<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE web-app PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN" "/opt/nevisproxy/dtd/web-app_2_3.dtd">
<web-app>
    <!-- source: pattern://6df66943ca713eed2a25d935 -->
    <context-param>
        <param-name>SectokenVerifierCert</param-name>
        <param-value>/var/opt/keys/trust/proxy-sp-nevisidm-sectoken-truststore/truststore.pem</param-value>
    </context-param>
    <!-- source: pattern://6df66943ca713eed2a25d935 -->
    <filter>
        <filter-name>AuthenticationService_OP-ONBRDNG-AuthenticationRealm</filter-name>
        <filter-class>ch::nevis::isiweb4::filter::auth::IdentityCreationFilter</filter-class>
        <!-- source: pattern://6df66943ca713eed2a25d935 -->
        <init-param>
            <param-name>AuthenticationServlet</param-name>
            <param-value>Connector_OP-ONBRDNG-AuthenticationRealm</param-value>
        </init-param>
        <!-- source: pattern://6df66943ca713eed2a25d935 -->
        <init-param>
            <param-name>BodyReadSize</param-name>
            <param-value>32768</param-value>
        </init-param>
        <!-- source: pattern://6df66943ca713eed2a25d935 -->
        <init-param>
            <param-name>EntryPointID</param-name>
            <param-value>op.agov-w.azure.adnovum.net</param-value>
        </init-param>
        <!-- source: pattern://6df66943ca713eed2a25d935 -->
        <init-param>
            <param-name>InactiveInterval</param-name>
            <param-value>1200</param-value>
        </init-param>
        <!-- source: pattern://6df66943ca713eed2a25d935 -->
        <init-param>
            <param-name>InterceptionRedirect</param-name>
            <param-value>never</param-value>
        </init-param>
        <!-- source: pattern://6df66943ca713eed2a25d935 -->
        <init-param>
            <param-name>LoginRendererServlet</param-name>
            <param-value>LoginRenderer_nevisLogrend</param-value>
        </init-param>
        <!-- source: pattern://6df66943ca713eed2a25d935 -->
        <init-param>
            <param-name>Realm</param-name>
            <param-value>OP-ONBRDNG-AuthenticationRealm</param-value>
        </init-param>
        <!-- source: pattern://6df66943ca713eed2a25d935 -->
        <init-param>
            <param-name>RecheckAuthentication</param-name>
            <param-value>On</param-value>
        </init-param>
        <!-- source: pattern://6df66943ca713eed2a25d935 -->
        <init-param>
            <param-name>RenewIdentification</param-name>
            <param-value>true</param-value>
        </init-param>
        <!-- source: pattern://6df66943ca713eed2a25d935 -->
        <init-param>
            <param-name>StateKey</param-name>
            <param-value>OP-ONBRDNG-AuthenticationRealm</param-value>
        </init-param>
        <!-- source: pattern://6df66943ca713eed2a25d935 -->
        <init-param>
            <param-name>StoreInterceptedRequest</param-name>
            <param-value>false</param-value>
        </init-param>
    </filter>
    <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
    <filter>
        <filter-name>Authentication_SAML_SP_nevisidm_operations_Realm</filter-name>
        <filter-class>ch::nevis::isiweb4::filter::auth::IdentityCreationFilter</filter-class>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <init-param>
            <param-name>AuthenticationServlet</param-name>
            <param-value>Connector_SAML_SP_nevisidm_operations_Realm</param-value>
        </init-param>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <init-param>
            <param-name>EntryPointID</param-name>
            <param-value>op.agov-w.azure.adnovum.net</param-value>
        </init-param>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <init-param>
            <param-name>InactiveInterval</param-name>
            <param-value>1800</param-value>
        </init-param>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <init-param>
            <param-name>InterceptionRedirect</param-name>
            <param-value>never</param-value>
        </init-param>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <init-param>
            <param-name>LoginRendererServlet</param-name>
            <param-value>LoginRenderer_nevisLogrend</param-value>
        </init-param>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <init-param>
            <param-name>Realm</param-name>
            <param-value>SAML_SP_nevisidm_operations_Realm</param-value>
        </init-param>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <init-param>
            <param-name>RenewIdentification</param-name>
            <param-value>true</param-value>
        </init-param>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <init-param>
            <param-name>StateKey</param-name>
            <param-value>SAML_SP_nevisidm_operations_Realm</param-value>
        </init-param>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <init-param>
            <param-name>StoreInterceptedRequest</param-name>
            <param-value>false</param-value>
        </init-param>
    </filter>
    <!-- source: pattern://088e03c92ee8a5168b030e9e -->
    <filter>
        <filter-name>Authorization_Required_Roles_AGOV-Loi.level300_AGOV-Loi.level400_AGOV-Loi.level500_SAML_SP_nevisidm_operations_Realm</filter-name>
        <filter-class>ch::nevis::isiweb4::filter::auth::SecurityRoleFilter</filter-class>
        <!-- source: pattern://088e03c92ee8a5168b030e9e -->
        <init-param>
            <param-name>DynamicRoleAcquire</param-name>
            <param-value>false</param-value>
        </init-param>
        <!-- source: pattern://088e03c92ee8a5168b030e9e -->
        <init-param>
            <param-name>RolesRequired</param-name>
