@@ -61,7 +61,7 @@ attribute_map_dir
61
61
Format::
62
62
63
63
"attribute_map_dir": "attribute-maps"
64
-
64
+
65
65
Points to a directory which has the attribute maps in Python modules.
66
66
A typical map file will looks like this::
67
67
@@ -91,9 +91,9 @@ The *to* and *fro* sub-dictionaries then contain the mapping between the names.
91
91
92
92
As you see the format is again a python dictionary where the key is the
93
93
name to convert from, and the value is the name to convert to.
94
-
95
- Since *to * in most cases is the inverse of the *fro * file, the
96
- software allowes you to only specify one of them and it will
94
+
95
+ Since *to * in most cases is the inverse of the *fro * file, the
96
+ software allowes you to only specify one of them and it will
97
97
automatically create the other.
98
98
99
99
cert_file
@@ -109,11 +109,11 @@ This is the public part of the service private/public key pair.
109
109
contact_person
110
110
^^^^^^^^^^^^^^
111
111
112
- This is only used by *make_metadata.py * when it constructs the metadata for
112
+ This is only used by *make_metadata.py * when it constructs the metadata for
113
113
the service described by the configuration file.
114
114
This is where you describe who can be contacted if questions arise
115
115
about the service or if support is needed. The possible types are according to
116
- the standard **technical **, **support **, **administrative **, **billing **
116
+ the standard **technical **, **support **, **administrative **, **billing **
117
117
and **other **.::
118
118
119
119
contact_person: [{
@@ -179,9 +179,9 @@ a file accessible on the server the service runs on, or somewhere on the net.::
179
179
}],
180
180
},
181
181
182
- The above configuration means that the service should read two local
182
+ The above configuration means that the service should read two local
183
183
metadata files, and on top of that load one from the net. To verify the
184
- authenticity of the file downloaded from the net, the local copy of the
184
+ authenticity of the file downloaded from the net, the local copy of the
185
185
public key should be used.
186
186
This public key must be acquired by some out-of-band method.
187
187
@@ -198,16 +198,16 @@ Where you describe the organization responsible for the service.::
198
198
}
199
199
200
200
.. note :: You can specify the language of the name, or the language used on
201
- the webpage, by entering a tuple, instead of a simple string,
201
+ the webpage, by entering a tuple, instead of a simple string,
202
202
where the second part is the language code. If you don't specify a
203
203
language the default is "en" (English).
204
204
205
205
service
206
206
^^^^^^^
207
207
208
- Which services the server will provide; those are combinations of "idp", "sp"
208
+ Which services the server will provide; those are combinations of "idp", "sp"
209
209
and "aa".
210
- So if a server is a Service Provider (SP) then the configuration
210
+ So if a server is a Service Provider (SP) then the configuration
211
211
could look something like this::
212
212
213
213
"service": {
@@ -225,7 +225,7 @@ could look something like this::
225
225
},
226
226
}
227
227
},
228
-
228
+
229
229
There are two options common to all services: 'name' and 'endpoints'.
230
230
The remaining options are specific to one or the other of the service types.
231
231
Which one is specified along side the name of the option.
@@ -312,17 +312,17 @@ An example might be::
312
312
}
313
313
}
314
314
}
315
-
316
- *lifetime *
317
- This is the maximum amount of time before the information should be
318
- regarded as stale. In an Assertion this is represented in the NotOnOrAfter
319
- attribute.
315
+
316
+ *lifetime *
317
+ This is the maximum amount of time before the information should be
318
+ regarded as stale. In an Assertion this is represented in the NotOnOrAfter
319
+ attribute.
320
320
*attribute_restrictions *
321
321
By default there is no restrictions as to which attributes should be
322
- return. Instead all the attributes and values that are gathered by the
322
+ return. Instead all the attributes and values that are gathered by the
323
323
database backends will be returned if nothing else is stated.
