Skip to content

Commit 9030d03

Browse files
c00kiemon5terc00kiemon5ter
committed
Format configuration examples
Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
1 parent 55be003 commit 9030d03

File tree

1 file changed

+136
-93
lines changed

1 file changed

+136
-93
lines changed

‎docs/howto/config.rst‎

Lines changed: 136 additions & 93 deletions
Original file line numberDiff line numberDiff line change
@@ -16,29 +16,37 @@ The basic structure of the configuration file is therefore like this::
1616
from saml2 import BINDING_HTTP_REDIRECT
1717

1818
CONFIG = {
19-
"entityid" : "http://saml.example.com:saml/idp.xml",
20-
"name" : "Rolands IdP",
19+
"entityid": "http://saml.example.com:saml/idp.xml",
20+
"name": "Rolands IdP",
2121
"service": {
2222
"idp": {
23-
"endpoints" : {
24-
"single_sign_on_service" : [
25-
("http://saml.example.com:saml:8088/sso",
26-
BINDING_HTTP_REDIRECT)],
23+
"endpoints": {
24+
"single_sign_on_service": [
25+
(
26+
"http://saml.example.com:saml:8088/sso",
27+
BINDING_HTTP_REDIRECT,
28+
),
29+
],
2730
"single_logout_service": [
28-
("http://saml.example.com:saml:8088/slo",
29-
BINDING_HTTP_REDIRECT)]
31+
(
32+
"http://saml.example.com:saml:8088/slo",
33+
BINDING_HTTP_REDIRECT,
34+
),
35+
],
3036
},
3137
...
3238
}
3339
},
34-
"key_file" : "my.key",
35-
"cert_file" : "ca.pem",
36-
"xmlsec_binary" : "/usr/local/bin/xmlsec1",
40+
"key_file": "my.key",
41+
"cert_file": "ca.pem",
42+
"xmlsec_binary": "/usr/local/bin/xmlsec1",
3743
"delete_tmpfiles": True,
3844
"metadata": {
39-
"local": ["edugain.xml"],
45+
"local": [
46+
"edugain.xml",
47+
],
4048
},
41-
"attribute_map_dir" : "attributemaps",
49+
"attribute_map_dir": "attributemaps",
4250
...
4351
}
4452

@@ -93,7 +101,7 @@ A typical map file will look like this::
93101
'urn:mace:dir:attribute-def:associatedDomain': 'associatedDomain',
94102
'urn:mace:dir:attribute-def:associatedName': 'associatedName',
95103
...
96-
},
104+
},
97105
"to": {
98106
'aRecord': 'urn:mace:dir:attribute-def:aRecord',
99107
'aliasedEntryName': 'urn:mace:dir:attribute-def:aliasedEntryName',
@@ -135,19 +143,22 @@ about the service or if support is needed. The possible types are according to
135143
the standard **technical**, **support**, **administrative**, **billing**
136144
and **other**.::
137145

138-
contact_person: [{
139-
"givenname": "Derek",
140-
"surname": "Jeter",
141-
"company": "Example Co.",
142-
"mail": ["jeter@example.com"],
143-
"type": "technical",
144-
},{
145-
"givenname": "Joe",
146-
"surname": "Girardi",
147-
"company": "Example Co.",
148-
"mail": "girardi@example.com",
149-
"type": "administrative",
150-
}]
146+
contact_person: [
147+
{
148+
"givenname": "Derek",
149+
"surname": "Jeter",
150+
"company": "Example Co.",
151+
"mail": ["jeter@example.com"],
152+
"type": "technical",
153+
},
154+
{
155+
"givenname": "Joe",
156+
"surname": "Girardi",
157+
"company": "Example Co.",
158+
"mail": "girardi@example.com",
159+
"type": "administrative",
160+
},
161+
]
151162

152163
debug
153164
^^^^^
@@ -193,7 +204,7 @@ Contains a list of places where metadata can be found. This can be
193204

194205
For example::
195206

196-
"metadata" : {
207+
"metadata": {
197208
"local": [
198209
"/opt/metadata"
199210
"metadata.xml",
@@ -222,24 +233,33 @@ metadata signing certificates should be used. These public keys must be
222233
acquired by some secure out-of-band method before being placed on the local
223234
file system.
224235

225-
When using MDQ, the `freshness_period` option can be set to define
226-
a period for which the metadata fetched from the the MDQ server are considered
227-
fresh. After that period has passed the metadata are not valid anymore and must
228-
be fetched again. The period must be in the format defined in `iso 8601 <https://www.iso.org/iso-8601-date-and-time-format.html>`_.
236+
When using MDQ, the `freshness_period` option can be set to define a period for
237+
which the metadata fetched from the the MDQ server are considered fresh. After
238+
that period has passed the metadata are not valid anymore and must be fetched
239+
again. The period must be in the format defined in
240+
`ISO 8601 <https://www.iso.org/iso-8601-date-and-time-format.html>`_
241+
or `RFC3999 <https://tools.ietf.org/html/rfc3339#appendix-A>`_.
229242

