<?php

return [

    // Entity ID or "Name" of our Service Provider. This is used for verifying messages received by IdP
    'EntityId'      => 'https://sp.tld/saml/entity.xml',

    // Entity ID of Identity Provider. This value will be HASHED and then looked up in 'idp.php' configuration file
    // That's the mechanism behind selecting appropriate IdP
    'IdentityProvider' => 'https://authstack',

    // Base URL of your service provider. The Assertion consumer service and single logout service URIs will be added
    // to Base URL
    'baseUrl' => 'https://sp.tld',

    // Format in which we want to receive NameId back
    // For full list, check the LightSaml\SamlConstants class
    // NameId is equivalent to primary key in relational databases.
    // IdP will deliver the NameId value and NameIdFormat
    // Bear in mind that certain IdP's can't deliver the Name ID in desired format
    'nameIdFormat' => \LightSaml\SamlConstants::NAME_ID_FORMAT_EMAIL,

    // If true, then library verifies the signature in messages received from IdP, to prove authenticity of message origin
    'wantsSignedMessages' => true,

    // If true, each assertion will be signed using IdP's private key
    'wantsSignedAssertions' => false,

    // If true, each assertion will be encrypted on the IdP's side, using SP's public key
    // SP requires a private key to decrypt them. Public key will be delivered to the IdP in metadata exchange
    'wantsEncryptedAssertions' => false,

    // Location of the service which consumes responses sent by IdP
    // Information specified here is included in SP metadata
    // If your webiste doesn't use "pretty" urls, then simply include the path to the URL to the script which will be using this library
    'AssertionConsumerService' => [
        // Binding or method. In this case, method is HTTP POST, which means if someone sends a
        // POST request to http://sp/saml/acs then the library will be invoked in order to parse the message
        'binding' => \LightSaml\SamlConstants::BINDING_SAML2_HTTP_POST,
        'location' => '/saml/acs'
    ],

    // SLO (Single Log Out) is a service which logs the user out. In SSO environment, a user can be
    // logged on to multiple services and a Single Log Out should log the user out from all the services.
    // That means that each service is supposed to receive a SLO request, log the user out and then return
    // them back to IdP so that IdP can coordinate log out from other services. That's why it's important
    // to have defined Single Log Out service (defined means to actually have it working)
    'SLO' => [
        'binding' => \LightSaml\SamlConstants::BINDING_SAML2_HTTP_POST,
        'location' => '/saml/slo'
    ],

    'validate' => [

        // Validates IdP's signature. Prevents unknown IdP's from sending whatever they want. You don't want to turn this off.
        'signature' => true,

        // If true, checks for presence of <samlp:Status> and tries to verify that its value is urn:oasis:names:tc:SAML:2.0:status:Success
        // If false, check is skipped
        'status' => true,

        // Checks whether the issuer matches IdP.entityId config key (verifies that actual and expected values are the same)
        // If false, check is skipped
        'issuer' => true,

        // Checks whether the destination in SAMLResponse matches the destination where this message is processed (simple URI comparison)
        // If false, check is skipped
        'destination' => true,

        // Validates whether the assertion expired
        // Below configuration checks whether the message is older than 1 minute or not. If it is, then it's not valid
        'lifetime' => true,

        // Upper time boundary (not AFTER 1 minute)
        'upper'     => '+1 minute',

        // Lower time boundary (not BEFORE 1 minute)
        'lower'     => '-1 minute'
    ],

    // Keys used for signing / encrypting messages. These can be empty if SP and IdP are configured
    // to communicate without signing / encrypting messages.
    // If that's the case, then Idp <> SP communication should go over TLS (https)
    'keys' => [

