plugins/frontends/saml2_frontend.yaml

module: satosa.frontends.saml2.SAMLFrontend
name: Saml2IDP
config:
  #acr_mapping:
  #  "": default-LoA
  #  "https://accounts.google.com": LoA1

  endpoints:
    single_sign_on_service:
      'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST': sso/post
      'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect': sso/redirect

  # If configured and not false or empty the common domain cookie _saml_idp will be set
  # with or have appended the IdP used for authentication. The default is not to set the
  # cookie. If the value is a dictionary with key 'domain' then the domain for the cookie
  # will be set to the value for the 'domain' key. If no 'domain' is set then the domain
  # from the BASE defined for the proxy will be used.
  #common_domain_cookie:
  #  domain: .example.com

  entityid_endpoint: true
  enable_metadata_reload: no

  idp_config:
    organization: {display_name: My Company, name: My Company, url: 'https://example.com'}
    contact_person:
    - {contact_type: technical, email_address: 'mailto:[email protected]', given_name: Technical}
    - {contact_type: support, email_address: 'mailto:[email protected]', given_name: Support}
    key_file: /home/satosa/satosa/satosa_config/plugins/frontends/frontend.key
    cert_file: /home/satosa/satosa/satosa_config/plugins/frontends/frontend.crt
    encryption_keypairs:
    - {'key_file': /home/satosa/satosa/satosa_config/plugins/frontends/frontend.key, 'cert_file': /home/satosa/satosa/satosa_config/plugins/frontends/frontend.crt}
    metadata:
      remote:
        - url: "https://gitlab.example.com/users/auth/saml/metadata"
          cert: null
    attribute_map_dir: /home/satosa/satosa/satosa_config/attribute-maps

    entityid: https://auth.example.com/saml/proxy.xml
    accepted_time_diff: 60
    service:
      idp:
        endpoints:
          single_sign_on_service: []
        name: IdP Proxy for GitLab
        ui_info:
          display_name:
            - lang: en
              text: "IdP Proxy for Gitlab"
          description:
            - lang: en
              text: "IdP Proxy for GitLab"
          information_url:
            - lang: en
              text: "https://example.com"
          logo:
            text: "http://idp.logo.url/"
            width: "100"
            height: "100"
        name_id_format: ['urn:oasis:names:tc:SAML:2.0:nameid-format:persistent', 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient']

        signing_algorithm: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"
        digest_algorithm: "http://www.w3.org/2001/04/xmlenc#sha256"

        policy:
          default:
            attribute_restrictions: null
            fail_on_missing_requested: false
            lifetime: {minutes: 15}
            name_form: urn:oasis:names:tc:SAML:2.0:attrname-format:uri
            encrypt_assertion: false
            encrypted_advice_attributes: false
            sign_response: True
            sign_assertion: True