{"type":"doc","content":[{"type":"paragraph","content":[{"text":"File(s):","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"conf/credentials.xml, conf/relying-party.xml, conf/idp.properties","type":"text","marks":[{"type":"em"}]},{"type":"hardBreak"},{"text":"Format:","type":"text","marks":[{"type":"strong"}]},{"text":" Native Spring, Property files.","type":"text"}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{"maxLevel":{"value":"2"}},"macroMetadata":{"macroId":{"value":"bf5c39e5-bcb3-4ae9-a37e-dbaa7c8a00b6"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"36d6889b-b4b4-421c-a938-183bfd37063e"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"Overview","type":"text"}]},{"type":"paragraph","content":[{"text":"There are multiple aspects of configuration that fall under the heading of security:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"credentials (keys and certificates)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"configuration and control of algorithms to use for signing or encryption (as well as verifying signatures and decryption)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"\"TrustEngines\" used to evalate signatures and certificates during message processing","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"other steps that run during profile execution to evaluate messages","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"All of these settings are associated with profile or relying party behavior, so most of them are configured as part of the more general ","type":"text"},{"text":"RelyingPartyConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199508044"}}]},{"text":" service, and as such are reloaded when that service is reloaded.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"General Topics","type":"text"}]},{"type":"expand","attrs":{"title":"Credentials"},"content":[{"type":"paragraph","content":[{"text":"In most cases, it's not necessary to modify your credential configuration except to ensure the ","type":"text"},{"text":"idp.properties","type":"text","marks":[{"type":"em"}]},{"text":" settings that identify keys and certificates are set correctly, which is true after an installation when using the automatically generated credentials. The actual beans that load these files are in ","type":"text"},{"text":"credentials.xml","type":"text","marks":[{"type":"em"}]},{"text":" and have the following required names:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.DefaultSigningCredential","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.DefaultClientTLSCredential","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.DefaultEncryptionCredentials","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"paragraph","content":[{"text":"The first two are instances of the ","type":"text"},{"text":"Credential","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.security.credential.Credential"}}]},{"text":" class and specify the default keypair to use for signing and client TLS respectively. Client TLS isn't common, but may occur in rare instances such as inbound HTTP-Artifact binding messages or in future features such as outbound SOAP logout messages.","type":"text"}]},{"type":"paragraph","content":[{"text":"The third is a list that contains one or more instances of that same class, used for encryption (actually for decryption; this is the public key used to encrypt data for the IdP and the private key to decrypt it with).","type":"text"}]},{"type":"paragraph","content":[{"text":"If all you need is a single keypair for each function, then nothing needs to be done to this file. This is the strongly recommended approach. If you need to create additional signing credentials to use as overrides to behavior for specific relying parties, you may want to copy the existing bean and assign it a different id to refer to later (see below under Signing and Encryption).","type":"text"}]},{"type":"paragraph","content":[{"text":"In the event that you want to perform a controlled rollover of an encryption keypair, that involves the configuration of multiple keypairs (old and new) into the IdP, and this is accomodated with pre-existing definitions you can use by uncommenting the second keypair bean in the list and setting a second set of properties to point to the keypair. Support for decrypting with either key will be handled automatically when both are configured.","type":"text"}]},{"type":"paragraph","content":[{"text":"Mechanisms exist for defining advanced Credentials and are discussed ","type":"text"},{"text":"here","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199508888"}}]},{"text":".","type":"text"}]}]},{"type":"expand","attrs":{"title":"Signing and Encryption"},"content":[{"type":"heading","attrs":{"level":3},"content":[{"text":"Enablement","type":"text"}]},{"type":"paragraph","content":[{"text":"For most situations, the default behavior of each ProfileConfiguration is appropriate when it comes to what to sign or encrypt. A common use case for creating overrides for particular relying parties is to either turn off XML Encryption, or possibly alter which part of a SAML message is to be signed. This is controlled with a set of properties on all ","type":"text"},{"text":"SAMLProfileConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.saml.profile.config.SAMLProfileConfiguration"}}]},{"text":" and ","type":"text"},{"text":"SAML2ProfileConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.saml.profile.config.SAMLProfileConfiguration"}}]},{"text":" objects, each of which is a condition that evaluates to true or false to determine what to sign or encrypt.","type":"text"}]},{"type":"paragraph","content":[{"text":"In most cases, you can set the properties to \"true\" or \"false\" to turn them on or off. An example follows:","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Per-Profile Signing or Encryption Options","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n\n\n \n \n \n \n \n","type":"text"}]},{"type":"paragraph","content":[{"text":"For more advanced scenarios, you can configure an arbitrary condition function to control the decision. Most commonly this would be used in conjunction with a built-in condition that works by deciding whether to sign or encrypt based on the security of the underlying communication channel. This isn't typically needed, but an example follows:","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Conditional Signing or Encryption","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n\n\n\n\n\n \n \n \n \n \n","type":"text"}]},{"type":"paragraph","content":[{"text":"Finally, a new feature exists to do encryption \"opportunistically\", that is, to encrypt whenever possible (meaning a compatible key is found in the peer's metadata to encrypt with) but to skip encryption otherwise. For those wishing to avoid having to constantly adapt their system to deal with new services that don't support encryption, this is an option you can use, understanding that this means a loss of explicit control over whether XML Encryption takes place. This feature is enabled with the ","type":"text"},{"text":"idp.encryption.optional","type":"text","marks":[{"type":"strong"}]},{"text":" property.