Gemfury

360core / pysaml2 python

Repository URL to install this package:
Details
pysaml2 / doc / _build / doctrees / howto / config.doctree
cdocutils.nodes
document
q)q}q(U	nametypesq}q(Xlogout_requests_signedqNX	cert_fileqNXentityidqNX
xmlsec_binaryq	NXattribute_map_dirq
NXrequired_attributesqNUcontentsqNXconfiguration directivesq
NXgeneral directivesqNXserviceqNX!configuration of pysaml2 entitiesqNXpolicyqNXsubject_dataqNXvirtual_organizationqNXmetadataqNXcomplete exampleqNXwant_assertions_signedqNX	timeslackqNXoptional_attributesqNXspecific directivesqNXorganizationqNX	idp/aa/spqNXcontact_personqNXspqNXidp/aaqNXhowto_configqKXidpq NX	valid_forq!NXdebugq"NXauthn_requests_signedq#NXkey_fileq$NX	endpointsq%NuUsubstitution_defsq&}q'Uparse_messagesq(]q)Ucurrent_sourceq*NU
decorationq+NUautofootnote_startq,KUnameidsq-}q.(hUlogout-requests-signedq/hU	cert-fileq0hUentityidq1h	U
xmlsec-binaryq2h
Uattribute-map-dirq3hUrequired-attributesq4hUcontentsq5h
Uconfiguration-directivesq6hUgeneral-directivesq7hUserviceq8hU!configuration-of-pysaml2-entitiesq9hUpolicyq:hUsubject-dataq;hUvirtual-organizationq<hUmetadataq=hUcomplete-exampleq>hUwant-assertions-signedq?hU	timeslackq@hUoptional-attributesqAhUspecific-directivesqBhUorganizationqChU	idp-aa-spqDhUcontact-personqEhUspqFhUidp-aaqGhUhowto-configqHh UidpqIh!U	valid-forqJh"UdebugqKh#Uauthn-requests-signedqLh$Ukey-fileqMh%U	endpointsqNuUchildrenqO]qP(cdocutils.nodes
target
qQ)qR}qS(U	rawsourceqTX.. _howto_config:UparentqUhUsourceqVcdocutils.nodes
reprunicode
qWX=/home/lgs/proyectos/yaco/pysaml2/pysaml2/doc/howto/config.rstqXqY}qZbUtagnameq[Utargetq\U
attributesq]}q^(Uidsq_]Ubackrefsq`]Udupnamesqa]Uclassesqb]Unamesqc]UrefidqdhHuUlineqeKUdocumentqfhhO]ubcdocutils.nodes
section
qg)qh}qi(hTUhUhhVhYUexpect_referenced_by_nameqj}qkhhRsh[Usectionqlh]}qm(ha]hb]h`]h_]qn(h9hHehc]qo(hheuheKhfhUexpect_referenced_by_idqp}qqhHhRshO]qr(cdocutils.nodes
title
qs)qt}qu(hTX!Configuration of pySAML2 entitiesqvhUhhhVhYh[Utitleqwh]}qx(ha]hb]h`]h_]hc]uheKhfhhO]qycdocutils.nodes
Text
qzX!Configuration of pySAML2 entitiesq{q|}q}(hThvhUhtubaubcdocutils.nodes
paragraph
q~)q}q(hTXÚWhether you plan to run a pySAML2 Service Provider, Identity provider or an
attribute authority you have to configure it. The format of the configuration
file is the same disregarding which type of service you plan to run.
What differs is some of the directives.
Below you will find a list of all the used directives in alphabetic order.
The configuration is written as a python module which contains a named
dictionary ("CONFIG") that contains the configuration directives.qhUhhhVhYh[U	paragraphqh]}q(ha]hb]h`]h_]hc]uheKhfhhO]qhzXÚWhether you plan to run a pySAML2 Service Provider, Identity provider or an
attribute authority you have to configure it. The format of the configuration
file is the same disregarding which type of service you plan to run.
What differs is some of the directives.
Below you will find a list of all the used directives in alphabetic order.
The configuration is written as a python module which contains a named
dictionary ("CONFIG") that contains the configuration directives.qq}q(hThhUhubaubh~)q}q(hTXEThe basic structure of the configuration file is therefor like this::qhUhhhVhYh[hh]}q(ha]hb]h`]h_]hc]uheKhfhhO]qhzXDThe basic structure of the configuration file is therefor like this:qq}q(hTXDThe basic structure of the configuration file is therefor like this:hUhubaubcdocutils.nodes
literal_block
q)q}q(hTXfrom saml2 import BINDING_HTTP_REDIRECT

CONFIG = {
    "entityid" : "http://saml.example.com:saml/idp.xml",
    "name" : "Rolands IdP",
    "service": {
        "idp": {
            "endpoints" : {
                "single_sign_on_service" : [
                        ("http://saml.example.com:saml:8088/sso",
                            BINDING_HTTP_REDIRECT)],
                "single_logout_service": [
                        ("http://saml.example.com:saml:8088/slo",
                            BINDING_HTTP_REDIRECT)]
            },
            ...
        }
    },
    "key_file" : "my.key",
    "cert_file" : "ca.pem",
    "xmlsec_binary" : "/usr/local/bin/xmlsec1",
    "metadata": {
        "local": ["edugain.xml"],
    },
    "attribute_map_dir" : "attributemaps",
    ...
}hUhhhVhYh[U
literal_blockqh]}q(U	xml:spaceqUpreserveqh_]h`]ha]hb]hc]uheKhfhhO]qhzXfrom saml2 import BINDING_HTTP_REDIRECT

CONFIG = {
    "entityid" : "http://saml.example.com:saml/idp.xml",
    "name" : "Rolands IdP",
    "service": {
        "idp": {
            "endpoints" : {
                "single_sign_on_service" : [
                        ("http://saml.example.com:saml:8088/sso",
                            BINDING_HTTP_REDIRECT)],
                "single_logout_service": [
                        ("http://saml.example.com:saml:8088/slo",
                            BINDING_HTTP_REDIRECT)]
            },
            ...
        }
    },
    "key_file" : "my.key",
    "cert_file" : "ca.pem",
    "xmlsec_binary" : "/usr/local/bin/xmlsec1",
    "metadata": {
        "local": ["edugain.xml"],
    },
    "attribute_map_dir" : "attributemaps",
    ...
}qq}q(hTUhUhubaubcdocutils.nodes
note
q)q}q(hTX¢You can build the metadata file for your services directly from the
configuration.The make_metadata.py script in the pySAML2 tools directory
will do that for you.hUhhhVhYh[Unoteqh]}q(ha]hb]h`]h_]hc]uheNhfhhO]q h~)q¡}q¢(hTX¢You can build the metadata file for your services directly from the
configuration.The make_metadata.py script in the pySAML2 tools directory
will do that for you.q£hUhhVhYh[hh]}q¤(ha]hb]h`]h_]hc]uheK,hO]q¥hzX¢You can build the metadata file for your services directly from the
configuration.The make_metadata.py script in the pySAML2 tools directory
will do that for you.q¦q§}q¨(hTh£hUh¡ubaubaubhg)q©}qª(hTUhUhhhVhYh[hlh]}q«(ha]hb]h`]h_]q¬h6ahc]qh
auheK1hfhhO]q®(hs)q¯}q°(hTXConfiguration directivesq±hUh©hVhYh[hwh]}q²(ha]hb]h`]h_]hc]uheK1hfhhO]q³hzXConfiguration directivesq´qµ}q¶(hTh±hUh¯ubaubcdocutils.nodes
topic
q·)q¸}q¹(hTUhUh©hVhYh[Utopicqºh]}q»(ha]hb]q¼(Ucontentsq½Ulocalq¾eh`]h_]q¿h5ahc]qÀhauheK5hfhhO]qÁcdocutils.nodes
bullet_list
qÂ)qÃ}qÄ(hTUhUh¸hVNh[Ubullet_listqÅh]}qÆ(ha]hb]h`]h_]hc]uheNhfhhO]qÇ(cdocutils.nodes
list_item
qÈ)qÉ}qÊ(hTUh]}qË(ha]hb]h`]h_]hc]uhUhÃhO]qÌ(h~)qÍ}qÎ(hTUh]}qÏ(ha]hb]h`]h_]hc]uhUhÉhO]qÐcdocutils.nodes
reference
