<SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"
    xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"
    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
    xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"    
    xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
    clockSkew="180">

	<!--
    <InProcess logger="native.logger">
        <ISAPI normalizeRequest="true" safeHeaderNames="true">
            <Site id="1" name="tiger.cc.binghamton.edu"/>
        </ISAPI>
    </InProcess>
    -->
	
    <RequestMapper type="Native">
        <RequestMap applicationId="default">
            <Host name="tiger.cc.binghamton.edu">
                <Path name="secure" authType="shibboleth" requireSession="true"/>
				<Path name="private" authType="shibboleth" requireSession="true"/>
				<!--
                <Path name="private" applicationId="vhost1" authType="shibboleth" requireSession="true"/>
				-->
            </Host>
        </RequestMap>
    </RequestMapper>

    <ApplicationDefaults entityID="https://tiger.cc.binghamton.edu/shibboleth-sp"
                         REMOTE_USER="eppn persistent-id targeted-id samAccountName"
                         cipherSuites="ECDHE+AESGCM:ECDHE:!aNULL:!eNULL:!LOW:!EXPORT:!RC4:!SHA:!SSLv2">

        <Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
                  checkAddress="false" handlerSSL="true"
				  cookieProps="; path=/; secure; HttpOnly">

            <SSO entityID="https://securetest.binghamton.edu/idp/shibboleth">
              SAML2 SAML1
            </SSO>

            <Logout>SAML2 Local</Logout>

            <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>

            <Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>

            <Handler type="Session" Location="/Session" showAttributeValues="false"/>

            <Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
        </Sessions>

        <Errors supportContact="root@localhost"
            helpLocation="/about.html"
            styleSheet="/shibboleth-sp/main.css"/>
        
        <MetadataProvider type="XML" file="securetest-metadata.xml"/>

        <AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/>
        
        <AttributeResolver type="Query" subjectMatch="true"/>

        <AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>

        <CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>
        
		<!--
		<ApplicationOverride id="vhost1" entityID="https://tiger.cc.binghamton.edu/private/shibboleth-sp">
            <Sessions lifetime="28800" timeout="7200"
			          checkAddress="false" handlerSSL="true"
					  cookieProps="; path=/; secure; HttpOnly"
					  handlerURL="/private/Shibboleth.sso" />
        </ApplicationOverride>
		-->
    </ApplicationDefaults>
    
    <SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/>

    <ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/>

</SPConfig>

-- validate configs
/opt/shibboleth-sp/sbin/shibd -check

-- start Shibboleth SP
/opt/shibboleth-sp/sbin/shibd

-- Shibboleth debug page
<html>
<head></head>
<body>
<pre style="font-size:10pt">
<?php print_r($_SERVER) ?>
</pre>
</body>
</html>

-- Shibboleth URLs
https://tiger.cc.binghamton.edu/Shibboleth.sso/Status
https://tiger.cc.binghamton.edu/Shibboleth.sso/Session
https://tiger.cc.binghamton.edu/Shibboleth.sso/Metadata


securetest-metadata.xml

<EntityDescriptor entityID="https://securetest.binghamton.edu/idp/shibboleth"
                  xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
                  xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
                  xmlns:shibmd="urn:mace:shibboleth:metadata:1.0"
                  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                  xmlns:mdrpi="urn:oasis:names:tc:SAML:metadata:rpi"
                  xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute"
                  xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui">

    <IDPSSODescriptor protocolSupportEnumeration="urn:mace:shibboleth:1.0 urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:2.0:protocol">
        <Extensions>
            <shibmd:Scope regexp="false">binghamton.edu</shibmd:Scope>
            <mdui:UIInfo xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui">
              <mdui:DisplayName xml:lang="en">Binghamton University</mdui:DisplayName>
              <mdui:InformationURL xml:lang="en">http://www.binghamton.edu/</mdui:InformationURL>
              <mdui:Description xml:lang="en">Binghamton University Authentication Service</mdui:Description>
              <mdui:PrivacyStatementURL xml:lang="en">https://its.binghamton.edu/policies/privacy</mdui:PrivacyStatementURL>
              <mdui:Logo height="115" width="315" xml:lang="en">https://www.binghamton.edu/images/v2/binghamton-university-logo2.png</mdui:Logo>
            </mdui:UIInfo>
            <mdui:DiscoHints xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui">
              <mdui:DomainHint>www.binghamton.edu</mdui:DomainHint>
              <mdui:DomainHint>securetest.binghamton.edu</mdui:DomainHint>
            </mdui:DiscoHints>
        </Extensions>