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Configuration","type":"text"}]},{"type":"paragraph","content":[{"text":"There are several levels of ","type":"text"},{"text":"SecurityConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.security.config.SecurityConfiguration"}}]},{"text":" objects to control the signing, validation, encryption, and decryption processes. These configurations include things like the keypairs to use, preferred/default algorithms, and algorithm allow or deny lists to enforce. The configurations can be derived from the underlying library defaults, a global IdP default, or a per-profile override.","type":"text"}]},{"type":"paragraph","content":[{"text":"In most cases you will leave the defaults in place, or very occasionally define a special configuration to use for specific profiles and/or relying parties.","type":"text"}]},{"type":"paragraph","content":[{"text":"The default objects that make up these configurations are defined in a ","type":"text"},{"text":"system file","type":"text","marks":[{"type":"link","attrs":{"href":"https://git.shibboleth.net/view/?p=java-identity-provider.git;a=blob;f=idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-system.xml;h=2303977412bc64d90a57a9dd4f43b83b78b7e4b5;hb=HEAD"}}]},{"text":" and are defined to match the defaults in the OpenSAML libraries. You can't modify these beans, but they do document the full range of wiring up of settings that's possible. You can inherit from some of them in order to override specific bits and leave the other defaults in place, which is simpler than creating an entire ","type":"text"},{"text":"SecurityConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.security.config.SecurityConfiguration"}}]},{"text":" object from scratch.","type":"text"}]},{"type":"paragraph","content":[{"text":"You can override the default bean name that is used as a global default by setting the ","type":"text"},{"text":"idp.security.config","type":"text","marks":[{"type":"strong"}]},{"text":" property. That effectively ignores the system-defined objects in favor of something else. You can also override this on a per-profile, per-relying-party basis by adding a ","type":"text"},{"text":"p:securityConfiguration-ref","type":"text","marks":[{"type":"code"}]},{"text":" attribute to a profile bean.","type":"text"}]},{"type":"paragraph","content":[{"text":"The (formerly common) case of controlling the use of SHA-1 and SHA-256 digest algorithms while signing is simplified because we have predefined beans that toggle between those two algorithms at a global level, with a property to switch between them (","type":"text"},{"text":"idp.signing.config","type":"text","marks":[{"type":"strong"}]},{"text":").","type":"text"}]},{"type":"paragraph","content":[{"text":"Similarly, there are predefined beans for toggling between two data encryption families, AES-CBC and AES-GCM. The former is widespread and well-supported, and vulnerable to attacks that can reveal the data. The latter is not widely supported but is the only practical algorithm that remains secure. A new property will switch between them globally (","type":"text"},{"text":"idp.encryption.config","type":"text","marks":[{"type":"strong"}]},{"text":") but in practice that won't work all that well because so many SPs will not support GCM (though that should be considered non-compliant with any modern support for the standard).","type":"text"}]},{"type":"paragraph","content":[{"text":"The following is an example to follow if you need to specify the use of SHA-1 instead of SHA-256 for a specific relying party.","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Per-Profile Signing Algorithm","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n\n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n","type":"text"}]},{"type":"paragraph","content":[{"text":"Similarly, you can do the same with encryption for GCM:","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Per-Profile Encryption Algorithm","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n\n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n","type":"text"}]},{"type":"paragraph","content":[{"text":"A more advanced case: to specify a custom keypair for signing for a particular relying party, you might create a bean in ","type":"text"},{"text":"credentials.xml","type":"text","marks":[{"type":"em"}]},{"text":" called \"ObnoxiousVendorCredential\", and then do the following (there are many ways to lay things out, this is just an example of what's possible):","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Per-Profile Credential","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n\n\n\t\n\t\t\n\t\n\n\n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n","type":"text"}]},{"type":"paragraph","content":[{"text":"Typically you want to think about what you need to customize, and then consolidate definitions of beans as much as possible to simplify the XML.","type":"text"}]}]},{"type":"expand","attrs":{"title":"Trust Engines"},"content":[{"type":"paragraph","content":[{"text":"TrustEngines are a type of object used to evaluate signatures and TLS certificates and make up the security backbone of the IdP. This defaults to a \"chain\" of two strategies:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"looking for a matching public key inside SAML metadata corresponding to a message issuer","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"verifying a certificate indirectly by performing PKIX path validation, generally against trust rules supplied in SAML metadata extensions defined by the Shibboleth Project many years ago","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"The recommended approach is the first one. The second is provided solely for compatibility and while it is used by some deployers, we expect to eventually disable it by default in a future release. It is not deprecated, but it is not a recommended choice.","type":"text"}]},{"type":"paragraph","content":[{"text":"In the event that you wish to replace the \"chain\" with a reference to one of the TrustEngines alone, you can set one or both of the ","type":"text"},{"text":"idp.trust.signatures","type":"text","marks":[{"type":"strong"}]},{"text":" and ","type":"text"},{"text":"idp.trust.certificates","type":"text","marks":[{"type":"strong"}]},{"text":" properties in ","type":"text"},{"text":"idp.properties","type":"text","marks":[{"type":"em"}]},{"text":" to appropriate bean names (noted below and in the property file's comments).","type":"text"}]}]},{"type":"expand","attrs":{"title":"Security Rules"},"content":[{"type":"paragraph","content":[{"text":"The last area of security configuration involves the steps to follow after a message is received to check the content and perform steps like replay detection, freshness detection, signature checking, evaluation of client certificate authentication