qÑ)qÒ}qÓ(hTUh]}qÔ(h_]qÕUid1qÖah`]ha]hb]hc]Urefidh7uhUhÍhO]q×hzXGeneral directivesq؅qÙ}qÚ(hTXGeneral directivesqÛhUhÒubah[U	referenceqÜubah[hubhÂ)qÝ}qÞ(hTUh]}qß(ha]hb]h`]h_]hc]uhUhÉhO]qà(hÈ)qá}qâ(hTUh]}qã(ha]hb]h`]h_]hc]uhUhÝhO]qäh~)qå}qæ(hTUh]}qç(ha]hb]h`]h_]hc]uhUháhO]qèhÑ)qé}qê(hTUh]}që(h_]qìUid2qíah`]ha]hb]hc]Urefidh3uhUhåhO]qîhzXattribute_map_dirqqð}qñ(hTXattribute_map_dirqòhUhéubah[hÜubah[hubah[U	list_itemqóubhÈ)qô}qõ(hTUh]}qö(ha]hb]h`]h_]hc]uhUhÝhO]q÷h~)qø}qù(hTUh]}qú(ha]hb]h`]h_]hc]uhUhôhO]qûhÑ)qü}qý(hTUh]}qþ(h_]qÿUid3rah`]ha]hb]hc]Urefidh0uhUhøhO]rhzX	cert_filerr}r(hTX	cert_filerhUhüubah[hÜubah[hubah[hóubhÈ)r}r(hTUh]}r(ha]hb]h`]h_]hc]uhUhÝhO]r	h~)r
}r(hTUh]}r(ha]hb]h`]h_]hc]uhUjhO]r
hÑ)r}r(hTUh]}r(h_]rUid4rah`]ha]hb]hc]UrefidhEuhUj
hO]rhzXcontact_personrr}r(hTXcontact_personrhUjubah[hÜubah[hubah[hóubhÈ)r}r(hTUh]}r(ha]hb]h`]h_]hc]uhUhÝhO]rh~)r}r(hTUh]}r(ha]hb]h`]h_]hc]uhUjhO]rhÑ)r }r!(hTUh]}r"(h_]r#Uid5r$ah`]ha]hb]hc]UrefidhKuhUjhO]r%hzXdebugr&r'}r((hTXdebugr)hUj ubah[hÜubah[hubah[hóubhÈ)r*}r+(hTUh]}r,(ha]hb]h`]h_]hc]uhUhÝhO]r-h~)r.}r/(hTUh]}r0(ha]hb]h`]h_]hc]uhUj*hO]r1hÑ)r2}r3(hTUh]}r4(h_]r5Uid6r6ah`]ha]hb]hc]Urefidh1uhUj.hO]r7hzXentityidr8r9}r:(hTXentityidr;hUj2ubah[hÜubah[hubah[hóubhÈ)r<}r=(hTUh]}r>(ha]hb]h`]h_]hc]uhUhÝhO]r?h~)r@}rA(hTUh]}rB(ha]hb]h`]h_]hc]uhUj<hO]rChÑ)rD}rE(hTUh]}rF(h_]rGUid7rHah`]ha]hb]hc]UrefidhMuhUj@hO]rIhzXkey_filerJrK}rL(hTXkey_filerMhUjDubah[hÜubah[hubah[hóubhÈ)rN}rO(hTUh]}rP(ha]hb]h`]h_]hc]uhUhÝhO]rQh~)rR}rS(hTUh]}rT(ha]hb]h`]h_]hc]uhUjNhO]rUhÑ)rV}rW(hTUh]}rX(h_]rYUid8rZah`]ha]hb]hc]Urefidh=uhUjRhO]r[hzXmetadatar\r]}r^(hTXmetadatar_hUjVubah[hÜubah[hubah[hóubhÈ)r`}ra(hTUh]}rb(ha]hb]h`]h_]hc]uhUhÝhO]rch~)rd}re(hTUh]}rf(ha]hb]h`]h_]hc]uhUj`hO]rghÑ)rh}ri(hTUh]}rj(h_]rkUid9rlah`]ha]hb]hc]UrefidhCuhUjdhO]rmhzXorganizationrnro}rp(hTXorganizationrqhUjhubah[hÜubah[hubah[hóubhÈ)rr}rs(hTUh]}rt(ha]hb]h`]h_]hc]uhUhÝhO]ruh~)rv}rw(hTUh]}rx(ha]hb]h`]h_]hc]uhUjrhO]ryhÑ)rz}r{(hTUh]}r|(h_]r}Uid10r~ah`]ha]hb]hc]Urefidh8uhUjvhO]rhzXservicerr}r(hTXservicerhUjzubah[hÜubah[hubah[hóubhÈ)r}r(hTUh]}r(ha]hb]h`]h_]hc]uhUhÝhO]rh~)r}r(hTUh]}r(ha]hb]h`]h_]hc]uhUjhO]rhÑ)r}r(hTUh]}r(h_]rUid11rah`]ha]hb]hc]Urefidh@uhUjhO]rhzX	timeslackrr}r(hTX	timeslackrhUjubah[hÜubah[hubah[hóubhÈ)r}r(hTUh]}r(ha]hb]h`]h_]hc]uhUhÝhO]rh~)r}r(hTUh]}r(ha]hb]h`]h_]hc]uhUjhO]rhÑ)r}r(hTUh]}r (h_]r¡Uid12r¢ah`]ha]hb]hc]Urefidh2uhUjhO]r£hzX
xmlsec_binaryr¤r¥}r¦(hTX
xmlsec_binaryr§hUjubah[hÜubah[hubah[hóubhÈ)r¨}r©(hTUh]}rª(ha]hb]h`]h_]hc]uhUhÝhO]r«h~)r¬}r(hTUh]}r®(ha]hb]h`]h_]hc]uhUj¨hO]r¯hÑ)r°}r±(hTUh]}r²(h_]r³Uid13r´ah`]ha]hb]hc]UrefidhJuhUj¬hO]rµhzX	valid_forr¶r·}r¸(hTX	valid_forr¹hUj°ubah[hÜubah[hubah[hóubeh[hÅubeh[hóubhÈ)rº}r»(hTUh]}r¼(ha]hb]h`]h_]hc]uhUhÃhO]r½(h~)r¾}r¿(hTUh]}rÀ(ha]hb]h`]h_]hc]uhUjºhO]rÁhÑ)rÂ}rÃ(hTUh]}rÄ(h_]rÅUid14rÆah`]ha]hb]hc]UrefidhBuhUj¾hO]rÇhzXSpecific directivesrÈrÉ}rÊ(hTXSpecific directivesrËhUjÂubah[hÜubah[hubhÂ)rÌ}rÍ(hTUh]}rÎ(ha]hb]h`]h_]hc]uhUjºhO]rÏ(hÈ)rÐ}rÑ(hTUh]}rÒ(ha]hb]h`]h_]hc]uhUjÌhO]rÓ(h~)rÔ}rÕ(hTUh]}rÖ(ha]hb]h`]h_]hc]uhUjÐhO]r×hÑ)rØ}rÙ(hTUh]}rÚ(h_]rÛUid15rÜah`]ha]hb]hc]UrefidhGuhUjÔhO]rÝhzXidp/aarÞrß}rà(hTXidp/aaráhUjØubah[hÜubah[hubhÂ)râ}rã(hTUh]}rä(ha]hb]h`]h_]hc]uhUjÐhO]råhÈ)ræ}rç(hTUh]}rè(ha]hb]h`]h_]hc]uhUjâhO]réh~)rê}rë(hTUh]}rì(ha]hb]h`]h_]hc]uhUjæhO]ríhÑ)rî}rï(hTUh]}rð(h_]rñUid16ròah`]ha]hb]hc]Urefidh:uhUjêhO]róhzXpolicyrôrõ}rö(hTXpolicyr÷hUjîubah[hÜubah[hubah[hóubah[hÅubeh[hóubhÈ)rø}rù(hTUh]}rú(ha]hb]h`]h_]hc]uhUjÌhO]rû(h~)rü}rý(hTUh]}rþ(ha]hb]h`]h_]hc]uhUjøhO]rÿhÑ)r}r(hTUh]}r(h_]rUid17rah`]ha]hb]hc]UrefidhFuhUjühO]rhzXsprr}r(hTXspr	hUjubah[hÜubah[hubhÂ)r
}r(hTUh]}r(ha]hb]h`]h_]hc]uhUjøhO]r
(hÈ)r}r(hTUh]}r(ha]hb]h`]h_]hc]uhUj
hO]rh~)r}r(hTUh]}r(ha]hb]h`]h_]hc]uhUjhO]rhÑ)r}r(hTUh]}r(h_]rUid18rah`]ha]hb]hc]UrefidhLuhUjhO]rhzXauthn_requests_signedrr}r(hTXauthn_requests_signedrhUjubah[hÜubah[hubah[hóubhÈ)r }r!(hTUh]}r"(ha]hb]h`]h_]hc]uhUj
hO]r#h~)r$}r%(hTUh]}r&(ha]hb]h`]h_]hc]uhUj hO]r'hÑ)r(}r)(hTUh]}r*(h_]r+Uid19r,ah`]ha]hb]hc]UrefidhIuhUj$hO]r-hzXidpr.r/}r0(hTXidpr1hUj(ubah[hÜubah[hubah[hóubhÈ)r2}r3(hTUh]}r4(ha]hb]h`]h_]hc]uhUj
hO]r5h~)r6}r7(hTUh]}r8(ha]hb]h`]h_]hc]uhUj2hO]r9hÑ)r:}r;(hTUh]}r<(h_]r=Uid20r>ah`]ha]hb]hc]UrefidhAuhUj6hO]r?hzXoptional_attributesr@rA}rB(hTXoptional_attributesrChUj:ubah[hÜubah[hubah[hóubhÈ)rD}rE(hTUh]}rF(ha]hb]h`]h_]hc]uhUj
hO]rGh~)rH}rI(hTUh]}rJ(ha]hb]h`]h_]hc]uhUjDhO]rKhÑ)rL}rM(hTUh]}rN(h_]rOUid21rPah`]ha]hb]hc]Urefidh4uhUjHhO]rQhzXrequired_attributesrRrS}rT(hTXrequired_attributesrUhUjLubah[hÜubah[hubah[hóubhÈ)rV}rW(hTUh]}rX(ha]hb]h`]h_]hc]uhUj
hO]rYh~)rZ}r[(hTUh]}r\(ha]hb]h`]h_]hc]uhUjVhO]r]hÑ)r^}r_(hTUh]}r`(h_]raUid22rbah`]ha]hb]hc]Urefidh?uhUjZhO]rchzXwant_assertions_signedrdre}rf(hTXwant_assertions_signedrghUj^ubah[hÜubah[hubah[hóubeh[hÅubeh[hóubhÈ)rh}ri(hTUh]}rj(ha]hb]h`]h_]hc]uhUjÌhO]rk(h~)rl}rm(hTUh]}rn(ha]hb]h`]h_]hc]uhUjhhO]rohÑ)rp}rq(hTUh]}rr(h_]rsUid23rtah`]ha]hb]hc]UrefidhDuhUjlhO]ruhzX	idp/aa/sprvrw}rx(hTX	idp/aa/spryhUjpubah[hÜubah[hubhÂ)rz}r{(hTUh]}r|(ha]hb]h`]h_]hc]uhUjhhO]r}(hÈ)r~}r(hTUh]}r(ha]hb]h`]h_]hc]uhUjzhO]rh~)r}r(hTUh]}r(ha]hb]h`]h_]hc]uhUj~hO]rhÑ)r}r(hTUh]}r(h_]rUid24rah`]ha]hb]hc]UrefidhNuhUjhO]rhzX	endpointsrr}r(hTX	endpointsrhUjubah[hÜubah[hubah[hóubhÈ)r}r(hTUh]}r(ha]hb]h`]h_]hc]uhUjzhO]rh~)r}r(hTUh]}r(ha]hb]h`]h_]hc]uhUjhO]rhÑ)r}r(hTUh]}r(h_]rUid25rah`]ha]hb]hc]Urefidh/uhUjhO]rhzXlogout_requests_signedrr}r (hTXlogout_requests_signedr¡hUjubah[hÜubah[hubah[hóubhÈ)r¢}r£(hTUh]}r¤(ha]hb]h`]h_]hc]uhUjzhO]r¥h~)r¦}r§(hTUh]}r¨(ha]hb]h`]h_]hc]uhUj¢hO]r©hÑ)rª}r«(hTUh]}r¬(h_]rUid26r®ah`]ha]hb]hc]Urefidh;uhUj¦hO]r¯hzXsubject_datar°r±}r²(hTXsubject_datar³hUjªubah[hÜubah[hubah[hóubhÈ)r´}rµ(hTUh]}r¶(ha]hb]h`]h_]hc]uhUjzhO]r·h~)r¸}r¹(hTUh]}rº(ha]hb]h`]h_]hc]uhUj´hO]r»hÑ)r¼}r½(hTUh]}r¾(h_]r¿Uid27rÀah`]ha]hb]hc]Urefidh<uhUj¸hO]rÁhzXvirtual_organizationrÂrÃ}rÄ(hTXvirtual_organizationrÅhUj¼ubah[hÜubah[hubah[hóubeh[hÅubeh[hóubeh[hÅubeh[hóubhÈ)rÆ}rÇ(hTUh]}rÈ(ha]hb]h`]h_]hc]uhUhÃhO]rÉh~)rÊ}rË(hTUh]}rÌ(ha]hb]h`]h_]hc]uhUjÆhO]rÍhÑ)rÎ}rÏ(hTUh]}rÐ(h_]rÑUid28rÒah`]ha]hb]hc]Urefidh>uhUjÊhO]rÓhzXComplete examplerÔrÕ}rÖ(hTXComplete exampler×hUjÎubah[hÜubah[hubah[hóubeubaubhg)rØ}rÙ(hTUhUh©hVhYh[hlh]}rÚ(ha]hb]h`]h_]rÛh7ahc]rÜhauheK8hfhhO]rÝ(hs)rÞ}rß(hThÛhUjØhVhYh[hwh]}rà(h_]h`]ha]hb]hc]hdhÖuheK8hfhhO]ráhzXGeneral directivesrârã}rä(hThÛhUjÞubaubhg)rå}ræ(hTUhUjØhVhYh[hlh]}rç(ha]hb]h`]h_]rèh3ahc]réh
auheK;hfhhO]rê(hs)rë}rì(hThòhUjåhVhYh[hwh]}rí(h_]h`]ha]hb]hc]hdhíuheK;hfhhO]rîhzXattribute_map_dirrïrð}rñ(hThòhUjëubaubh~)rò}ró(hTXFormat::rôhUjåhVhYh[hh]}rõ(ha]hb]h`]h_]hc]uheK=hfhhO]röhzXFormat:r÷rø}rù(hTXFormat:hUjòubaubh)rú}rû(hTX%"attribute_map_dir": "attribute-maps"hUjåhVhYh[hh]}rü(hhh_]h`]ha]hb]hc]uheK?hfhhO]rýhzX%"attribute_map_dir": "attribute-maps"rþrÿ}r(hTUhUjúubaubh~)r}r(hTXoPoints to a directory which has the attribute maps in Python modules.
A typical map file will looks like this::hUjåhVhYh[hh]}r(ha]hb]h`]h_]hc]uheKAhfhhO]rhzXnPoints to a directory which has the attribute maps in Python modules.
A typical map file will looks like this:rr}r(hTXnPoints to a directory which has the attribute maps in Python modules.
