SAML configuration file
public void init() {
this.backgroundTaskTimer = new Timer(true);
this.multiThreadedHttpConnectionManager = new MultiThreadedHttpConnectionManager();
}
public void shutdown() {
this.backgroundTaskTimer.purge();
this.backgroundTaskTimer.cancel();
this.multiThreadedHttpConnectionManager.shutdown();
}
@Autowired
private SAMLUserDetailsServiceImpl samlUserDetailsServiceImpl;
// Initialization of the velocity engine
@Bean
public VelocityEngine velocityEngine() {
return VelocityFactory.getEngine();
}
// XML parser pool needed for OpenSAML parsing
@Bean(initMethod = "initialize")
public StaticBasicParserPool parserPool() {
return new StaticBasicParserPool();
}
@Bean(name = "parserPoolHolder")
public ParserPoolHolder parserPoolHolder() {
return new ParserPoolHolder();
}
// Bindings, encoders and decoders used for creating and parsing messages
@Bean
public HttpClient httpClient() {
return new HttpClient(this.multiThreadedHttpConnectionManager);
}
// SAML Authentication Provider responsible for validating of received SAML
// messages
@Bean
public SAMLAuthenticationProvider samlAuthenticationProvider() {
SAMLAuthenticationProvider samlAuthenticationProvider = new SAMLAuthenticationProvider();
samlAuthenticationProvider.setUserDetails(samlUserDetailsServiceImpl);
samlAuthenticationProvider.setForcePrincipalAsString(false);
return samlAuthenticationProvider;
}
// Provider of SAML Context
@Bean
public SAMLContextProviderLB contextProvider() {
SAMLContextProviderLB samlContextProviderLB = new SAMLContextProviderLB();
samlContextProviderLB.setScheme(scheme);
samlContextProviderLB.setServerName(serverName);
samlContextProviderLB.setContextPath(contextPath);
return samlContextProviderLB;
}
// Initialization of OpenSAML library
@Bean
public static SAMLBootstrap sAMLBootstrap() {
return new SAMLBootstrap();
}
// Logger for SAML messages and events
@Bean
public SAMLDefaultLogger samlLogger() {
return new SAMLDefaultLogger();
}
// SAML 2.0 WebSSO Assertion Consumer
@Bean
public WebSSOProfileConsumer webSSOprofileConsumer() {
WebSSOProfileConsumerImpl webSSOProfileConsumer = new WebSSOProfileConsumerImpl();
webSSOProfileConsumer.setResponseSkew(600);
webSSOProfileConsumer.setMaxAssertionTime(600);
return webSSOProfileConsumer;
}
// SAML 2.0 Holder-of-Key WebSSO Assertion Consumer
@Bean
public WebSSOProfileConsumerHoKImpl hokWebSSOprofileConsumer() {
return new WebSSOProfileConsumerHoKImpl();
}
// SAML 2.0 Web SSO profile
@Bean
public WebSSOProfile webSSOprofile() {
return new WebSSOProfileImpl();
}
// SAML 2.0 Holder-of-Key Web SSO profile
@Bean
public WebSSOProfileConsumerHoKImpl hokWebSSOProfile() {
return new WebSSOProfileConsumerHoKImpl();
}
// SAML 2.0 ECP profile
@Bean
public WebSSOProfileECPImpl ecpprofile() {
return new WebSSOProfileECPImpl();
}
@Bean
public SingleLogoutProfile logoutprofile() {
return new SingleLogoutProfileImpl();
}
// Central storage of cryptographic keys
@Bean
public KeyManager keyManager() {
DefaultResourceLoader loader = new DefaultResourceLoader();
Resource storeFile = loader
.getResource(keyStoreFilePath);
Map<String, String> passwords = new HashMap<String, String>();
passwords.put(keyAlias, storePass);
return new JKSKeyManager(storeFile, storePass, passwords, keyAlias);
}
@Bean
public WebSSOProfileOptions defaultWebSSOProfileOptions() {
WebSSOProfileOptions webSSOProfileOptions = new WebSSOProfileOptions();
webSSOProfileOptions.setIncludeScoping(false);
return webSSOProfileOptions;