for server to server communication, etc. This is also where profiles that require authentication of the request, such as Attribute Queries, enforce that requirement.","type":"text"}]},{"type":"paragraph","content":[{"text":"Internally, these rules are run as part of something called the inboundInterceptorFlows collection, which is a list of \"interceptor\" webflows to run before accepting a request for further processing. While this is in principle an extensible feature, in most cases you don't need to even think about this mechanism, and it's configured for you for all the built-in profile beans to do the \"right\" thing, provided you inherit any custom profile beans you want to use for overrides from the built-in beans listed in the ","type":"text"},{"text":"RelyingPartyConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199508044"}}]},{"text":" (e.g., \"Shibboleth.SSO\", \"SAML2.AttributeQuery\").","type":"text"}]},{"type":"paragraph","content":[{"text":"Normally you need never customize these flows directly, other than via a few properties defined for that purpose, such as ","type":"text"},{"text":"idp.policy.messageLifetime.","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Reference","type":"text"}]},{"type":"expand","attrs":{"title":"Properties"},"content":[{"type":"paragraph","content":[{"text":"Properties defined in ","type":"text"},{"text":"idp.properties","type":"text","marks":[{"type":"em"}]},{"text":" directly related to this configuration area follow:","type":"text"}]},{"type":"table","attrs":{"layout":"full-width","localId":"9712ce7f-066b-4e6b-a5fd-74aab2490ba0"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[208.0]},"content":[{"type":"paragraph","content":[{"text":"Property / Type / Default","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[209.0]},"content":[{"type":"paragraph","content":[{"text":"Default","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[313.0]},"content":[{"type":"paragraph","content":[{"text":"Function","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[208.0]},"content":[{"type":"paragraph","content":[{"text":"idp.cookie.secure","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[209.0]},"content":[{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[313.0]},"content":[{"type":"paragraph","content":[{"text":"If true, all cookies issued by the IdP (not including the container) will be limited to TLS","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[208.0]},"content":[{"type":"paragraph","content":[{"text":"idp.cookie.httpOnly","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[209.0]},"content":[{"type":"paragraph","content":[{"text":"true","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[313.0]},"content":[{"type":"paragraph","content":[{"text":"If true, all cookies issued by the IdP (not including the container) will contain the HttpOnly property","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[208.0]},"content":[{"type":"paragraph","content":[{"text":"idp.cookie.domain","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[209.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[313.0]},"content":[{"type":"paragraph","content":[{"text":"Overrides the domain of any cookies issued by the IdP, not including the container","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[208.0]},"content":[{"type":"paragraph","content":[{"text":"idp.cookie.path","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[209.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[313.0]},"content":[{"type":"paragraph","content":[{"text":"Overrides the path of any cookies issued by the IdP, not including the container","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[208.0]},"content":[{"type":"paragraph","content":[{"text":"idp.cookie.maxAge","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Integer","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[209.0]},"content":[{"type":"paragraph","content":[{"text":"31536000 (1 year)","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[313.0]},"content":[{"type":"paragraph","content":[{"text":"Lifetime in seconds of cookies issued by the IdP that are meant to span sessions (365 days)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[208.0]},"content":[{"type":"paragraph","content":[{"text":"idp.cookie.sameSite","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"\"Null\", \"None\", \"Lax\", or \"Strict\"","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[209.0]},"content":[{"type":"paragraph","content":[{"text":"\"None\"","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[313.0]},"content":[{"type":"paragraph","content":[{"text":"Default SameSite value to apply to cookies via servlet filter if no explicit rule for the named cookie is specified","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[208.0]},"content":[{"type":"paragraph","content":[{"text":"idp.cookie.sameSiteCondition","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Bean ID of ","type":"text"},{"text":"Predicate","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.function.Predicate"}}]},{"text":"<","type":"text"},{"text":"ServletRequest","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-ee.cgi/jakarta.servlet.ServletRequest"}}]},{"text":">","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[209.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.Conditions.FALSE","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[313.0]},"content":[{"type":"paragraph","content":[{"text":"Predicate","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.function.Predicate"}}]},{"text":"<","type":"text"},{"text":"ServletRequest","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-ee.cgi/jakarta.servlet.ServletRequest"}}]},{"text":"> condition bean controlling whether SameSite filter runs","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[208.0]},"content":[{"type":"paragraph","content":[{"text":"idp.sealer.keyStrategy","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Bean ID of ","type":"text"},{"text":"DataSealerKeyStrategy","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-shared.cgi/net.shibboleth.shared.security.DataSealerKeyStrategy"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[209.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.DataSealerKeyStrategy","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[313.0]},"content":[{"type":"paragraph","content":[{"text":"Bean ID supporting the ","type":"text"},{"text":"DataSealerKeyStrategy","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-shared.cgi/net.shibboleth.shared.security.DataSealerKeyStrategy"}}]},{"text":" interface to use in place of the built-in option.