A typical map file will looks like this:hUjubaubh)r}r	(hTXXMAP = {
    "identifier": "urn:oasis:names:tc:SAML:2.0:attrname-format:basic",
    "fro": {
        'urn:mace:dir:attribute-def:aRecord': 'aRecord',
        'urn:mace:dir:attribute-def:aliasedEntryName': 'aliasedEntryName',
        'urn:mace:dir:attribute-def:aliasedObjectName': 'aliasedObjectName',
        'urn:mace:dir:attribute-def:associatedDomain': 'associatedDomain',
        'urn:mace:dir:attribute-def:associatedName': 'associatedName',
        ...
        },
    "to": {
        'aRecord': 'urn:mace:dir:attribute-def:aRecord',
        'aliasedEntryName': 'urn:mace:dir:attribute-def:aliasedEntryName',
        'aliasedObjectName': 'urn:mace:dir:attribute-def:aliasedObjectName',
        'associatedDomain': 'urn:mace:dir:attribute-def:associatedDomain',
        'associatedName': 'urn:mace:dir:attribute-def:associatedName',
        ...
    }
}hUjåhVhYh[hh]}r
(hhh_]h`]ha]hb]hc]uheKDhfhhO]rhzXXMAP = {
    "identifier": "urn:oasis:names:tc:SAML:2.0:attrname-format:basic",
    "fro": {
        'urn:mace:dir:attribute-def:aRecord': 'aRecord',
        'urn:mace:dir:attribute-def:aliasedEntryName': 'aliasedEntryName',
        'urn:mace:dir:attribute-def:aliasedObjectName': 'aliasedObjectName',
        'urn:mace:dir:attribute-def:associatedDomain': 'associatedDomain',
        'urn:mace:dir:attribute-def:associatedName': 'associatedName',
        ...
        },
    "to": {
        'aRecord': 'urn:mace:dir:attribute-def:aRecord',
        'aliasedEntryName': 'urn:mace:dir:attribute-def:aliasedEntryName',
        'aliasedObjectName': 'urn:mace:dir:attribute-def:aliasedObjectName',
        'associatedDomain': 'urn:mace:dir:attribute-def:associatedDomain',
        'associatedName': 'urn:mace:dir:attribute-def:associatedName',
        ...
    }
}rr
}r(hTUhUjubaubh~)r}r(hTXÕThe attribute map module contains a MAP dictionary with three items.  The
`identifier` item is the name-format you expect to support.
The *to* and *fro* sub-dictionaries then contain the mapping between the names.hUjåhVhYh[hh]}r(ha]hb]h`]h_]hc]uheKXhfhhO]r(hzXJThe attribute map module contains a MAP dictionary with three items.  The
rr}r(hTXJThe attribute map module contains a MAP dictionary with three items.  The
hUjubcdocutils.nodes
title_reference
r)r}r(hTX`identifier`h]}r(ha]hb]h`]h_]hc]uhUjhO]rhzX
identifierrr}r(hTUhUjubah[Utitle_referencerubhzX4 item is the name-format you expect to support.
The rr }r!(hTX4 item is the name-format you expect to support.
The hUjubcdocutils.nodes
emphasis
r")r#}r$(hTX*to*h]}r%(ha]hb]h`]h_]hc]uhUjhO]r&hzXtor'r(}r)(hTUhUj#ubah[Uemphasisr*ubhzX and r+r,}r-(hTX and hUjubj")r.}r/(hTX*fro*h]}r0(ha]hb]h`]h_]hc]uhUjhO]r1hzXfror2r3}r4(hTUhUj.ubah[j*ubhzX= sub-dictionaries then contain the mapping between the names.r5r6}r7(hTX= sub-dictionaries then contain the mapping between the names.hUjubeubh~)r8}r9(hTXAs you see the format is again a python dictionary where the key is the
name to convert from and the value is the name to convert to.r:hUjåhVhYh[hh]}r;(ha]hb]h`]h_]hc]uheK\hfhhO]r<hzXAs you see the format is again a python dictionary where the key is the
name to convert from and the value is the name to convert to.r=r>}r?(hTj:hUj8ubaubh~)r@}rA(hTXSince *to* in most cases are the inverse of the *fro* file, the
software allowes you to only specify one of them and it will
automatically create the other.hUjåhVhYh[hh]}rB(ha]hb]h`]h_]hc]uheK_hfhhO]rC(hzXSince rDrE}rF(hTXSince hUj@ubj")rG}rH(hTX*to*h]}rI(ha]hb]h`]h_]hc]uhUj@hO]rJhzXtorKrL}rM(hTUhUjGubah[j*ubhzX& in most cases are the inverse of the rNrO}rP(hTX& in most cases are the inverse of the hUj@ubj")rQ}rR(hTX*fro*h]}rS(ha]hb]h`]h_]hc]uhUj@hO]rThzXfrorUrV}rW(hTUhUjQubah[j*ubhzXg file, the
software allowes you to only specify one of them and it will
automatically create the other.rXrY}rZ(hTXg file, the
software allowes you to only specify one of them and it will
automatically create the other.hUj@ubeubeubhg)r[}r\(hTUhUjØhVhYh[hlh]}r](ha]hb]h`]h_]r^h0ahc]r_hauheKdhfhhO]r`(hs)ra}rb(hTjhUj[hVhYh[hwh]}rc(h_]h`]ha]hb]hc]hdjuheKdhfhhO]rdhzX	cert_filererf}rg(hTjhUjaubaubh~)rh}ri(hTXFormat::rjhUj[hVhYh[hh]}rk(ha]hb]h`]h_]hc]uheKfhfhhO]rlhzXFormat:rmrn}ro(hTXFormat:hUjhubaubh)rp}rq(hTXcert_file: "cert.pem"hUj[hVhYh[hh]}rr(hhh_]h`]ha]hb]hc]uheKhhfhhO]rshzXcert_file: "cert.pem"rtru}rv(hTUhUjpubaubh~)rw}rx(hTX{This is the public part of the service private/public key pair.
*cert_file* must be a PEM formatted certificate chain file.hUj[hVhYh[hh]}ry(ha]hb]h`]h_]hc]uheKjhfhhO]rz(hzX@This is the public part of the service private/public key pair.
r{r|}r}(hTX@This is the public part of the service private/public key pair.
hUjwubj")r~}r(hTX*cert_file*h]}r(ha]hb]h`]h_]hc]uhUjwhO]rhzX	cert_filerr}r(hTUhUj~ubah[j*ubhzX0 must be a PEM formatted certificate chain file.rr}r(hTX0 must be a PEM formatted certificate chain file.hUjwubeubeubhg)r}r(hTUhUjØhVhYh[hlh]}r(ha]hb]h`]h_]rhEahc]rhauheKnhfhhO]r(hs)r}r(hTjhUjhVhYh[hwh]}r(h_]h`]ha]hb]hc]hdjuheKnhfhhO]rhzXcontact_personrr}r(hTjhUjubaubh~)r}r(hTXjThis is only used by *make_metadata.py* when it constructs the metadata for
the service described by the configuration file.
This is where you described who can be contacted if questions arises
about the service or if support is needed. The possible types are according to
the standard **technical**, **support**, **administrative**, **billing**
and **other**.::hUjhVhYh[hh]}r(ha]hb]h`]h_]hc]uheKphfhhO]r(hzXThis is only used by rr}r(hTXThis is only used by hUjubj")r}r(hTX*make_metadata.py*h]}r(ha]hb]h`]h_]hc]uhUjhO]rhzXmake_metadata.pyr r¡}r¢(hTUhUjubah[j*ubhzX÷ when it constructs the metadata for
the service described by the configuration file.
This is where you described who can be contacted if questions arises
about the service or if support is needed. The possible types are according to
the standard r£r¤}r¥(hTX÷ when it constructs the metadata for
the service described by the configuration file.
This is where you described who can be contacted if questions arises
about the service or if support is needed. The possible types are according to
the standard hUjubcdocutils.nodes
strong
r¦)r§}r¨(hTX
**technical**h]}r©(ha]hb]h`]h_]hc]uhUjhO]rªhzX	technicalr«r¬}r(hTUhUj§ubah[Ustrongr®ubhzX, r¯r°}r±(hTX, hUjubj¦)r²}r³(hTX**support**h]}r´(ha]hb]h`]h_]hc]uhUjhO]rµhzXsupportr¶r·}r¸(hTUhUj²ubah[j®ubhzX, r¹rº}r»(hTX, hUjubj¦)r¼}r½(hTX**administrative**h]}r¾(ha]hb]h`]h_]hc]uhUjhO]r¿hzXadministrativerÀrÁ}rÂ(hTUhUj¼ubah[j®ubhzX, rÃrÄ}rÅ(hTX, hUjubj¦)rÆ}rÇ(hTX**billing**h]}rÈ(ha]hb]h`]h_]hc]uhUjhO]rÉhzXbillingrÊrË}rÌ(hTUhUjÆubah[j®ubhzX
and rÍrÎ}rÏ(hTX
and hUjubj¦)rÐ}rÑ(hTX	**other**h]}rÒ(ha]hb]h`]h_]hc]uhUjhO]rÓhzXotherrÔrÕ}rÖ(hTUhUjÐubah[j®ubhzX.:r×rØ}rÙ(hTX.:hUjubeubh)rÚ}rÛ(hTX6contact_person: [{
    "givenname": "Derek",
    "surname": "Jeter",
    "company": "Example Co.",
    "mail": ["jeter@example.com"],
    "type": "technical",
},{
    "givenname": "Joe",
    "surname": "Girardi",
    "company": "Example Co.",
    "mail": "girardi@example.com",
    "type": "administrative",
}]hUjhVhYh[hh]}rÜ(hhh_]h`]ha]hb]hc]uheKwhfhhO]rÝhzX6contact_person: [{
    "givenname": "Derek",
    "surname": "Jeter",
    "company": "Example Co.",
    "mail": ["jeter@example.com"],
    "type": "technical",
},{
    "givenname": "Joe",
    "surname": "Girardi",
    "company": "Example Co.",
    "mail": "girardi@example.com",
    "type": "administrative",
}]rÞrß}rà(hTUhUjÚubaubeubhg)rá}râ(hTUhUjØhVhYh[hlh]}rã(ha]hb]h`]h_]rähKahc]råh"auheKhfhhO]ræ(hs)rç}rè(hTj)hUjáhVhYh[hwh]}ré(h_]h`]ha]hb]hc]hdj$uheKhfhhO]rêhzXdebugrërì}rí(hTj)hUjçubaubh~)rî}rï(hTXFormat::rðhUjáhVhYh[hh]}rñ(ha]hb]h`]h_]hc]uheKhfhhO]ròhzXFormat:rórô}rõ(hTXFormat:hUjîubaubh)rö}r÷(hTXdebug: 1hUjáhVhYh[hh]}rø(hhh_]h`]ha]hb]hc]uheKhfhhO]rùhzXdebug: 1rúrû}rü(hTUhUjöubaubh~)rý}rþ(hTX9Whether debug information should be sent to the log file.rÿhUjáhVhYh[hh]}r(ha]hb]h`]h_]hc]uheKhfhhO]rhzX9Whether debug information should be sent to the log file.rr}r(hTjÿhUjýubaubeubhg)r}r(hTUhUjØhVhYh[hlh]}r(ha]hb]h`]h_]rh1ahc]r	hauheKhfhhO]r
(hs)r}r(hTj;hUjhVhYh[hwh]}r
(h_]h`]ha]hb]hc]hdj6uheKhfhhO]rhzXentityidrr}r(hTj;hUjubaubh~)r}r(hTXFormat::rhUjhVhYh[hh]}r(ha]hb]h`]h_]hc]uheKhfhhO]rhzXFormat:rr}r(hTXFormat:hUjubaubh)r}r(hTX&entityid: "http://saml.example.com/sp"hUjhVhYh[hh]}r(hhh_]h`]ha]hb]hc]uheKhfhhO]rhzX&entityid: "http://saml.example.com/sp"rr}r (hTUhUjubaubh~)r!}r"(hTX-The globally unique identifier of the entity.r#hUjhVhYh[hh]}r$(ha]hb]h`]h_]hc]uheKhfhhO]r%hzX-The globally unique identifier of the entity.r&r'}r((hTj#hUj!ubaubh)r)}r*(hTXzThere is a recommendation that the entityid should point to a real
webpage where the metadata for the entity can be found.hUjhVhYh[hh]}r+(ha]hb]h`]h_]hc]uheNhfhhO]r,h~)r-}r.(hTXzThere is a recommendation that the entityid should point to a real
webpage where the metadata for the entity can be found.r/hUj)hVhYh[hh]}r0(ha]hb]h`]h_]hc]uheKhO]r1hzXzThere is a recommendation that the entityid should point to a real
