<PicketLink xmlns="urn:picketlink:identity-federation:config:2.1">
  <PicketLinkIDP xmlns="urn:picketlink:identity-federation:config:2.1"
                   SupportsSignatures="true"
                   AttributeManager="org.picketlink.identity.federation.bindings.wildfly.idp.UndertowAttributeManager"
                   RoleGenerator="org.picketlink.identity.federation.bindings.wildfly.idp.UndertowRoleGenerator">
    <IdentityURL>${idp-sig.url::http://localhost:8080/idp-sig/}</IdentityURL>
    <Trust>
      <Domains>${sp.domains}</Domains>
    </Trust>
    <!-- WARNING: This bundled keystore is only for testing purposes. You should generate and configure your own keystore!-->
    <KeyProvider
      ClassName="org.picketlink.identity.federation.core.impl.KeyStoreKeyManager">
            <Auth Key="KeyStoreURL" Value="${picketlink.keystore}" />
      <!-- <Auth Key="KeyStorePass" Value="store123" /> -->
      <Auth Key="KeyStorePass" Value="MASK-O1P+U1Domeec8lCaoIkTGg==" />
      <!-- <Auth Key="SigningKeyPass" Value="test123" /> -->
      <Auth Key="SigningKeyPass" Value="MASK-AJbh4WmHwy8=" />
      <Auth Key="SigningKeyAlias" Value="servercert" />
      <Auth Key="X509CERTIFICATE" Value="servercert"/>
      <Auth Key="salt" Value="18273645" />
      <Auth Key="iterationCount" Value="11" />
            <ValidatingAlias Key="${sp.host}" Value="servercert" />
    </KeyProvider>
  </PicketLinkIDP>
  <Handlers xmlns="urn:picketlink:identity-federation:handler:config:2.1">
    <Handler
      class="org.picketlink.identity.federation.web.handlers.saml2.SAML2IssuerTrustHandler" />
    <Handler
      class="org.picketlink.identity.federation.web.handlers.saml2.SAML2LogOutHandler" />
    <Handler
      class="org.picketlink.identity.federation.web.handlers.saml2.SAML2AuthenticationHandler" />
    <Handler
      class="org.picketlink.identity.federation.web.handlers.saml2.RolesGenerationHandler" />
    <Handler
            class="org.picketlink.identity.federation.web.handlers.saml2.SAML2SignatureGenerationHandler">
            <!--
                This is a optional configuration. By default, method http://www.w3.org/2000/09/xmldsig#rsa-sha1
                and digest http://www.w3.org/2000/09/xmldsig#sha1 are used.
            -->
            <Option Key="SIGN_METHOD" Value="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
            <Option Key="SIGN_DIGEST" Value="http://www.w3.org/2001/04/xmlenc#sha256"/>
        </Handler>
  </Handlers>
</PicketLink>