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[208.0]},"content":[{"type":"paragraph","content":[{"text":"idp.sealer.storeType","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[209.0]},"content":[{"type":"paragraph","content":[{"text":"\"JCEKS\"","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[313.0]},"content":[{"type":"paragraph","content":[{"text":"Type of Java keystore used for IdP's internal AES encryption key","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[208.0]},"content":[{"type":"paragraph","content":[{"text":"idp.sealer.updateInterval","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Duration","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[209.0]},"content":[{"type":"paragraph","content":[{"text":"PT15M","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[313.0]},"content":[{"type":"paragraph","content":[{"text":"Time between checks for a new AES key version","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[208.0]},"content":[{"type":"paragraph","content":[{"text":"idp.sealer.aliasBase","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[209.0]},"content":[{"type":"paragraph","content":[{"text":"\"secret\"","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[313.0]},"content":[{"type":"paragraph","content":[{"text":"Case insensitive name of keystore alias prefix used in AES keystore (the entries will be suffixed by the key version number)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[208.0]},"content":[{"type":"paragraph","content":[{"text":"idp.sealer.storeResource","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Resource path","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[209.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[313.0]},"content":[{"type":"paragraph","content":[{"text":"Keystore resource containing AES encryption key, usually a file path","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[208.0]},"content":[{"type":"paragraph","content":[{"text":"idp.sealer.versionResource","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Resource path","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[209.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[313.0]},"content":[{"type":"paragraph","content":[{"text":"Resource that tracks the \"active\" AES encryption key version, usually a file path","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[208.0]},"content":[{"type":"paragraph","content":[{"text":"idp.sealer.storePassword","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[209.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[313.0]},"content":[{"type":"paragraph","content":[{"text":"Keystore password unlocking AES encryption keystore, typically set during installation","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[208.0]},"content":[{"type":"paragraph","content":[{"text":"idp.sealer.keyPassword","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[209.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[313.0]},"content":[{"type":"paragraph","content":[{"text":"Key password unlocking AES encryption key, typically set to the same as the previous property and set during installation","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[208.0]},"content":[{"type":"paragraph","content":[{"text":"idp.signing.key","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Resource path","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[209.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[313.0]},"content":[{"type":"paragraph","content":[{"text":"Resource containing private key for signing, typically a file in the ","type":"text"},{"text":"credentials","type":"text","marks":[{"type":"strong"}]},{"text":" directory","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[208.0]},"content":[{"type":"paragraph","content":[{"text":"idp.signing.cert","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Resource path","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[209.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[313.0]},"content":[{"type":"paragraph","content":[{"text":"Resource containing the public key certificate inserted into signed messages, typically a file in the ","type":"text"},{"text":"credentials","type":"text","marks":[{"type":"strong"}]},{"text":" directory","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[208.0]},"content":[{"type":"paragraph","content":[{"text":"idp.encryption.key","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Resource path","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[209.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[313.0]},"content":[{"type":"paragraph","content":[{"text":"Resource containing a private key for decryption, typically a file in the ","type":"text"},{"text":"credentials","type":"text","marks":[{"type":"strong"}]},{"text":" directory","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[208.0]},"content":[{"type":"paragraph","content":[{"text":"idp.encryption.cert","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Resource path","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[209.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[313.0]},"content":[{"type":"paragraph","content":[{"text":"Resource containing a public key certificate given to others needing to encrypt data for the IdP, typically a file in the ","type":"text"},{"text":"credentials","type":"text","marks":[{"type":"strong"}]},{"text":" directory","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[208.0]},"content":[{"type":"paragraph","content":[{"text":"idp.encryption.key.2","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Resource path","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[209.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[313.0]},"content":[{"type":"paragraph","content":[{"text":"Resource containing an alternate private key for decryption, generally unused except while changing decryption keys","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[208.0]},"content":[{"type":"paragraph","content":[{"text":"idp.encryption.cert.2","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Resource path","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[209.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[313.0]},"content":[{"type":"paragraph","content":[{"text":"Resource containing an alternate public key certificate, generally unused except while changing decryption keys","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[208.0]},"content":[{"type":"paragraph","content":[{"text":"idp.security.config","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Bean ID of ","type":"text"},{"text":"SecurityConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.security.config.SecurityConfiguration"}}]},{"text":" ","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.profile.config.SecurityConfiguration"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[209.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.DefaultSecurityConfiguration","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[313.0]},"content":[{"type":"paragraph","content":[{"text":"Name of Spring bean supplying the default ","type":"text"},{"text":"SecurityConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.security.config.SecurityConfiguration"}}]},{"text":" ","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.profile.config.SecurityConfiguration"}}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[208.0]},"content":[{"type":"paragraph","content":[{"text":"idp.signing.config","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Bean ID of ","type":"text"},{"text":"SignatureSigningConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.xmlsec.SignatureSigningConfiguration"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[209.