webpage where the metadata for the entity can be found.r2r3}r4(hTj/hUj-ubaubaubeubhg)r5}r6(hTUhUjØhVhYh[hlh]}r7(ha]hb]h`]h_]r8hMahc]r9h$auheKhfhhO]r:(hs)r;}r<(hTjMhUj5hVhYh[hwh]}r=(h_]h`]ha]hb]hc]hdjHuheKhfhhO]r>hzXkey_filer?r@}rA(hTjMhUj;ubaubh~)rB}rC(hTXFormat::rDhUj5hVhYh[hh]}rE(ha]hb]h`]h_]hc]uheKhfhhO]rFhzXFormat:rGrH}rI(hTXFormat:hUjBubaubh)rJ}rK(hTXkey_file: "key.pem"hUj5hVhYh[hh]}rL(hhh_]h`]ha]hb]hc]uheKhfhhO]rMhzXkey_file: "key.pem"rNrO}rP(hTUhUjJubaubh~)rQ}rR(hTX¹*key_file* is the name of a PEM formatted file that contains the private key
of the service. This is presently used both to encrypt/sign assertions and as
client key in a HTTPS session.hUj5hVhYh[hh]}rS(ha]hb]h`]h_]hc]uheK¡hfhhO]rT(j")rU}rV(hTX
*key_file*h]}rW(ha]hb]h`]h_]hc]uhUjQhO]rXhzXkey_filerYrZ}r[(hTUhUjUubah[j*ubhzX¯ is the name of a PEM formatted file that contains the private key
of the service. This is presently used both to encrypt/sign assertions and as
client key in a HTTPS session.r\r]}r^(hTX¯ is the name of a PEM formatted file that contains the private key
of the service. This is presently used both to encrypt/sign assertions and as
client key in a HTTPS session.hUjQubeubeubhg)r_}r`(hTUhUjØhVhYh[hlh]}ra(ha]hb]h`]h_]rbh=ahc]rchauheK¦hfhhO]rd(hs)re}rf(hTj_hUj_hVhYh[hwh]}rg(h_]h`]ha]hb]hc]hdjZuheK¦hfhhO]rhhzXmetadatarirj}rk(hTj_hUjeubaubh~)rl}rm(hTXContains a list of places where metadata can be found. This can be either
a file accessible on the server the service runs on or somewhere on the net.::hUj_hVhYh[hh]}rn(ha]hb]h`]h_]hc]uheK¨hfhhO]rohzXContains a list of places where metadata can be found. This can be either
a file accessible on the server the service runs on or somewhere on the net.:rprq}rr(hTXContains a list of places where metadata can be found. This can be either
a file accessible on the server the service runs on or somewhere on the net.:hUjlubaubh)rs}rt(hTX"metadata" : {
    "local": [
        "metadata.xml", "vo_metadata.xml"
        ],
    "remote": [
        {
            "url":"https://kalmar2.org/simplesaml/module.php/aggregator/?id=kalmarcentral2&set=saml2",
            "cert":"kalmar2.cert"
        }],
},hUj_hVhYh[hh]}ru(hhh_]h`]ha]hb]hc]uheK«hfhhO]rvhzX"metadata" : {
    "local": [
        "metadata.xml", "vo_metadata.xml"
        ],
    "remote": [
        {
            "url":"https://kalmar2.org/simplesaml/module.php/aggregator/?id=kalmarcentral2&set=saml2",
            "cert":"kalmar2.cert"
        }],
},rwrx}ry(hTUhUjsubaubh~)rz}r{(hTX*The above configuration means that the service should read two local
metadata files and on top of that load one from the net. To verify the
authenticity of the file downloaded from the net the local copy of the
public key should be used.
This public key must be acquired by some out-of-band method.r|hUj_hVhYh[hh]}r}(ha]hb]h`]h_]hc]uheK¶hfhhO]r~hzX*The above configuration means that the service should read two local
metadata files and on top of that load one from the net. To verify the
authenticity of the file downloaded from the net the local copy of the
public key should be used.
This public key must be acquired by some out-of-band method.rr}r(hTj|hUjzubaubeubhg)r}r(hTUhUjØhVhYh[hlh]}r(ha]hb]h`]h_]rhCahc]rhauheK½hfhhO]r(hs)r}r(hTjqhUjhVhYh[hwh]}r(h_]h`]ha]hb]hc]hdjluheK½hfhhO]rhzXorganizationrr}r(hTjqhUjubaubh~)r}r(hTXcOnly used by *make_metadata.py*.
Where you describe the organization responsible for the service.::hUjhVhYh[hh]}r(ha]hb]h`]h_]hc]uheK¿hfhhO]r(hzX
Only used by rr}r(hTX
Only used by hUjubj")r}r(hTX*make_metadata.py*h]}r(ha]hb]h`]h_]hc]uhUjhO]rhzXmake_metadata.pyrr}r(hTUhUjubah[j*ubhzXC.
Where you describe the organization responsible for the service.:rr}r(hTXC.
Where you describe the organization responsible for the service.:hUjubeubh)r }r¡(hTX¹"organization": {
    "name": [("Example Company","en"), ("Exempel AB","se")],
    "display_name": ["Exempel AB"],
    "url": [("http://example.com","en"),("http://exempel.se","se")],
}hUjhVhYh[hh]}r¢(hhh_]h`]ha]hb]hc]uheKÂhfhhO]r£hzX¹"organization": {
    "name": [("Example Company","en"), ("Exempel AB","se")],
    "display_name": ["Exempel AB"],
    "url": [("http://example.com","en"),("http://exempel.se","se")],
}r¤r¥}r¦(hTUhUj ubaubh)r§}r¨(hTXêYou can specify the language of the name, or the language used on
the webpage, by entering a tuple, instead of a simple string,
where the second part is the language code. If you don't specify a
language the default is "en" (English).hUjhVhYh[hh]}r©(ha]hb]h`]h_]hc]uheNhfhhO]rªh~)r«}r¬(hTXêYou can specify the language of the name, or the language used on
the webpage, by entering a tuple, instead of a simple string,
where the second part is the language code. If you don't specify a
language the default is "en" (English).rhUj§hVhYh[hh]}r®(ha]hb]h`]h_]hc]uheKÈhO]r¯hzXêYou can specify the language of the name, or the language used on
the webpage, by entering a tuple, instead of a simple string,
where the second part is the language code. If you don't specify a
language the default is "en" (English).r°r±}r²(hTjhUj«ubaubaubeubhg)r³}r´(hTUhUjØhVhYh[hlh]}rµ(ha]hb]h`]h_]r¶h8ahc]r·hauheKÎhfhhO]r¸(hs)r¹}rº(hTjhUj³hVhYh[hwh]}r»(h_]h`]ha]hb]hc]hdj~uheKÎhfhhO]r¼hzXservicer½r¾}r¿(hTjhUj¹ubaubh~)rÀ}rÁ(hTX¸Which services the server will provide, those are combinations of "idp","sp"
and "aa".
So if a server is a Service Provider (SP) then the configuration
could look something like this::hUj³hVhYh[hh]}rÂ(ha]hb]h`]h_]hc]uheKÐhfhhO]rÃhzX·Which services the server will provide, those are combinations of "idp","sp"
and "aa".
So if a server is a Service Provider (SP) then the configuration
could look something like this:rÄrÅ}rÆ(hTX·Which services the server will provide, those are combinations of "idp","sp"
and "aa".
So if a server is a Service Provider (SP) then the configuration
could look something like this:hUjÀubaubh)rÇ}rÈ(hTX
"service": {
    "sp":{
        "name" : "Rolands SP",
        "endpoints":{
            "assertion_consumer_service": ["http://localhost:8087/"],
            "single_logout_service" : [("http://localhost:8087/slo",
                           'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect')],
        },
        "required_attributes": ["surname", "givenname", "edupersonaffiliation"],
        "optional_attributes": ["title"],
        "idp": {
            "urn:mace:umu.se:saml:roland:idp": None,
        },
    }
},hUj³hVhYh[hh]}rÉ(hhh_]h`]ha]hb]hc]uheKÕhfhhO]rÊhzX
"service": {
    "sp":{
        "name" : "Rolands SP",
        "endpoints":{
            "assertion_consumer_service": ["http://localhost:8087/"],
            "single_logout_service" : [("http://localhost:8087/slo",
                           'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect')],
        },
        "required_attributes": ["surname", "givenname", "edupersonaffiliation"],
        "optional_attributes": ["title"],
        "idp": {
            "urn:mace:umu.se:saml:roland:idp": None,
        },
    }
},rËrÌ}rÍ(hTUhUjÇubaubh~)rÎ}rÏ(hTXËThere are two options common to all services: 'name' and 'endpoints'.
The remaining options are specific to one or the other of the service types.
Which one is specified along side the name of the optionrÐhUj³hVhYh[hh]}rÑ(ha]hb]h`]h_]hc]uheKåhfhhO]rÒhzXËThere are two options common to all services: 'name' and 'endpoints'.
The remaining options are specific to one or the other of the service types.
Which one is specified along side the name of the optionrÓrÔ}rÕ(hTjÐhUjÎubaubeubhg)rÖ}r×(hTUhUjØhVhYh[hlh]}rØ(ha]hb]h`]h_]rÙh@ahc]rÚhauheKêhfhhO]rÛ(hs)rÜ}rÝ(hTjhUjÖhVhYh[hwh]}rÞ(h_]h`]ha]hb]hc]hdjuheKêhfhhO]rßhzX	timeslackràrá}râ(hTjhUjÜubaubh~)rã}rä(hTX½If your computer and another computer that you are communicating with are not
in synch regarding the computer clock. Then you here can state how big a
difference you are prepared to accept.råhUjÖhVhYh[hh]}ræ(ha]hb]h`]h_]hc]uheKìhfhhO]rçhzX½If your computer and another computer that you are communicating with are not
in synch regarding the computer clock. Then you here can state how big a
difference you are prepared to accept.rèré}rê(hTjåhUjãubaubh)rë}rì(hTXwThis will indiscriminately effect all time comparisons.
Hence your server my accept a statement that in fact is to old.hUjÖhVhYh[hh]}rí(ha]hb]h`]h_]hc]uheNhfhhO]rîh~)rï}rð(hTXwThis will indiscriminately effect all time comparisons.
Hence your server my accept a statement that in fact is to old.rñhUjëhVhYh[hh]}rò(ha]hb]h`]h_]hc]uheKðhO]róhzXwThis will indiscriminately effect all time comparisons.
Hence your server my accept a statement that in fact is to old.rôrõ}rö(hTjñhUjïubaubaubeubhg)r÷}rø(hTUhUjØhVhYh[hlh]}rù(ha]hb]h`]h_]rúh2ahc]rûh	auheKôhfhhO]rü(hs)rý}rþ(hTj§hUj÷hVhYh[hwh]}rÿ(h_]h`]ha]hb]hc]hdj¢uheKôhfhhO]rhzX
xmlsec_binaryrr}r(hTj§hUjýubaubh~)r}r(hTXPresently xmlsec1 binaries are used for all the signing and encryption stuff.
