{"type":"doc","content":[{"type":"heading","attrs":{"level":2},"content":[{"text":"Overview","type":"text"}]},{"type":"paragraph","content":[{"text":"Each ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" element contains a couple of general settings and a configurable set of \"rules\" that implement particular protections and peer authentication mechanisms. You don't have to worry too much in general about unsafe behavior because if something disables all of the rules for authenticating a message, the system simply rejects it.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Reference","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Attributes","type":"text"}]},{"type":"table","attrs":{"layout":"full-width","localId":"5b35ef8c-401a-45e0-ad5c-2703c38e4196"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[126.0]},"content":[{"type":"paragraph","content":[{"text":"Name","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[100.0]},"content":[{"type":"paragraph","content":[{"text":"Type","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[90.0]},"content":[{"type":"paragraph","content":[{"text":"Default","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[1316.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[126.0]},"content":[{"type":"paragraph","content":[{"text":"id ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[100.0]},"content":[{"type":"paragraph","content":[{"text":"XML ID","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[90.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1316.0]},"content":[{"type":"paragraph","content":[{"text":"Uniquely names this policy within the configuration","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[126.0]},"content":[{"type":"paragraph","content":[{"text":"validate ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[100.0]},"content":[{"type":"paragraph","content":[{"text":"boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[90.0]},"content":[{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1316.0]},"content":[{"type":"paragraph","content":[{"text":"Enables or disables schema validation of XML when parsing messages at runtime. Includes all SAML and SOAP messages.","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Child Elements","type":"text"}]},{"type":"table","attrs":{"layout":"default","localId":"df7995c6-6012-4b46-9709-755c105a6ca8"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[81.0]},"content":[{"type":"paragraph","content":[{"text":"Name","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[100.0]},"content":[{"type":"paragraph","content":[{"text":"Cardinality","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[578.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[81.0]},"content":[{"type":"paragraph","content":[{"text":"","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[100.0]},"content":[{"type":"paragraph","content":[{"text":"1 or more","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[578.0]},"content":[{"type":"paragraph","content":[{"text":"Security policy rules to apply","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Example","type":"text"}]},{"type":"paragraph","content":[{"text":"The default policy for dealing with SAML messages, in English, is:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Don't schema validate.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Check for replay, and reject messages older than 60 seconds in the past.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Honor any SAML ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" elements, including timestamps, and make sure the SP sees itself as an audience for any assertions. Reject any other conditions as unrecognized.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Allow a message to be authenticated by checking for a TLS client certificate, an XML signature, and a \"blob\"-type signature, in that order. Anything present that can't be validated is fatal. Validation is based on the configured ","type":"text"},{"text":"<","type":"text","marks":[{"type":"code"}]},{"text":"TrustEngine","type":"text","marks":[{"type":"code"},{"type":"link","attrs":{"__confluenceMetadata":{"isRenamedTitle":true,"linkType":"page","contentTitle":"TrustEngine","versionAtSave":"19"},"href":"/wiki/spaces/SP3/pages/2063695951"}}]},{"text":">","type":"text","marks":[{"type":"code"}]},{"text":"(s).","type":"text"}]}]}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":" \n \n \n \n \n \n \n \n \n \n ","type":"text"}]}],"version":1}

Browser not supported