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.SigningConfiguration.SHA256","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[313.0]},"content":[{"type":"paragraph","content":[{"text":"Name of Spring bean supplying the default ","type":"text"},{"text":"SignatureSigningConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.xmlsec.SignatureSigningConfiguration"}}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[208.0]},"content":[{"type":"paragraph","content":[{"text":"idp.encryption.config","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Bean ID of ","type":"text"},{"text":"EncryptionConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.xmlsec.EncryptionConfiguration"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[209.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.EncryptionConfiguration.CBC","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[313.0]},"content":[{"type":"paragraph","content":[{"text":"Name of Spring bean supplying the default ","type":"text"},{"text":"EncryptionConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.xmlsec.EncryptionConfiguration"}}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[208.0]},"content":[{"type":"paragraph","content":[{"text":"idp.trust.signatures","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Bean ID of ","type":"text"},{"text":"SignatureTrustEngine","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.xmlsec.signature.support.SignatureTrustEngine"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[209.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.ChainingSignatureTrustEngine","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[313.0]},"content":[{"type":"paragraph","content":[{"text":"Name of Spring bean for the trust engine used to verify signatures","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[208.0]},"content":[{"type":"paragraph","content":[{"text":"idp.trust.certificates","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Bean ID of ","type":"text"},{"text":"TrustEngine","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.security.trust.TrustEngine"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[209.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.ChainingX509TrustEngine","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[313.0]},"content":[{"type":"paragraph","content":[{"text":"Name of Spring bean for the trust engine used to verify TLS certificates","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[208.0]},"content":[{"type":"paragraph","content":[{"text":"idp.encryption.optional","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[209.0]},"content":[{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[313.0]},"content":[{"type":"paragraph","content":[{"text":"If true, failure to locate an encryption key to use, when enabled, won't result in request failure","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[208.0]},"content":[{"type":"paragraph","content":[{"text":"idp.errors.detailed","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[209.0]},"content":[{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[313.0]},"content":[{"type":"paragraph","content":[{"text":"If true, more detailed error information may be returned in profile responses, which could leak useful information in rare cases","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[208.0]},"content":[{"type":"paragraph","content":[{"text":"idp.errors.signed","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[209.0]},"content":[{"type":"paragraph","content":[{"text":"true","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[313.0]},"content":[{"type":"paragraph","content":[{"text":"When message signing is enabled, controls whether to sign responses that signal errors as opposed to successful outcomes","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[208.0]},"content":[{"type":"paragraph","content":[{"text":"idp.policy.messageLifetime","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Duration","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[209.0]},"content":[{"type":"paragraph","content":[{"text":"PT3M","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[313.0]},"content":[{"type":"paragraph","content":[{"text":"Default freshness window for accepting timestamped messages","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[208.0]},"content":[{"type":"paragraph","content":[{"text":"idp.policy.assertionLifetime","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Duration","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[209.0]},"content":[{"type":"paragraph","content":[{"text":"PT3M","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[313.0]},"content":[{"type":"paragraph","content":[{"text":"Default freshness window for accepting timestamped assertions","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[208.0]},"content":[{"type":"paragraph","content":[{"text":"idp.policy.clockSkew","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Duration","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[209.0]},"content":[{"type":"paragraph","content":[{"text":"PT3M","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[313.0]},"content":[{"type":"paragraph","content":[{"text":"Default allowance for clock differences between systems","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[208.0]},"content":[{"type":"paragraph","content":[{"text":"idp.artifact.secureChannel","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[209.0]},"content":[{"type":"paragraph","content":[{"text":"true","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[313.0]},"content":[{"type":"paragraph","content":[{"text":"If true, skips signing/encryption when the message will be passed by reference (via artifact in SAML terms)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[208.0]},"content":[{"type":"paragraph","content":[{"text":"idp.security.basicKeyInfoFactory","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Bean ID of ","type":"text"},{"text":"KeyInfoGeneratorManager","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.xmlsec.keyinfo.KeyInfoGeneratorManager"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[209.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.BasicKeyInfoGeneratorFactory","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[313.0]},"content":[{"type":"paragraph","content":[{"text":"Overrides the ","type":"text"},{"text":"BasicKeyInfoGeneratorFactory","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.xmlsec.keyinfo.impl.BasicKeyInfoGeneratorFactory"}}]},{"text":" used by default","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[208.0]},"content":[{"type":"paragraph","content":[{"text":"idp.security.x509KeyInfoFactory","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Bean ID of ","type":"text"},{"text":"KeyInfoGeneratorManager","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.xmlsec.keyinfo.KeyInfoGeneratorManager"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[209.