<?php
/*
 * This is an EXAMPLE to help you configure a SimpleSAMLphp 2.0.x identity provider
 * to produce metadata that is reasonably complete and closely meets SAIFRE's
 * recommendations. You may need to hand-edit the result, but hopefully not much.
 */
$metadata['https://idp.example.ac.za/simplesaml/module.php/saml/idp/metadata'] = [ /* entityID - unique identifier within your domain name space */
    'host' => '__DEFAULT__',
    'privatekey' => 'server.pem',
    'privatekey_pass' => 'YourPrivateKeyPassphrase', /* you encrypt your private key, right? */
    'certificate' => 'server.crt', /* see https://safire.ac.za/technical/resources/generating-certificates-for-safire/ */
    'auth' => 'example-userpass', /* from config/authsources.php */
    'scope' => ['safire.ac.za', 'wf.safire.ac.za'], /* Scopes showing all possible valid right-hand-sides for eduPersonPrincipalName and mail */
    'SingleSignOnServiceBinding' => ['urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',], /* SAML2int only requires HTTP-Redirect, but could include HTTP-POST */
    'SingleLogoutServiceBinding' => ['urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',], /* SAML2int only requires HTTP-Redirect, but could include HTTP-POST */
    'attributes.NameFormat' => 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri',

    /*
     * Feel free to include as many official translations as you have.
     * English, IsiZulu, isiXhosa & Afrikaans currently natively supported.
     * Where a translation is not included, English will be used by default.
     */
    'OrganizationName' => [ /* Legal Name */
        'en' => 'Example University',
        'af' => 'Byvorbeeld Universiteit',
    ],
    'OrganizationDisplayName' => [ /* Name your university is commonly known by */
        'en' => 'ExampleU',
        'af' => 'ByvorbeeldU',
    ],
    'OrganizationURL' => ['en' => 'https://www.example.ac.za/',], /* Your home page */
    'UIInfo' => [
        'DisplayName' => [ /* usually same as OrganizationDisplayName */
            'en' => 'Example Identity Provider',
            'af' => 'Byvorbeeld Identiteit Verskaffer',
        ],
        'Description' => [
            'en' => 'Example Identity Provider',
            'af' => 'Byvorbeeld Identiteit Verskaffer',
        ],
        'PrivacyStatementURL' => ['en' => 'https://idp.example.ac.za/privacy-statement-or-policy-for-my-idp',], /* STRONGLY RECOMMENDED */
        'InformationURL' => ['en' => 'https://idp.example.ac.za/about-my-idp',], /* suggested */
        'Logo' => [
            [ /* Recommended by Shibboleth SP */
                'url' => 'https://sp.example.ac.za/my-16x16-logo.png',
                'height' => 16,
                'width' => 16,
            ],
            [ /* Recommended by Shibboleth SP */
                'url' => 'https://idp.example.ac.za/my-80x60-logo.png',
                'height' => 60,
                'width' => 80,
            ],
            [ /* This is the size recommended by SAFIRE (at least 150x150, square) */
                'url' => 'https://idp.example.ac.za/my-300x300-logo.png',
                'height' => 300,
                'width' => 300,
            ],
        ],
    ],
    'DiscoHints' => [ /* centre of your campus. u= radius in metres */
        'GeolocationHint' => ['geo:-34.002972,18.467533;u=100'],
    ],
    'contacts' => [ /* technical contact is added automatically from config/config.php */
        [
            'contactType' => 'support',
            'emailAddress' => 'mailto:support@example.ac.za', /* role not person */
            'givenName' => 'Example University Help Desk',
            'telephoneNumber' => '+27.21.114.0000',
        ],
        [
            /* required security contact */
            'contactType' => 'other',
            'emailAddress' => 'mailto:csirt@example.ac.za',
            'givenName' => 'Example University CSIRT',
            'telephoneNumber' => '+27.21.114.9999',
            'attributes' => [
                'xmlns:remd' => 'http://refeds.org/metadata',
                'remd:contactType' => 'http://refeds.org/metadata/contactType/security',
            ],
        ],
    ],

    'authproc' => [
        /*
         * here you can manipulate the attributes you got from your authsource
         * before sending them to the federation/other services. You use
         * authentication processing filters as described at
         * https://simplesamlphp.org/docs/stable/simplesamlphp-authproc.html
         */
        // to generate a SAML subject-id
        /*
        20 => [
            'class' => 'saml:SubjectID',
            'identifyingAttribute' => 'objectID', // some unique, non-assignable attribute
            'scopeAttribute' => 'eduPersonPrincipalName',
        ],
        */
        100 => ['class' => 'core:AttributeMap', 'name2oid',],
        /* subject identifier - separated to ensure it only ever processes aftere name2oid */
        101 => ['class' => 'core:AttributeMap', 'name2urn',],
    ],
];