}
// Entry point to initialize authentication, default values taken from
// properties file
@Bean
public SAMLEntryPoint samlEntryPoint() {
SAMLEntryPoint samlEntryPoint = new SAMLEntryPoint();
samlEntryPoint.setDefaultProfileOptions(defaultWebSSOProfileOptions());
return samlEntryPoint;
}
// Setup advanced info about metadata
@Bean
public ExtendedMetadata extendedMetadata() {
ExtendedMetadata extendedMetadata = new ExtendedMetadata();
extendedMetadata.setSigningAlgorithm("http://www.w3.org/2001/04/xmldsig-more#rsa-sha256");
extendedMetadata.setDigestMethodAlgorithm("http://www.w3.org/2001/04/xmlenc#sha256");
extendedMetadata.setSignMetadata(true);
extendedMetadata.setEcpEnabled(true);
return extendedMetadata;
}
// IDP Discovery Service
@Bean
public SAMLDiscovery samlIDPDiscovery() {
SAMLDiscovery idpDiscovery = new SAMLDiscovery();
idpDiscovery.setIdpSelectionPath("/ats/ssoDiscovery");
return idpDiscovery;
}
@Bean
@Qualifier("idp-ssocircle")
public ExtendedMetadataDelegate ssoCircleExtendedMetadataProvider()
throws MetadataProviderException {
HTTPMetadataProvider httpMetadataProvider = new HTTPMetadataProvider(
this.backgroundTaskTimer, httpClient(), metadataUrl);
httpMetadataProvider.setParserPool(parserPool());
ExtendedMetadataDelegate extendedMetadataDelegate =
new ExtendedMetadataDelegate(httpMetadataProvider, extendedMetadata());
extendedMetadataDelegate.setMetadataTrustCheck(true);
extendedMetadataDelegate.setMetadataRequireSignature(false);
backgroundTaskTimer.purge();
return extendedMetadataDelegate;
}
// IDP Metadata configuration - paths to metadata of IDPs in circle of trust
// is here
// Do no forget to call iniitalize method on providers
@Bean
@Qualifier("metadata")
public CachingMetadataManager metadata() throws MetadataProviderException {
List<MetadataProvider> providers = new ArrayList<MetadataProvider>();
providers.add(ssoCircleExtendedMetadataProvider());
return new CachingMetadataManager(providers);
}
// Filter automatically generates default SP metadata
@Bean
public MetadataGenerator metadataGenerator() {
MetadataGenerator metadataGenerator = new MetadataGenerator();
metadataGenerator.setEntityBaseURL(appBaseUrl);
metadataGenerator.setEntityId(metaDataEntityId);
metadataGenerator.setExtendedMetadata(extendedMetadata());
metadataGenerator.setIncludeDiscoveryExtension(true);
metadataGenerator.setKeyManager(keyManager());
return metadataGenerator;
}
// The filter is waiting for connections on URL suffixed with filterSuffix
// and presents SP metadata there
@Bean
public MetadataDisplayFilter metadataDisplayFilter() {
return new MetadataDisplayFilter();
}
// Handler deciding where to redirect user after successful login
@Bean
public SavedRequestAwareAuthenticationSuccessHandler successRedirectHandler() {
SavedRequestAwareAuthenticationSuccessHandler successRedirectHandler =
new SavedRequestAwareAuthenticationSuccessHandler();
successRedirectHandler.setDefaultTargetUrl("/ats/ssoLogin");
return successRedirectHandler;
}
// Handler deciding where to redirect user after failed login
@Bean
public SimpleUrlAuthenticationFailureHandler authenticationFailureHandler() {
SimpleUrlAuthenticationFailureHandler failureHandler =
new SimpleUrlAuthenticationFailureHandler();
failureHandler.setUseForward(true);
failureHandler.setDefaultFailureUrl("/error");
return failureHandler;
}
@Bean
public SAMLWebSSOHoKProcessingFilter samlWebSSOHoKProcessingFilter() throws Exception {