230243
By default, if `freshness_period` is not defined, the metadata are refreshed
231244
every 12 hours (`P0Y0M0DT12H0M0S`).
232245

246+
233247
organization
234248
^^^^^^^^^^^^
235249

236250
Only used by *make_metadata.py*.
237251
Where you describe the organization responsible for the service.::
238252

239253
"organization": {
240-
"name": [("Example Company","en"), ("Exempel AB","se")],
254+
"name": [
255+
("Example Company", "en"),
256+
("Exempel AB", "se")
257+
],
241258
"display_name": ["Exempel AB"],
242-
"url": [("http://example.com","en"),("http://exempel.se","se")],
259+
"url": [
260+
("http://example.com", "en"),
261+
("http://exempel.se", "se"),
262+
],
243263
}
244264

245265
.. note:: You can specify the language of the name, or the language used on
@@ -289,14 +309,22 @@ So if a server is a Service Provider (SP) then the configuration
289309
could look something like this::
290310

291311
"service": {
292-
"sp":{
293-
"name" : "Rolands SP",
294-
"endpoints":{
312+
"sp": {
313+
"name": "Rolands SP",
314+
"endpoints": {
295315
"assertion_consumer_service": ["http://localhost:8087/"],
296-
"single_logout_service" : [("http://localhost:8087/slo",
297-
'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect')],
316+
"single_logout_service": [
317+
(
318+
"http://localhost:8087/slo",
319+
'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
320+
),
321+
],
298322
},
299-
"required_attributes": ["surname", "givenname", "edupersonaffiliation"],
323+
"required_attributes": [
324+
"surname",
325+
"givenname",
326+
"edupersonaffiliation",
327+
],
300328
"optional_attributes": ["title"],
301329
"idp": {
302330
"urn:mace:umu.se:saml:roland:idp": None,
@@ -393,7 +421,7 @@ An example might be::
393421
},
394422
"urn:mace:example.com:saml:roland:sp": {
395423
"lifetime": {"minutes": 5},
396-
"attribute_restrictions":{
424+
"attribute_restrictions": {
397425
"givenName": None,
398426
"surName": None,
399427
}
@@ -429,7 +457,7 @@ regular expressions.::
429457
"policy": {
430458
"urn:mace:umu.se:saml:roland:sp": {
431459
"lifetime": {"minutes": 5},
432-
"attribute_restrictions":{
460+
"attribute_restrictions": {
433461
"mail": [".*\.umu\.se$"],
434462
}
435463
}
@@ -670,7 +698,11 @@ Example::
670698

671699
"service": {
672700
"sp": {
673-
"required_attributes": ["surname", "givenName", "mail"],
701+
"required_attributes": [
702+
"surname",
703+
"givenName",
704+
"mail",
705+
],
674706
}
675707
}
676708

@@ -717,7 +749,7 @@ Example::
717749
"sp": {
718750
"want_response_signed": False,
719751
"want_assertions_signed": False,
720-
"want_assertions_or_response_signed": True
752+
"want_assertions_or_response_signed": True,
721753
}
722754
}
723755

@@ -766,11 +798,13 @@ Example::
766798

767799
"service":
768800
"idp": {
769-
"endpoints" : {
770-
"single_sign_on_service" : [
771-
("http://localhost:8088/sso", BINDING_HTTP_REDIRECT)],
801+
"endpoints": {
802+
"single_sign_on_service": [
803+
("http://localhost:8088/sso", BINDING_HTTP_REDIRECT),
804+
],
772805
"single_logout_service": [
773-
("http://localhost:8088/slo", BINDING_HTTP_REDIRECT)]
806+
("http://localhost:8088/slo", BINDING_HTTP_REDIRECT),
807+
],
774808
},
775809
},
776810
},
@@ -819,9 +853,9 @@ virtual_organization
819853

820854
Gives information about common identifiers for virtual_organizations::
821855

822-
"virtual_organization" : {
823-
"urn:mace:example.com:it:tek":{
824-
"nameid_format" : "urn:oid:1.3.6.1.4.1.1466.115.121.1.15-NameID",
856+
"virtual_organization": {
857+
"urn:mace:example.com:it:tek": {
858+
"nameid_format": "urn:oid:1.3.6.1.4.1.1466.115.121.1.15-NameID",
825859
"common_identifier": "umuselin",
826860
}
827861
},
@@ -839,35 +873,38 @@ We start with a simple but fairly complete Service provider configuration::
839873
from saml2 import BINDING_HTTP_REDIRECT
840874