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.X509KeyInfoGeneratorFactory","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[313.0]},"content":[{"type":"paragraph","content":[{"text":"Overrides the ","type":"text"},{"text":"X509KeyInfoGeneratorFactory","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.xmlsec.keyinfo.impl.X509KeyInfoGeneratorFactory"}}]},{"text":" used by default","type":"text"}]}]}]}]}]},{"type":"expand","attrs":{"title":"Beans"},"content":[{"type":"paragraph","content":[{"text":"These beans are typically defined internally in various system files for use, or are defined in ","type":"text"},{"text":"conf/credentials.xml","type":"text","marks":[{"type":"em"}]},{"text":" or ","type":"text"},{"text":"conf/relying-party.xml","type":"text","marks":[{"type":"em"}]},{"text":":","type":"text"}]},{"type":"table","attrs":{"layout":"full-width","localId":"625beb0f-9caf-4f19-a16b-5951170911a1"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[238.0]},"content":[{"type":"paragraph","content":[{"text":"Name","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[193.0]},"content":[{"type":"paragraph","content":[{"text":"Type","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[299.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[238.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.BasicX509CredentialFactoryBean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[193.0]},"content":[{"type":"paragraph","content":[{"text":"BasicX509CredentialFactoryBean","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.spring.credential.BasicX509CredentialFactoryBean"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[299.0]},"content":[{"type":"paragraph","content":[{"text":"Parent bean used for defining an X.509 keypair via external resources (this is the most common way)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[238.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.X509InlineCredentialFactoryBean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[193.0]},"content":[{"type":"paragraph","content":[{"text":"X509InlineCredentialFactoryBean","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.spring.credential.X509InlineCredentialFactoryBean"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[299.0]},"content":[{"type":"paragraph","content":[{"text":"Parent bean used for defining an X.509 credential via inline data","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[238.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.BasicResourceCredentialFactoryBean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[193.0]},"content":[{"type":"paragraph","content":[{"text":"BasicResourceCredentialFactoryBean","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.spring.credential.BasicResourceCredentialFactoryBean"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[299.0]},"content":[{"type":"paragraph","content":[{"text":"Parent bean used for defining a basic public/private or secret credential via external resources","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[238.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.BasicInlineCredentialFactoryBean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[193.0]},"content":[{"type":"paragraph","content":[{"text":"BasicInlineCredentialFactoryBean","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.spring.credential.BasicInlineCredentialFactoryBean"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[299.0]},"content":[{"type":"paragraph","content":[{"text":"Parent bean used for defining a basic public/private or secret credential via inline data","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[238.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.DefaultSigningCredential","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[193.0]},"content":[{"type":"paragraph","content":[{"text":"Credential","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.security.credential.Credential"}}]},{"text":" ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[299.0]},"content":[{"type":"paragraph","content":[{"text":"Keypair used for signing, usually including a certificate","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[238.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.DefaultClientTLSCredential","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[193.0]},"content":[{"type":"paragraph","content":[{"text":"Credential","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/pages/resumedraft.action?draftId=1265631697"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[299.0]},"content":[{"type":"paragraph","content":[{"text":"Keypair used for client TLS, including a certificate","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[238.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.DefaultEncryptionCredentials","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[193.0]},"content":[{"type":"paragraph","content":[{"text":"List","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.List"}}]},{"text":"<","type":"text"},{"text":"Credential","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.security.credential.Credential"}}]},{"text":">","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[299.0]},"content":[{"type":"paragraph","content":[{"text":"Collection of keypairs used to decrypt data sent by others (technically only the private key matters here)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[238.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.DefaultSecurityConfiguration","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[193.0]},"content":[{"type":"paragraph","content":[{"text":"SecurityConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.security.config.SecurityConfiguration"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[299.0]},"content":[{"type":"paragraph","content":[{"text":"Default security configuration used by all profile beans","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[238.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.SecurityConfiguration.SHA256","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[193.0]},"content":[{"type":"paragraph","content":[{"text":"SecurityConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.security.config.SecurityConfiguration"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[299.0]},"content":[{"type":"paragraph","content":[{"text":"Security configuration that directly incorporates the SHA-256 signing configuration","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[238.