<?xml version="1.0" encoding="UTF-8"?>
<!--
          This is example metadata only. Do *NOT* supply it as is without review,
     and do *NOT* provide it in real time to your partners.

     This metadata is not dynamic - it will not change as your configuration changes.
-->
<EntityDescriptor  xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:shibmd="urn:mace:shibboleth:metadata:1.0" xmlns:xml="http://www.w3.org/XML/1998/namespace" xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui" entityID="https://hkafidp.hku.hk/idp/shibboleth">

    <IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol urn:oasis:names:tc:SAML:1.1:protocol urn:mace:shibboleth:1.0">

        <Extensions>
            <shibmd:Scope regexp="false">hku.hk</shibmd:Scope>
<!-- HKU -->
            <mdui:UIInfo>
                <mdui:DisplayName xml:lang="en">HKAF HKU Idp</mdui:DisplayName>
                <mdui:Description xml:lang="en">HKAF HKU Idp</mdui:Description>
		<mdui:InformationURL xml:lang="en">https://www.its.hku.hk</mdui:InformationURL>
<!--
                     <mdui:Logo height="80" width="80">https://hkafidp.hku.hk/Path/To/Logo.png</mdui:Logo>
-->
            </mdui:UIInfo>
        </Extensions>

        <KeyDescriptor use="signing">
            <ds:KeyInfo>
                    <ds:X509Data>
                        <ds:X509Certificate>
MIIDMDCCAhigAwIBAgIVAOronsiEDv12pgefTNSlco9EPj/cMA0GCSqGSIb3DQEB
CwUAMBwxGjAYBgNVBAMMEWp1Y2NhZi1pZHAuaGt1LmhrMB4XDTE2MDQwNDE0MzY0
MFoXDTM2MDQwNDE0MzY0MFowHDEaMBgGA1UEAwwRanVjY2FmLWlkcC5oa3UuaGsw
ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCgkXFdSKzdWIysHrlRYQ4g
9hlnM3nch20AgA4eOPYlFyPr8rqbbMQoygam7Y3ZqjqCK05EQS1JZHV5UciJBAIj
xwnYy0qpdQbj73/2U3qJpXnd/ehpwSZVu+5sUCeGCCBxy+Y2X/U5XtyqEImmT3Nt
528HAw9VV8p4mb0JF4t3vJ+bGYMH1iPD1rbZNr/3LA+U97AhFKtyvF5kgre7/g8q
/RgS3WzAyUOK2d+Gq7TiMD3Af3Q3Fm93q+IMJMCi3L2cmaBmugtLiTwBygXSq1WV
7nQToQvNoikiz0hg3IOhpJ4b2IBUlmmU8kEIK7KAu2kIbpCwamumREjYgcvOM07Z
AgMBAAGjaTBnMB0GA1UdDgQWBBQPl0+c/GJoB/YvwmJsVR9IDAblVjBGBgNVHREE
PzA9ghFqdWNjYWYtaWRwLmhrdS5oa4YoaHR0cHM6Ly9qdWNjYWYtaWRwLmhrdS5o
ay9pZHAvc2hpYmJvbGV0aDANBgkqhkiG9w0BAQsFAAOCAQEAYaShN485JZQZVZ0U
39uzbwvKytmakXRTTEV9o+uK/cnloPjT0BGrMNr6jm1FBQLi1RoaK3SV8CbLDDZX
dQc96lHfgOKL193axZUApLfzpwiUGhpB3ZMNpEVJG3bg+DZ4sSJxGCWEpYmJ9e2+
LwFXVM1P87wiLbbsXfmabAldvNFtAkOlFSAs9tl+MDBR6T64h4X7MVdQ+DX18/4Q
L0LSNYmQTOE5eG/jQ7kNPZBSnKmSWKyz8vA6MKtsvhbXQ4xHDnDlTJTonkgd5y+s
g8YwE+nUK+5cj81NDGmqlGML3Y/9qsMCXq7bUKew9yFZrlIjyItNo1AqZjgYINSd
wkP9kQ==
                        </ds:X509Certificate>
                    </ds:X509Data>
            </ds:KeyInfo>

