saml2_backend.yaml.example

module: satosa.backends.saml2.SAMLBackend
name: Saml2
config:
  idp_blacklist_file: /path/to/blacklist.json

  acr_mapping:
    "": default-LoA
    "https://accounts.google.com": LoA1

  # disco_srv must be defined if there is more than one IdP in the metadata specified above
  disco_srv: http://disco.example.com

  entityid_endpoint: true
  mirror_force_authn: no
  memorize_idp: no
  use_memorized_idp_when_force_authn: no
  send_requester_id: no
  enable_metadata_reload: no
  acs_selection_strategy: prefer_matching_host

  sp_config:
    name: "SP Name"
    description: "SP Description"
    key_file: backend.key
    cert_file: backend.crt
    organization: {display_name: Example Identities, name: Example Identities Org., url: 'http://www.example.com'}
    contact_person:
    - {contact_type: technical, email_address: 'mailto:technical@example.com', given_name: Technical}
    - {contact_type: support, email_address: 'mailto:support@example.com', given_name: Support}
    - {contact_type: other, email_address: 'mailto:security@example.com', given_name: Security, extension_attributes: {'xmlns:remd': 'http://refeds.org/metadata', 'remd:contactType': 'http://refeds.org/metadata/contactType/security'}}

    metadata:
      local: [idp.xml]

    entityid: <base_url>/<name>/proxy_saml2_backend.xml
    accepted_time_diff: 60
    service:
      sp:
        ui_info:
          display_name:
            - lang: en
              text: "SP Display Name"
          description:
            - lang: en
              text: "SP Description"
          information_url:
            - lang: en
              text: "http://sp.information.url/"
          privacy_statement_url:
            - lang: en
              text: "http://sp.privacy.url/"
          keywords:
            - lang: se
              text: ["Satosa", "SP-SE"]
            - lang: en
              text: ["Satosa", "SP-EN"]
          logo:
            text: "http://sp.logo.url/"
            width: "100"
            height: "100"
        authn_requests_signed: true
        want_response_signed: true
        allow_unsolicited: true
        endpoints:
          assertion_consumer_service:
          - [<base_url>/<name>/acs/post, 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST']
          discovery_response:
          - [<base_url>/<name>/disco, 'urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol']

        # name_id_format: a list of strings to set the <NameIDFormat> element in SP metadata
        # name_id_policy_format: a string to set the Format attribute in the NameIDPolicy element
        # of the authentication request
        # name_id_format_allow_create: sets the AllowCreate attribute in the NameIDPolicy element
        # of the authentication request
        name_id_format_allow_create: true