<?php

return [

    'baseUrl'       =>  'https://buckhill.co.uk',

    'IdP'           => [
        sha1('https://authstack.co.uk') => [

            'entityId'      => 'https://authstack.co.uk',

            // Single Sign On service URL and binding. Binding can be Redirect (GET method) or POST
            'SSO' => [
                'url' => 'https://authstack.co.uk/saml2.0/sso',
                'binding' => \LightSaml\SamlConstants::BINDING_SAML2_HTTP_POST
            ],

            // Single Log Out service
            'SLO' => [
                'url'   => 'https://authstack.co.uk/saml2.0/slo',
                'binding' => \LightSaml\SamlConstants::BINDING_SAML2_HTTP_POST
            ],

            // IdP's public key, saved as encoded x.509 certificate
            // Don't provide paths to files or use file_get_contents - reason for that is that configuration is supposed to be serializable
            // to JSON and saved, so that clustering is easy (multiple php-fpm nodes can read from MySQL cluster, so it becomes irrelevant which node does the job)
            // Therefore, provide the actual x509 as a string
            'x509' => 'MIIGETCCA/mgAwIBAgIJAMER1d6GG2V/MA0GCSqGSIb3DQEBCwUAMIGeMQswCQYDVQQGEwJIUjERMA8GA1UECAwISHJ2YXRza2ExDzANBgNVBAcMBlphZ3JlYjEVMBMGA1UECgwMQnVja2hpbGwgTHRkMRIwEAYDVQQLDAlBdXRoU3RhY2sxGDAWBgNVBAMMD2F1dGhzdGFjay5jby51azEmMCQGCSqGSIb3DQEJARYXc3VwcG9ydEBhdXRoc3RhY2suY28udWswHhcNMTYwOTE0MTIzMjA2WhcNMjYwOTE0MTIzMjA2WjCBnjELMAkGA1UEBhMCSFIxETAPBgNVBAgMCEhydmF0c2thMQ8wDQYDVQQHDAZaYWdyZWIxFTATBgNVBAoMDEJ1Y2toaWxsIEx0ZDESMBAGA1UECwwJQXV0aFN0YWNrMRgwFgYDVQQDDA9hdXRoc3RhY2suY28udWsxJjAkBgkqhkiG9w0BCQEWF3N1cHBvcnRAYXV0aHN0YWNrLmNvLnVrMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAqW9E8Y/7gjZ/92tmZDZeWmOX2XJDf1SNKhQ94CXkpaqZpRNx801VQmDZu0r6KFDNwLusJp3JvAdkgxVgZSxkPqaVMzuYUtIVZ/itVYqezoPbdNTTsOb6QmJ1nSs6D+YHJEj8gBovz3zajPFSF9iSR0FxmoOkiEB/X5hVhKw/tgLSGauKihmsh5o3l0zOnllOcaQL3FnMftXHlzUvT2A2wxk2UrzQS1lVKwSyyPGk5e2XXeilZBVVp9jbYbyg9a9XSnt7StGDbBdBdftZTupusQcltjU3oWbTwUs2AQZGwmpzb+PiKasGSzM9V45MN7ASsemw1qv8WDXbu9Bt8SFvBcsC+weF/IVtt7554qPDEnvoWa1X1SYr47a7jO6rzLCLwF2dZrlKPVJMdej/OWSnrZ9jHGBLrQTO3Ljv2fzVCClmqHbiXpf9Xcy1TzRSrx5cP/OIArSoPB5M2/Nv3H2CvDdoZeBarc9usKPGv2AbIneW1Z/FlSkM/E8wk20Jn8AufktuaC9YHCRJ2SV8F3hFTNPAjj6iXqiNqk8vpAlqb1OYl1yBck87LhSwfiuiigBwE7E8nD8GU9AVrL51UdcZB2JfYRA9gPh0KeGqXO/NWeAO+P5+OsHUCL8ggeT0ny111ZNfUFS8rOqjO7KgVp2lQbYx2T9t7fv3IMPXKTSLN/kCAwEAAaNQME4wHQYDVR0OBBYEFMw+1YuuVauIBAv3kqzNjf7ZNYvvMB8GA1UdIwQYMBaAFMw+1YuuVauIBAv3kqzNjf7ZNYvvMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADggIBACbreEaF6O359druNRDdduWKGGInQ0wkKUtYnA9l6ttusIa6CyESr+/WJrUP2jjYfqpk0SbWQ5N9WSN2WMIw7rY00e4VjDZB7Q4TL9GpHHgpq/AXzY1QVcYM9L2RXSV6wCRl5IFGjt0/Y++DEJKqN87dMSwZMcU58ABfmjQ5XfPdy9PWFxW+z2nN1sHW55HsgXWm3fHoQ9U/uQXIdoWUGcwHjErc5NjDf/xxu+8/5r5ZtDK//cqp0uo+kB04Ab2rs9Jodwov+J20FqRwis3P17Ju2uFb/Uaqf0Qucd5yO1rV6NFzSMXpfr4Dwh/0GiFGVyMVFeIRMeJyK2/HXNa0px3OLWkfPv0cJZVIPB/SR8GZ6samGZjr0962ADQVV78AIXtEWQy1dcEH7gD3fWyGpznNAthhMd+mvg1otGn5G/0jsFvBOVrtEMLFN4n9zQ8UmVLGlTwSP5UcRnAxsrDbLPkO8d63w2WKxlYCH9Gm+/LW4ZrXWk7Zhagmu1eW3queq1coO1DJ86jpk/3LmzBb2gK3OtlMInF3V43GDBq6vNFMikd2PTbJUlqjcjpaIxLpIGT/0cgZaWi8p8q2uA6EWVgnvJSX3WjKSv01EdT851DUnEASWRUTMRIj/zcw1rwnEoUb4dYQ3NipEjtzFNcFUWaestygY5YQ1uoC0qyXHdpn',