841875
CONFIG = {
842-
"entityid" : "http://example.com/sp/metadata.xml",
876+
"entityid": "http://example.com/sp/metadata.xml",
843877
"service": {
844-
"sp":{
845-
"name" : "Example SP",
846-
"endpoints":{
878+
"sp": {
879+
"name": "Example SP",
880+
"endpoints": {
847881
"assertion_consumer_service": ["http://example.com/sp"],
848-
"single_logout_service" : [("http://example.com/sp/slo",
849-
BINDING_HTTP_REDIRECT)],
882+
"single_logout_service": [
883+
("http://example.com/sp/slo", BINDING_HTTP_REDIRECT),
884+
],
850885
},
851886
}
852887
},
853-
"key_file" : "./mykey.pem",
854-
"cert_file" : "./mycert.pem",
855-
"xmlsec_binary" : "/usr/local/bin/xmlsec1",
888+
"key_file": "./mykey.pem",
889+
"cert_file": "./mycert.pem",
890+
"xmlsec_binary": "/usr/local/bin/xmlsec1",
856891
"delete_tmpfiles": True,
857892
"attribute_map_dir": "./attributemaps",
858893
"metadata": {
859894
"local": ["idp.xml"]
860895
}
861896
"organization": {
862-
"display_name":["Example identities"]
897+
"display_name": ["Example identities"]
863898
}
864-
"contact_person": [{
865-
"givenname": "Roland",
866-
"surname": "Hedberg",
867-
"phone": "+46 90510",
868-
"mail": "roland@example.com",
869-
"type": "technical",
870-
}]
899+
"contact_person": [
900+
{
901+
"givenname": "Roland",
902+
"surname": "Hedberg",
903+
"phone": "+46 90510",
904+
"mail": "roland@example.com",
905+
"type": "technical",
906+
},
907+
]
871908
}
872909

873910
This is the typical setup for an SP.
@@ -881,45 +918,51 @@ A slightly more complex configuration::
881918
from saml2 import BINDING_HTTP_REDIRECT
882919

883920
CONFIG = {
884-
"entityid" : "http://sp.example.com/metadata.xml",
921+
"entityid": "http://sp.example.com/metadata.xml",
885922
"service": {
886-
"sp":{
887-
"name" : "Example SP",
888-
"endpoints":{
923+
"sp": {
924+
"name": "Example SP",
925+
"endpoints": {
889926
"assertion_consumer_service": ["http://sp.example.com/"],
890-
"single_logout_service" : [("http://sp.example.com/slo",
891-
BINDING_HTTP_REDIRECT)],
927+
"single_logout_service": [
928+
("http://sp.example.com/slo", BINDING_HTTP_REDIRECT),
929+
],
892930
},
893931
"subject_data": ("memcached", "localhost:12121"),
894-
"virtual_organization" : {
895-
"urn:mace:example.com:it:tek":{
896-
"nameid_format" : "urn:oid:1.3.6.1.4.1.1466.115.121.1.15-NameID",
932+
"virtual_organization": {
933+
"urn:mace:example.com:it:tek": {
934+
"nameid_format": "urn:oid:1.3.6.1.4.1.1466.115.121.1.15-NameID",
897935
"common_identifier": "eduPersonPrincipalName",
898936
}
899937
},
900938
}
901939
},
902-
"key_file" : "./mykey.pem",
903-
"cert_file" : "./mycert.pem",
904-
"xmlsec_binary" : "/usr/local/bin/xmlsec1",
940+
"key_file": "./mykey.pem",
941+
"cert_file": "./mycert.pem",
942+
"xmlsec_binary": "/usr/local/bin/xmlsec1",
905943
"delete_tmpfiles": True,
906-
"metadata" : {
944+
"metadata": {
907945
"local": ["example.xml"],
908-
"remote": [{
909-
"url":"https://kalmar2.org/simplesaml/module.php/aggregator/?id=kalmarcentral2&set=saml2",
910-
"cert":"kalmar2.pem"}]
946+
"remote": [
947+
{
948+
"url":"https://kalmar2.org/simplesaml/module.php/aggregator/?id=kalmarcentral2&set=saml2",
949+
"cert":"kalmar2.pem",
950+
}
951+
]
911952
},
912-
"attribute_maps" : "attributemaps",
953+
"attribute_maps": "attributemaps",
913954
"organization": {
914-
"display_name":["Example identities"]
955+
"display_name": ["Example identities"]
915956
}
916-
"contact_person": [{
917-
"givenname": "Roland",
918-
"surname": "Hedberg",
919-
"phone": "+46 90510",
920-
"mail": "roland@example.com",
921-
"type": "technical",
922-
}]
957+
"contact_person": [
958+
{
959+
"givenname": "Roland",
960+
"surname": "Hedberg",
961+
"phone": "+46 90510",
962+
"mail": "roland@example.com",
963+
"type": "technical",
964+
},
965+
]
923966
}
924967

925968
Uses metadata files, both local and remote, and will talk to whatever

0 commit comments

Comments
 (0)