This option defines where the binary is situated.rhUj÷hVhYh[hh]}r(ha]hb]h`]h_]hc]uheKöhfhhO]rhzXPresently xmlsec1 binaries are used for all the signing and encryption stuff.
This option defines where the binary is situated.r	r
}r(hTjhUjubaubh~)r}r
(hTX	Example::rhUj÷hVhYh[hh]}r(ha]hb]h`]h_]hc]uheKùhfhhO]rhzXExample:rr}r(hTXExample:hUjubaubh)r}r(hTX*"xmlsec_binary": "/usr/local/bin/xmlsec1",hUj÷hVhYh[hh]}r(hhh_]h`]ha]hb]hc]uheKûhfhhO]rhzX*"xmlsec_binary": "/usr/local/bin/xmlsec1",rr}r(hTUhUjubaubeubhg)r}r(hTUhUjØhVhYh[hlh]}r(ha]hb]h`]h_]rhJahc]rh!auheKþhfhhO]r (hs)r!}r"(hTj¹hUjhVhYh[hwh]}r#(h_]h`]ha]hb]hc]hdj´uheKþhfhhO]r$hzX	valid_forr%r&}r'(hTj¹hUj!ubaubh~)r(}r)(hTXAHow many *hours* this configuration is expected to be accurate.::r*hUjhVhYh[hh]}r+(ha]hb]h`]h_]hc]uheMhfhhO]r,(hzX	How many r-r.}r/(hTX	How many hUj(ubj")r0}r1(hTX*hours*h]}r2(ha]hb]h`]h_]hc]uhUj(hO]r3hzXhoursr4r5}r6(hTUhUj0ubah[j*ubhzX0 this configuration is expected to be accurate.:r7r8}r9(hTX0 this configuration is expected to be accurate.:hUj(ubeubh)r:}r;(hTX"valid_for": 24hUjhVhYh[hh]}r<(hhh_]h`]ha]hb]hc]uheMhfhhO]r=hzX"valid_for": 24r>r?}r@(hTUhUj:ubaubh~)rA}rB(hTX}This of course is only used by *make_metadata.py*.
The server will not stop working when this amount of time has elapsed :-).hUjhVhYh[hh]}rC(ha]hb]h`]h_]hc]uheMhfhhO]rD(hzXThis of course is only used by rErF}rG(hTXThis of course is only used by hUjAubj")rH}rI(hTX*make_metadata.py*h]}rJ(ha]hb]h`]h_]hc]uhUjAhO]rKhzXmake_metadata.pyrLrM}rN(hTUhUjHubah[j*ubhzXL.
The server will not stop working when this amount of time has elapsed :-).rOrP}rQ(hTXL.
The server will not stop working when this amount of time has elapsed :-).hUjAubeubeubeubhg)rR}rS(hTUhUh©hVhYh[hlh]}rT(ha]hb]h`]h_]rUhBahc]rVhauheMhfhhO]rW(hs)rX}rY(hTjËhUjRhVhYh[hwh]}rZ(h_]h`]ha]hb]hc]hdjÆuheMhfhhO]r[hzXSpecific directivesr\r]}r^(hTjËhUjXubaubh~)r_}r`(hTX:Directives that are specific to a certain type of service.rahUjRhVhYh[hh]}rb(ha]hb]h`]h_]hc]uheM
hfhhO]rchzX:Directives that are specific to a certain type of service.rdre}rf(hTjahUj_ubaubhg)rg}rh(hTUhUjRhVhYh[hlh]}ri(ha]hb]h`]h_]rjhGahc]rkhauheM
hfhhO]rl(hs)rm}rn(hTjáhUjghVhYh[hwh]}ro(h_]h`]ha]hb]hc]hdjÜuheM
hfhhO]rphzXidp/aarqrr}rs(hTjáhUjmubaubh~)rt}ru(hTX=Directives that are specific to an IdP or AA service instancervhUjghVhYh[hh]}rw(ha]hb]h`]h_]hc]uheMhfhhO]rxhzX=Directives that are specific to an IdP or AA service instanceryrz}r{(hTjvhUjtubaubhg)r|}r}(hTUhUjghVhYh[hlh]}r~(ha]hb]h`]h_]rh:ahc]rhauheMhfhhO]r(hs)r}r(hTj÷hUj|hVhYh[hwh]}r(h_]h`]ha]hb]hc]hdjòuheMhfhhO]rhzXpolicyrr}r(hTj÷hUjubaubh~)r}r(hTX»If the server is an IdP and/or an AA then there might be reasons to do things
differently depending on who is asking; this is where that is specified.
The keys are 'default' and SP entity identifiers, default is used whenever
there is no entry for a specific SP. The reasoning is also that if there is
no default and only SP entity identifiers as keys, then the server will only
except connections from the specified SPs.
An example might be::hUj|hVhYh[hh]}r(ha]hb]h`]h_]hc]uheMhfhhO]rhzXºIf the server is an IdP and/or an AA then there might be reasons to do things
differently depending on who is asking; this is where that is specified.
The keys are 'default' and SP entity identifiers, default is used whenever
there is no entry for a specific SP. The reasoning is also that if there is
no default and only SP entity identifiers as keys, then the server will only
except connections from the specified SPs.
An example might be:rr}r(hTXºIf the server is an IdP and/or an AA then there might be reasons to do things
differently depending on who is asking; this is where that is specified.
The keys are 'default' and SP entity identifiers, default is used whenever
there is no entry for a specific SP. The reasoning is also that if there is
no default and only SP entity identifiers as keys, then the server will only
except connections from the specified SPs.
An example might be:hUjubaubh)r}r(hTX"service": {
    "idp": {
        "policy": {
            "default": {
                "lifetime": {"minutes":15},
                "attribute_restrictions": None, # means all I have
                "name_form": "urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
            },
            "urn:mace:example.com:saml:roland:sp": {
                "lifetime": {"minutes": 5},
                "attribute_restrictions":{
                    "givenName": None,
                    "surName": None,
                }
            }
        }
    }
}hUj|hVhYh[hh]}r(hhh_]h`]ha]hb]hc]uheMhfhhO]rhzX"service": {
    "idp": {
        "policy": {
            "default": {
                "lifetime": {"minutes":15},
                "attribute_restrictions": None, # means all I have
                "name_form": "urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
            },
            "urn:mace:example.com:saml:roland:sp": {
                "lifetime": {"minutes": 5},
                "attribute_restrictions":{
                    "givenName": None,
                    "surName": None,
                }
            }
        }
    }
}rr}r(hTUhUjubaubcdocutils.nodes
definition_list
r)r}r(hTUhUj|hVhYh[Udefinition_listrh]}r(ha]hb]h`]h_]hc]uheNhfhhO]r(cdocutils.nodes
definition_list_item
r)r}r(hTX*lifetime*
is the maximum amount of time before the information should be
regarded as stale. In an Assertion this is represented in the NotOnOrAfter
attribute.hUjhVhYh[Udefinition_list_itemr h]}r¡(ha]hb]h`]h_]hc]uheM1hO]r¢(cdocutils.nodes
term
r£)r¤}r¥(hTUh]}r¦(ha]hb]h`]h_]hc]uhUjhO]r§j")r¨}r©(hTX
*lifetime*rªh]}r«(ha]hb]h`]h_]hc]uhUj¤hO]r¬hzXlifetimerr®}r¯(hTUhUj¨ubah[j*ubah[Utermr°ubcdocutils.nodes
definition
r±)r²}r³(hTUh]}r´(ha]hb]h`]h_]hc]uhUjhO]rµh~)r¶}r·(hTXis the maximum amount of time before the information should be
regarded as stale. In an Assertion this is represented in the NotOnOrAfter
attribute.r¸hUj²hVhYh[hh]}r¹(ha]hb]h`]h_]hc]uheM0hO]rºhzXis the maximum amount of time before the information should be
regarded as stale. In an Assertion this is represented in the NotOnOrAfter
attribute.r»r¼}r½(hTj¸hUj¶ubaubah[U
definitionr¾ubeubj)r¿}rÀ(hTXí*attribute_restrictions*
By default there is no restrictions as to which attributes should be
return. Instead all the attributes and values that is gathered by the
database backends will be returned if nothing else is stated.
In the example above the SP with the entity identifier
"urn:mace:umu.se:saml:roland:sp"
has an attribute restriction: only the attributes
'givenName' and 'surName' are to be returned. There is no limitations as to
what values on these attributes that can be returned.hUjhVhYh[j h]}rÁ(ha]hb]h`]h_]hc]uheM:hfhhO]rÂ(j£)rÃ}rÄ(hTUh]}rÅ(ha]hb]h`]h_]hc]uhUj¿hO]rÆj")rÇ}rÈ(hTX*attribute_restrictions*rÉh]}rÊ(ha]hb]h`]h_]hc]uhUjÃhO]rËhzXattribute_restrictionsrÌrÍ}rÎ(hTUhUjÇubah[j*ubah[j°ubj±)rÏ}rÐ(hTUh]}rÑ(ha]hb]h`]h_]hc]uhUj¿hO]rÒh~)rÓ}rÔ(hTXÔBy default there is no restrictions as to which attributes should be
return. Instead all the attributes and values that is gathered by the
database backends will be returned if nothing else is stated.
In the example above the SP with the entity identifier
"urn:mace:umu.se:saml:roland:sp"
has an attribute restriction: only the attributes
'givenName' and 'surName' are to be returned. There is no limitations as to
what values on these attributes that can be returned.hUjÏhVhYh[hh]}rÕ(ha]hb]h`]h_]hc]uheM4hO]rÖ(hzXBy default there is no restrictions as to which attributes should be
return. Instead all the attributes and values that is gathered by the
database backends will be returned if nothing else is stated.
In the example above the SP with the entity identifier
"r×rØ}rÙ(hTXBy default there is no restrictions as to which attributes should be
return. Instead all the attributes and values that is gathered by the
database backends will be returned if nothing else is stated.
In the example above the SP with the entity identifier
"hUjÓubhÑ)rÚ}rÛ(hTXurn:mace:umu.se:saml:roland:sprÜh]}rÝ(UrefurijÜh_]h`]ha]hb]hc]uhUjÓhO]rÞhzXurn:mace:umu.se:saml:roland:sprßrà}rá(hTUhUjÚubah[hÜubhzXµ"
has an attribute restriction: only the attributes
'givenName' and 'surName' are to be returned. There is no limitations as to
what values on these attributes that can be returned.rârã}rä(hTXµ"
has an attribute restriction: only the attributes
'givenName' and 'surName' are to be returned. There is no limitations as to
what values on these attributes that can be returned.hUjÓubeubah[j¾ubeubj)rå}ræ(hTXI*name_form*
Which name-form that should be used when sending assertions.
