#
# CERN configuration for mod_auth_mellon SAML 2.0 
# authentication service
#
# Preconfigures whole apache server tree to use Mellon.
#
<Directory />

# enable mellon for entire site served by apache 
MellonEnable "info"
#
# enable multi valued variables (for group authentication)
MellonMergeEnvVars On
#
# must correspond to path registered with CERN SSO service 
# at: https://cern.ch/sso-management
#
MellonEndpointPath /mellon
#
# Mellon metadata files created using:
# cd /etc/httpd/conf.d/mellon/
# /usr/libexec/mod_auth_mellon/mellon_create_metadata.sh \
# https://HOSTNAME.cern.ch/mellon https://HOSTNAME.cern.ch/mellon
# 
# change HOSTNAME to your system hostname.
#
MellonSPPrivateKeyFile /etc/httpd/conf.d/mellon/https_HOSTNAME.cern.ch_mellon.key
MellonSPCertFile /etc/httpd/conf.d/mellon/https_HOSTNAME.cern.ch_mellon.cert
MellonSPMetadataFile /etc/httpd/conf.d/mellon/https_HOSTNAME.cern.ch_mellon.xml
#
# IdP (Identity Provider) metadata downloaded as:
# curl -o /etc/httpd/conf.d/mellon/ \
# https://login.cern.ch/FederationMetadata/2007-06/FederationMetadata.xml
#
MellonIdPMetadataFile /etc/httpd/conf.d/mellon/FederationMetadata.xml
#
# ADFS attributes to Mellon variables mappings
# in most cases only ADFS_LOGIN and ADFS_GROUP are needed.
#
MellonSetEnvNoPrefix "ADFS_GROUP" "http://schemas.xmlsoap.org/claims/Group"
MellonSetEnvNoPrefix "ADFS_EMAIL" "http://schemas.xmlsoap.org/claims/EmailAddress"
MellonSetEnvNoPrefix "ADFS_LOGIN" "http://schemas.xmlsoap.org/claims/CommonName"
MellonSetEnvNoPrefix "ADFS_UIDNUMBER" "http://schemas.xmlsoap.org/claims/uidNumber"
MellonSetEnvNoPrefix "ADFS_GIDNUMBER" "http://schemas.xmlsoap.org/claims/gidNumber"
MellonSetEnvNoPrefix "ADFS_FULLNAME" "http://schemas.xmlsoap.org/claims/DisplayName"
MellonSetEnvNoPrefix "ADFS_PHONENUMBER" "http://schemas.xmlsoap.org/claims/PhoneNumber"
MellonSetEnvNoPrefix "ADFS_FAXNUMBER" "http://schemas.xmlsoap.org/claims/FaxNumber"
MellonSetEnvNoPrefix "ADFS_MOBILENUMBER" "http://schemas.xmlsoap.org/claims/MobileNumber"
MellonSetEnvNoPrefix "ADFS_BUILDING" "http://schemas.xmlsoap.org/claims/Building"
MellonSetEnvNoPrefix "ADFS_FIRSTNAME" "http://schemas.xmlsoap.org/claims/Firstname"
MellonSetEnvNoPrefix "ADFS_LASTNAME" "http://schemas.xmlsoap.org/claims/Lastname"
MellonSetEnvNoPrefix "ADFS_DEPARTMENT" "http://schemas.xmlsoap.org/claims/Department"
MellonSetEnvNoPrefix "ADFS_HOMEINSTITUTE" "http://schemas.xmlsoap.org/claims/HomeInstitute"
MellonSetEnvNoPrefix "ADFS_HOMEDIR" "http://schemas.xmlsoap.org/claims/HomeDir"
MellonSetEnvNoPrefix "ADFS_PERSONID" "http://schemas.xmlsoap.org/claims/PersonID"
MellonSetEnvNoPrefix "ADFS_PREFERREDLANGUAGE" "http://schemas.xmlsoap.org/claims/PreferredLanguage"
MellonSetEnvNoPrefix "ADFS_ROLE" "http://schemas.microsoft.com/ws/2008/06/identity/claims/role"
MellonSetEnvNoPrefix "ADFS_IDENTITYCLASS" "http://schemas.xmlsoap.org/claims/IdentityClass"
MellonSetEnvNoPrefix "ADFS_FEDERATION" "http://schemas.xmlsoap.org/claims/Federation"
MellonSetEnvNoPrefix "ADFS_AUTHLEVEL" "http://schemas.xmlsoap.org/claims/AuthLevel"
MellonSetEnvNoPrefix "ADFS_FEDACLS" "http://cern.ch/fedacls"
#
# 'user' variable - MUST be set.
#
MellonUser "ADFS_LOGIN"
#
# for debugging only
#
#MellonSamlResponseDump On
#
</Directory> 
#
# Enable authentication only for part of the web site
# adjust to your path.
#
# See: /usr/share/doc/mod_auth_mellon*/README for 
# detailed description of MellonCond
#
#<Location /protected>
# SSL only module: mellon does not require it 
# but MS ADFS does
#SSLRequireSSL
#
# enable authentication
#MellonEnable "auth"
#
# restrict access to some users
#MellonCond ADFS_LOGIN jpolok [MAP]
##
# or ADFS (e-group) groups
#MellonCond ADFS_GROUP c3 [MAP]
#
#</Location>
#
# v 0.4; 07.04.2016 Jaroslaw.Polok@cern.ch
#

