<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE esauth-server SYSTEM "/opt/nevisauth/dtd/esauth4.dtd">
<esauth-server instance="auth">
    <!-- source: pattern://6df66943ca713eed2a25d935, pattern://6df66943ca713eed2a25d935, pattern://6f9c9f982dcc7ef59a34f1f7, pattern://7518c6cc61e47eec6322ae17, pattern://ac27dd7daad0ca2b7229bfaf -->
    <SessionCoordinator sessionInitialInactivityTimeout="1200" sessionInactivityTimeout="28800" sessionInitialMaxLifetime="1200" sessionMaxLifetime="28800" sessionIdPreGenerate="true">
        <!-- source: pattern://ac27dd7daad0ca2b7229bfaf -->
        <LocalSessionStore maxSessions="100000"/>
        <!-- source: pattern://ac27dd7daad0ca2b7229bfaf -->
        <TokenAssembler name="DefaultTokenAssembler">
            <Selector default="true"/>
            <!-- source: pattern://3fd09bb6cfbd34874595c263, pattern://6df66943ca713eed2a25d935, pattern://6f9c9f982dcc7ef59a34f1f7, pattern://7518c6cc61e47eec6322ae17 -->
            <TokenSpec ttl="28800">
                <!-- source: pattern://ac27dd7daad0ca2b7229bfaf -->
                <field src="session" key="ch.nevis.session.sessid" as="sessid"/>
                <!-- source: pattern://ac27dd7daad0ca2b7229bfaf -->
                <field src="session" key="ch.nevis.session.userid" as="userid"/>
                <!-- source: pattern://ac27dd7daad0ca2b7229bfaf -->
                <field src="session" key="ch.nevis.session.authlevel" as="authLevel"/>
                <!-- source: pattern://ac27dd7daad0ca2b7229bfaf -->
                <field src="session" key="ch.nevis.session.esauthid" as="esauthid"/>
                <!-- source: pattern://ac27dd7daad0ca2b7229bfaf -->
                <field src="session" key="ch.nevis.session.entryid" as="entryid"/>
                <!-- source: pattern://ac27dd7daad0ca2b7229bfaf -->
                <field src="session" key="ch.nevis.session.loginid" as="loginId"/>
                <!-- source: pattern://ac27dd7daad0ca2b7229bfaf -->
                <field src="session" key="ch.nevis.session.domain" as="domain"/>
                <!-- source: pattern://ac27dd7daad0ca2b7229bfaf -->
                <field src="session" key="ch.nevis.session.secroles" as="roles"/>
            </TokenSpec>
            <!-- source: pattern://ac27dd7daad0ca2b7229bfaf -->
            <Signer key="DefaultSigner"/>
        </TokenAssembler>
        <!-- source: pattern://271d024334021208b71ac80a -->
        <TokenAssembler name="Token_SAML_SP_nevisidm_admin_Realm_NEVIS_SecToken">
            <!-- source: pattern://271d024334021208b71ac80a -->
            <Selector default="false"/>
            <!-- source: pattern://271d024334021208b71ac80a -->
            <TokenSpec ttl="14400">
                <!-- source: pattern://271d024334021208b71ac80a -->
                <field src="request" key="UserId" as="userid"/>
                <!-- source: pattern://271d024334021208b71ac80a -->
                <field src="session" key="ch.nevis.session.loginid" as="loginId"/>
                <!-- source: pattern://271d024334021208b71ac80a -->
                <field src="session" key="ch.adnovum.nevisidm.profileId" as="profileId"/>
                <!-- source: pattern://271d024334021208b71ac80a -->
                <field src="session" key="ch.adnovum.nevisidm.clientId" as="clientId"/>
                <!-- source: pattern://271d024334021208b71ac80a -->
                <field src="request" key="ActualRoles" as="roles"/>
            </TokenSpec>
            <!-- source: pattern://271d024334021208b71ac80a -->
            <Signer key="Signer_NEVIS_SecToken"/>
        </TokenAssembler>
        <!-- source: pattern://271d024334021208b71ac80a -->
        <TokenAssembler name="Token_SAML_SP_nevisidm_operations_Realm_NEVIS_SecToken">
            <!-- source: pattern://271d024334021208b71ac80a -->