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.SecurityConfiguration.SHA1","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[193.0]},"content":[{"type":"paragraph","content":[{"text":"SecurityConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.security.config.SecurityConfiguration"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[299.0]},"content":[{"type":"paragraph","content":[{"text":"Security configuration that directly incorporates the SHA-1 signing configuration","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[238.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.SecurityConfiguration.CBC","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[193.0]},"content":[{"type":"paragraph","content":[{"text":"SecurityConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.security.config.SecurityConfiguration"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[299.0]},"content":[{"type":"paragraph","content":[{"text":"Security configuration that directly incorporates the AES-CBC encryption configuration","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[238.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.SecurityConfiguration.GCM","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[193.0]},"content":[{"type":"paragraph","content":[{"text":"SecurityConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.security.config.SecurityConfiguration"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[299.0]},"content":[{"type":"paragraph","content":[{"text":"Security configuration that directly incorporates the AES-GCM encryption configuration","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[238.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.SigningConfiguration.SHA256","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[193.0]},"content":[{"type":"paragraph","content":[{"text":"BasicSignatureSigningConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.xmlsec.impl.BasicSignatureSigningConfiguration"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[299.0]},"content":[{"type":"paragraph","content":[{"text":"Signing configuration that uses the SHA-256 digest algorithm","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[238.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.SigningConfiguration.SHA1","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[193.0]},"content":[{"type":"paragraph","content":[{"text":"BasicSignatureSigningConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.xmlsec.impl.BasicSignatureSigningConfiguration"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[299.0]},"content":[{"type":"paragraph","content":[{"text":"Signing configuration that uses the SHA-1 digest algorithm","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[238.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.EncryptionConfiguration.CBC","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[193.0]},"content":[{"type":"paragraph","content":[{"text":"EncryptionConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.xmlsec.EncryptionConfiguration"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[299.0]},"content":[{"type":"paragraph","content":[{"text":"Encryption configuration that uses the AES-CBC encryption algorithm","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[238.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.EncryptionConfiguration.GCM","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[193.0]},"content":[{"type":"paragraph","content":[{"text":"EncryptionConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/pages/resumedraft.action?draftId=1265631697"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[299.0]},"content":[{"type":"paragraph","content":[{"text":"Encryption configuration that uses the AES-GCM encryption algorithm","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[238.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.ExplicitKeySignatureTrustEngine","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[193.0]},"content":[{"type":"paragraph","content":[{"text":"ExplicitKeySignatureTrustEngine","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.xmlsec.signature.support.impl.ExplicitKeySignatureTrustEngine"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[299.0]},"content":[{"type":"paragraph","content":[{"text":"Signature verifier that relies on explicit keys in metadata","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[238.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.PKIXSignatureTrustEngine","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[193.0]},"content":[{"type":"paragraph","content":[{"text":"PKIXSignatureTrustEngine","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.xmlsec.signature.support.impl.PKIXSignatureTrustEngine"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[299.0]},"content":[{"type":"paragraph","content":[{"text":"Signature verifier that validates certificates against PKIX rules in metadata","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[238.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.ChainingSignatureTrustEngine","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[193.0]},"content":[{"type":"paragraph","content":[{"text":"ChainingSignatureTrustEngine","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.xmlsec.signature.support.impl.ChainingSignatureTrustEngine"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[299.0]},"content":[{"type":"paragraph","content":[{"text":"Signature verifier that chains the previous two beans together","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[238.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.ExplicitKeyX509TrustEngine","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[193.0]},"content":[{"type":"paragraph","content":[{"text":"ExplicitKeyTrustEngine","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.security.trust.impl.ExplicitKeyTrustEngine"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[299.0]},"content":[{"type":"paragraph","content":[{"text":"Client certificate verifier that relies on explicit keys in metadata","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[238.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.PKIXX509TrustEngine","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[193.0]},"content":[{"type":"paragraph","content":[{"text":"PKIXX509CredentialTrustEngine","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.security.x509.impl.PKIXX509CredentialTrustEngine"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[299.0]},"content":[{"type":"paragraph","content":[{"text":"Client certificate verifier that validates certificates against PKIX rules in metadata","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[238.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.ChainingX509TrustEngine","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[193.0]},"content":[{"type":"paragraph","content":[{"text":"ChainingTrustEngine","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.security.trust.impl.ChainingTrustEngine"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[299.0]},"content":[{"type":"paragraph","content":[{"text":"Client certificate verifier that chains the previous two beans together","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[238.