hUjhVhYh[j h]}rç(ha]hb]h`]h_]hc]uheM=hfhhO]rè(j£)ré}rê(hTUh]}rë(ha]hb]h`]h_]hc]uhUjåhO]rìj")rí}rî(hTX*name_form*rïh]}rð(ha]hb]h`]h_]hc]uhUjéhO]rñhzX	name_formròró}rô(hTUhUjíubah[j*ubah[j°ubj±)rõ}rö(hTUh]}r÷(ha]hb]h`]h_]hc]uhUjåhO]røh~)rù}rú(hTX<Which name-form that should be used when sending assertions.rûhUjõhVhYh[hh]}rü(ha]hb]h`]h_]hc]uheM=hO]rýhzX<Which name-form that should be used when sending assertions.rþrÿ}r(hTjûhUjùubaubah[j¾ubeubeubh~)r}r(hTX^If restrictions on values are deemed necessary those are represented by
regular expressions.::hUj|hVhYh[hh]}r(ha]hb]h`]h_]hc]uheM?hfhhO]rhzX]If restrictions on values are deemed necessary those are represented by
regular expressions.:rr}r(hTX]If restrictions on values are deemed necessary those are represented by
regular expressions.:hUjubaubh)r}r	(hTX"service": {
    "aa": {
        "policy": {
            "urn:mace:umu.se:saml:roland:sp": {
                "lifetime": {"minutes": 5},
                "attribute_restrictions":{
                     "mail": [".*\.umu\.se$"],
                }
            }
        }
    }
}hUj|hVhYh[hh]}r
(hhh_]h`]ha]hb]hc]uheMBhfhhO]rhzX"service": {
    "aa": {
        "policy": {
            "urn:mace:umu.se:saml:roland:sp": {
                "lifetime": {"minutes": 5},
                "attribute_restrictions":{
                     "mail": [".*\.umu\.se$"],
                }
            }
        }
    }
}rr
}r(hTUhUjubaubh~)r}r(hTXCHere only mail addresses that ends with ".umu.se" will be returned.rhUj|hVhYh[hh]}r(ha]hb]h`]h_]hc]uheMOhfhhO]rhzXCHere only mail addresses that ends with ".umu.se" will be returned.rr}r(hTjhUjubaubeubeubhg)r}r(hTUhUjRhVhYh[hlh]}r(ha]hb]h`]h_]rhFahc]rhauheMRhfhhO]r(hs)r}r(hTj	hUjhVhYh[hwh]}r(h_]h`]ha]hb]hc]hdjuheMRhfhhO]r hzXspr!r"}r#(hTj	hUjubaubh~)r$}r%(hTX#Directives specific to SP instancesr&hUjhVhYh[hh]}r'(ha]hb]h`]h_]hc]uheMThfhhO]r(hzX#Directives specific to SP instancesr)r*}r+(hTj&hUj$ubaubhg)r,}r-(hTUhUjhVhYh[hlh]}r.(ha]hb]h`]h_]r/hLahc]r0h#auheMWhfhhO]r1(hs)r2}r3(hTjhUj,hVhYh[hwh]}r4(h_]h`]ha]hb]hc]hdjuheMWhfhhO]r5hzXauthn_requests_signedr6r7}r8(hTjhUj2ubaubh~)r9}r:(hTXIndicates if the Authentication Requests sent by this SP should be signed
by default. This can be overriden by application code for a specific call.r;hUj,hVhYh[hh]}r<(ha]hb]h`]h_]hc]uheMYhfhhO]r=hzXIndicates if the Authentication Requests sent by this SP should be signed
by default. This can be overriden by application code for a specific call.r>r?}r@(hTj;hUj9ubaubh~)rA}rB(hTXThis set the AuthnRequestsSigned attribute of the SPSSODescriptor node.
of the metadata so the IdP will know this SP preference.rChUj,hVhYh[hh]}rD(ha]hb]h`]h_]hc]uheM\hfhhO]rEhzXThis set the AuthnRequestsSigned attribute of the SPSSODescriptor node.
of the metadata so the IdP will know this SP preference.rFrG}rH(hTjChUjAubaubh~)rI}rJ(hTX=Valid values are "true" or "false". Default value is "false".rKhUj,hVhYh[hh]}rL(ha]hb]h`]h_]hc]uheM_hfhhO]rMhzX=Valid values are "true" or "false". Default value is "false".rNrO}rP(hTjKhUjIubaubh~)rQ}rR(hTX	Example::rShUj,hVhYh[hh]}rT(ha]hb]h`]h_]hc]uheMahfhhO]rUhzXExample:rVrW}rX(hTXExample:hUjQubaubh)rY}rZ(hTXK"service": {
    "sp": {
        "authn_assertions_signed": "true",
    }
}hUj,hVhYh[hh]}r[(hhh_]h`]ha]hb]hc]uheMchfhhO]r\hzXK"service": {
    "sp": {
        "authn_assertions_signed": "true",
    }
}r]r^}r_(hTUhUjYubaubeubhg)r`}ra(hTUhUjhVhYh[hlh]}rb(ha]hb]h`]h_]rchIahc]rdh auheMkhfhhO]re(hs)rf}rg(hTj1hUj`hVhYh[hwh]}rh(h_]h`]ha]hb]hc]hdj,uheMkhfhhO]rihzXidprjrk}rl(hTj1hUjfubaubh~)rm}rn(hTX!Defines the set of IdPs that this SP is allowed to use. If not all the IdPs in
the metadata is allowed, then the value is expected to be a list with entity
identifiers for the allowed IdPs.
A typical configuration, when the allowed set of IdPs are limited, would look
something like this::hUj`hVhYh[hh]}ro(ha]hb]h`]h_]hc]uheMmhfhhO]rphzX Defines the set of IdPs that this SP is allowed to use. If not all the IdPs in
the metadata is allowed, then the value is expected to be a list with entity
identifiers for the allowed IdPs.
A typical configuration, when the allowed set of IdPs are limited, would look
something like this:rqrr}rs(hTX Defines the set of IdPs that this SP is allowed to use. If not all the IdPs in
the metadata is allowed, then the value is expected to be a list with entity
identifiers for the allowed IdPs.
A typical configuration, when the allowed set of IdPs are limited, would look
something like this:hUjmubaubh)rt}ru(hTXT"service": {
    "sp": {
        "idp": ["urn:mace:umu.se:saml:roland:idp"],
    }
}hUj`hVhYh[hh]}rv(hhh_]h`]ha]hb]hc]uheMshfhhO]rwhzXT"service": {
    "sp": {
        "idp": ["urn:mace:umu.se:saml:roland:idp"],
    }
}rxry}rz(hTUhUjtubaubh~)r{}r|(hTX0In this case the SP has only one IdP it can use.r}hUj`hVhYh[hh]}r~(ha]hb]h`]h_]hc]uheMyhfhhO]rhzX0In this case the SP has only one IdP it can use.rr}r(hTj}hUj{ubaubh~)r}r(hTXKIf all IdPs present in the metadata loaded this directive must be left out.rhUj`hVhYh[hh]}r(ha]hb]h`]h_]hc]uheM{hfhhO]rhzXKIf all IdPs present in the metadata loaded this directive must be left out.rr}r(hTjhUjubaubeubhg)r}r(hTUhUjhVhYh[hlh]}r(ha]hb]h`]h_]rhAahc]rhauheM~hfhhO]r(hs)r}r(hTjChUjhVhYh[hwh]}r(h_]h`]ha]hb]hc]hdj>uheM~hfhhO]rhzXoptional_attributesrr}r(hTjChUjubaubh~)r}r(hTX8Attributes that this SP would like to receive from IdPs.rhUjhVhYh[hh]}r(ha]hb]h`]h_]hc]uheMhfhhO]rhzX8Attributes that this SP would like to receive from IdPs.rr}r(hTjhUjubaubh~)r }r¡(hTX	Example::r¢hUjhVhYh[hh]}r£(ha]hb]h`]h_]hc]uheMhfhhO]r¤hzXExample:r¥r¦}r§(hTXExample:hUj ubaubh)r¨}r©(hTXJ"service": {
    "sp": {
        "optional_attributes": ["title"],
    }
}hUjhVhYh[hh]}rª(hhh_]h`]ha]hb]hc]uheMhfhhO]r«hzXJ"service": {
    "sp": {
        "optional_attributes": ["title"],
    }
}r¬r}r®(hTUhUj¨ubaubh~)r¯}r°(hTX«Since the attribute names used here are the user friendly ones an attribute map
must exist, so that the server can use the full name when communicating
with other servers.r±hUjhVhYh[hh]}r²(ha]hb]h`]h_]hc]uheMhfhhO]r³hzX«Since the attribute names used here are the user friendly ones an attribute map
must exist, so that the server can use the full name when communicating
with other servers.r´rµ}r¶(hTj±hUj¯ubaubeubhg)r·}r¸(hTUhUjhVhYh[hlh]}r¹(ha]hb]h`]h_]rºh4ahc]r»hauheMhfhhO]r¼(hs)r½}r¾(hTjUhUj·hVhYh[hwh]}r¿(h_]h`]ha]hb]hc]hdjPuheMhfhhO]rÀhzXrequired_attributesrÁrÂ}rÃ(hTjUhUj½ubaubh~)rÄ}rÅ(hTX5Attributes that this SP demands to receive from IdPs.rÆhUj·hVhYh[hh]}rÇ(ha]hb]h`]h_]hc]uheMhfhhO]rÈhzX5Attributes that this SP demands to receive from IdPs.rÉrÊ}rË(hTjÆhUjÄubaubh~)rÌ}rÍ(hTX	Example::rÎhUj·hVhYh[hh]}rÏ(ha]hb]h`]h_]hc]uheMhfhhO]rÐhzXExample:rÑrÒ}rÓ(hTXExample:hUjÌubaubh)rÔ}rÕ(hTXa"service": {
    "sp": {
        "required_attributes": ["surname", "givenName", "mail"],
    }
}hUj·hVhYh[hh]}rÖ(hhh_]h`]ha]hb]hc]uheMhfhhO]r×hzXa"service": {
    "sp": {
        "required_attributes": ["surname", "givenName", "mail"],
    }
}rØrÙ}rÚ(hTUhUjÔubaubh~)rÛ}rÜ(hTX^Again as for *optional_attributes* the names given are expected to be
the user friendly names.hUj·hVhYh[hh]}rÝ(ha]hb]h`]h_]hc]uheMhfhhO]rÞ(hzX
Again as for rßrà}rá(hTX
Again as for hUjÛubj")râ}rã(hTX*optional_attributes*h]}rä(ha]hb]h`]h_]hc]uhUjÛhO]råhzXoptional_attributesrærç}rè(hTUhUjâubah[j*ubhzX< the names given are expected to be
the user friendly names.rérê}rë(hTX< the names given are expected to be
the user friendly names.hUjÛubeubeubhg)rì}rí(hTUhUjhVhYh[hlh]}rî(ha]hb]h`]h_]rïh?ahc]rðhauheMhfhhO]rñ(hs)rò}ró(hTjghUjìhVhYh[hwh]}rô(h_]h`]ha]hb]hc]hdjbuheMhfhhO]rõhzXwant_assertions_signedrör÷}rø(hTjghUjòubaubh~)rù}rú(hTXÃIndicates if this SP wants the IdP to send the assertions signed. This
set the WantAssertionsSigned attribute of the SPSSODescriptor node.
of the metadata so the IdP will know this SP preference.rûhUjìhVhYh[hh]}rü(ha]hb]h`]h_]hc]uheM¡hfhhO]rýhzXÃIndicates if this SP wants the IdP to send the assertions signed. This
set the WantAssertionsSigned attribute of the SPSSODescriptor node.
of the metadata so the IdP will know this SP preference.rþrÿ}r(hTjûhUjùubaubh~)r}r(hTX<Valid values are "true" or "false". Default value is "true".rhUjìhVhYh[hh]}r(ha]hb]h`]h_]hc]uheM¥hfhhO]rhzX<Valid values are "true" or "false". Default value is "true".rr}r(hTjhUjubaubh~)r	}r
(hTX	Example::rhUjìhVhYh[hh]}r(ha]hb]h`]h_]hc]uheM§hfhhO]r
hzXExample:rr}r(hTXExample:hUj	ubaubh)r}r(hTXJ"service": {
    "sp": {
        "want_assertions_signed": "true",
    }
}hUjìhVhYh[hh]}r(hhh_]h`]ha]hb]hc]uheM©hfhhO]rhzXJ"service": {
    "sp": {
        "want_assertions_signed": "true",
    }
}rr}r(hTUhUjubaubeubeubhg)r}r(hTUhUjRhVhYh[hlh]}r(ha]hb]h`]h_]rhDahc]rhauheM±hfhhO]r(hs)r}r(hTjyhUjhVhYh[hwh]}r (h_]h`]ha]hb]hc]hdjtuheM±hfhhO]r!hzX	idp/aa/spr"r#}r$(hTjyhUjubaubh~)r%}r&(hTXæIf the configuration is covering both two or three different service types
(like if one server is actually acting as both an IdP and a SP) then in some
cases you might want to have these below different for the different services.r'hUjhVhYh[hh]}r((ha]hb]h`]h_]hc]uheM³hfhhO]r)hzXæIf the configuration is covering both two or three different service types
(like if one server is actually acting as both an IdP and a SP) then in some
cases you might want to have these below different for the different services.r*r+}r,(hTj'hUj%ubaubhg)r-}r.(hTUhUjhVhYh[hlh]}r/(ha]hb]h`]h_]r0hNahc]r1h%auheM¸hfhhO]r2(hs)r3}r4(hTjhUj-hVhYh[hwh]}r5(h_]h`]ha]hb]hc]hdjuheM¸hfhhO]r6hzX	endpointsr7r8}r9(hTjhUj3ubaubh~)r:}r;(hTX{Where the endpoints for the services provided are.