            <param-value>AGOV-Loi.level300 AGOV-Loi.level400 AGOV-Loi.level500</param-value>
        </init-param>
    </filter>
    <!-- source: pattern://13ea034de32c190083ba9e35, pattern://13ea034de32c190083ba9e35#nevisIDM -->
    <filter>
        <filter-name>CSRFRewrite_nevisIDM_Operations_Administration_GUI</filter-name>
        <filter-class>ch::nevis::isiweb4::filter::rewrite::RewriteFilter</filter-class>
        <!-- source: pattern://13ea034de32c190083ba9e35 -->
        <init-param>
            <param-name>ResponseBody</param-name>
            <param-value>PCRE/(if\s?\(isValidDomain\(document.domain,).*$/:$1(function(h) { var i = h.indexOf("\:"); return h.substring(0, i != -1 ? i \: h.length) })("ENV\:HTTP_Host;"))) {:PT</param-value>
        </init-param>
        <!-- source: pattern://13ea034de32c190083ba9e35 -->
        <init-param>
            <param-name>ResponseBody.Mode</param-name>
            <param-value>replacement</param-value>
        </init-param>
    </filter>
    <!-- source: pattern://58ece0328f5bf4d78e1a82d2, pattern://58ece0328f5bf4d78e1a82d2#filters -->
    <filter>
        <filter-name>DefaultErrorFilter</filter-name>
        <filter-class>ch::nevis::isiweb4::filter::error::ErrorFilter</filter-class>
        <!-- source: pattern://58ece0328f5bf4d78e1a82d2#filters -->
        <init-param>
            <param-name>CheckAcceptHeader</param-name>
            <param-value>true</param-value>
        </init-param>
        <!-- source: pattern://58ece0328f5bf4d78e1a82d2#filters -->
        <init-param>
            <param-name>PlaceHolders</param-name>
            <param-value>
                TransferIdHolder:TRANSFER_ID
                TimestampHolder:TIMESTAMP
            </param-value>
        </init-param>
        <!-- source: pattern://58ece0328f5bf4d78e1a82d2#filters -->
        <init-param>
            <param-name>StatusCode</param-name>
            <param-value>
                403:NevisLogrendConnector_nevisLogrend:/nevislogrend/webdata/template/403.vm?logrendresourcepath=/nevislogrend:keep-status-code
                404:NevisLogrendConnector_nevisLogrend:/nevislogrend/webdata/template/404.vm?logrendresourcepath=/nevislogrend:keep-status-code
                408:NevisLogrendConnector_nevisLogrend:/nevislogrend/webdata/template/timeout.vm?logrendresourcepath=/nevislogrend:keep-status-code
                500:NevisLogrendConnector_nevisLogrend:/nevislogrend/webdata/template/500.vm?logrendresourcepath=/nevislogrend:keep-status-code
                502:NevisLogrendConnector_nevisLogrend:/nevislogrend/webdata/template/502.vm?logrendresourcepath=/nevislogrend:keep-status-code
            </param-value>
        </init-param>
    </filter>
    <!-- source: pattern://58ece0328f5bf4d78e1a82d2, pattern://58ece0328f5bf4d78e1a82d2#filters -->
    <filter>
        <filter-name>FallbackErrorFilter</filter-name>
        <filter-class>ch::nevis::isiweb4::filter::error::ErrorFilter</filter-class>
        <!-- source: pattern://58ece0328f5bf4d78e1a82d2#filters -->
        <init-param>
            <param-name>CheckAcceptHeader</param-name>
            <param-value>true</param-value>
        </init-param>
        <!-- source: pattern://58ece0328f5bf4d78e1a82d2#filters -->
        <init-param>
            <param-name>PlaceHolders</param-name>
            <param-value>
                TransferIdHolder:TRANSFER_ID
                TimestampHolder:TIMESTAMP
            </param-value>
        </init-param>
        <!-- source: pattern://58ece0328f5bf4d78e1a82d2#filters -->
        <init-param>
            <param-name>StatusCode</param-name>
            <param-value>
                500:file:/resources/errorPages/500.html:reset-header:reset-status-code
                502:file:/resources/errorPages/502.html:reset-header:reset-status-code
                503:file:/resources/errorPages/500.html:reset-header:reset-status-code
                504:file:/resources/errorPages/500.html:reset-header:reset-status-code
            </param-value>
        </init-param>
    </filter>
    <!-- source: pattern://29a7ba8eaff67eb26d2394bc -->
    <filter>
        <filter-name>Lua_CSP_Security_Response_Headers</filter-name>
        <filter-class>ch::nevis::isiweb4::filter::lua::LuaFilter</filter-class>
        <!-- source: pattern://29a7ba8eaff67eb26d2394bc -->
        <init-param>
            <param-name>Script.Namespace</param-name>
            <param-value>param_</param-value>
        </init-param>
        <!-- source: pattern://29a7ba8eaff67eb26d2394bc -->
        <init-param>
            <param-name>Script.OutputHeaderFunctionName</param-name>
            <param-value>outputHeader</param-value>
        </init-param>
        <!-- source: pattern://29a7ba8eaff67eb26d2394bc -->
        <init-param>
            <param-name>Script.Path</param-name>
            <param-value>/var/opt/nevisproxy/default/host-op.agov-w.azure.adnovum.net/WEB-INF/csp_security_response_headers.lua</param-value>
        </init-param>
        <!-- source: pattern://29a7ba8eaff67eb26d2394bc -->
        <init-param>
            <param-name>param_csp</param-name>
            <param-value>default-src 'none'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; form-action 'self' https://trustbroker.agov-d.azure.adnovum.net/ https://me.agov-d.azure.adnovum.net/; font-src 'self'; manifest-src 'self';</param-value>
        </init-param>
        <!-- source: pattern://29a7ba8eaff67eb26d2394bc -->
        <init-param>
            <param-name>param_report_only_csp</param-name>
            <param-value>default-src 'none'; script-src 'self'; connect-src 'self'; img-src 'self'; style-src 'self' 'unsafe-inline'; form-action 'self' https://trustbroker.agov-d.azure.adnovum.net/ https://me.agov-d.azure.adnovum.net/; font-src 'self'; manifest-src 'self';</param-value>