        // Keypair used for signing purposes
        'signing' => [

            // X.509 certificate
            // This is base64 encoded value, WITHOUT the ---BEGIN PUBLIC KEY---
            'x509' => <<<EOF
MIIEEDCCAvigAwIBAgIJAIfobjSZS5HNMA0GCSqGSIb3DQEBCwUAMIGcMQswCQYD
VQQGEwJIUjERMA8GA1UECAwISHJ2YXRza2ExDzANBgNVBAcMBlphZ3JlYjEUMBIG
A1UECgwLY2toaWxsIEx0ZC4xFDASBgNVBAsMC0RldmVsb3BtZW50MRowGAYDVQQD
DBFodHRwczovL2F1dGhzdGFjazEhMB8GCSqGSIb3DQEJARYSbmlhQGJ1Y2toaWxs
LmNvLnVrMB4XDTE4MDMxNjEyNTQ1NloXDTE5MDMxNjEyNTQ1NlowgZwxCzAJBgNV
BAYTAkhSMREwDwYDVQQIDAhIcnZhdHNrYTEPMA0GA1UEBwwGWmFncmViMRQwEgYD
VQQKDAtja2hpbGwgTHRkLjEUMBIGA1UECwwLRGV2ZWxvcG1lbnQxGjAYBgNVBAMM
EWh0dHBzOi8vYXV0aHN0YWNrMSEwHwYJKoZIhvcNAQkBFhJuaWFAYnVja2hpbGwu
Y28udWswggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDmRvaPPaSqI93/
Ie+3l3RzYVc3tH7gjdbW/bmAoepjt0bEP7oh/85iDqysyLApLoS2F8B7uPJ0WPkf
Jk0c6LyD6gHoGeCXDWRhtKuKxFCkpAl9e8n8PQ8nwxrqXORohvRUVnhsYGzMzhsm
ZfR8x4IwwzjT7TIZzLa0dk76SkuQzmP7x3lJ2M36cSyxf4CyZJPhJaFg1Rm9CCCI
qTb2MWpxSOTfxVjffFvZGiUyL+hLSxIQ8IXDEiD7Uhmwjm/2hlBXzfuZ8r9Xmy/l
eockkJs4FI2inrLT1WDc7+Ds1f2vLMvXHFxsW8ejYhSnkM5w5a2vnPNN4Mc2/5Nb
FIBQUUbvAgMBAAGjUzBRMB0GA1UdDgQWBBSX6v9xkCH9P80Iu5Nl958S+cOgUjAf
BgNVHSMEGDAWgBSX6v9xkCH9P80Iu5Nl958S+cOgUjAPBgNVHRMBAf8EBTADAQH/
MA0GCSqGSIb3DQEBCwUAA4IBAQA5ZbhW4Fj0GA9w6eUN5sudUzLXnWnhVd9T7Ihc
UWfqRRRSEGpO4Bm1qXzhRvbwhW7qYcPzjEK4k+EHPcIOmKn9b4TtbMmgjHavR1t5
gV0ap98o8BKG8XP4k/tHA91jQtiLp7mfzuHaeYQXrL3vLYAvj5Bv7XSOEI8GpbF5
XwQGLhuqVEPNcsxfh3/gmYyUTK/4gh/m+DVgREqZ79tvY4K5pRUJ8pFI47co3q4Q
VMy+/TiCOc1R2g1Pstz/xDIbQBPJsypAo1kZw8Bl22DtcEy1He5hkRd0WisUt/qJ
389P/L0pZc2/S36BLDMqyPxKpgd3ck6UTQm5RCWg2Kc6gK3v
EOF
,