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.SameSiteCookieMap","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[193.0]},"content":[{"type":"paragraph","content":[{"text":"Map","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.Map"}}]},{"text":"<","type":"text"},{"text":"String","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.lang.String"}}]},{"text":",","type":"text"},{"text":"SameSiteValue","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-shared.cgi/net/shibboleth/shared/spring/servlet/impl/SameSiteCookieHeaderFilter"}}]},{"text":">","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[299.0]},"content":[{"type":"paragraph","content":[{"text":"Map of rules for assigning explicit SameSite values to specific cookies via servlet filter","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[238.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.BasicKeyInfoGeneratorFactory","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[193.0]},"content":[{"type":"paragraph","content":[{"text":"BasicKeyInfoGeneratorFactory","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.xmlsec.keyinfo.impl.BasicKeyInfoGeneratorFactory"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[299.0]},"content":[{"type":"paragraph","content":[{"text":"Parent bean for defining custom KeyInfo behavior for non-certificate credentials","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[238.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.X509KeyInfoGeneratorFactory","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[193.0]},"content":[{"type":"paragraph","content":[{"text":"X509KeyInfoGeneratorFactory","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.xmlsec.keyinfo.impl.X509KeyInfoGeneratorFactory"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[299.0]},"content":[{"type":"paragraph","content":[{"text":"Parent bean for defining custom KeyInfo behavior for X.500 certificates","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"The following beans may be defined in ","type":"text"},{"text":"conf/global.xml","type":"text","marks":[{"type":"em"}]},{"text":" and are, as a result, not reloadable. These lists override library defaults globally and allow updates to these policies in the event of an algorithm compromise or other local constraints.","type":"text"}]},{"type":"table","attrs":{"layout":"full-width","localId":"87ac51de-2121-4c20-b4b9-314b9c010376"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[246.0]},"content":[{"type":"paragraph","content":[{"text":"Name","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[83.0]},"content":[{"type":"paragraph","content":[{"text":"Type","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[401.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[246.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.IncludedSignatureAlgorithms","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[83.0]},"content":[{"type":"paragraph","content":[{"text":"Set","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.Set"}}]},{"text":"<","type":"text"},{"text":"String","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.lang.String"}}]},{"text":">","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[401.0]},"content":[{"type":"paragraph","content":[{"text":"Explicitly names signature and digest algorithms to allow, with others disallowed","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[246.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.ExcludedSignatureAlgorithms","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[83.0]},"content":[{"type":"paragraph","content":[{"text":"Set","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.Set"}}]},{"text":"<","type":"text"},{"text":"String","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.lang.String"}}]},{"text":">","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[401.0]},"content":[{"type":"paragraph","content":[{"text":"Explicitly names signature and digest algorithms to block, with others allowed","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[246.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.IncludedEncryptionAlgorithms","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[83.0]},"content":[{"type":"paragraph","content":[{"text":"Set","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.Set"}}]},{"text":"<","type":"text"},{"text":"String","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.lang.String"}}]},{"text":">","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[401.0]},"content":[{"type":"paragraph","content":[{"text":"Explicitly names encryption algorithms to allow, with others disallowed","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[246.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.ExcludedEncryptionAlgorithms","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[83.0]},"content":[{"type":"paragraph","content":[{"text":"Set","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.Set"}}]},{"text":"<","type":"text"},{"text":"String","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.lang.String"}}]},{"text":">","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[401.0]},"content":[{"type":"paragraph","content":[{"text":"Explicitly names encryption algorithms to block, with others allowed","type":"text"}]}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Notes","type":"text"}]},{"type":"paragraph","content":[{"text":"The IdP defaults to the use of separate keypairs for signing and decryption, the latter being a capability that is rarely used at present and primarily comes into play only when processing ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" messages that contain an encrypted subject ID.","type":"text"}]},{"type":"paragraph","content":[{"text":"The default algorithms used have been updated to:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"RSA or ECDSA (depending on key type) with SHA-256 digests","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"AES-GCM-128 with RSA-OAEP-MGF1 key transport","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"The IdP also supports a standardized SAML metadata ","type":"text"},{"text":"extension","type":"text","marks":[{"type":"link","attrs":{"href":"https://wiki.oasis-open.org/security/SAML2MetadataAlgSupport"}}]},{"text":" that influences the algorithms it will use, based on the capabilities of the SP. For metadata under your control, using the extension to specify that SHA-1 is required is generally a better strategy than specifying it in a RelyingParty override, but often this isn't possible, so a ","type":"text"},{"text":"filter","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199507042"}}]},{"text":" is also provided for supplementing remote sources. We encourage deployers to ask their metadata sources (i.e., federations) about this capability, as it is critically important for dealing with future algorithm weaknesses that may emerge over time.","type":"text"}]}],"version":1}