SAMLWebSSOHoKProcessingFilter samlWebSSOHoKProcessingFilter = new SAMLWebSSOHoKProcessingFilter();
samlWebSSOHoKProcessingFilter.setAuthenticationSuccessHandler(successRedirectHandler());
samlWebSSOHoKProcessingFilter.setAuthenticationManager(authenticationManager());
samlWebSSOHoKProcessingFilter.setAuthenticationFailureHandler(authenticationFailureHandler());
return samlWebSSOHoKProcessingFilter;
}
// Processing filter for WebSSO profile messages
@Bean
public SAMLProcessingFilter samlWebSSOProcessingFilter() throws Exception {
SAMLProcessingFilter samlWebSSOProcessingFilter = new SAMLProcessingFilter();
samlWebSSOProcessingFilter.setAuthenticationManager(authenticationManager());
samlWebSSOProcessingFilter.setAuthenticationSuccessHandler(successRedirectHandler());
samlWebSSOProcessingFilter.setAuthenticationFailureHandler(authenticationFailureHandler());
return samlWebSSOProcessingFilter;
}
@Bean
public MetadataGeneratorFilter metadataGeneratorFilter() {
return new MetadataGeneratorFilter(metadataGenerator());
}
// Bindings
private ArtifactResolutionProfile artifactResolutionProfile() {
final ArtifactResolutionProfileImpl artifactResolutionProfile =
new ArtifactResolutionProfileImpl(httpClient());
artifactResolutionProfile.setProcessor(new SAMLProcessorImpl(soapBinding()));
return artifactResolutionProfile;
}
@Bean
public HTTPArtifactBinding artifactBinding(ParserPool parserPool, VelocityEngine velocityEngine) {
return new HTTPArtifactBinding(parserPool, velocityEngine, artifactResolutionProfile());
}
@Bean
public HTTPSOAP11Binding soapBinding() {
return new HTTPSOAP11Binding(parserPool());
}
@Bean
public HTTPPostBinding httpPostBinding() {
return new HTTPPostBinding(parserPool(), velocityEngine());
}
@Bean
public HTTPRedirectDeflateBinding httpRedirectDeflateBinding() {
return new HTTPRedirectDeflateBinding(parserPool());
}
@Bean
public HTTPSOAP11Binding httpSOAP11Binding() {
return new HTTPSOAP11Binding(parserPool());
}
@Bean
public HTTPPAOS11Binding httpPAOS11Binding() {
return new HTTPPAOS11Binding(parserPool());
}
// Processor
@Bean
public SAMLProcessorImpl processor() {
Collection<SAMLBinding> bindings = new ArrayList<SAMLBinding>();
bindings.add(httpRedirectDeflateBinding());
bindings.add(httpPostBinding());
bindings.add(artifactBinding(parserPool(), velocityEngine()));
bindings.add(httpSOAP11Binding());
bindings.add(httpPAOS11Binding());
return new SAMLProcessorImpl(bindings);
}
/**
* Define the security filter chain in order to support SSO Auth by using SAML 2.0
* @return Filter chain proxy
* @throws Exception
*/
@Bean
public FilterChainProxy samlFilter() throws Exception {
List<SecurityFilterChain> chains = new ArrayList<SecurityFilterChain>();
chains.add(new DefaultSecurityFilterChain(new AntPathRequestMatcher("/ats/ssoLogin/**"),
samlEntryPoint()));
chains.add(new DefaultSecurityFilterChain(new AntPathRequestMatcher("/saml/metadata/**"),
metadataDisplayFilter()));
chains.add(new DefaultSecurityFilterChain(new AntPathRequestMatcher("/saml/SSO/**"),
samlWebSSOProcessingFilter()));
chains.add(new DefaultSecurityFilterChain(new AntPathRequestMatcher("/saml/SSOHoK/**"),
samlWebSSOHoKProcessingFilter()));
chains.add(new DefaultSecurityFilterChain(new AntPathRequestMatcher("/saml/ssoDiscovery/**"),
samlIDPDiscovery()));
return new FilterChainProxy(chains);
}
/**
* Returns the authentication manager currently used by Spring.
* It represents a bean definition with the aim allow wiring from
* other classes performing the Inversion of Control (IoC).