        </init-param>
    </filter>
    <!-- source: pattern://f010ec68088ebd56349c7135 -->
    <filter>
        <filter-name>ModSecurity_GreenMail</filter-name>
        <filter-class>ch::nevis::nevisproxy::filter::modsecurity::ModsecurityFilter</filter-class>
        <!-- source: pattern://f010ec68088ebd56349c7135 -->
        <init-param>
            <param-name>ConfigFile</param-name>
            <param-value>/var/opt/nevisproxy/default/host-op.agov-w.azure.adnovum.net/WEB-INF/security_greenmail.conf</param-value>
        </init-param>
    </filter>
    <!-- source: pattern://f02bc0de60aad829670e4c5b -->
    <filter>
        <filter-name>ModSecurity_OP-ONBRDNG-ModSecuritySettings</filter-name>
        <filter-class>ch::nevis::nevisproxy::filter::modsecurity::ModsecurityFilter</filter-class>
        <!-- source: pattern://f02bc0de60aad829670e4c5b -->
        <init-param>
            <param-name>ConfigFile</param-name>
            <param-value>/var/opt/nevisproxy/default/host-op.agov-w.azure.adnovum.net/WEB-INF/security_op-onbrdng-modsecuritysettings.conf</param-value>
        </init-param>
    </filter>
    <!-- source: pattern://13ea034de32c190083ba9e35 -->
    <filter>
        <filter-name>ModSecurity_nevisIDM_Operations_Administration_GUI</filter-name>
        <filter-class>ch::nevis::nevisproxy::filter::modsecurity::ModsecurityFilter</filter-class>
        <!-- source: pattern://13ea034de32c190083ba9e35 -->
        <init-param>
            <param-name>ConfigFile</param-name>
            <param-value>/var/opt/nevisproxy/default/host-op.agov-w.azure.adnovum.net/WEB-INF/security_nevisidm_operations_administration_gui.conf</param-value>
        </init-param>
    </filter>
    <!-- source: pattern://39ecde9a0d101628fed3e3be -->
    <filter>
        <filter-name>Redirect_Default</filter-name>
        <filter-class>ch::nevis::isiweb4::filter::rewrite::RewriteFilter</filter-class>
        <!-- source: pattern://39ecde9a0d101628fed3e3be -->
        <init-param>
            <param-name>RequestURI</param-name>
            <param-value>^/$:/nevisidm/admin/:R</param-value>
        </init-param>
    </filter>
    <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
    <filter>
        <filter-name>Requirement_NEVIS_SecToken_SAML_SP_nevisidm_operations_Realm</filter-name>
        <filter-class>ch::nevis::isiweb4::filter::auth::SecurityRoleFilter</filter-class>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <init-param>
            <param-name>AuthenticationServlet</param-name>
            <param-value>Connector_SAML_SP_nevisidm_operations_Realm</param-value>
        </init-param>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <init-param>
            <param-name>DynamicRoleAcquire</param-name>
            <param-value>true</param-value>
        </init-param>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <init-param>
            <param-name>DynamicRoleAcquire.CheckRoleRemoval</param-name>
            <param-value>false</param-value>
        </init-param>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <init-param>
            <param-name>InterceptionRedirect</param-name>
            <param-value>never</param-value>
        </init-param>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <init-param>
            <param-name>LoginRendererServlet</param-name>
            <param-value>LoginRenderer_nevisLogrend</param-value>
        </init-param>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <init-param>
            <param-name>RolesRequired</param-name>
            <param-value>token.NEVIS_SecToken</param-value>
        </init-param>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <init-param>
            <param-name>StoreInterceptedRequest</param-name>
            <param-value>false</param-value>
        </init-param>
    </filter>
    <!-- source: pattern://36886a1934993d1f69690e1d -->
    <filter>
        <filter-name>ResponseHeader_Base_Security_Response_Headers</filter-name>
        <filter-class>ch::nevis::isiweb4::filter::delegation::HeaderDelegationFilter</filter-class>
        <!-- source: pattern://36886a1934993d1f69690e1d -->
        <init-param>
            <param-name>DelegateToFrontend</param-name>
            <param-value>
                Cross-Origin-Embedder-Policy:require-corp
                Cross-Origin-Opener-Policy:same-origin
                Cross-Origin-Resource-Policy:same-site
                Permissions-Policy:geolocation=(), camera=(), microphone=(), interest-cohort=()
                Referrer-Policy:strict-origin-when-cross-origin
                Strict-Transport-Security:max-age=63072000; includeSubDomains;
                X-Content-Type-Options:nosniff
                X-Frame-Options:DENY
            </param-value>
        </init-param>
    </filter>
    <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
    <filter>
        <filter-name>SAML_AllowCORS_SAML_SP_nevisidm_operations_Realm</filter-name>
        <filter-class>ch::nevis::isiweb4::filter::lua::LuaFilter</filter-class>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <init-param>
            <param-name>Script</param-name>
            <param-value>
                function inputHeader(request, response)
                    if request:getHeader("Origin") == "https://trustbroker.agov-d.azure.adnovum.net" then
                        response:setHeader("Access-Control-Allow-Origin", "https://trustbroker.agov-d.azure.adnovum.net")
                    end
                    response:setHeader("Access-Control-Allow-Credentials", "true")
                    response:setHeader("Access-Control-Expose-Headers", "*")                           