        <KeyDescriptor>
            <ds:KeyInfo>
                <ds:X509Data>
<!-- Serial No. 78C8C87921A273DDD64D738C6831B3F76F612FA1, expires on Fri Jun 20 16:24:47 2031 GMT -->
                    <ds:X509Certificate>
MIIDTzCCAjegAwIBAgIUeMjIeSGic93WTXOMaDGz929hL6EwDQYJKoZIhvcNAQEF
BQAwJDEiMCAGA1UEAxMZc2VjdXJldGVzdC5iaW5naGFtdG9uLmVkdTAeFw0xMTA2
MjAxNjI0NDdaFw0zMTA2MjAxNjI0NDdaMCQxIjAgBgNVBAMTGXNlY3VyZXRlc3Qu
YmluZ2hhbXRvbi5lZHUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCl
Qt8caDnEvoVM9dl6RATUsEtiQD9j/W2rN8gU8+0Qp3jl4+IQI3v7+jwArkZ5u4/1
GkU5lW0VGePCRwSMSAnlQHDmnIGZ9+PPz0rv8UbNvqojltJY0iTI6eatZ932peXz
Q2Y3OkV1fBd6KMf6zNZNrP2TwljUcjvhlx0cvXBEYHevIJ3W9yUiGsQcJDN/o2CS
Hze/oqryafg469jbR301mbrkM+hZ7rIBFhdI6UjYrcm+uKyCwtSfOyKxszNxp2t+
HjC2lCgW3U21osMaRsJxBaw0Y1YmI2mmlngHwqb3MPttvgYw7dYLZRIHfy+grQPZ
m+sM0Wcjc+c5iLvJ/c23AgMBAAGjeTB3MFYGA1UdEQRPME2CGXNlY3VyZXRlc3Qu
YmluZ2hhbXRvbi5lZHWGMGh0dHBzOi8vc2VjdXJldGVzdC5iaW5naGFtdG9uLmVk
dS9pZHAvc2hpYmJvbGV0aDAdBgNVHQ4EFgQUg1DrTRN4UbfA/+u52J05B5lE7AQw
DQYJKoZIhvcNAQEFBQADggEBAEDyIwpvoZdLtqQW9tx4lnlMeVJwz862wzKe1xLf
ZY6ciVFiAYndiiJerrjNbqXpw+rH/U0Sc4SEbdFKuujUcEHWjfm3NuNFOBFg+YXF
6xoizJk0tB62q7PdlQhGYx7ti7hRhNMP58niO/Pn8lv2qnnBnI97vDVq+QTlkXAE
kNjEJ0Xr+BuLwfbaVxavu+aibFW14dJw8STBFBBuGOu3JLNkkQBHRalzNwWAmcmW
HoSl1jfyez74SqXdOLyMugKWVeJ7FmlWYNwHKCa8BFTCS8XTA7kHSwvFQ/RMD82L
7tqoxUVFu+w7MOJCzyHnZMgBoXG78EoPnBOg7qQN9RoqNEM=

                    </ds:X509Certificate>
                </ds:X509Data>
            </ds:KeyInfo>
        </KeyDescriptor>
        
        <ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding"
                                   Location="https://securetest.binghamton.edu/idp/profile/SAML1/SOAP/ArtifactResolution" 
                                   index="1"/>

        <ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"
                                   Location="https://securetest.binghamton.edu/idp/profile/SAML2/SOAP/ArtifactResolution" 
                                   index="2"/>
                                   
        <NameIDFormat>urn:mace:shibboleth:1.0:nameIdentifier</NameIDFormat>
        <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>

        <SingleSignOnService Binding="urn:mace:shibboleth:1.0:profiles:AuthnRequest" 
                             Location="https://securetest.binghamton.edu/idp/profile/Shibboleth/SSO" />
        
        <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" 
                             Location="https://securetest.binghamton.edu/idp/profile/SAML2/POST/SSO" />

        <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" 
                             Location="https://securetest.binghamton.edu/idp/profile/SAML2/POST-SimpleSign/SSO" />
        
        <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" 
                             Location="https://securetest.binghamton.edu/idp/profile/SAML2/Redirect/SSO" />
    </IDPSSODescriptor>

    <AttributeAuthorityDescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:2.0:protocol">

        <Extensions>
            <shibmd:Scope regexp="false">binghamton.edu</shibmd:Scope>
        </Extensions>