* @throws Exception
*/
@Bean
@Override
public AuthenticationManager authenticationManagerBean() throws Exception {
return super.authenticationManagerBean();
}
/**
* Defines the web based security configuration.
* @param http It allows configuring web based security for specific http requests.
* @throws Exception
*/
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.httpBasic()
.authenticationEntryPoint(samlEntryPoint());
http
.addFilterBefore(metadataGeneratorFilter(), ChannelProcessingFilter.class)
.addFilterAfter(samlFilter(), BasicAuthenticationFilter.class);
http.csrf().disable();
}
/**
* Sets a custom authentication provider.
* @param auth SecurityBuilder used to create an AuthenticationManager.
* @throws Exception
*/
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth
.authenticationProvider(samlAuthenticationProvider());
}
@Override
public void afterPropertiesSet() throws Exception {
init();
}
@Override
public void destroy() throws Exception {
shutdown();
}
I am generating Jks file like this
keytool -genkey -v -keystore talman-dev-key.jks -alias talmandev -keyalg RSA -keysize 2048
What is your first and last name? [Unknown]: www.qtsolv.com
What is the name of your organizational unit? [Unknown]: Development
what is the name of your organization? [Unknown]: quarks
What is the name of your City or Locality? [Unknown]: noida
What is the name of your State or Province? [Unknown]: UP
What is the two-letter country code for this unit? [Unknown]: IN
Also i have imported token certificate provided ADFS IDP
keytool -importcert -alias devkeystore -keystore talman-dev-key.jks -file adfs-token.cer
After Generating metadata, when it is configured at adfs, its validity is only 3 months. Can anyone have any suggestion what should i do so that my metadata validity increases?
Here is my metadata file for local environment
**<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" ID="com_quarks_bccl_talmandev" entityID="com:quarks:bccl:talmandev">
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
<ds:Reference URI="#com_quarks_bccl_talmandev">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
<ds:DigestValue>5VigwMzuqvNICrCnK6ianq1Q1ttKIP8XhRCExuf66r4=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>bhgQfNMVFHoFI7PFOmm7Z8qlaWTRcpMS/o9Q4NIO6f3Y6sp6JHqonX33TKX6uMsTJssqFY6/kste3u5BOCZS9lTdqqAZpj7lZJvQxEeXY9eD/GEo3JYEY6X6R+swiKU3PL4WDB2h6NX8v050dSvryniMTvjcgPFOHwVlvHGRa4W0mci4yRnD2V3PS4W3xzSbAc0xICDLbE/m4CyYpnnAs/WQWt6OujKWnoq2abXUbW/qXPlLmRs5ZRWkKkNx7z8ZfJicU1Z40EukYA8g3SbXLN3HBM+swU2DQv5px+03OdPINZYfA9H1nrsjfekrxhEWRVhBFUX1kQVjYQZdoVd+iQ==</ds:SignatureValue>