                    if request:getMethod() == "OPTIONS" then
                        response:send(204)
                    end
                end
            </param-value>
        </init-param>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <init-param>
            <param-name>Script.InputHeaderFunctionName</param-name>
            <param-value>inputHeader</param-value>
        </init-param>
    </filter>
    <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
    <filter>
        <filter-name>SAML_SAML_SP_nevisidm_operations_Realm</filter-name>
        <filter-class>ch::nevis::isiweb4::filter::auth::IdentityCreationFilter</filter-class>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <init-param>
            <param-name>AuthenticationServlet</param-name>
            <param-value>Connector_SAML_SP_nevisidm_operations_Realm</param-value>
        </init-param>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <init-param>
            <param-name>BodyReadSize</param-name>
            <param-value>32768</param-value>
        </init-param>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <init-param>
            <param-name>EntryPointID</param-name>
            <param-value>op.agov-w.azure.adnovum.net</param-value>
        </init-param>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <init-param>
            <param-name>InactiveInterval</param-name>
            <param-value>1800</param-value>
        </init-param>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <init-param>
            <param-name>InterceptionRedirect</param-name>
            <param-value>never</param-value>
        </init-param>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <init-param>
            <param-name>LoginRendererServlet</param-name>
            <param-value>LoginRenderer_nevisLogrend</param-value>
        </init-param>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <init-param>
            <param-name>Realm</param-name>
            <param-value>SAML_SP_nevisidm_operations_Realm</param-value>
        </init-param>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <init-param>
            <param-name>RecheckAuthentication</param-name>
            <param-value>On</param-value>
        </init-param>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <init-param>
            <param-name>RenewIdentification</param-name>
            <param-value>true</param-value>
        </init-param>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <init-param>
            <param-name>StateKey</param-name>
            <param-value>SAML_SP_nevisidm_operations_Realm</param-value>
        </init-param>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <init-param>
            <param-name>StoreInterceptedRequest</param-name>
            <param-value>false</param-value>
        </init-param>
    </filter>
    <!-- source: pattern://6df66943ca713eed2a25d935 -->
    <filter>
        <filter-name>SessionHandler_OP-ONBRDNG-AuthenticationRealm</filter-name>
        <filter-class>ch::nevis::nevisproxy::filter::session::SessionManagementFilter</filter-class>
        <!-- source: pattern://6df66943ca713eed2a25d935 -->
        <init-param>
            <param-name>Cookie.ExtraAttributes</param-name>
            <param-value>SameSite=Lax</param-value>
        </init-param>
        <!-- source: pattern://6df66943ca713eed2a25d935 -->
        <init-param>
            <param-name>Cookie.Name</param-name>
            <param-value>OP-ONBRDNG</param-value>
        </init-param>
        <!-- source: pattern://6df66943ca713eed2a25d935 -->
        <init-param>
            <param-name>Cookie.Secure</param-name>
            <param-value>true</param-value>
        </init-param>
        <!-- source: pattern://6df66943ca713eed2a25d935 -->
        <init-param>
            <param-name>Identification</param-name>
            <param-value>COOKIE</param-value>
        </init-param>
        <!-- source: pattern://6df66943ca713eed2a25d935 -->
        <init-param>
            <param-name>MaxInactiveInterval</param-name>
            <param-value>1200</param-value>
        </init-param>
        <!-- source: pattern://6df66943ca713eed2a25d935 -->
        <init-param>
            <param-name>MaxLifetime</param-name>
            <param-value>28800</param-value>
        </init-param>
        <!-- source: pattern://6df66943ca713eed2a25d935 -->
        <init-param>
            <param-name>Servlet</param-name>
            <param-value>LocalSessionStoreServlet</param-value>
        </init-param>
        <!-- source: pattern://6df66943ca713eed2a25d935 -->
        <init-param>
            <param-name>UpdateTimeStampMinInterval</param-name>
            <param-value>120</param-value>
        </init-param>
    </filter>
    <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
    <filter>
        <filter-name>SessionHandler_SAML_SP_nevisidm_operations_Realm</filter-name>
        <filter-class>ch::nevis::nevisproxy::filter::session::SessionManagementFilter</filter-class>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <init-param>
            <param-name>Cookie.ExtraAttributes</param-name>
            <param-value>SameSite=None</param-value>
        </init-param>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <init-param>
            <param-name>Cookie.Name</param-name>
            <param-value>OP-OPADMIN</param-value>
        </init-param>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <init-param>
            <param-name>Cookie.Secure</param-name>
            <param-value>true</param-value>
        </init-param>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <init-param>
            <param-name>Identification</param-name>
            <param-value>COOKIE</param-value>
