<?php

return [

    // Entity ID or "Name" of our Service Provider. This is used for verifying messages received by IdP
    'EntityId'      => 'https://sp.tld/saml/entity.xml',

    // Entity ID of Identity Provider. This value will be HASHED and then looked up in 'idp.php' configuration file
    // That's the mechanism behind selecting appropriate IdP
    'IdentityProvider' => 'https://www.authstack.co.uk',

    // Base URL of your service provider. The Assertion consumer service and single logout service URIs will be added
    // to Base URL
    'baseUrl' => 'https://sp.tld',

    // Format in which we want to receive NameId back
    // For full list, check the LightSaml\SamlConstants class
    // NameId is equivalent to primary key in relational databases.
    // IdP will deliver the NameId value and NameIdFormat
    // Bear in mind that certain IdP's can't deliver the Name ID in desired format
    'nameIdFormat' => \LightSaml\SamlConstants::NAME_ID_FORMAT_EMAIL,

    // If true, then library verifies the signature in messages received from IdP, to prove authenticity of message origin
    'wantsSignedMessages' => true,

    // If true, each assertion will be signed using IdP's private key
    'wantsSignedAssertions' => false,

    // If true, each assertion will be encrypted on the IdP's side, using SP's public key
    // SP requires a private key to decrypt them. Public key will be delivered to the IdP in metadata exchange
    'wantsEncryptedAssertions' => true,

    // Location of the service which consumes responses sent by IdP
    // Information specified here is included in SP metadata
    // If your webiste doesn't use "pretty" urls, then simply include the path to the URL to the script which will be using this library
    'AssertionConsumerService' => [
        // Binding or method. In this case, method is HTTP POST, which means if someone sends a
        // POST request to http://sp/saml/acs then the library will be invoked in order to parse the message
        'binding' => \LightSaml\SamlConstants::BINDING_SAML2_HTTP_POST,
        'location' => '/saml/acs'
    ],

    // SLO (Single Log Out) is a service which logs the user out. In SSO environment, a user can be
    // logged on to multiple services and a Single Log Out should log the user out from all the services.
    // That means that each service is supposed to receive a SLO request, log the user out and then return
    // them back to IdP so that IdP can coordinate log out from other services. That's why it's important
    // to have defined Single Log Out service (defined means to actually have it working)
    'SLO' => [
        'binding' => \LightSaml\SamlConstants::BINDING_SAML2_HTTP_POST,
        'location' => '/saml/slo'
    ],

    'validate' => [

        // Validates IdP's signature. Prevents unknown IdP's from sending whatever they want. You don't want to turn this off.
        'signature' => true,

        // If true, checks for presence of <samlp:Status> and tries to verify that its value is urn:oasis:names:tc:SAML:2.0:status:Success
        // If false, check is skipped
        'status' => true,

        // Checks whether the issuer matches IdP.entityId config key (verifies that actual and expected values are the same)
        // If false, check is skipped
        'issuer' => true,

        // Checks whether the destination in SAMLResponse matches the destination where this message is processed (simple URI comparison)
        // If false, check is skipped
        'destination' => true,

        // Validates whether the assertion expired
        // Below configuration checks whether the message is older than 1 minute or not. If it is, then it's not valid
        'lifetime' => true,

        // Upper time boundary (not AFTER 1 minute)
        'upper'     => '+1 minute',

        // Lower time boundary (not BEFORE 1 minute)
        'lower'     => '-1 minute'
    ],

    // Keys used for signing / encrypting messages. These can be empty if SP and IdP are configured
    // to communicate without signing / encrypting messages.
    // If that's the case, then Idp <> SP communication should go over TLS (https)
    'keys' => [

        // Keypair used for signing purposes
        'signing' => [

            // Value of x.509 certificate
            // This is base64 encoded value, WITHOUT the ---BEGIN PUBLIC KEY---
            'x509' => '',

            // Value of private key
            'private' => '',

            // Passphrase for the private key, if any
            'passphrase' => '',

            // Hash function for signature algorithm
            'algorithm' => \RobRichards\XMLSecLibs\XMLSecurityKey::RSA_SHA256
        ],

        // Keypair used for encrypting assertions
        'encryption' => [

            // Value of x.509 certificate
            'x509' => '',

            // Value of private key
            'private' => '',

            // Passphrase for the private key, if any
            'passphrase' => '',

            // Hash function for signature algorithm
            'algorithm' => \RobRichards\XMLSecLibs\XMLSecurityKey::RSA_SHA256
        ]
    ]
];