324
324
In the example above the SP with the entity identifier
325
- "urn:mace: umu.se:saml: roland:sp"
325
+ "urn:mace: umu.se:saml: roland:sp"
326
326
has an attribute restriction: only the attributes
327
327
'givenName' and 'surName' are to be returned. There is no limitations as to
328
328
what values on these attributes that can be returned.
@@ -332,7 +332,7 @@ An example might be::
332
332
the friendly name, and the saml attribute name will be taken from the uri/oid
333
333
defined in the attribute map.
334
334
335
- If restrictions on values are deemed necessary those are represented by
335
+ If restrictions on values are deemed necessary those are represented by
336
336
regular expressions.::
337
337
338
338
"service": {
380
380
381
381
Defines the set of IdPs that this SP is allowed to use; if unset, all listed
382
382
IdPs may be used. If set, then the value is expected to be a list with entity
383
- identifiers for the allowed IdPs.
383
+ identifiers for the allowed IdPs.
384
384
A typical configuration, when the allowed set of IdPs are limited, would look
385
385
something like this::
386
386
@@ -404,7 +404,7 @@ Example::
404
404
"optional_attributes": ["title"],
405
405
}
406
406
}
407
-
407
+
408
408
Since the attribute names used here are the user friendly ones an attribute map
409
409
must exist, so that the server can use the full name when communicating
410
410
with other servers.
@@ -422,7 +422,7 @@ Example::
422
422
}
423
423
}
424
424
425
- Again as for *optional_attributes * the names given are expected to be
425
+ Again as for *optional_attributes * the names given are expected to be
426
426
the user friendly names.
427
427
428
428
want_assertions_signed
@@ -444,7 +444,7 @@ Example::
444
444
445
445
446
446
idp/aa/sp
447
- ^^^^^^^^^
447
+ ^^^^^^^^^
448
448
449
449
If the configuration is covering both two or three different service types
450
450
(like if one server is actually acting as both an IdP and a SP) then in some
@@ -516,7 +516,7 @@ Example::
516
516
subject_data
517
517
""""""""""""
518
518
519
- The name of a database where the map between a local identifier and
519
+ The name of a database where the map between a local identifier and
520
520
a distributed identifier is kept. By default this is a shelve database.
521
521
So if you just specify name, then a shelve database with that name
522
522
is created. On the other hand if you specify a tuple then the first
@@ -548,8 +548,8 @@ Gives information about common identifiers for virtual_organizations::
548
548
},
549
549
550
550
Keys in this dictionary are the identifiers for the virtual organizations.
551
- The arguments per organization are 'nameid_format' and 'common_identifier'.
552
- Useful if all the IdPs and AAs that are involved in a virtual organization
551
+ The arguments per organization are 'nameid_format' and 'common_identifier'.
552
+ Useful if all the IdPs and AAs that are involved in a virtual organization
553
553
have common attribute values for users that are part of the VO.
554
554
555
555
Complete example
@@ -622,9 +622,9 @@ A slightly more complex configuration::
622
622
"key_file" : "./mykey.pem",
623
623
"cert_file" : "./mycert.pem",
624
624
"xmlsec_binary" : "/usr/local/bin/xmlsec1",
625
- "metadata" : {
625
+ "metadata" : {
626
626
"local": ["example.xml"],
627
- "remote": [{
627
+ "remote": [{
628
628
"url":"https://kalmar2.org/simplesaml/module.php/aggregator/?id=kalmarcentral2&set=saml2",
629
629
"cert":"kalmar2.pem"}]
630
630
},
@@ -640,9 +640,9 @@ A slightly more complex configuration::
640
640
"type": "technical",
641
641
}]
642
642
}
643
-
644
- Uses metadata files, both local and remote, and will talk to whatever
645
- IdP that appears in any of the metadata files.
643
+
644
+ Uses metadata files, both local and remote, and will talk to whatever
645
+ IdP that appears in any of the metadata files.
646
646
647
647
Other considerations
648
648
::::::::::::::::::::
0 commit comments