        </init-param>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <init-param>
            <param-name>MaxInactiveInterval</param-name>
            <param-value>180</param-value>
        </init-param>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <init-param>
            <param-name>MaxLifetime</param-name>
            <param-value>14400</param-value>
        </init-param>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <init-param>
            <param-name>Servlet</param-name>
            <param-value>LocalSessionStoreServlet</param-value>
        </init-param>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <init-param>
            <param-name>UpdateTimeStampMinInterval</param-name>
            <param-value>120</param-value>
        </init-param>
    </filter>
    <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
    <filter>
        <filter-name>Token_NEVIS_SecToken</filter-name>
        <filter-class>ch::nevis::isiweb4::filter::delegation::DelegationFilter</filter-class>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <init-param>
            <param-name>DelegateBasicAuth</param-name>
            <param-value>
                AUTH:user.auth.UserId
                AUTH:token.NEVIS_SecToken
            </param-value>
        </init-param>
    </filter>
    <!-- source: pattern://076ce5c5440843a23150b386 -->
    <filter>
        <filter-name>URLHandler_Virtual_Host_idmOperations-Loggedout</filter-name>
        <filter-class>ch::nevis::isiweb4::filter::rewrite::RewriteFilter</filter-class>
        <!-- source: pattern://076ce5c5440843a23150b386 -->
        <init-param>
            <param-name>ModifierFlags</param-name>
            <param-value>+RESET_PARAMS</param-value>
        </init-param>
        <!-- source: pattern://076ce5c5440843a23150b386 -->
        <init-param>
            <param-name>RequestURI</param-name>
            <param-value>
                ^/loggedout.*$:/resources/errorPages/Loggedout.html:PT
                ^/favicon.ico$:/resources/favicon.ico:PT
            </param-value>
        </init-param>
        <!-- source: pattern://076ce5c5440843a23150b386 -->
        <init-param>
            <param-name>UseQueryString</param-name>
            <param-value>true</param-value>
        </init-param>
    </filter>
    <!-- source: pattern://39ecde9a0d101628fed3e3be -->
    <filter-mapping>
        <filter-name>Redirect_Default</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>
    <!-- source: pattern://58ece0328f5bf4d78e1a82d2, pattern://58ece0328f5bf4d78e1a82d2#filters -->
    <filter-mapping>
        <filter-name>DefaultErrorFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>
    <!-- source: pattern://58ece0328f5bf4d78e1a82d2, pattern://58ece0328f5bf4d78e1a82d2#filters -->
    <filter-mapping>
        <filter-name>FallbackErrorFilter</filter-name>
        <servlet-name>NevisLogrendConnector_nevisLogrend</servlet-name>
    </filter-mapping>
    <!-- source: pattern://076ce5c5440843a23150b386 -->
    <filter-mapping>
        <filter-name>URLHandler_Virtual_Host_idmOperations-Loggedout</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>
    <!-- source: pattern://36886a1934993d1f69690e1d -->
    <filter-mapping>
        <filter-name>ResponseHeader_Base_Security_Response_Headers</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>
    <!-- source: pattern://29a7ba8eaff67eb26d2394bc -->
    <filter-mapping>
        <filter-name>Lua_CSP_Security_Response_Headers</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>
    <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
    <filter-mapping>
        <filter-name>SessionHandler_SAML_SP_nevisidm_operations_Realm</filter-name>
        <url-pattern>/mail/*</url-pattern>
    </filter-mapping>
    <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
    <filter-mapping>
        <filter-name>SessionHandler_SAML_SP_nevisidm_operations_Realm</filter-name>
        <url-pattern>/SAML2/ACS/*</url-pattern>
    </filter-mapping>
    <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
    <filter-mapping>
        <filter-name>SessionHandler_SAML_SP_nevisidm_operations_Realm</filter-name>
        <url-pattern>/SAML2/stepup/*</url-pattern>
    </filter-mapping>
    <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
    <filter-mapping>
        <filter-name>SessionHandler_SAML_SP_nevisidm_operations_Realm</filter-name>
        <url-pattern>/nevisidm/*</url-pattern>
    </filter-mapping>
    <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
    <filter-mapping>
        <filter-name>SAML_AllowCORS_SAML_SP_nevisidm_operations_Realm</filter-name>
        <url-pattern>/SAML2/ACS/*</url-pattern>
    </filter-mapping>
    <!-- source: pattern://6df66943ca713eed2a25d935 -->
    <filter-mapping>
        <filter-name>SessionHandler_OP-ONBRDNG-AuthenticationRealm</filter-name>
        <url-pattern>/AUTH/ONBOARDING/*</url-pattern>
    </filter-mapping>
    <!-- source: pattern://f010ec68088ebd56349c7135 -->
    <filter-mapping>
        <filter-name>ModSecurity_GreenMail</filter-name>
        <url-pattern>/mail/*</url-pattern>
    </filter-mapping>
    <!-- source: pattern://13ea034de32c190083ba9e35 -->
    <filter-mapping>
        <filter-name>ModSecurity_nevisIDM_Operations_Administration_GUI</filter-name>
        <url-pattern>/nevisidm/admin/*</url-pattern>
    </filter-mapping>
    <!-- source: pattern://f02bc0de60aad829670e4c5b -->
    <filter-mapping>
        <filter-name>ModSecurity_OP-ONBRDNG-ModSecuritySettings</filter-name>
        <url-pattern>/AUTH/ONBOARDING/*</url-pattern>
    </filter-mapping>
    <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
    <filter-mapping>
        <filter-name>Authentication_SAML_SP_nevisidm_operations_Realm</filter-name>