            // Value of private key
            'private' => <<<EOF
-----BEGIN ENCRYPTED PRIVATE KEY-----
MIIFHDBOBgkqhkiG9w0BBQ0wQTApBgkqhkiG9w0BBQwwHAQI9DY+t4lMWwgCAggA
MAwGCCqGSIb3DQIJBQAwFAYIKoZIhvcNAwcECNgzhVE7Gb8yBIIEyBhecVCmfkvX
V3pr1C/1cmYlGRh/f2D8wa2s5St0Ct6ty594PIhaYMJSZ555rj/buaBTAhxN2YZk
Mvl0D1kahOvK9BeSEzpiKY/k1uxjS0B+4g0kqEvOd/q5tstdp7DliHm4oqvZic7B
ixcC/U5+FxBChyVC32y8bhvLGbiQFP3O3wNgiS8wQCFSm2LqtD4yUxPCB/DYUUm5
xV6IyTfiADpO/L2TGRZxlDV/5xoobBwMCavu9M5RJV46E4exJgirJJZjVLAfJvNr
5J+hHZZkZ97UQjd1JoNDyto1R3imfzxzjBm+N5g1tSswq7OaqpCKhpOYah/wOtxt
0hjWdrT3tAzedIK/97nRseitLWls+K67h7CYzvteAf5KHbz2eokF/4Pw+50ZVuMr
xzLNBaw3XuNz6cdiefWCTTORUyXy9ywOJ462rEzVr4B9pdNR/WX75WnrMZcpKqMv
sGj9FjHJ/6a1J81bzM18ee2mmSvaFHAOPHdOkFU4dDCDI34l+UudGf2ceC+0CISK
E2nu5Npkq9+jYvjZ42vWwjY7nzlrwgRIXTdTZvjVUJcSySTJtHOKpvmkBeYn3A12
8+q4L10vAueX1yq2AMUzFWcDeS7k6uzqiqtGlWAHm/NehMsMhk6IZLbUbee2DLzA
LZIr4hgd2aK9l9SHgEAPPcv+27Ck37/TXcmhzZhXMMiPCBU1njRBCelfC+GEaQyG
X+mGCh45LDCsj8ma/dbuMQyzCxQR3Po0NW0++viK4gzNtu90OQgzpzsPP4HnON0F
2CnTNPLQ4iMfVWB+Vh4IAlyBbV8ZFtM9AtJsRe9eNkZJXOzocYS5Sv8t48rWRkRv
tDGrDQvncXkHQXsb1fia4X2qFlik/8Hs1U8sGj8sDwpyHnhPnrWda39z12D2n28j
BP43I1Nfh4Z3xaLUPtutR4wkooEy6Hic0U8HZ9R/r4GrKSMxPihRjO1pDB4V1y0f
oe1shgK4JMR62+ederHUq/a7I+ygkVsqcWRggo9wpA6UGMLD0ZKPo5eLmFPjpFdK
mDUg5vFKmlTFN2tg1AeMuHvNW3CpLvVf7DIuzFSmBpFpDQ7eRxrijR3GfxGmEX20
Z9klu495Tix0+BW0SSi+CH1V/ZJjXMs7eYJovb1UI4Om3pnIC0K8SmXS1cd5QfDM
UUJMRR2gHK9JuDmWIohQDDuG99kS1V3TzYXtaEyJCSDa+l/lKmyTBvDo3zIzf1eO
kS/DGrV/j32cE+7jWf5coc6f+BdbqZ1UdEa6qnNJBOJLAK07Nd6bAQkA3zzc20WE
djxXRjPawrI0AAs7qj12BoSKe2G1YkWxYjLkM5LLUVYI189Arh62eurNCSM3LakT
V9eIKU0fEr4p/jvVUu/ltIcP+/fJAe+5/+gqAua9h1KekKYiFMs8uxgkhuneK5l3
WWAh7AEoTR2tJ9522nLhSZLzUzYez3qRq5RkEz11Canf6a+K730VGTEoER9uXBfo
mTFegX9sfOK9AwIC373A/0xQ5jAI/ujS/vLfbx7ozoTJUeGEmnI2OGavN4CqRvcc
WGlMDy2F0s1q6JONep51leKeGI1UTMyRHgYaPKQb7tIKPN3v0TPk/gFToC1vPn9R
jvRWZcoN8NNfqNLAa+S3RA==
-----END ENCRYPTED PRIVATE KEY-----
EOF
,

            // Passphrase for the private key, if any
            'passphrase' => 'test',

            // Hash function for signature algorithm
            'algorithm' => \RobRichards\XMLSecLibs\XMLSecurityKey::RSA_SHA256
        ],