        <KeyDescriptor>
            <ds:KeyInfo>
                <ds:X509Data>
<!-- Serial No. 78C8C87921A273DDD64D738C6831B3F76F612FA1, expires on Fri Jun 20 16:24:47 2031 GMT -->
                    <ds:X509Certificate>
MIIDTzCCAjegAwIBAgIUeMjIeSGic93WTXOMaDGz929hL6EwDQYJKoZIhvcNAQEF
BQAwJDEiMCAGA1UEAxMZc2VjdXJldGVzdC5iaW5naGFtdG9uLmVkdTAeFw0xMTA2
MjAxNjI0NDdaFw0zMTA2MjAxNjI0NDdaMCQxIjAgBgNVBAMTGXNlY3VyZXRlc3Qu
YmluZ2hhbXRvbi5lZHUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCl
Qt8caDnEvoVM9dl6RATUsEtiQD9j/W2rN8gU8+0Qp3jl4+IQI3v7+jwArkZ5u4/1
GkU5lW0VGePCRwSMSAnlQHDmnIGZ9+PPz0rv8UbNvqojltJY0iTI6eatZ932peXz
Q2Y3OkV1fBd6KMf6zNZNrP2TwljUcjvhlx0cvXBEYHevIJ3W9yUiGsQcJDN/o2CS
Hze/oqryafg469jbR301mbrkM+hZ7rIBFhdI6UjYrcm+uKyCwtSfOyKxszNxp2t+
HjC2lCgW3U21osMaRsJxBaw0Y1YmI2mmlngHwqb3MPttvgYw7dYLZRIHfy+grQPZ
m+sM0Wcjc+c5iLvJ/c23AgMBAAGjeTB3MFYGA1UdEQRPME2CGXNlY3VyZXRlc3Qu
YmluZ2hhbXRvbi5lZHWGMGh0dHBzOi8vc2VjdXJldGVzdC5iaW5naGFtdG9uLmVk
dS9pZHAvc2hpYmJvbGV0aDAdBgNVHQ4EFgQUg1DrTRN4UbfA/+u52J05B5lE7AQw
DQYJKoZIhvcNAQEFBQADggEBAEDyIwpvoZdLtqQW9tx4lnlMeVJwz862wzKe1xLf
ZY6ciVFiAYndiiJerrjNbqXpw+rH/U0Sc4SEbdFKuujUcEHWjfm3NuNFOBFg+YXF
6xoizJk0tB62q7PdlQhGYx7ti7hRhNMP58niO/Pn8lv2qnnBnI97vDVq+QTlkXAE
kNjEJ0Xr+BuLwfbaVxavu+aibFW14dJw8STBFBBuGOu3JLNkkQBHRalzNwWAmcmW
HoSl1jfyez74SqXdOLyMugKWVeJ7FmlWYNwHKCa8BFTCS8XTA7kHSwvFQ/RMD82L
7tqoxUVFu+w7MOJCzyHnZMgBoXG78EoPnBOg7qQN9RoqNEM=

                    </ds:X509Certificate>
                </ds:X509Data>
            </ds:KeyInfo>
        </KeyDescriptor>

        <AttributeService Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding" 
                          Location="https://securetest.binghamton.edu/idp/profile/SAML1/SOAP/AttributeQuery" />
        
        <AttributeService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"
                          Location="https://securetest.binghamton.edu/idp/profile/SAML2/SOAP/AttributeQuery" />
        
        <NameIDFormat>urn:mace:shibboleth:1.0:nameIdentifier</NameIDFormat>
        <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>
        
    </AttributeAuthorityDescriptor>
    
       <Organization>
                <OrganizationName xml:lang="en">Binghamton University</OrganizationName>
                <OrganizationDisplayName xml:lang="en">Binghamton University</OrganizationDisplayName>
                <OrganizationURL xml:lang="en">http://www.binghamton.edu/</OrganizationURL>
        </Organization>
        <ContactPerson contactType="administrative">
                <GivenName>Identity Management</GivenName>
                <EmailAddress>jramsay@binghamton.edu</EmailAddress>
        </ContactPerson>
        <ContactPerson contactType="technical">
                <GivenName>Identity Management</GivenName>
                <EmailAddress>jramsay@binghamton.edu</EmailAddress>
        </ContactPerson>
        <ContactPerson contactType="support">
                <GivenName>ITS Helpdesk</GivenName>
                <EmailAddress>helpdesk@binghamton.edu</EmailAddress>
        </ContactPerson>
</EntityDescriptor>    