            // If true, then service provider signs the requests so that IdP can prove the authenticity of message origin
            // For signing to work, you must have IdP's public key (usually delivered via x.509 certificate exposed in metadata)
            'wantsSignedRequests' => true
        ]
    ],


    'SP' => [
        'IdP' => 'https://authstack.web',

        // If no RelayState is defined in response, this is where we redirect the user after successful assertion consuming
        // It can be an absolute path or full url
        'redirectAfterSuccess' => '/account',

        // Key for session() under which user data will be saved
        'sessionKeyName' => 'SSOAuthProfile',

        // Configurable routes - you can specify your own controllers. Your controllers can extend the default controller
        'routes' => [
            'metadata' => [
                'path' => '/sso/saml2.0/metadata.xml',
                'methods' => ['get'],
                'controller' => '\\Buckhill\\LaravelSAML\\Http\\Controllers\\SSO@metadata'
            ],

            'authn' => [
                'path' => '/sso/saml2.0/authenticate',
                'methods' => ['get'],
                'controller' => '\\Buckhill\\LaravelSAML\\Http\\Controllers\\SSO@authn'
            ],

            'acs' => [
                'path' => '/sso/saml2.0/acs',
                'methods' => ['get', 'post'],
                'controller' => '\\Buckhill\\LaravelSAML\\Http\\Controllers\\SSO@acs'
            ],
        ],

        // Controls what gets validated to assert that SAML response is valid
        'validate' => [

            // If true, checks for presence of <samlp:Status> and tries to verify that its value is urn:oasis:names:tc:SAML:2.0:status:Success
            // If false, check is skipped
            'status' => true,

            // Checks whether the issuer matches IdP.entityId config key (verifies that actual and expected values are the same)
            // If false, check is skipped
            'issuer' => true,

            // Checks whether the destination in SAMLResponse matches the destination where this message is processed (simple URI comparison)
            // If false, check is skipped
            'destination' => true,

            // If true, this checks and compares the time when assertion was issued at. If it's older than 'interval' value, then assertion is considered expired
            // and ExpiredAssertionException is thrown
            'lifetime' => true,

            'upper' => '+1 minute',
            'lower' => '-1 minute'
        ],

        // Entity ID or "Name" of our Service Provider. This is used for verifying messages received by IdP
        'entityId'      => 'https://buckhill.co.uk',

        // Format in which we want to receive NameId back
        // For full list, check the LightSaml\SamlConstants class
        // NameId is equivalent to primary key in relational databases.
        // IdP will deliver the NameId value and NameIdFormat
        'nameIdFormat' => \LightSaml\SamlConstants::NAME_ID_FORMAT_EMAIL,

        // This is a map of attributes. On the left is the key name we'll use at this SP, on the right is the value that should be matched in assertion
        // If the IdP delivered 'cn' attribute, and we want to refer to that attribute as 'id' in our app, we map 'id' to 'cn'
        'attributes' => [
            'id'        => 'cn',
            'email'     => 'mail',
            'firstName' => 'givenname',
            'lastName'  => 'sn',
            'tel'       => 'telephoneNumber'
        ],

        // If true, then library verifies the signature in messages received from IdP, to prove authenticity of message origin
        'wantsSignedMessages' => true,

        // If true, each assertion will be signed using IdP's private key
        'wantsSignedAssertions' => false,

        // If true, each assertion will be encrypted on the IdP's side, using SP's public key
        // SP requires a private key to decrypt them. Public key will be delivered to the IdP in metadata exchange
        'wantsEncryptedAssertions' => true,

        // Location of the service which consumes responses sent by IdP
        // Information specified here is included in SP metadata
        // If your webiste doesn't use "pretty" urls, then simply include the path to the URL to the script which will be using this library
        'AssertionConsumerService' => [
            // Binding or method. In this case, method is HTTP POST, which means if someone sends a
            // POST request to http://sp/saml/acs then the library will be invoked in order to parse the message
            'binding' => \LightSaml\SamlConstants::BINDING_SAML2_HTTP_POST,
            'location' => '/sso/saml2.0/acs'
        ],

        // SLO (Single Log Out) is a service which logs the user out. In SSO environment, a user can be
        // logged on to multiple services and a Single Log Out should log the user out from all the services.
        // That means that each service is supposed to receive a SLO request, log the user out and then return
        // them back to IdP so that IdP can coordinate log out from other services. That's why it's important
        // to have defined Single Log Out service (defined means to actually have it working)
        'SLO' => [
            'binding' => \LightSaml\SamlConstants::BINDING_SAML2_HTTP_POST,
            'location' => '/sso/saml2.0/slo'
        ],

        // Keys used for signing / encrypting messages. These can be empty if SP and IdP are configured
        // to communicate without signing / encrypting messages.
        // If that's the case, then Idp <> SP communication should go over TLS (https)
        'keys' => [

            // Keypair used for signing purposes
            'signing' => [

                // Value of x.509 certificate
                // This is base64 encoded value, WITHOUT the ---BEGIN PUBLIC KEY---
                'x509' => '',

                'private' => '',

                'passphrase' => '',

                // Hash function for signature algorithm
                'algorithm' => \RobRichards\XMLSecLibs\XMLSecurityKey::RSA_SHA256
            ],

            // Keypair used for encrypting assertions
            'encryption' => [

                // Value of x.509 certificate
                'x509' => '',

                'private' => '',

                'passphrase' => '',

                // Hash function for signature algorithm
                'algorithm' => \RobRichards\XMLSecLibs\XMLSecurityKey::RSA_SHA256
            ]
        ]
    ]


];
