Install and configure the Matching Service Adapter¶

# Configure the matching service adapter's server settings here.
server:
  # Ports on which to listen for normal connections.
  # See http://www.dropwizard.io for information on HTTPS and TLS connections.
  applicationConnectors:
    - type: http
      port: 8080
  # Ports on which to listen for admin tasks.
  # This can probably be set to the above port+1.
  adminConnectors:
    - type: http
      port: 8081

# Add information about your matching service adapter (MSA) here.
matchingServiceAdapter:
  # The entityId is used for SAML communication with Verify.
  entityId: my-entity-id
  # The externalUrl is the internet-facing URL for your MSA.
  externalUrl: http://service.gov.uk/matching-service/POST

# Configure the URLs for your local matching service here.
localMatchingService:
  # The matchUrl is where the MSA should post user attributes on a successful match
  matchUrl: http://service.gov.uk/local-matching/match
  # The accountCreationUrl is where the MSA should post attributes for unknown users
  accountCreationUrl: http://service.gov.uk/local-matching/create-account

# Configure the key pairs used by your MSA for signing SAML messages here.
signingKeys:
  # The primary signing key is used to sign all messages to Verify.
  primary:
    publicKey:
      # The certificate (.crt) containing the primary public signing key:
      certFile: test_primary_signing.crt
      # The common name (CN) of that certificate:
      name: Test MSA Signing
    privateKey:
      # The PK8 (.pk8) containing the primary private signing key:
      keyFile: test_primary_signing.pk8
  # The public part of the secondary signing key is published in the MSA's metadata
  # during key rollovers but is otherwise unused by the MSA.
  secondary:
    publicKey:
      certFile: test_secondary_signing.crt
      name: Test Another MSA Signing
    privateKey:
      keyFile: test_secondary_signing.pk8

# Configure the key pairs used by your MSA for encrypting and decrypting SAML
# messages here. You can configure up to 2 encryption keys at a time and the MSA
# will attempt decryption with both. Only the first key will be used for encryption.
encryptionKeys:
  - publicKey:
      certFile: test_msa_encryption_1.crt
      name: Test MSA Encryption 1
    privateKey:
      keyFile: test_msa_encryption_1.pk8
  - publicKey:
      certFile: test_msa_encryption_2.crt
      name: Test MSA Encryption 2
    privateKey:
      keyFile: test_msa_encryption_2.pk8

# Settings for connecting with the hub can be configured here
# if necessary.
hub:
  ssoUrl: https://compliance-tool-reference.ida.digital.cabinet-office.gov.uk/SAML2/SSO

# Settings for obtaining Verify's metadata can be configured here.
metadata:
  environment: INTEGRATION
  url: https://compliance-tool-reference.ida.digital.cabinet-office.gov.uk/SAML2/metadata/federation
  trustStore:
    path: test_ida_metadata.ts
    password: puppet
# To override the `hub` and `idp` trust stores, i.e. for testing or manual modifications,
# you can extract them from the MSA JAR file to a local disk, modify them, and then un-comment the following section:
  # hubTrustStore:
    # path: test_hub.ts
    # password: puppet
  # idpTrustStore:
    # path: test_idp.ts
    # password: puppet

# This is a required section if your service needs to consume European identities.
europeanIdentity:
  enabled: ${EUROPEAN_IDENTITY_ENABLED} # true or false
  hubConnectorEntityId: https://www.integration.signin.service.gov.uk/SAML2/metadata/connector # The URL of the metadata for the node that requests and receives identities from European countries.
  # Configure metadata for European countries.
  aggregatedMetadata:
    trustAnchorUri: https://www.integration.signin.service.gov.uk/SAML2/metadata/trust-anchor # The location of the trust anchor used to validate country metadata
    metadataSourceUri: https://www.integration.signin.service.gov.uk/SAML2/metadata/aggregator # The location of the aggregated country metadata
    trustStore: # The location and password for the truststore
      path: test_ida_metadata.ts
      password: puppet

## Options to add additional logging. By default, logs will be output to console.
## See http://www.dropwizard.io for more information.
#logging:
#  level: INFO
#  appenders:
#    - type: file
#      currentLogFilename: apps-home/test-rp-msa.log
#      archivedLogFilenamePattern: apps-home/test-rp-msa.log.%d.gz
#      logFormat: '%-5p [%d{ISO8601,UTC}] %c: %X{logPrefix}%m%n%xEx'
#    - type: console
#      logFormat: '%-5p [%d{ISO8601,UTC}] %c: %X{logPrefix}%m%n%xEx'
#
#
## By default the MSA signs messages using SHA-256.
## Switch the flag below to `true` if you need to revert to SHA-1 signing:
#shouldSignWithSHA1: false