{"type":"doc","content":[{"type":"heading","attrs":{"level":2},"content":[{"text":"Overview","type":"text"}]},{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" element is a container for one or more uniquely identified ","type":"text"},{"text":"<","type":"text","marks":[{"type":"code"}]},{"text":"Policy","type":"text","marks":[{"type":"code"},{"type":"link","attrs":{"__confluenceMetadata":{"isRenamedTitle":true,"linkType":"self","anchorName":"Policy"},"href":"#SecurityPolicies-Policy"}}]},{"text":"> ","type":"text","marks":[{"type":"code"}]},{"text":"elements that control low-level security and profile processing performed by the SP. It also contains mechanisms to enable and disable security algorithms.","type":"text"}]},{"type":"paragraph","content":[{"text":"The system is flexible enough to allow very fine-grained selection of different policies to use for different use cases or even different IdPs, but this is not a commonly needed feature and the vast majority of deployments will just use the defaults, or at least a single default policy.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Reference","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Child Elements","type":"text"}]},{"type":"table","attrs":{"layout":"full-width","localId":"7def2210-8f7e-4d37-899b-cff06fea325f"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[353.0]},"content":[{"type":"paragraph","content":[{"text":"Name","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[247.0]},"content":[{"type":"paragraph","content":[{"text":"Cardinality","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[1032.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[353.0]},"content":[{"type":"paragraph","content":[{"text":"<","type":"text"},{"text":"Policy","type":"text","marks":[{"type":"link","attrs":{"__confluenceMetadata":{"isRenamedTitle":true,"linkType":"page","contentTitle":"Policy","versionAtSave":"4"},"href":"/wiki/spaces/SP3/pages/2065334531"}}]},{"text":">","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[247.0]},"content":[{"type":"paragraph","content":[{"text":"1 or more","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1032.0]},"content":[{"type":"paragraph","content":[{"text":"Security policy rules.","type":"text"}]},{"type":"paragraph","content":[{"text":"These ","type":"text"},{"text":"must","type":"text","marks":[{"type":"strong"}]},{"text":" be the first child elements.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[353.0]},"content":[{"type":"paragraph","content":[{"text":"","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[247.0]},"content":[{"type":"paragraph","content":[{"text":"0 or 1","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1032.0]},"content":[{"type":"paragraph","content":[{"text":"DEPRECATED: Whitespace-delimited list of algorithm URIs to explicitly enable","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[353.0]},"content":[{"type":"paragraph","content":[{"text":" 3.2","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[247.0]},"content":[{"type":"paragraph","content":[{"text":"0 or 1","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1032.0]},"content":[{"type":"paragraph","content":[{"text":"Whitespace-delimited list of algorithm URIs to explicitly enable","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[353.0]},"content":[{"type":"paragraph","content":[{"text":"<","type":"text"},{"text":"AlgorithmBlacklist","type":"text","marks":[{"type":"link","attrs":{"__confluenceMetadata":{"isRenamedTitle":true,"linkType":"page","contentTitle":"ExcludedAlgorithms","versionAtSave":"6"},"href":"/wiki/spaces/SP3/pages/2065334583"}}]},{"text":">","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[247.0]},"content":[{"type":"paragraph","content":[{"text":"0 or 1","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1032.0]},"content":[{"type":"paragraph","content":[{"text":"DEPRECATED: Whitespace-delimited list of algorithms to explicitly disable","type":"text"},{"type":"hardBreak"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[353.0]},"content":[{"type":"paragraph","content":[{"text":"<","type":"text"},{"text":"ExcludedAlgorithms","type":"text","marks":[{"type":"link","attrs":{"__confluenceMetadata":{"isRenamedTitle":true,"linkType":"page","contentTitle":"ExcludedAlgorithms","versionAtSave":"6"},"href":"/wiki/spaces/SP3/pages/2065334583"}}]},{"text":"> 3.2","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[247.0]},"content":[{"type":"paragraph","content":[{"text":"0 or 1","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1032.0]},"content":[{"type":"paragraph","content":[{"text":"Whitespace-delimited list of algorithms to explicitly disable","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"Custom security policies can be defined at the level of a specific ","type":"text"},{"text":"application","type":"text","marks":[{"type":"link","attrs":{"__confluenceMetadata":{"isRenamedTitle":true,"linkType":"page","contentTitle":"ApplicationDefaults","versionAtSave":"27"},"href":"/wiki/spaces/SP3/pages/2063695997"}}]},{"text":" or protocol endpoint and referenced via a ","type":"text"},{"text":"policyId","type":"text","marks":[{"type":"code"}]},{"text":" attribute, but in most cases, the default policy is appropriate for all typical exchanges.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Example","type":"text"}]},{"type":"paragraph","content":[{"text":"The example below is the default shipping version at the time of authoring. The default policy is the one used for all the typical interactions in the SP. For safety's sake, you will find that just removing some of the obviously named rules won't actually open your system to attacks but you might learn a bit about the system by playing with them.","type":"text"}]},{"type":"paragraph","content":[{"text":"The second named policy is an example of how to define a special set of rules for an unusual use case, the evaluation of signed SAML Assertions inside SAML metadata. It has only a couple of rules because a lot of the usual message oriented checks don't apply to that use case.","type":"text"}]},{"type":"paragraph","content":[{"text":"The last line essentially delegates the rules for disabling insecure algorithms to the software's defaults, allowing us to change them easily. The example dates to before V3.2, which has deprecated and renamed that element.","type":"text"}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n\n \n\n \n \n \n \n \n \n \n \n \n \n \n \n\n \n \n \n \n \n \n \n \n\n\n","type":"text"}]}],"version":1}

Browser not supported