        // Keypair used for encrypting assertions
        'encryption' => [

            // X.509 certificate
            'x509' => <<<EOF
MIIEEDCCAvigAwIBAgIJAIfobjSZS5HNMA0GCSqGSIb3DQEBCwUAMIGcMQswCQYD
VQQGEwJIUjERMA8GA1UECAwISHJ2YXRza2ExDzANBgNVBAcMBlphZ3JlYjEUMBIG
A1UECgwLY2toaWxsIEx0ZC4xFDASBgNVBAsMC0RldmVsb3BtZW50MRowGAYDVQQD
DBFodHRwczovL2F1dGhzdGFjazEhMB8GCSqGSIb3DQEJARYSbmlhQGJ1Y2toaWxs
LmNvLnVrMB4XDTE4MDMxNjEyNTQ1NloXDTE5MDMxNjEyNTQ1NlowgZwxCzAJBgNV
BAYTAkhSMREwDwYDVQQIDAhIcnZhdHNrYTEPMA0GA1UEBwwGWmFncmViMRQwEgYD
VQQKDAtja2hpbGwgTHRkLjEUMBIGA1UECwwLRGV2ZWxvcG1lbnQxGjAYBgNVBAMM
EWh0dHBzOi8vYXV0aHN0YWNrMSEwHwYJKoZIhvcNAQkBFhJuaWFAYnVja2hpbGwu
Y28udWswggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDmRvaPPaSqI93/
Ie+3l3RzYVc3tH7gjdbW/bmAoepjt0bEP7oh/85iDqysyLApLoS2F8B7uPJ0WPkf
Jk0c6LyD6gHoGeCXDWRhtKuKxFCkpAl9e8n8PQ8nwxrqXORohvRUVnhsYGzMzhsm
ZfR8x4IwwzjT7TIZzLa0dk76SkuQzmP7x3lJ2M36cSyxf4CyZJPhJaFg1Rm9CCCI
qTb2MWpxSOTfxVjffFvZGiUyL+hLSxIQ8IXDEiD7Uhmwjm/2hlBXzfuZ8r9Xmy/l
eockkJs4FI2inrLT1WDc7+Ds1f2vLMvXHFxsW8ejYhSnkM5w5a2vnPNN4Mc2/5Nb
FIBQUUbvAgMBAAGjUzBRMB0GA1UdDgQWBBSX6v9xkCH9P80Iu5Nl958S+cOgUjAf
BgNVHSMEGDAWgBSX6v9xkCH9P80Iu5Nl958S+cOgUjAPBgNVHRMBAf8EBTADAQH/
MA0GCSqGSIb3DQEBCwUAA4IBAQA5ZbhW4Fj0GA9w6eUN5sudUzLXnWnhVd9T7Ihc
UWfqRRRSEGpO4Bm1qXzhRvbwhW7qYcPzjEK4k+EHPcIOmKn9b4TtbMmgjHavR1t5
gV0ap98o8BKG8XP4k/tHA91jQtiLp7mfzuHaeYQXrL3vLYAvj5Bv7XSOEI8GpbF5
XwQGLhuqVEPNcsxfh3/gmYyUTK/4gh/m+DVgREqZ79tvY4K5pRUJ8pFI47co3q4Q
VMy+/TiCOc1R2g1Pstz/xDIbQBPJsypAo1kZw8Bl22DtcEy1He5hkRd0WisUt/qJ
389P/L0pZc2/S36BLDMqyPxKpgd3ck6UTQm5RCWg2Kc6gK3v
EOF
            ,

