Name | Cardinality | Description |
|---|
<TLSTrustEngine> | 0 or 1 | A custom TrustEngine used to evaluate TLS server certificates. This element conflicts with and is overridden by the httpClientSecurityParametersRef attribute. It contains a single <security:TrustEngine> element. | <MetadataQueryProtocol> |
0 or 1 | Constructs the metadata request URL based on the requirements of the Metadata Query Protocol | <Template> | Constructs the metadata request URL by means of a simple transform based on substitution | <Regex> | Constructs the metadata request URL by means of a complex transform based on a regular expression |
At most one of the <MetadataQueryProtocol>, <Template>, or <Regex> child elements is allowed. If none are configured, the provider constructs the metadata request URL directly from the entityID. This corresponds to the "well-known location" mechanism defined in the SAML 2.0 Metadata specification, section 4.1. | Warning |
|---|
If you forget to configure a child element, the provider will default to the well-known location strategy. This constrains the entityID to be an URL (not an URN) but the provider does not check the URL scheme. If the scheme on the entityID is "http:", the metadata exchange will be vulnerable to a man-in-the-middle attack. For this reason, the well-known location strategy should be avoided in most cases. |
If the <MetadataQueryProtocol> child element is used, the metadata request URL is constructed according to the SAML Profile for the Metadata Query Protocol, which itself is based on the Metadata Query Protocol specification. The content of the <MetadataQueryProtocol> child element will be used as the "Base URL" defined in that specification. The <MetadataQueryProtocol> child element has the following optional attribute: Name | Type | Description |
|---|
transformRef | Bean ID | A reference to a transform function for the entityID. If used, the child element must be empty. |
If the <Template> child element is used, the metadata request URL is constructed by means of a simple transform. Specifically, the value of the entityID is substituted into the template parameter "${entityID}".
The <Template> child element has the following attributes: Name | Type | Default | Description |
|---|
encodingStyle | "none", "form", "path", or "fragment" | "form" | Determines whether and how the entityID value will be URL encoded prior to replacement. Allowed values are: "none" : No encoding is performed. "form" : Encoded using URL form parameter encoding (for query parameters). "path" : Encoded using URL path encoding. "fragment" : Encoded using URL fragment encoding.
The precise definition of these terms is defined in the documentation for the methods of the Guava library's UrlEscapers class. | transformRef | Bean ID |
| A reference to a transform function for the entityID. If used, the child element must be empty. | velocityEngine | Bean ID | shibboleth.VelocityEngine | Bean ID of a custom VelocityEngine to use, generally unneeded |
If the <Regex> child element is used, the metadata request URL is constructed by means of a regular expression transform. The entityID value is first matched against the regular expression contained in the <Regex> element's match attribute. Then, the <Regex> element's content is treated as a replacement expression to run based on the results of the match. The <Regex> child element has the following required attribute: Name | Type | Req? | Description |
|---|
match | String | Y | A regular expression against which the entityID is evaluated |
Note that only numeric/positional group references (e.g., $1) are supported. |