# Load any additional property resources from a comma-delimited list
idp.additionalProperties = /conf/ldap.properties, /conf/saml-nameid.properties, /conf/services.properties

# Set the entityID of the IdP
idp.entityID = https://idp.example.org

# Set the scope used in the attribute resolver for scoped attributes 
idp.scope = example.org

# General cookie properties (maxAge only applies to persistent cookies)
#idp.cookie.secure = false
#idp.cookie.httpOnly = true
#idp.cookie.domain =
#idp.cookie.path =
#idp.cookie.maxAge = 31536000

# Set the location of Velocity view templates
#idp.views = %{idp.home}/views

# Settings for internal AES encryption key
#idp.sealer.storeType = JCEKS
#idp.sealer.updateInterval = PT15M
#idp.sealer.aliasBase = secret
idp.sealer.storeResource = %{idp.home}/credentials/sealer.jks
idp.sealer.versionResource = %{idp.home}/credentials/sealer.kver
idp.sealer.storePassword = password
idp.sealer.keyPassword = password

# Settings for public/private signing and encryption key(s)
# During decryption key rollover, point the ".2" properties at a second
# keypair, uncomment in credentials.xml, then publish it in your metadata.
idp.signing.key = %{idp.home}/credentials/idp-signing.key
idp.signing.cert = %{idp.home}/credentials/idp-signing.crt
idp.encryption.key = %{idp.home}/credentials/idp-encryption.key
idp.encryption.cert = %{idp.home}/credentials/idp-encryption.crt
#idp.encryption.key.2 = %{idp.home}/credentials/idp-encryption-old.key
#idp.encryption.cert.2 = %{idp.home}/credentials/idp-encryption-old.crt

# Sets the bean ID to use as a default security configuration set
#idp.security.config = shibboleth.DefaultSecurityConfiguration

# To default to SHA-1, set to shibboleth.SigningConfiguration.SHA1
#idp.signing.config = shibboleth.SigningConfiguration.SHA256

# Configures trust evaluation of keys used by services at runtime
# Defaults to supporting both explicit key and PKIX using SAML metadata.
#idp.trust.signatures = shibboleth.ChainingSignatureTrustEngine
# To pick only one set to one of:
#   shibboleth.ExplicitKeySignatureTrustEngine, shibboleth.PKIXSignatureTrustEngine
#idp.trust.certificates = shibboleth.ChainingX509TrustEngine
# To pick only one set to one of:
#   shibboleth.ExplicitKeyX509TrustEngine, shibboleth.PKIXX509TrustEngine

# If true, encryption will happen whenever a key to use can be located, but
# failure to encrypt won't result in request failure.
#idp.encryption.optional = false

# Configures the primary server-side storage plugin
#idp.storage.StorageService = org.opensaml.storage.impl.MemoryStorageService
#idp.storage.cleanupInterval = PT10M

# Set to true to expose more detailed errors in responses to SPs
#idp.errors.detailed = false

# Set to false to skip signing of SAML response messages that signal errors
#idp.errors.signed = true

# Set if a different default view name for events and exceptions is needed
#idp.errors.defaultView = error

# Set to false to disable the IdP session layer
#idp.session.enabled = true

# Set to "shibboleth.StorageService" for server-side storage of user sessions
#idp.session.StorageService = shibboleth.ClientSessionStorageService

# Size of session IDs
#idp.session.idSize = 32
# Bind sessions to IP addresses
#idp.session.consistentAddress = true
# Inactivity timeout
#idp.session.timeout = PT60M
# Extra time to store sessions for logout
#idp.session.slop = 0
# Tolerate storage-related errors
#idp.session.maskStorageFailure = false
# Track information about SPs logged into
#idp.session.trackSPSessions = false
# Support lookup by SP for SAML logout
#idp.session.secondaryServiceIndex = false
# Length of time to track SP sessions
#idp.session.defaultSPlifetime = PT2H

# Regular expression matching login flows to enable, e.g. IPAddress|Password
idp.authn.flows = Password

# Regular expression of forced "initial" methods when no session exists,
# usually in conjunction with the idp.authn.resolveAttribute property below.
#idp.authn.flows.initial = Password

# Set to an attribute ID to resolve prior to selecting authentication flows;
# its values are used to filter the flows to allow.
#idp.authn.resolveAttribute = eduPersonAssurance

# Default lifetime and timeout of various authentication methods
#idp.authn.defaultLifetime = PT60M
#idp.authn.defaultTimeout = PT30M

# Whether to prioritize "active" results when an SP requests more than
# one possible matching login method (V2 behavior was to favor them)
#idp.authn.favorSSO = true

# Whether to fail requests when a user identity after authentication
# doesn't match the identity in a pre-existing session.
#idp.authn.identitySwitchIsError = false

# Set to "shibboleth.StorageService" or custom bean for alternate storage of consent
#idp.consent.StorageService = shibboleth.ClientPersistentStorageService

# Set to "shibboleth.consent.AttributeConsentStorageKey" to use an attribute
# to key user consent storage records (and set the attribute name)
#idp.consent.userStorageKey = shibboleth.consent.PrincipalConsentStorageKey
#idp.consent.userStorageKeyAttribute = uid

# Flags controlling how built-in attribute consent feature operates 
#idp.consent.allowDoNotRemember = true
#idp.consent.allowGlobal = true
#idp.consent.allowPerAttribute = false

# Whether attribute values and terms of use text are compared
#idp.consent.compareValues = false
# Maximum number of consent storage records
# Set to -1 for unlimited server-side storage
#idp.consent.maxStoredRecords = 10

# Time in milliseconds to expire consent storage records.
#idp.consent.storageRecordLifetime = P1Y

# Whether to lookup metadata, etc. for every SP involved in a logout
# for use by user interface logic; adds overhead so off by default.
#idp.logout.elaboration = false

# Message freshness and replay cache tuning
#idp.policy.messageLifetime = PT3M
#idp.policy.clockSkew = PT3M

# Set to custom bean for alternate storage of replay cache
#idp.replayCache.StorageService = shibboleth.StorageService

# Suppresses typical signing/encryption when artifact binding used
#idp.artifact.secureChannel = true

# May differ to direct SAML 2 artifact lookups to specific server nodes
#idp.artifact.endpointIndex = 2

# Set to custom bean for alternate storage of artifact map state
#idp.artifact.StorageService = shibboleth.StorageService

# Name of access control policy for various admin flows
idp.status.accessPolicy = AccessByIPAddress
idp.resolvertest.accessPolicy = AccessByIPAddress
idp.reload.accessPolicy = AccessByIPAddress

# Comma-delimited languages to use if not match can be found with the
# browser-supported languages, defaults to an empty list.
idp.ui.fallbackLanguages=en,fr,de