            // Value of private key
            'private' => <<<EOF
-----BEGIN ENCRYPTED PRIVATE KEY-----
MIIFHDBOBgkqhkiG9w0BBQ0wQTApBgkqhkiG9w0BBQwwHAQI9DY+t4lMWwgCAggA
MAwGCCqGSIb3DQIJBQAwFAYIKoZIhvcNAwcECNgzhVE7Gb8yBIIEyBhecVCmfkvX
V3pr1C/1cmYlGRh/f2D8wa2s5St0Ct6ty594PIhaYMJSZ555rj/buaBTAhxN2YZk
Mvl0D1kahOvK9BeSEzpiKY/k1uxjS0B+4g0kqEvOd/q5tstdp7DliHm4oqvZic7B
ixcC/U5+FxBChyVC32y8bhvLGbiQFP3O3wNgiS8wQCFSm2LqtD4yUxPCB/DYUUm5
xV6IyTfiADpO/L2TGRZxlDV/5xoobBwMCavu9M5RJV46E4exJgirJJZjVLAfJvNr
5J+hHZZkZ97UQjd1JoNDyto1R3imfzxzjBm+N5g1tSswq7OaqpCKhpOYah/wOtxt
0hjWdrT3tAzedIK/97nRseitLWls+K67h7CYzvteAf5KHbz2eokF/4Pw+50ZVuMr
xzLNBaw3XuNz6cdiefWCTTORUyXy9ywOJ462rEzVr4B9pdNR/WX75WnrMZcpKqMv
sGj9FjHJ/6a1J81bzM18ee2mmSvaFHAOPHdOkFU4dDCDI34l+UudGf2ceC+0CISK
E2nu5Npkq9+jYvjZ42vWwjY7nzlrwgRIXTdTZvjVUJcSySTJtHOKpvmkBeYn3A12
8+q4L10vAueX1yq2AMUzFWcDeS7k6uzqiqtGlWAHm/NehMsMhk6IZLbUbee2DLzA
LZIr4hgd2aK9l9SHgEAPPcv+27Ck37/TXcmhzZhXMMiPCBU1njRBCelfC+GEaQyG
X+mGCh45LDCsj8ma/dbuMQyzCxQR3Po0NW0++viK4gzNtu90OQgzpzsPP4HnON0F
2CnTNPLQ4iMfVWB+Vh4IAlyBbV8ZFtM9AtJsRe9eNkZJXOzocYS5Sv8t48rWRkRv
tDGrDQvncXkHQXsb1fia4X2qFlik/8Hs1U8sGj8sDwpyHnhPnrWda39z12D2n28j
BP43I1Nfh4Z3xaLUPtutR4wkooEy6Hic0U8HZ9R/r4GrKSMxPihRjO1pDB4V1y0f
oe1shgK4JMR62+ederHUq/a7I+ygkVsqcWRggo9wpA6UGMLD0ZKPo5eLmFPjpFdK
mDUg5vFKmlTFN2tg1AeMuHvNW3CpLvVf7DIuzFSmBpFpDQ7eRxrijR3GfxGmEX20
Z9klu495Tix0+BW0SSi+CH1V/ZJjXMs7eYJovb1UI4Om3pnIC0K8SmXS1cd5QfDM
UUJMRR2gHK9JuDmWIohQDDuG99kS1V3TzYXtaEyJCSDa+l/lKmyTBvDo3zIzf1eO
kS/DGrV/j32cE+7jWf5coc6f+BdbqZ1UdEa6qnNJBOJLAK07Nd6bAQkA3zzc20WE
djxXRjPawrI0AAs7qj12BoSKe2G1YkWxYjLkM5LLUVYI189Arh62eurNCSM3LakT
V9eIKU0fEr4p/jvVUu/ltIcP+/fJAe+5/+gqAua9h1KekKYiFMs8uxgkhuneK5l3
WWAh7AEoTR2tJ9522nLhSZLzUzYez3qRq5RkEz11Canf6a+K730VGTEoER9uXBfo
mTFegX9sfOK9AwIC373A/0xQ5jAI/ujS/vLfbx7ozoTJUeGEmnI2OGavN4CqRvcc
WGlMDy2F0s1q6JONep51leKeGI1UTMyRHgYaPKQb7tIKPN3v0TPk/gFToC1vPn9R
jvRWZcoN8NNfqNLAa+S3RA==
-----END ENCRYPTED PRIVATE KEY-----
EOF
            ,

            // Passphrase for the private key, if any
            'passphrase' => 'test',

            // Hash function for signature algorithm
            'algorithm' => \RobRichards\XMLSecLibs\XMLSecurityKey::RSA_SHA256
        ]
    ]
];