        <url-pattern>/mail/*</url-pattern>
    </filter-mapping>
    <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
    <filter-mapping>
        <filter-name>Authentication_SAML_SP_nevisidm_operations_Realm</filter-name>
        <url-pattern>/nevisidm/*</url-pattern>
    </filter-mapping>
    <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
    <filter-mapping>
        <filter-name>SAML_SAML_SP_nevisidm_operations_Realm</filter-name>
        <url-pattern>/SAML2/ACS/*</url-pattern>
    </filter-mapping>
    <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
    <filter-mapping>
        <filter-name>SAML_SAML_SP_nevisidm_operations_Realm</filter-name>
        <url-pattern>/SAML2/stepup/*</url-pattern>
    </filter-mapping>
    <!-- source: pattern://6df66943ca713eed2a25d935 -->
    <filter-mapping>
        <filter-name>AuthenticationService_OP-ONBRDNG-AuthenticationRealm</filter-name>
        <url-pattern>/AUTH/ONBOARDING/*</url-pattern>
    </filter-mapping>
    <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
    <filter-mapping>
        <filter-name>Requirement_NEVIS_SecToken_SAML_SP_nevisidm_operations_Realm</filter-name>
        <url-pattern>/nevisidm/*</url-pattern>
    </filter-mapping>
    <!-- source: pattern://088e03c92ee8a5168b030e9e -->
    <filter-mapping>
        <filter-name>Authorization_Required_Roles_AGOV-Loi.level300_AGOV-Loi.level400_AGOV-Loi.level500_SAML_SP_nevisidm_operations_Realm</filter-name>
        <url-pattern>/nevisidm/*</url-pattern>
    </filter-mapping>
    <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
    <filter-mapping>
        <filter-name>Token_NEVIS_SecToken</filter-name>
        <url-pattern>/nevisidm/*</url-pattern>
    </filter-mapping>
    <!-- source: pattern://13ea034de32c190083ba9e35, pattern://13ea034de32c190083ba9e35#nevisIDM -->
    <filter-mapping>
        <filter-name>CSRFRewrite_nevisIDM_Operations_Administration_GUI</filter-name>
        <url-pattern>/nevisidm/JavaScriptServlet</url-pattern>
    </filter-mapping>
    <!-- source: pattern://6df66943ca713eed2a25d935 -->
    <listener>
        <listener-class>ch::nevis::isiweb4::listener::SessionListener</listener-class>
    </listener>
    <!-- source: pattern://f010ec68088ebd56349c7135, pattern://f010ec68088ebd56349c7135#allowedMethods, pattern://f010ec68088ebd56349c7135#backends, pattern://f010ec68088ebd56349c7135#responseRewrite -->
    <servlet>
        <servlet-name>Connector_GreenMail</servlet-name>
        <!-- source: pattern://f010ec68088ebd56349c7135 -->
        <servlet-class>ch::nevis::isiweb4::servlet::connector::http::HttpsConnectorServlet</servlet-class>
        <!-- source: pattern://f010ec68088ebd56349c7135#allowedMethods -->
        <init-param>
            <param-name>AllowedMethods</param-name>
            <param-value>ALL-HTTP,ALL-WEBDAV,-TRACE,-CONNECT</param-value>
        </init-param>
        <!-- source: pattern://f010ec68088ebd56349c7135#responseRewrite -->
        <init-param>
            <param-name>AutoRewrite</param-name>
            <param-value>header</param-value>
        </init-param>
        <!-- source: pattern://f010ec68088ebd56349c7135 -->
        <init-param>
            <param-name>CookieManager</param-name>
            <param-value>retain:^.*$</param-value>
        </init-param>
        <!-- source: pattern://f010ec68088ebd56349c7135 -->
        <init-param>
            <param-name>DNSCache.ttl</param-name>
            <param-value>60</param-value>
        </init-param>
        <!-- source: pattern://f010ec68088ebd56349c7135#backends -->
        <init-param>
            <param-name>InetAddress</param-name>
            <param-value>rainloop.adn-agov-mail-01-uat:80</param-value>
        </init-param>
        <!-- source: pattern://f010ec68088ebd56349c7135#backends -->
        <init-param>
            <param-name>MappingType</param-name>
            <param-value>pathinfo</param-value>
        </init-param>
        <!-- source: pattern://f010ec68088ebd56349c7135#backends -->
        <init-param>
            <param-name>UseSSL</param-name>
            <param-value>false</param-value>
        </init-param>
    </servlet>
    <!-- source: pattern://6df66943ca713eed2a25d935 -->
    <servlet>
        <servlet-name>Connector_OP-ONBRDNG-AuthenticationRealm</servlet-name>
        <!-- source: pattern://6df66943ca713eed2a25d935 -->
        <servlet-class>ch::nevis::isiweb4::servlet::connector::soap::esauth4::Esauth4ConnectorServlet</servlet-class>
        <!-- source: pattern://6df66943ca713eed2a25d935 -->
        <init-param>
            <param-name>Transport.DNSCache.ttl</param-name>
            <param-value>60</param-value>
        </init-param>
        <!-- source: pattern://6df66943ca713eed2a25d935 -->
        <init-param>
            <param-name>Transport.InetAddress</param-name>
            <param-value>auth:8991</param-value>
        </init-param>
        <!-- source: pattern://6df66943ca713eed2a25d935 -->
        <init-param>
            <param-name>Transport.KeepAlive.LifeTime</param-name>
            <param-value>30</param-value>
        </init-param>
        <!-- source: pattern://6df66943ca713eed2a25d935 -->
        <init-param>
            <param-name>Transport.RequestTimeout</param-name>
            <param-value>90000</param-value>
        </init-param>
        <!-- source: pattern://6df66943ca713eed2a25d935 -->
        <init-param>
            <param-name>Transport.ResourceManager.RetryTimeout</param-name>
            <param-value>0</param-value>
        </init-param>
        <!-- source: pattern://6df66943ca713eed2a25d935 -->
        <init-param>
            <param-name>Transport.SSLCACertificateFile</param-name>
            <param-value>/var/opt/keys/trust/proxy-sp-op-onbrdng-authenticationrealm-tls-trust/truststore.pem</param-value>