        </KeyDescriptor>
        <KeyDescriptor use="signing">
            <ds:KeyInfo>
                    <ds:X509Data>
                        <ds:X509Certificate>
MIIDLzCCAhegAwIBAgIURo+yUsLcqVobRFQKYXTkqtAGfZEwDQYJKoZIhvcNAQEL
BQAwHDEaMBgGA1UEAwwRanVjY2FmLWlkcC5oa3UuaGswHhcNMTYwNDA0MTQzNjM5
WhcNMzYwNDA0MTQzNjM5WjAcMRowGAYDVQQDDBFqdWNjYWYtaWRwLmhrdS5oazCC
ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJ/MtINUNdAs7ZW6Llt1HsyG
u+mTyMD5X+HaGCcfiwsOmDGf7wVFjfgWgMHAT5YSM0idQu1bTAIc22fNcDRh/OKh
TNMwBfRUfnlPi0VvLaprn4YHVLduVI+O/XK6OWLzkRdbdPv71vEj01tUX+MzpywS
muAUmF4Tax4/psXLLLCk3si1SVEiRbYotQXJ/eO9KvuQjl8wF/MKqt2xzOMQM/Gq
pAxg9U8/5U2NiSNK32YgLud2DQy9DygmdMBfd5TiTtzxI1g7OVO/sslJTtzOk7AK
TAGKRXq71KQqtgJWE34ZGmOV9vs5HY3Ipdab+Sd9h1YVtPMjp/fpLQwkGiQVhhkC
AwEAAaNpMGcwHQYDVR0OBBYEFBxa3wSWJEzJkZIFaoMUpU9UNFEnMEYGA1UdEQQ/
MD2CEWp1Y2NhZi1pZHAuaGt1LmhrhihodHRwczovL2p1Y2NhZi1pZHAuaGt1Lmhr
L2lkcC9zaGliYm9sZXRoMA0GCSqGSIb3DQEBCwUAA4IBAQCO+InZTnuvelsv+UQ5
9LyWYtSfZ/RiF59szZHfYbsh8hS8JaYVzfEyI0Ah2neXkREU+EepZWLXcvjF4ypG
Qfy43GyDF4MTVh3GAL36y2KEqQN43AxkPlq9UEpBdmpF0HDBuwAOW8OvEUI2CTj4
Z97wWp2/ZMJrxnmnr8vFgymhtb39xempor4j4qkWcIwEflpX5+H2oOKj2KCV9VGL
dRGKH7jyFPhXxce5OSg8xkwC4oU02+W99/F7iUIdR+T/HbLkn2whMugRr8sGiWEu
mzjKkCj+6+pj8CAaSAkXx+EM/5mDZgWUbCfJG6cb6F3GwBfYMf+s3m8sgauYXM2I
opfF
                        </ds:X509Certificate>
                    </ds:X509Data>
            </ds:KeyInfo>

        </KeyDescriptor>
        <KeyDescriptor use="encryption">
            <ds:KeyInfo>
                    <ds:X509Data>
                        <ds:X509Certificate>
MIIDLzCCAhegAwIBAgIUeWAofqPKd1x6+a0b9zVH0LD/ONowDQYJKoZIhvcNAQEL
BQAwHDEaMBgGA1UEAwwRanVjY2FmLWlkcC5oa3UuaGswHhcNMTYwNDA0MTQzNjQw
WhcNMzYwNDA0MTQzNjQwWjAcMRowGAYDVQQDDBFqdWNjYWYtaWRwLmhrdS5oazCC
ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK9Qwvlw1uR3mA5eMI4pA959
RNZS1S/b1UYFdsIWdQd55JUZ0UhbfMgf9hAlONNuJNv4QMOzwCWi5JgpkLGAhR/7
gavUTmUg3k26wOW5TPwwjuysDmIjPgk9yo9kQjyBflgdGovDr/wit15AVjxQQksp
duvUgoANeMRc+fDdM38YL0wp/HjC2ExzLrlnNuMDwti4q077g2UzshPdAJLrbbyS
2B4cQLR1qomNmbvP27Iod74MgI2ZFjkjoxv3T9/R/YrTy+M1zoLU3a4tLnQ1if1z
MgEC08LjPrCQKaVrRq1piqMKYD/ZQoHKJvz9iyULVZvrWJ6tPSjRZIe8ekI6LuUC
AwEAAaNpMGcwHQYDVR0OBBYEFDqKCA78VKI+1A5Bt8wvVUzDWN7CMEYGA1UdEQQ/
MD2CEWp1Y2NhZi1pZHAuaGt1LmhrhihodHRwczovL2p1Y2NhZi1pZHAuaGt1Lmhr
L2lkcC9zaGliYm9sZXRoMA0GCSqGSIb3DQEBCwUAA4IBAQBVmATJSstH+D73P98x
5BJiDOVgc2lav5jsSOB410xeNE5K8dQdBFR5w17uRAwL9TB/99aIYiB22r5s0ddY
+i+j6XhZzfBVhlBS7FY4ev/vcHheFX8mgIJ2WmG4VtaN4mAECAYRFLqdI5R/HQyZ
2XrGA5He8cz9a4LQj8NKvBFIXZstXzq/2A3Dhx8o0BrvIlK86vpvCZRRB6jx+Db8
gpDnkdH9j2czhPg0MFcu1X1j+89OzMu1EqAALSSKtRKTOQSsNrlqPFoU02JUTGwn
oWmCKH+PenrnRS77MER8uKF3OAfvG3V6Y9tU2/Lc2of6Dai8GVsGFRI9zXfnUOk+
JCuX
                        </ds:X509Certificate>
                    </ds:X509Data>
            </ds:KeyInfo>