<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate>MIIDczCCAlugAwIBAgIEQPMBRDANBgkqhkiG9w0BAQsFADBqMQswCQYDVQQGEwJJTjELMAkGA1UE CBMCVVAxDjAMBgNVBAcTBW5vaWRhMQ8wDQYDVQQKEwZxdWFya3MxFDASBgNVBAsTC0RldmVsb3Bt ZW50MRcwFQYDVQQDEw53d3cuZ3Rzb2x2LmNvbTAeFw0yMDA1MDUwNzQ1MzdaFw0yMDA4MDMwNzQ1 MzdaMGoxCzAJBgNVBAYTAklOMQswCQYDVQQIEwJVUDEOMAwGA1UEBxMFbm9pZGExDzANBgNVBAoT BnF1YXJrczEUMBIGA1UECxMLRGV2ZWxvcG1lbnQxFzAVBgNVBAMTDnd3dy5ndHNvbHYuY29tMIIB IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmxjm5uj0d91vKyGGyN8Cwr5VZ1FL+6GVex83 J5ULHfYhvFEb0sT8oEpJnEaS2flPDQotWWlN7eN57EHAu9Vo1CXWVo2FbUeNbmKcxDxbY/w+VKGU BCJYQOuSdXgzI3lLs9rpR/xdNUfBF6/I7zXdFli/yP6c3MZ8kJjTiJ+EnIYXTkZ4JBzApKjjPqzQ ss2MlFVjWCIXa3C46RUQWKT1uBnDcp+byrxrQYxk4oO2Glv7r/vKdRSXNJxkAnVIQSliU/e3YVrE 3ybdBpmoUi79sd1SK4NdwTtmbWpLBXP0Ale8p0jwU1cRBvB+MDvNSXwzv8nChXtixv5SDKKf3iIx PQIDAQABoyEwHzAdBgNVHQ4EFgQU9PSyv4q+dH2BtYeRfbEePSe9O4swDQYJKoZIhvcNAQELBQAD ggEBAIhcVcCgX58tdHisGqcs2Ti1emDi/jkrYdXttjcKHDVxRYNwZHj2z0wxpJmxCw7Qraf2FC6s mKdUZ0TwTPnWb9AVcNXu65pUJd/3bIPaQYQHb7II/aPD2+53FwAGhQdqV9oWQilu81/aqYLcjZ/I OuSU00xX0K/UE957cbFQl9VbnB34lOIuQRJAxX8y/fcl6yQ4V+4Ak1gcDYBnebehjx2JqCaRo4e8 M8ThYM0Jv0Wb6paiA+nN0uhQeapuwRbjUzOV26s8qzx5BFexWmNDAwGNgntXDOVXpQJdgORecnzC 1CdAjlzJ4ORvNM57ZSPZRCz6WXG/PRd5OcxLD9pktjg=</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</ds:Signature>
<md:SPSSODescriptor AuthnRequestsSigned="true" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
<md:Extensions>
<idpdisco:DiscoveryResponse xmlns:idpdisco="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol" Binding="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol" Location="https://localcareers.timesgroup.com:8080/saml/login?disco=true" index="0"/>
</md:Extensions>
<md:KeyDescriptor use="signing">
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:X509Data>
<ds:X509Certificate>MIIDczCCAlugAwIBAgIEQPMBRDANBgkqhkiG9w0BAQsFADBqMQswCQYDVQQGEwJJTjELMAkGA1UE CBMCVVAxDjAMBgNVBAcTBW5vaWRhMQ8wDQYDVQQKEwZxdWFya3MxFDASBgNVBAsTC0RldmVsb3Bt ZW50MRcwFQYDVQQDEw53d3cuZ3Rzb2x2LmNvbTAeFw0yMDA1MDUwNzQ1MzdaFw0yMDA4MDMwNzQ1 MzdaMGoxCzAJBgNVBAYTAklOMQswCQYDVQQIEwJVUDEOMAwGA1UEBxMFbm9pZGExDzANBgNVBAoT BnF1YXJrczEUMBIGA1UECxMLRGV2ZWxvcG1lbnQxFzAVBgNVBAMTDnd3dy5ndHNvbHYuY29tMIIB IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmxjm5uj0d91vKyGGyN8Cwr5VZ1FL+6GVex83 J5ULHfYhvFEb0sT8oEpJnEaS2flPDQotWWlN7eN57EHAu9Vo1CXWVo2FbUeNbmKcxDxbY/w+VKGU BCJYQOuSdXgzI3lLs9rpR/xdNUfBF6/I7zXdFli/yP6c3MZ8kJjTiJ+EnIYXTkZ4JBzApKjjPqzQ ss2MlFVjWCIXa3C46RUQWKT1uBnDcp+byrxrQYxk4oO2Glv7r/vKdRSXNJxkAnVIQSliU/e3YVrE 3ybdBpmoUi79sd1SK4NdwTtmbWpLBXP0Ale8p0jwU1cRBvB+MDvNSXwzv8nChXtixv5SDKKf3iIx PQIDAQABoyEwHzAdBgNVHQ4EFgQU9PSyv4q+dH2BtYeRfbEePSe9O4swDQYJKoZIhvcNAQELBQAD