saml2_backend.yaml.example

module: satosa.backends.saml2.SAMLBackend
name: Saml2
config:
  idp_blacklist_file: /path/to/blacklist.json

  mirror_force_authn: no
  memorize_idp: no
  use_memorized_idp_when_force_authn: no

  sp_config:
    key_file: backend.key
    cert_file: backend.crt
    organization: {display_name: Example Identities, name: Example Identities Org., url: 'http://www.example.com'}
    contact_person:
    - {contact_type: technical, email_address: technical@example.com, given_name: Technical}
    - {contact_type: support, email_address: support@example.com, given_name: Support}

    metadata:
      local: [idp.xml]

    entityid: <base_url>/<name>/proxy_saml2_backend.xml
    accepted_time_diff: 60
    service:
      sp:
        ui_info:
          display_name:
            - lang: en
              text: "SP Display Name"
          description:
            - lang: en
              text: "SP Description"
          information_url:
            - lang: en
              text: "http://sp.information.url/"
          privacy_statement_url:
            - lang: en
              text: "http://sp.privacy.url/"
          keywords:
            - lang: se
              text: ["Satosa", "SP-SE"]
            - lang: en
              text: ["Satosa", "SP-EN"]
          logo:
            text: "http://sp.logo.url/"
            width: "100"
            height: "100"
        authn_requests_signed: true
        want_response_signed: true
        allow_unsolicited: true
        endpoints:
          assertion_consumer_service:
          - [<base_url>/<name>/acs/post, 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST']
          discovery_response:
          - [<base_url>/<name>/disco, 'urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol']
        name_id_format: 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient'
        # A name_id_format of 'None' will cause the authentication request to not
        # include a Format attribute in the NameIDPolicy.
        # name_id_format: 'None'
        name_id_format_allow_create: true
  # disco_srv must be defined if there is more than one IdP in the metadata specified above
  disco_srv: http://disco.example.com