This directive has as value a dictionary with one of the following keys:r<hUj-hVhYh[hh]}r=(ha]hb]h`]h_]hc]uheMºhfhhO]r>hzX{Where the endpoints for the services provided are.
This directive has as value a dictionary with one of the following keys:r?r@}rA(hTj<hUj:ubaubhÂ)rB}rC(hTUhUj-hVhYh[hÅh]}rD(UbulletrEX*h_]h`]ha]hb]hc]uheM½hfhhO]rF(hÈ)rG}rH(hTX,artifact_resolution_service (aa, idp and sp)rIhUjBhVhYh[hóh]}rJ(ha]hb]h`]h_]hc]uheNhfhhO]rKh~)rL}rM(hTjIhUjGhVhYh[hh]}rN(ha]hb]h`]h_]hc]uheM½hO]rOhzX,artifact_resolution_service (aa, idp and sp)rPrQ}rR(hTjIhUjLubaubaubhÈ)rS}rT(hTXassertion_consumer_service (sp)rUhUjBhVhYh[hóh]}rV(ha]hb]h`]h_]hc]uheNhfhhO]rWh~)rX}rY(hTjUhUjShVhYh[hh]}rZ(ha]hb]h`]h_]hc]uheM¾hO]r[hzXassertion_consumer_service (sp)r\r]}r^(hTjUhUjXubaubaubhÈ)r_}r`(hTX&assertion_id_request_service (aa, idp)rahUjBhVhYh[hóh]}rb(ha]hb]h`]h_]hc]uheNhfhhO]rch~)rd}re(hTjahUj_hVhYh[hh]}rf(ha]hb]h`]h_]hc]uheM¿hO]rghzX&assertion_id_request_service (aa, idp)rhri}rj(hTjahUjdubaubaubhÈ)rk}rl(hTXattribute_service (aa)rmhUjBhVhYh[hóh]}rn(ha]hb]h`]h_]hc]uheNhfhhO]roh~)rp}rq(hTjmhUjkhVhYh[hh]}rr(ha]hb]h`]h_]hc]uheMÀhO]rshzXattribute_service (aa)rtru}rv(hTjmhUjpubaubaubhÈ)rw}rx(hTX manage_name_id_service (aa, idp)ryhUjBhVhYh[hóh]}rz(ha]hb]h`]h_]hc]uheNhfhhO]r{h~)r|}r}(hTjyhUjwhVhYh[hh]}r~(ha]hb]h`]h_]hc]uheMÁhO]rhzX manage_name_id_service (aa, idp)rr}r(hTjyhUj|ubaubaubhÈ)r}r(hTXname_id_mapping_service (idp)rhUjBhVhYh[hóh]}r(ha]hb]h`]h_]hc]uheNhfhhO]rh~)r}r(hTjhUjhVhYh[hh]}r(ha]hb]h`]h_]hc]uheMÂhO]rhzXname_id_mapping_service (idp)rr}r(hTjhUjubaubaubhÈ)r}r(hTX#single_logout_service (aa, idp, sp)rhUjBhVhYh[hóh]}r(ha]hb]h`]h_]hc]uheNhfhhO]rh~)r}r(hTjhUjhVhYh[hh]}r(ha]hb]h`]h_]hc]uheMÃhO]rhzX#single_logout_service (aa, idp, sp)rr}r(hTjhUjubaubaubhÈ)r}r(hTXsingle_sign_on_service (idp)
hUjBhVhYh[hóh]}r(ha]hb]h`]h_]hc]uheNhfhhO]rh~)r}r (hTXsingle_sign_on_service (idp)r¡hUjhVhYh[hh]}r¢(ha]hb]h`]h_]hc]uheMÄhO]r£hzXsingle_sign_on_service (idp)r¤r¥}r¦(hTj¡hUjubaubaubeubh~)r§}r¨(hTXPThe values per service is a list of tuples containing endpoint and binding
type.r©hUj-hVhYh[hh]}rª(ha]hb]h`]h_]hc]uheMÆhfhhO]r«hzXPThe values per service is a list of tuples containing endpoint and binding
type.r¬r}r®(hTj©hUj§ubaubh~)r¯}r°(hTX	Example::r±hUj-hVhYh[hh]}r²(ha]hb]h`]h_]hc]uheMÉhfhhO]r³hzXExample:r´rµ}r¶(hTXExample:hUj¯ubaubh)r·}r¸(hTX)"service":
    "idp": {
        "endpoints" : {
            "single_sign_on_service" : [
                    ("http://localhost:8088/sso", BINDING_HTTP_REDIRECT)],
            "single_logout_service": [
                    ("http://localhost:8088/slo", BINDING_HTTP_REDIRECT)]
        },
    },
},hUj-hVhYh[hh]}r¹(hhh_]h`]ha]hb]hc]uheMËhfhhO]rºhzX)"service":
    "idp": {
        "endpoints" : {
            "single_sign_on_service" : [
                    ("http://localhost:8088/sso", BINDING_HTTP_REDIRECT)],
            "single_logout_service": [
                    ("http://localhost:8088/slo", BINDING_HTTP_REDIRECT)]
        },
    },
},r»r¼}r½(hTUhUj·ubaubeubhg)r¾}r¿(hTUhUjhVhYh[hlh]}rÀ(ha]hb]h`]h_]rÁh/ahc]rÂhauheM×hfhhO]rÃ(hs)rÄ}rÅ(hTj¡hUj¾hVhYh[hwh]}rÆ(h_]h`]ha]hb]hc]hdjuheM×hfhhO]rÇhzXlogout_requests_signedrÈrÉ}rÊ(hTj¡hUjÄubaubh~)rË}rÌ(hTXJIndicates if this entity will sign the Logout Requests originated from it.rÍhUj¾hVhYh[hh]}rÎ(ha]hb]h`]h_]hc]uheMÙhfhhO]rÏhzXJIndicates if this entity will sign the Logout Requests originated from it.rÐrÑ}rÒ(hTjÍhUjËubaubh~)rÓ}rÔ(hTX>This can be overriden by application code for a specific call.rÕhUj¾hVhYh[hh]}rÖ(ha]hb]h`]h_]hc]uheMÛhfhhO]r×hzX>This can be overriden by application code for a specific call.rØrÙ}rÚ(hTjÕhUjÓubaubh~)rÛ}rÜ(hTX<Valid values are "true" or "false". Default value is "false"rÝhUj¾hVhYh[hh]}rÞ(ha]hb]h`]h_]hc]uheMÝhfhhO]rßhzX<Valid values are "true" or "false". Default value is "false"ràrá}râ(hTjÝhUjÛubaubh~)rã}rä(hTX	Example::råhUj¾hVhYh[hh]}ræ(ha]hb]h`]h_]hc]uheMßhfhhO]rçhzXExample:rèré}rê(hTXExample:hUjãubaubh)rë}rì(hTXJ"service": {
    "sp": {
        "logout_requests_signed": "true",
    }
}hUj¾hVhYh[hh]}rí(hhh_]h`]ha]hb]hc]uheMáhfhhO]rîhzXJ"service": {
    "sp": {
        "logout_requests_signed": "true",
    }
}rïrð}rñ(hTUhUjëubaubeubhg)rò}ró(hTUhUjhVhYh[hlh]}rô(ha]hb]h`]h_]rõh;ahc]röhauheMèhfhhO]r÷(hs)rø}rù(hTj³hUjòhVhYh[hwh]}rú(h_]h`]ha]hb]hc]hdj®uheMèhfhhO]rûhzXsubject_datarürý}rþ(hTj³hUjøubaubh~)rÿ}r(hTXThe name of a database where the map between a local identifier and
a distributed identifier is kept. By default this is a shelve database.
So if you just specify name, then a shelve database with that name
is created. On the other hand if you specify a tuple then the first
element in the tuple specifise which type of database you want to use
and the second element is the address of the database.rhUjòhVhYh[hh]}r(ha]hb]h`]h_]hc]uheMêhfhhO]rhzXThe name of a database where the map between a local identifier and
a distributed identifier is kept. By default this is a shelve database.
So if you just specify name, then a shelve database with that name
is created. On the other hand if you specify a tuple then the first
element in the tuple specifise which type of database you want to use
and the second element is the address of the database.rr}r(hTjhUjÿubaubh~)r}r(hTX	Example::r	hUjòhVhYh[hh]}r
(ha]hb]h`]h_]hc]uheMñhfhhO]rhzXExample:rr
}r(hTXExample:hUjubaubh)r}r(hTX#"subject_data": "./idp.subject.db",hUjòhVhYh[hh]}r(hhh_]h`]ha]hb]hc]uheMóhfhhO]rhzX#"subject_data": "./idp.subject.db",rr}r(hTUhUjubaubh~)r}r(hTX-or if you want to use for instance memcache::rhUjòhVhYh[hh]}r(ha]hb]h`]h_]hc]uheMõhfhhO]rhzX,or if you want to use for instance memcache:rr}r(hTX,or if you want to use for instance memcache:hUjubaubh)r}r(hTX1"subject_data": ("memcached", "localhost:12121"),hUjòhVhYh[hh]}r (hhh_]h`]ha]hb]hc]uheM÷hfhhO]r!hzX1"subject_data": ("memcached", "localhost:12121"),r"r#}r$(hTUhUjubaubh~)r%}r&(hTXR*shelve* and *memcached* are the only database types that are presently
supported.hUjòhVhYh[hh]}r'(ha]hb]h`]h_]hc]uheMùhfhhO]r((j")r)}r*(hTX*shelve*h]}r+(ha]hb]h`]h_]hc]uhUj%hO]r,hzXshelver-r.}r/(hTUhUj)ubah[j*ubhzX and r0r1}r2(hTX and hUj%ubj")r3}r4(hTX*memcached*h]}r5(ha]hb]h`]h_]hc]uhUj%hO]r6hzX	memcachedr7r8}r9(hTUhUj3ubah[j*ubhzX: are the only database types that are presently
supported.r:r;}r<(hTX: are the only database types that are presently
supported.hUj%ubeubeubhg)r=}r>(hTUhUjhVhYh[hlh]}r?(ha]hb]h`]h_]r@h<ahc]rAhauheMþhfhhO]rB(hs)rC}rD(hTjÅhUj=hVhYh[hwh]}rE(h_]h`]ha]hb]hc]hdjÀuheMþhfhhO]rFhzXvirtual_organizationrGrH}rI(hTjÅhUjCubaubh~)rJ}rK(hTXFGives information about common identifiers for virtual_organizations::rLhUj=hVhYh[hh]}rM(ha]hb]h`]h_]hc]uheMhfhhO]rNhzXEGives information about common identifiers for virtual_organizations:rOrP}rQ(hTXEGives information about common identifiers for virtual_organizations:hUjJubaubh)rR}rS(hTXº"virtual_organization" : {
    "urn:mace:example.com:it:tek":{
        "nameid_format" : "urn:oid:1.3.6.1.4.1.1466.115.121.1.15-NameID",
        "common_identifier": "umuselin",
    }
},hUj=hVhYh[hh]}rT(hhh_]h`]ha]hb]hc]uheMhfhhO]rUhzXº"virtual_organization" : {
    "urn:mace:example.com:it:tek":{
        "nameid_format" : "urn:oid:1.3.6.1.4.1.1466.115.121.1.15-NameID",
        "common_identifier": "umuselin",
    }
},rVrW}rX(hTUhUjRubaubh~)rY}rZ(hTX Keys in this dictionary are the identifiers for the virtual organizations.