        </init-param>
        <!-- source: pattern://6df66943ca713eed2a25d935 -->
        <init-param>
            <param-name>Transport.SSLCheckPeerHostname</param-name>
            <param-value>false</param-value>
        </init-param>
        <!-- source: pattern://6df66943ca713eed2a25d935 -->
        <init-param>
            <param-name>Transport.SSLClientCertificateFile</param-name>
            <param-value>/var/opt/keys/own/proxy-sp-op-onbrdng-authenticationrealm-identity/cert.pem</param-value>
        </init-param>
        <!-- source: pattern://6df66943ca713eed2a25d935 -->
        <init-param>
            <param-name>Transport.SSLClientKeyFile</param-name>
            <param-value>/var/opt/keys/own/proxy-sp-op-onbrdng-authenticationrealm-identity/key.pem</param-value>
        </init-param>
    </servlet>
    <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
    <servlet>
        <servlet-name>Connector_SAML_SP_nevisidm_operations_Realm</servlet-name>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <servlet-class>ch::nevis::isiweb4::servlet::connector::soap::esauth4::Esauth4ConnectorServlet</servlet-class>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <init-param>
            <param-name>Transport.DNSCache.ttl</param-name>
            <param-value>60</param-value>
        </init-param>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <init-param>
            <param-name>Transport.InetAddress</param-name>
            <param-value>auth:8991</param-value>
        </init-param>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <init-param>
            <param-name>Transport.KeepAlive.LifeTime</param-name>
            <param-value>30</param-value>
        </init-param>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <init-param>
            <param-name>Transport.RequestTimeout</param-name>
            <param-value>90000</param-value>
        </init-param>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <init-param>
            <param-name>Transport.ResourceManager.RetryTimeout</param-name>
            <param-value>0</param-value>
        </init-param>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <init-param>
            <param-name>Transport.SSLCACertificateFile</param-name>
            <param-value>/var/opt/keys/trust/proxy-sp-saml-sp-nevisidm-operations-realm-tls-trust/truststore.pem</param-value>
        </init-param>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <init-param>
            <param-name>Transport.SSLCheckPeerHostname</param-name>
            <param-value>false</param-value>
        </init-param>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <init-param>
            <param-name>Transport.SSLClientCertificateFile</param-name>
            <param-value>/var/opt/keys/own/proxy-sp-saml-sp-nevisidm-operations-realm-identity/cert.pem</param-value>
        </init-param>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <init-param>
            <param-name>Transport.SSLClientKeyFile</param-name>
            <param-value>/var/opt/keys/own/proxy-sp-saml-sp-nevisidm-operations-realm-identity/key.pem</param-value>
        </init-param>
    </servlet>
    <!-- source: pattern://13ea034de32c190083ba9e35, pattern://13ea034de32c190083ba9e35#allowedMethods, pattern://13ea034de32c190083ba9e35#nevisIDM -->
    <servlet>
        <servlet-name>Connector_nevisIDM_Operations_Administration_GUI</servlet-name>
        <!-- source: pattern://13ea034de32c190083ba9e35 -->
        <servlet-class>ch::nevis::isiweb4::servlet::connector::http::HttpsConnectorServlet</servlet-class>
        <!-- source: pattern://13ea034de32c190083ba9e35#allowedMethods -->
        <init-param>
            <param-name>AllowedMethods</param-name>
            <param-value>GET,DELETE,PUT,PATCH,POST,HEAD,OPTIONS</param-value>
        </init-param>
        <!-- source: pattern://13ea034de32c190083ba9e35 -->
        <init-param>
            <param-name>AutoRewrite</param-name>
            <param-value>header</param-value>
        </init-param>
        <!-- source: pattern://13ea034de32c190083ba9e35 -->
        <init-param>
            <param-name>CookieManager</param-name>
            <param-value>retain:^.*$</param-value>
        </init-param>
        <!-- source: pattern://13ea034de32c190083ba9e35#nevisIDM -->
        <init-param>
            <param-name>InetAddress</param-name>
            <param-value>idm-job-web:8989</param-value>
        </init-param>
        <!-- source: pattern://13ea034de32c190083ba9e35 -->
        <init-param>
            <param-name>ResourceManager.RetryTimeout</param-name>
            <param-value>0</param-value>
        </init-param>
        <!-- source: pattern://13ea034de32c190083ba9e35#nevisIDM -->
        <init-param>
            <param-name>UseSSL</param-name>
            <param-value>true</param-value>
        </init-param>
    </servlet>
    <!-- source: pattern://7518c6cc61e47eec6322ae17, pattern://9415bf61610843e0f5c77e39 -->
    <servlet>
        <servlet-name>Hosting_Default</servlet-name>
        <!-- source: pattern://7518c6cc61e47eec6322ae17, pattern://9415bf61610843e0f5c77e39 -->
        <servlet-class>ch::nevis::isiweb4::servlet::defaults::DefaultServlet</servlet-class>
    </servlet>
    <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
    <servlet>
        <servlet-name>LocalSessionStoreServlet</servlet-name>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <servlet-class>ch::nevis::nevisproxy::servlet::cache::local::LocalSessionStoreServlet</servlet-class>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <init-param>
            <param-name>MaxInactiveInterval</param-name>
            <param-value>600</param-value>