ggEBAIhcVcCgX58tdHisGqcs2Ti1emDi/jkrYdXttjcKHDVxRYNwZHj2z0wxpJmxCw7Qraf2FC6s mKdUZ0TwTPnWb9AVcNXu65pUJd/3bIPaQYQHb7II/aPD2+53FwAGhQdqV9oWQilu81/aqYLcjZ/I OuSU00xX0K/UE957cbFQl9VbnB34lOIuQRJAxX8y/fcl6yQ4V+4Ak1gcDYBnebehjx2JqCaRo4e8 M8ThYM0Jv0Wb6paiA+nN0uhQeapuwRbjUzOV26s8qzx5BFexWmNDAwGNgntXDOVXpQJdgORecnzC 1CdAjlzJ4ORvNM57ZSPZRCz6WXG/PRd5OcxLD9pktjg=</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</md:KeyDescriptor>
<md:KeyDescriptor use="encryption">
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:X509Data>
<ds:X509Certificate>MIIDczCCAlugAwIBAgIEQPMBRDANBgkqhkiG9w0BAQsFADBqMQswCQYDVQQGEwJJTjELMAkGA1UE CBMCVVAxDjAMBgNVBAcTBW5vaWRhMQ8wDQYDVQQKEwZxdWFya3MxFDASBgNVBAsTC0RldmVsb3Bt ZW50MRcwFQYDVQQDEw53d3cuZ3Rzb2x2LmNvbTAeFw0yMDA1MDUwNzQ1MzdaFw0yMDA4MDMwNzQ1 MzdaMGoxCzAJBgNVBAYTAklOMQswCQYDVQQIEwJVUDEOMAwGA1UEBxMFbm9pZGExDzANBgNVBAoT BnF1YXJrczEUMBIGA1UECxMLRGV2ZWxvcG1lbnQxFzAVBgNVBAMTDnd3dy5ndHNvbHYuY29tMIIB IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmxjm5uj0d91vKyGGyN8Cwr5VZ1FL+6GVex83 J5ULHfYhvFEb0sT8oEpJnEaS2flPDQotWWlN7eN57EHAu9Vo1CXWVo2FbUeNbmKcxDxbY/w+VKGU BCJYQOuSdXgzI3lLs9rpR/xdNUfBF6/I7zXdFli/yP6c3MZ8kJjTiJ+EnIYXTkZ4JBzApKjjPqzQ ss2MlFVjWCIXa3C46RUQWKT1uBnDcp+byrxrQYxk4oO2Glv7r/vKdRSXNJxkAnVIQSliU/e3YVrE 3ybdBpmoUi79sd1SK4NdwTtmbWpLBXP0Ale8p0jwU1cRBvB+MDvNSXwzv8nChXtixv5SDKKf3iIx PQIDAQABoyEwHzAdBgNVHQ4EFgQU9PSyv4q+dH2BtYeRfbEePSe9O4swDQYJKoZIhvcNAQELBQAD ggEBAIhcVcCgX58tdHisGqcs2Ti1emDi/jkrYdXttjcKHDVxRYNwZHj2z0wxpJmxCw7Qraf2FC6s mKdUZ0TwTPnWb9AVcNXu65pUJd/3bIPaQYQHb7II/aPD2+53FwAGhQdqV9oWQilu81/aqYLcjZ/I OuSU00xX0K/UE957cbFQl9VbnB34lOIuQRJAxX8y/fcl6yQ4V+4Ak1gcDYBnebehjx2JqCaRo4e8 M8ThYM0Jv0Wb6paiA+nN0uhQeapuwRbjUzOV26s8qzx5BFexWmNDAwGNgntXDOVXpQJdgORecnzC 1CdAjlzJ4ORvNM57ZSPZRCz6WXG/PRd5OcxLD9pktjg=</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</md:KeyDescriptor>
<md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://localcareers.timesgroup.com:8080/saml/SingleLogout"/>
<md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://localcareers.timesgroup.com:8080/saml/SingleLogout"/>
<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>
<md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat>
<md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</md:NameIDFormat>
<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>
<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</md:NameIDFormat>
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://localcareers.timesgroup.com:8080/saml/SSO" index="0" isDefault="true"/>
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://localcareers.timesgroup.com:8080/saml/SSO" index="1"/>
</md:SPSSODescriptor>
</md:EntityDescriptor>**