        </KeyDescriptor>

        <ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding" Location="https://hkafidp.hku.hk/idp/profile/SAML1/SOAP/ArtifactResolution" index="1"/>
        <ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://hkafidp.hku.hk/idp/profile/SAML2/SOAP/ArtifactResolution" index="2"/>

        <!--
                     <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://hkafidp.hku.hk/idp/profile/SAML2/Redirect/SLO"/>
        <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://hkafidp.hku.hk/idp/profile/SAML2/POST/SLO"/>
        <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="https://hkafidp.hku.hk/idp/profile/SAML2/POST-SimpleSign/SLO"/>
        <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://hkafidp.hku.hk/idp/profile/SAML2/SOAP/SLO"/>
        -->

        <NameIDFormat>urn:mace:shibboleth:1.0:nameIdentifier</NameIDFormat>
        <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>

        <SingleSignOnService Binding="urn:mace:shibboleth:1.0:profiles:AuthnRequest" Location="https://hkafidp.hku.hk/idp/profile/Shibboleth/SSO"/>
        <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://hkafidp.hku.hk/idp/profile/SAML2/POST/SSO"/>
        <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="https://hkafidp.hku.hk/idp/profile/SAML2/POST-SimpleSign/SSO"/>
        <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://hkafidp.hku.hk/idp/profile/SAML2/Redirect/SSO"/>

    </IDPSSODescriptor>


    <AttributeAuthorityDescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol">

        <Extensions>
            <shibmd:Scope regexp="false">hku.hk</shibmd:Scope>
        </Extensions>

        <KeyDescriptor use="signing">
            <ds:KeyInfo>
                    <ds:X509Data>
                        <ds:X509Certificate>
MIIDMDCCAhigAwIBAgIVAOronsiEDv12pgefTNSlco9EPj/cMA0GCSqGSIb3DQEB
CwUAMBwxGjAYBgNVBAMMEWp1Y2NhZi1pZHAuaGt1LmhrMB4XDTE2MDQwNDE0MzY0
MFoXDTM2MDQwNDE0MzY0MFowHDEaMBgGA1UEAwwRanVjY2FmLWlkcC5oa3UuaGsw
ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCgkXFdSKzdWIysHrlRYQ4g
9hlnM3nch20AgA4eOPYlFyPr8rqbbMQoygam7Y3ZqjqCK05EQS1JZHV5UciJBAIj
xwnYy0qpdQbj73/2U3qJpXnd/ehpwSZVu+5sUCeGCCBxy+Y2X/U5XtyqEImmT3Nt
528HAw9VV8p4mb0JF4t3vJ+bGYMH1iPD1rbZNr/3LA+U97AhFKtyvF5kgre7/g8q
/RgS3WzAyUOK2d+Gq7TiMD3Af3Q3Fm93q+IMJMCi3L2cmaBmugtLiTwBygXSq1WV
7nQToQvNoikiz0hg3IOhpJ4b2IBUlmmU8kEIK7KAu2kIbpCwamumREjYgcvOM07Z
AgMBAAGjaTBnMB0GA1UdDgQWBBQPl0+c/GJoB/YvwmJsVR9IDAblVjBGBgNVHREE
PzA9ghFqdWNjYWYtaWRwLmhrdS5oa4YoaHR0cHM6Ly9qdWNjYWYtaWRwLmhrdS5o
ay9pZHAvc2hpYmJvbGV0aDANBgkqhkiG9w0BAQsFAAOCAQEAYaShN485JZQZVZ0U
39uzbwvKytmakXRTTEV9o+uK/cnloPjT0BGrMNr6jm1FBQLi1RoaK3SV8CbLDDZX
dQc96lHfgOKL193axZUApLfzpwiUGhpB3ZMNpEVJG3bg+DZ4sSJxGCWEpYmJ9e2+
LwFXVM1P87wiLbbsXfmabAldvNFtAkOlFSAs9tl+MDBR6T64h4X7MVdQ+DX18/4Q
L0LSNYmQTOE5eG/jQ7kNPZBSnKmSWKyz8vA6MKtsvhbXQ4xHDnDlTJTonkgd5y+s
g8YwE+nUK+5cj81NDGmqlGML3Y/9qsMCXq7bUKew9yFZrlIjyItNo1AqZjgYINSd
wkP9kQ==
                        </ds:X509Certificate>
                    </ds:X509Data>
            </ds:KeyInfo>