The arguments per organization is 'nameid_format' and 'common_identifier'.
Useful if all the IdPs and AAs that are involved in a virtual organization
have common attribute values for users that are part of the VO.r[hUj=hVhYh[hh]}r\(ha]hb]h`]h_]hc]uheM	hfhhO]r]hzX Keys in this dictionary are the identifiers for the virtual organizations.
The arguments per organization is 'nameid_format' and 'common_identifier'.
Useful if all the IdPs and AAs that are involved in a virtual organization
have common attribute values for users that are part of the VO.r^r_}r`(hTj[hUjYubaubeubeubeubhg)ra}rb(hTUhUh©hVhYh[hlh]}rc(ha]hb]h`]h_]rdh>ahc]rehauheMhfhhO]rf(hs)rg}rh(hTj×hUjahVhYh[hwh]}ri(h_]h`]ha]hb]hc]hdjÒuheMhfhhO]rjhzXComplete examplerkrl}rm(hTj×hUjgubaubh~)rn}ro(hTXKWe start with a simple but fairly complete Service provider configuration::rphUjahVhYh[hh]}rq(ha]hb]h`]h_]hc]uheMhfhhO]rrhzXJWe start with a simple but fairly complete Service provider configuration:rsrt}ru(hTXJWe start with a simple but fairly complete Service provider configuration:hUjnubaubh)rv}rw(hTXfrom saml2 import BINDING_HTTP_REDIRECT

CONFIG = {
    "entityid" : "http://example.com/sp/metadata.xml",
    "service": {
        "sp":{
            "name" : "Example SP",
            "endpoints":{
                "assertion_consumer_service": ["http://example.com/sp"],
                "single_logout_service" : [("http://example.com/sp/slo",
                                            BINDING_HTTP_REDIRECT)],
            },
        }
    },
    "key_file" : "./mykey.pem",
    "cert_file" : "./mycert.pem",
    "xmlsec_binary" : "/usr/local/bin/xmlsec1",
    "attribute_map_dir": "./attributemaps",
    "metadata": {
        "local": ["idp.xml"]
    }
    "organization": {
        "display_name":["Example identities"]
    }
    "contact_person": [{
        "givenname": "Roland",
        "surname": "Hedberg",
        "phone": "+46 90510",
        "mail": "roland@example.com",
        "type": "technical",
        }]
}hUjahVhYh[hh]}rx(hhh_]h`]ha]hb]hc]uheMhfhhO]ryhzXfrom saml2 import BINDING_HTTP_REDIRECT

CONFIG = {
    "entityid" : "http://example.com/sp/metadata.xml",
    "service": {
        "sp":{
            "name" : "Example SP",
            "endpoints":{
                "assertion_consumer_service": ["http://example.com/sp"],
                "single_logout_service" : [("http://example.com/sp/slo",
                                            BINDING_HTTP_REDIRECT)],
            },
        }
    },
    "key_file" : "./mykey.pem",
    "cert_file" : "./mycert.pem",
    "xmlsec_binary" : "/usr/local/bin/xmlsec1",
    "attribute_map_dir": "./attributemaps",
    "metadata": {
        "local": ["idp.xml"]
    }
    "organization": {
        "display_name":["Example identities"]
    }
    "contact_person": [{
        "givenname": "Roland",
        "surname": "Hedberg",
        "phone": "+46 90510",
        "mail": "roland@example.com",
        "type": "technical",
        }]
}rzr{}r|(hTUhUjvubaubh~)r}}r~(hTX¢This is the typical setup for a SP.
A metadata file to load is *always* needed, but it can of course be
containing anything from 1 up to many entity descriptions.hUjahVhYh[hh]}r(ha]hb]h`]h_]hc]uheM4hfhhO]r(hzX?This is the typical setup for a SP.
A metadata file to load is rr}r(hTX?This is the typical setup for a SP.
A metadata file to load is hUj}ubj")r}r(hTX*always*h]}r(ha]hb]h`]h_]hc]uhUj}hO]rhzXalwaysrr}r(hTUhUjubah[j*ubhzX[ needed, but it can of course be
containing anything from 1 up to many entity descriptions.rr}r(hTX[ needed, but it can of course be
containing anything from 1 up to many entity descriptions.hUj}ubeubcdocutils.nodes
transition
r)r}r(hTX------rhUjahVhYh[U
transitionrh]}r(ha]hb]h`]h_]hc]uheM8hfhhO]ubh~)r}r(hTX'A slightly more complex configuration::rhUjahVhYh[hh]}r(ha]hb]h`]h_]hc]uheM:hfhhO]rhzX&A slightly more complex configuration:rr}r(hTX&A slightly more complex configuration:hUjubaubh)r}r(hTXfrom saml2 import BINDING_HTTP_REDIRECT

CONFIG = {
    "entityid" : "http://sp.example.com/metadata.xml",
    "service": {
        "sp":{
            "name" : "Example SP",
            "endpoints":{
                "assertion_consumer_service": ["http://sp.example.com/"],
                "single_logout_service" : [("http://sp.example.com/slo",
                               BINDING_HTTP_REDIRECT)],
            },
            "subject_data": ("memcached", "localhost:12121"),
            "virtual_organization" : {
                "urn:mace:example.com:it:tek":{
                    "nameid_format" : "urn:oid:1.3.6.1.4.1.1466.115.121.1.15-NameID",
                    "common_identifier": "eduPersonPrincipalName",
                }
            },
        }
    },
    "key_file" : "./mykey.pem",
    "cert_file" : "./mycert.pem",
    "xmlsec_binary" : "/usr/local/bin/xmlsec1",
    "metadata" : {
        "local": ["example.xml"],
        "remote": [{
            "url":"https://kalmar2.org/simplesaml/module.php/aggregator/?id=kalmarcentral2&set=saml2",
            "cert":"kalmar2.pem"}]
    },
    "attribute_maps" : "attributemaps",
    "organization": {
        "display_name":["Example identities"]
    }
    "contact_person": [{
        "givenname": "Roland",
        "surname": "Hedberg",
        "phone": "+46 90510",
        "mail": "roland@example.com",
        "type": "technical",
        }]
}hUjahVhYh[hh]}r(hhh_]h`]ha]hb]hc]uheM<hfhhO]rhzXfrom saml2 import BINDING_HTTP_REDIRECT

CONFIG = {
    "entityid" : "http://sp.example.com/metadata.xml",
    "service": {
        "sp":{
            "name" : "Example SP",
            "endpoints":{
                "assertion_consumer_service": ["http://sp.example.com/"],
                "single_logout_service" : [("http://sp.example.com/slo",
                               BINDING_HTTP_REDIRECT)],
            },
            "subject_data": ("memcached", "localhost:12121"),
            "virtual_organization" : {
                "urn:mace:example.com:it:tek":{
                    "nameid_format" : "urn:oid:1.3.6.1.4.1.1466.115.121.1.15-NameID",
                    "common_identifier": "eduPersonPrincipalName",
                }
            },
        }
    },
    "key_file" : "./mykey.pem",
    "cert_file" : "./mycert.pem",
    "xmlsec_binary" : "/usr/local/bin/xmlsec1",
    "metadata" : {
        "local": ["example.xml"],
        "remote": [{
            "url":"https://kalmar2.org/simplesaml/module.php/aggregator/?id=kalmarcentral2&set=saml2",
            "cert":"kalmar2.pem"}]
    },
    "attribute_maps" : "attributemaps",
    "organization": {
        "display_name":["Example identities"]
    }
    "contact_person": [{
        "givenname": "Roland",
        "surname": "Hedberg",
        "phone": "+46 90510",
        "mail": "roland@example.com",
        "type": "technical",
        }]
}r r¡}r¢(hTUhUjubaubh~)r£}r¤(hTXtUses metadata files, both local and remote, and will talk to whatever
IdP that appears in any of the metadata files.r¥hUjahVhYh[hh]}r¦(ha]hb]h`]h_]hc]uheMghfhhO]r§hzXtUses metadata files, both local and remote, and will talk to whatever
IdP that appears in any of the metadata files.r¨r©}rª(hTj¥hUj£ubaubeubeubeubehTUUtransformerr«NU
footnote_refsr¬}rUrefnamesr®}r¯Usymbol_footnotesr°]r±Uautofootnote_refsr²]r³Usymbol_footnote_refsr´]rµU	citationsr¶]r·hfhUcurrent_liner¸NUtransform_messagesr¹]rºcdocutils.nodes
system_message
r»)r¼}r½(hTUh]}r¾(ha]UlevelKh_]h`]UsourcehYhb]hc]UlineKUtypeUINFOr¿uhO]rÀh~)rÁ}rÂ(hTUh]}rÃ(ha]hb]h`]h_]hc]uhUj¼hO]rÄhzX2Hyperlink target "howto-config" is not referenced.rÅrÆ}rÇ(hTUhUjÁubah[hubah[Usystem_messagerÈubaUreporterrÉNUid_startrÊKU
autofootnotesrË]rÌU
citation_refsrÍ}rÎUindirect_targetsrÏ]rÐUsettingsrÑ(cdocutils.frontend
Values
rÒorÓ}rÔ(Ufootnote_backlinksrÕKUrecord_dependenciesrÖNUrfc_base_urlr×Uhttp://tools.ietf.org/html/rØU	tracebackrÙKUpep_referencesrÚNUstrip_commentsrÛNU
toc_backlinksrÜUentryrÝU
language_coderÞUenrßU	datestampràNUreport_levelráKU_destinationrâNU
halt_levelrãKU
strip_classesräNhwNUerror_encoding_error_handlerråUbackslashreplaceræUdebugrçNUembed_stylesheetrèUoutput_encoding_error_handlerréUstrictrêU
sectnum_xformrëKUdump_transformsrìNU
docinfo_xformríKUwarning_streamrîNUpep_file_url_templaterïUpep-%04drðUexit_status_levelrñKUconfigròNUstrict_visitorróNUcloak_email_addressesrôUtrim_footnote_reference_spacerõUenvröNUdump_pseudo_xmlr÷NUexpose_internalsrøNUsectsubtitle_xformrùUsource_linkrúNUrfc_referencesrûNUoutput_encodingrüUutf-8rýU
source_urlrþNUinput_encodingrÿU	utf-8-sigr	U_disable_configr	NU	id_prefixr	UU	tab_widthr	KUerror_encodingr	UUTF-8r	U_sourcer	U=/home/lgs/proyectos/yaco/pysaml2/pysaml2/doc/howto/config.rstr	U	generatorr	NUdump_internalsr		NUpep_base_urlr
	Uhttp://www.python.org/dev/peps/r	Uinput_encoding_error_handlerr	jêUauto_id_prefixr
	Uidr	Udoctitle_xformr	Ustrip_elements_with_classesr	NU
_config_filesr	]Ufile_insertion_enabledr	KUraw_enabledr	KU
dump_settingsr	NubUsymbol_footnote_startr	KUidsr	}r	(jPjLh4j·jhühEjhMj5h5h¸h>jaj>j:h8j³jljhj6j2jHjDjjj$j híhéh7jØhÖhÒj~jzh;jòj¢jj´j°jÆjÂjÜjØjòjîjjh:j|h6h©h=j_jtjphDjhHhhh2j÷jjh@jÖhJjh<j=h3jåj,j(h9hhhBjRhGjgh/j¾hLj,jbj^jZjVh?jìhAjhFjhIj`jjh0j[jÒjÎhKjáhCjh1jhNj-jjjjjÀj¼j®jªuUsubstitution_namesr	}r	h[hfh]}r	(ha]h_]h`]UsourcehYhb]hc]uU	footnotesr	]r	Urefidsr	}r	hH]r	hRasub.
360core / pysaml2 python

Products

About

Resources

Contact Gemfury
