# Make sure that we use SSL throughout.
RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [NE,L,R]

# Strip off any jsessionid parameter.
# Unless this is a POST, force a redirect so the client sees the
# proper URL.  (We do not want to drop POSTed input).
RewriteCond %{REQUEST_METHOD} =POST
RewriteRule ^(.*);jsessionid=[A-Za-z0-9.]+(.*)$ $1$2 [NC,NE,PT]
RewriteRule ^(.*);jsessionid=[A-Za-z0-9.]+(.*)$ $1$2 [NC,NE,L,R]

# Cams protected resources
<Location /cams/NameupdateStart.action*>
  AuthType shibboleth
  ShibRequireSession On
  ShibRequireSessionWith CAMS
  ShibRedirectToSSL 443
  ShibUseHeaders On
  require user ~ ^.+@touchstonenetwork.net$
</Location>

<Location /cams/NameUpdate.action*>
  AuthType shibboleth
  ShibRequireSession On
  ShibRequireSessionWith CAMS
  ShibRedirectToSSL 443
  ShibUseHeaders On
  require user ~ ^.+@touchstonenetwork.net$
</Location>

<Location /cams/ProfileChangePasswordStart.action*>
  AuthType shibboleth
  ShibRequireSession On
  ShibRequireSessionWith CAMS
  ShibRedirectToSSL 443
  ShibUseHeaders On
  require user ~ ^.+@touchstonenetwork.net$
</Location>

<Location /cams/ProfileChangePassword.action*>
  AuthType shibboleth
  ShibRequireSession On
  ShibRequireSessionWith CAMS
  ShibRedirectToSSL 443
  ShibUseHeaders On
  require user ~ ^.+@touchstonenetwork.net$
</Location>

<Location /cams/AddAlternateIdRequest.action*>
  AuthType shibboleth
  ShibRequireSession On
  ShibRequireSessionWith CAMS
  ShibRedirectToSSL 443
  ShibUseHeaders On
  require user ~ ^.+@touchstonenetwork.net$
</Location>

<Location /cams/ManageAlternateId.action*>
  AuthType shibboleth
  ShibRequireSession On
  ShibRequireSessionWith CAMS
  ShibRedirectToSSL 443
  ShibUseHeaders On
  require user ~ ^.+@touchstonenetwork.net$
</Location>

<Location /cams/DeleteAltSecurity.action*>
  AuthType shibboleth
  ShibRequireSession On
  ShibRequireSessionWith CAMS
  ShibRedirectToSSL 443
  ShibUseHeaders On
  require user ~ ^.+@touchstonenetwork.net$
</Location>

<Location /cams/DeactivateAltSecurity.action*>
  AuthType shibboleth
  ShibRequireSession On
  ShibRequireSessionWith CAMS
  ShibRedirectToSSL 443
  ShibUseHeaders On
  require user ~ ^.+@touchstonenetwork.net$
</Location>

<Location /cams/ActivateAltSecurity.action*>
  AuthType shibboleth
  ShibRequireSession On
  ShibRequireSessionWith CAMS
  ShibRedirectToSSL 443
  ShibUseHeaders On
  require user ~ ^.+@touchstonenetwork.net$
</Location>

<Location /cams/AddAlternateSecurity.action*>
  AuthType shibboleth
  ShibRequireSession On
  ShibRequireSessionWith CAMS
  ShibRedirectToSSL 443
  ShibUseHeaders On
  require user ~ ^.+@touchstonenetwork.net$
</Location>

<Location /cams/UserMITNumber.action*>
  AuthType shibboleth
  ShibRequireSession On
  ShibRequireSessionWith CAMS
  ShibRedirectToSSL 443
  ShibUseHeaders On
  require user ~ ^.+@touchstonenetwork.net$
</Location>

<Location /cams/UserDeleteAccount.action*>
  AuthType shibboleth
  ShibRequireSession On
  ShibRequireSessionWith CAMS
  ShibRedirectToSSL 443
  ShibUseHeaders On
  require user ~ ^.+@touchstonenetwork.net$
</Location>

<Location /cams/UserMITNumberStart.action*>
  AuthType shibboleth
  ShibRequireSession On
  ShibRequireSessionWith CAMS
  ShibRedirectToSSL 443
  ShibUseHeaders On
  require user ~ ^.+@touchstonenetwork.net$
</Location>

<Location /cams/UserProfile.action*>
  AuthType shibboleth
  ShibRequireSession On
  ShibRequireSessionWith CAMS
  ShibRedirectToSSL 443
  ShibUseHeaders On
  require user ~ ^.+@touchstonenetwork.net$
</Location>

<Location /cams/UserRemoveMITId.action*>
  AuthType shibboleth
  ShibRequireSession On
  ShibRequireSessionWith CAMS
  ShibRedirectToSSL 443
  ShibUseHeaders On
  require user ~ ^.+@touchstonenetwork.net$
</Location>

<Location /cams/UserMITIdManualActivate.action*>
  AuthType shibboleth
  ShibRequireSession On
  ShibRequireSessionWith CAMS
  ShibRedirectToSSL 443
  ShibUseHeaders On
  require user ~ ^.+@touchstonenetwork.net$
</Location>

# Admin functions are defined as a separate application in shibboleth.xml,
# and go against the core IdP.
<Location /cams/admin/*>
  AuthType shibboleth
  ShibApplicationId camsAdmin
  ShibRequireSession On
  ShibRequireSessionWith MIT
  ShibRedirectToSSL 443
  ShibUseHeaders On
  require user ~ ^.+@mit.edu$
</Location>