        </KeyDescriptor>
        <KeyDescriptor use="signing">
            <ds:KeyInfo>
                    <ds:X509Data>
                        <ds:X509Certificate>
MIIDLzCCAhegAwIBAgIURo+yUsLcqVobRFQKYXTkqtAGfZEwDQYJKoZIhvcNAQEL
BQAwHDEaMBgGA1UEAwwRanVjY2FmLWlkcC5oa3UuaGswHhcNMTYwNDA0MTQzNjM5
WhcNMzYwNDA0MTQzNjM5WjAcMRowGAYDVQQDDBFqdWNjYWYtaWRwLmhrdS5oazCC
ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJ/MtINUNdAs7ZW6Llt1HsyG
u+mTyMD5X+HaGCcfiwsOmDGf7wVFjfgWgMHAT5YSM0idQu1bTAIc22fNcDRh/OKh
TNMwBfRUfnlPi0VvLaprn4YHVLduVI+O/XK6OWLzkRdbdPv71vEj01tUX+MzpywS
muAUmF4Tax4/psXLLLCk3si1SVEiRbYotQXJ/eO9KvuQjl8wF/MKqt2xzOMQM/Gq
pAxg9U8/5U2NiSNK32YgLud2DQy9DygmdMBfd5TiTtzxI1g7OVO/sslJTtzOk7AK
TAGKRXq71KQqtgJWE34ZGmOV9vs5HY3Ipdab+Sd9h1YVtPMjp/fpLQwkGiQVhhkC
AwEAAaNpMGcwHQYDVR0OBBYEFBxa3wSWJEzJkZIFaoMUpU9UNFEnMEYGA1UdEQQ/
MD2CEWp1Y2NhZi1pZHAuaGt1LmhrhihodHRwczovL2p1Y2NhZi1pZHAuaGt1Lmhr
L2lkcC9zaGliYm9sZXRoMA0GCSqGSIb3DQEBCwUAA4IBAQCO+InZTnuvelsv+UQ5
9LyWYtSfZ/RiF59szZHfYbsh8hS8JaYVzfEyI0Ah2neXkREU+EepZWLXcvjF4ypG
Qfy43GyDF4MTVh3GAL36y2KEqQN43AxkPlq9UEpBdmpF0HDBuwAOW8OvEUI2CTj4
Z97wWp2/ZMJrxnmnr8vFgymhtb39xempor4j4qkWcIwEflpX5+H2oOKj2KCV9VGL
dRGKH7jyFPhXxce5OSg8xkwC4oU02+W99/F7iUIdR+T/HbLkn2whMugRr8sGiWEu
mzjKkCj+6+pj8CAaSAkXx+EM/5mDZgWUbCfJG6cb6F3GwBfYMf+s3m8sgauYXM2I
opfF
                        </ds:X509Certificate>
                    </ds:X509Data>
            </ds:KeyInfo>