        </init-param>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <init-param>
            <param-name>MaxLifetime</param-name>
            <param-value>28800</param-value>
        </init-param>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <init-param>
            <param-name>MemorySize</param-name>
            <param-value>512000000</param-value>
        </init-param>
    </servlet>
    <!-- source: pattern://8401da6318c6915d689cdfc9 -->
    <servlet>
        <servlet-name>LoginRenderer_nevisLogrend</servlet-name>
        <!-- source: pattern://8401da6318c6915d689cdfc9 -->
        <servlet-class>ch::nevis::isiweb4::servlet::rendering::LoginRendererServlet</servlet-class>
        <!-- source: pattern://8401da6318c6915d689cdfc9 -->
        <init-param>
            <param-name>PropagateRemoteHeaders</param-name>
            <param-value>Set-Cookie</param-value>
        </init-param>
        <!-- source: pattern://8401da6318c6915d689cdfc9 -->
        <init-param>
            <param-name>RenderingProvider</param-name>
            <param-value>remote:NevisLogrendConnector_nevisLogrend:/nevislogrend/index.vm?logrendresourcepath=/nevislogrend</param-value>
        </init-param>
    </servlet>
    <!-- source: pattern://8401da6318c6915d689cdfc9 -->
    <servlet>
        <servlet-name>NevisLogrendConnector_nevisLogrend</servlet-name>
        <!-- source: pattern://8401da6318c6915d689cdfc9 -->
        <servlet-class>ch::nevis::isiweb4::servlet::connector::http::HttpConnectorServlet</servlet-class>
        <!-- source: pattern://8401da6318c6915d689cdfc9 -->
        <init-param>
            <param-name>InetAddress</param-name>
            <param-value>logrend:8988</param-value>
        </init-param>
        <!-- source: pattern://8401da6318c6915d689cdfc9 -->
        <init-param>
            <param-name>MappingType</param-name>
            <param-value>pathinfo</param-value>
        </init-param>
        <!-- source: pattern://8401da6318c6915d689cdfc9 -->
        <init-param>
            <param-name>ResourceManager.RetryTimeout</param-name>
            <param-value>0</param-value>
        </init-param>
        <!-- source: pattern://8401da6318c6915d689cdfc9 -->
        <init-param>
            <param-name>URIPrefix</param-name>
            <param-value>/nevislogrend</param-value>
        </init-param>
    </servlet>
    <!-- source: pattern://9415bf61610843e0f5c77e39 -->
    <servlet-mapping>
        <servlet-name>Hosting_Default</servlet-name>
        <url-pattern>/AUTH/ONBOARDING/*</url-pattern>
    </servlet-mapping>
    <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
    <servlet-mapping>
        <servlet-name>Hosting_Default</servlet-name>
        <url-pattern>/SAML2/ACS/*</url-pattern>
    </servlet-mapping>
    <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
    <servlet-mapping>
        <servlet-name>Hosting_Default</servlet-name>
        <url-pattern>/SAML2/stepup/*</url-pattern>
    </servlet-mapping>
    <!-- source: pattern://f010ec68088ebd56349c7135, pattern://f010ec68088ebd56349c7135#path -->
    <servlet-mapping>
        <servlet-name>Connector_GreenMail</servlet-name>
        <url-pattern>/mail/*</url-pattern>
    </servlet-mapping>
    <!-- source: pattern://13ea034de32c190083ba9e35, pattern://13ea034de32c190083ba9e35#nevisIDM -->
    <servlet-mapping>
        <servlet-name>Connector_nevisIDM_Operations_Administration_GUI</servlet-name>
        <url-pattern>/nevisidm/*</url-pattern>
        <exclude-url-regex>/nevisidm/services/.*|/nevisidm/api/.*|/nevisidm/selfadmin/.*</exclude-url-regex>
    </servlet-mapping>
    <!-- source: pattern://8401da6318c6915d689cdfc9 -->
    <servlet-mapping>
        <servlet-name>NevisLogrendConnector_nevisLogrend</servlet-name>
        <url-pattern>/nevislogrend/*</url-pattern>
    </servlet-mapping>
    <servlet-mapping>
        <servlet-name>Hosting_Default</servlet-name>
        <url-pattern>/*</url-pattern>
    </servlet-mapping>
    <!-- source: pattern://d9c194064d834ad41843ff4e -->
    <mime-mapping>
        <extension>ipa</extension>
        <mime-type>application/octet-stream</mime-type>
    </mime-mapping>
    <!-- source: pattern://39ecde9a0d101628fed3e3be -->
    <mime-mapping>
        <extension>txt</extension>
        <mime-type>text/plain</mime-type>
    </mime-mapping>
    <!-- source: pattern://39ecde9a0d101628fed3e3be -->
    <mime-mapping>
        <extension>css</extension>
        <mime-type>text/css</mime-type>
    </mime-mapping>
    <!-- source: pattern://39ecde9a0d101628fed3e3be -->
    <mime-mapping>
        <extension>ico</extension>
        <mime-type>image/x-icon</mime-type>
    </mime-mapping>
    <!-- source: pattern://39ecde9a0d101628fed3e3be -->
    <mime-mapping>
        <extension>svg</extension>
        <mime-type>image/svg+xml</mime-type>
    </mime-mapping>
    <!-- source: pattern://39ecde9a0d101628fed3e3be -->
    <mime-mapping>
        <extension>ttf</extension>
        <mime-type>application/x-font-ttf</mime-type>
    </mime-mapping>
    <!-- source: pattern://39ecde9a0d101628fed3e3be -->
    <mime-mapping>
        <extension>png</extension>
        <mime-type>image/png</mime-type>
    </mime-mapping>
    <!-- source: pattern://39ecde9a0d101628fed3e3be -->
    <mime-mapping>
        <extension>js</extension>
        <mime-type>application/javascript</mime-type>
    </mime-mapping>
    <!-- source: pattern://39ecde9a0d101628fed3e3be -->
    <mime-mapping>
        <extension>html</extension>
        <mime-type>text/html</mime-type>
    </mime-mapping>
    <!-- source: pattern://39ecde9a0d101628fed3e3be -->
    <mime-mapping>
        <extension>woff2</extension>
        <mime-type>application/font-woff2</mime-type>
    </mime-mapping>
</web-app>
