metadata.xml" maxRefreshDelay="7200">
            <DiscoveryFilter type="Exclude" matcher="EntityAttributes" trimTags="true"
                             attributeName="http://macedir.org/entity-category"
                             attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
                             attributeValue="http://refeds.org/category/hide-from-discovery" />
        </MetadataProvider>

        <!-- Map to extract attributes from SAML assertions. -->
        <AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/>

        <!-- Default filtering policy for recognized attributes, lets other data pass. -->
        <AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>

        <!-- Simple file-based resolvers for separate signing/encryption keys. -->
        <CredentialResolver type="File" use="signing"
                            key="sp-signing-key.pem" certificate="sp-signing-cert.pem"/>
        <CredentialResolver type="File" use="encryption"
                            key="sp-encrypt-key.pem" certificate="sp-encrypt-cert.pem"/>

    </ApplicationDefaults>

    <!-- Policies that determine how to process and authenticate runtime messages. -->
    <SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/>

    <!-- Low-level configuration about protocols and bindings available for use. -->
    <ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/>

</SPConfig>