        </KeyDescriptor>
        <KeyDescriptor use="encryption">
            <ds:KeyInfo>
                    <ds:X509Data>
                        <ds:X509Certificate>
MIIDLzCCAhegAwIBAgIUeWAofqPKd1x6+a0b9zVH0LD/ONowDQYJKoZIhvcNAQEL
BQAwHDEaMBgGA1UEAwwRanVjY2FmLWlkcC5oa3UuaGswHhcNMTYwNDA0MTQzNjQw
WhcNMzYwNDA0MTQzNjQwWjAcMRowGAYDVQQDDBFqdWNjYWYtaWRwLmhrdS5oazCC
ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK9Qwvlw1uR3mA5eMI4pA959
RNZS1S/b1UYFdsIWdQd55JUZ0UhbfMgf9hAlONNuJNv4QMOzwCWi5JgpkLGAhR/7
gavUTmUg3k26wOW5TPwwjuysDmIjPgk9yo9kQjyBflgdGovDr/wit15AVjxQQksp
duvUgoANeMRc+fDdM38YL0wp/HjC2ExzLrlnNuMDwti4q077g2UzshPdAJLrbbyS
2B4cQLR1qomNmbvP27Iod74MgI2ZFjkjoxv3T9/R/YrTy+M1zoLU3a4tLnQ1if1z
MgEC08LjPrCQKaVrRq1piqMKYD/ZQoHKJvz9iyULVZvrWJ6tPSjRZIe8ekI6LuUC
AwEAAaNpMGcwHQYDVR0OBBYEFDqKCA78VKI+1A5Bt8wvVUzDWN7CMEYGA1UdEQQ/
MD2CEWp1Y2NhZi1pZHAuaGt1LmhrhihodHRwczovL2p1Y2NhZi1pZHAuaGt1Lmhr
L2lkcC9zaGliYm9sZXRoMA0GCSqGSIb3DQEBCwUAA4IBAQBVmATJSstH+D73P98x
5BJiDOVgc2lav5jsSOB410xeNE5K8dQdBFR5w17uRAwL9TB/99aIYiB22r5s0ddY
+i+j6XhZzfBVhlBS7FY4ev/vcHheFX8mgIJ2WmG4VtaN4mAECAYRFLqdI5R/HQyZ
2XrGA5He8cz9a4LQj8NKvBFIXZstXzq/2A3Dhx8o0BrvIlK86vpvCZRRB6jx+Db8
gpDnkdH9j2czhPg0MFcu1X1j+89OzMu1EqAALSSKtRKTOQSsNrlqPFoU02JUTGwn
oWmCKH+PenrnRS77MER8uKF3OAfvG3V6Y9tU2/Lc2of6Dai8GVsGFRI9zXfnUOk+
JCuX
                        </ds:X509Certificate>
                    </ds:X509Data>
            </ds:KeyInfo>

        </KeyDescriptor>

        <AttributeService Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding" Location="https://hkafidp.hku.hk/idp/profile/SAML1/SOAP/AttributeQuery"/>
        <!-- <AttributeService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://hkafidp.hku.hk/idp/profile/SAML2/SOAP/AttributeQuery"/> -->
        <!-- If you uncomment the above you should add urn:oasis:names:tc:SAML:2.0:protocol to the protocolSupportEnumeration above -->

    </AttributeAuthorityDescriptor>

        <md:Extensions xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">
                <mdattr:EntityAttributes xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute">
                        <!-- Attribute for REFEDS Research & Scholarship -->
                        <saml:Attribute xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
                                        NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
                                        Name="http://macedir.org/entity-category-support">
                                <saml:AttributeValue>http://refeds.org/category/research-and-scholarship</saml:AttributeValue>
                        </saml:Attribute>

                        <!-- Attribute for REFEDS SIRTFI -->
                        <saml:Attribute xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
                                        NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
                                        Name="urn:oasis:names:tc:SAML:attribute:assurance-certification">
                                <saml:AttributeValue>https://refeds.org/sirtfi</saml:AttributeValue>
                        </saml:Attribute>
                </mdattr:EntityAttributes>
        </md:Extensions>

        <md:ContactPerson contactType="technical"
                          xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">
                <md:GivenName>Information Technology Services</md:GivenName>
                <md:EmailAddress>mailto:ithelp@hku.hk</md:EmailAddress>
        </md:ContactPerson>

        <md:ContactPerson contactType="administrative"
                          xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">
                <md:GivenName>Information Technology Services</md:GivenName>
                <md:EmailAddress>mailto:ithelp@hku.hk</md:EmailAddress>
        </md:ContactPerson>

        <md:ContactPerson contactType="support"
                          xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">
                <md:GivenName>Information Technology Services</md:GivenName>
                <md:EmailAddress>mailto:ithelp@hku.hk</md:EmailAddress>
        </md:ContactPerson>

        <!-- security contact with REFEDS syntax -->
        <md:ContactPerson contactType="other"
                          xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
                          xmlns:remd="http://refeds.org/metadata"
                          remd:contactType="http://refeds.org/metadata/contactType/security">
                <md:GivenName>Kelvin Chan</md:GivenName>
                <md:EmailAddress>mailto:lhkchan@hku.hk</md:EmailAddress>
        </md:ContactPerson>

</EntityDescriptor>