            <Selector default="false"/>
            <!-- source: pattern://271d024334021208b71ac80a -->
            <TokenSpec ttl="14400">
                <!-- source: pattern://271d024334021208b71ac80a -->
                <field src="request" key="UserId" as="userid"/>
                <!-- source: pattern://271d024334021208b71ac80a -->
                <field src="session" key="ch.nevis.session.loginid" as="loginId"/>
                <!-- source: pattern://271d024334021208b71ac80a -->
                <field src="session" key="ch.adnovum.nevisidm.profileId" as="profileId"/>
                <!-- source: pattern://271d024334021208b71ac80a -->
                <field src="session" key="ch.adnovum.nevisidm.clientId" as="clientId"/>
                <!-- source: pattern://271d024334021208b71ac80a -->
                <field src="request" key="ActualRoles" as="roles"/>
            </TokenSpec>
            <!-- source: pattern://271d024334021208b71ac80a -->
            <Signer key="Signer_NEVIS_SecToken"/>
        </TokenAssembler>
        <!-- source: pattern://271d024334021208b71ac80a -->
        <KeyStore name="DefaultKeyStore">
            <!-- source: pattern://ac27dd7daad0ca2b7229bfaf -->
            <KeyObject name="DefaultSigner" certificate="/var/opt/keys/own/auth-sh4r3d-nevisidm-sectoken-signer/cert.pem" privateKey="/var/opt/keys/own/auth-sh4r3d-nevisidm-sectoken-signer/keystore.jks" passPhrase="pipe:///var/opt/keys/own/auth-sh4r3d-nevisidm-sectoken-signer/keypass"/>
            <!-- source: pattern://ac27dd7daad0ca2b7229bfaf -->
            <KeyObject name="DefaultSignerTrust" certificate="/var/opt/keys/trust/auth-default-default-signer-trust/truststore.jks"/>
            <!-- source: pattern://271d024334021208b71ac80a -->
            <KeyObject name="Signer_NEVIS_SecToken" certificate="/var/opt/keys/own/auth-sh4r3d-nevisidm-sectoken-signer/cert.pem" privateKey="/var/opt/keys/own/auth-sh4r3d-nevisidm-sectoken-signer/keystore.jks" passPhrase="pipe:///var/opt/keys/own/auth-sh4r3d-nevisidm-sectoken-signer/keypass"/>
        </KeyStore>
        <!-- source: pattern://6589067d403de8c65bcdcb16 -->
        <KeyStore name="AGOV_IDENT_KS">
            <!-- source: pattern://6589067d403de8c65bcdcb16 -->
            <KeyObject name="AGOV_IDENT_SIGNER" certificate="/var/opt/keys/own/agov-ident-signer-keystore/cert.pem" privateKey="/var/opt/keys/own/agov-ident-signer-keystore/keystore.jks" passPhrase="pipe:///var/opt/keys/own/agov-ident-signer-keystore/keypass"/>
        </KeyStore>
        <!-- source: pattern://7e94f2eb346f07f78440e884 -->
        <KeyStore name="Store_SAML_SP_nevisidm_admin_Realm">
            <!-- source: pattern://7e94f2eb346f07f78440e884 -->
            <KeyObject name="Signer_SAML_SP_nevisidm_admin_Realm" certificate="/var/opt/keys/own/operations-admin-signer-pem-key-store/cert.pem" privateKey="/var/opt/keys/own/operations-admin-signer-pem-key-store/keystore.jks" passPhrase="pipe:///var/opt/keys/own/operations-admin-signer-pem-key-store/keypass"/>
            <!-- source: pattern://7e94f2eb346f07f78440e884 -->
            <KeyObject name="https://trustbroker.agov-d.azure.adnovum.net" certificate="/var/opt/keys/trust/auth-saml-idp-admin-connector-trust-store/truststore.jks"/>
        </KeyStore>
        <!-- source: pattern://36af90d50b0d6ba66136dbde -->
        <KeyStore name="Store_SAML_SP_nevisidm_operations_Realm">
            <!-- source: pattern://36af90d50b0d6ba66136dbde -->
            <KeyObject name="Signer_SAML_SP_nevisidm_operations_Realm" certificate="/var/opt/keys/own/operations-admin-signer-pem-key-store/cert.pem" privateKey="/var/opt/keys/own/operations-admin-signer-pem-key-store/keystore.jks" passPhrase="pipe:///var/opt/keys/own/operations-admin-signer-pem-key-store/keypass"/>
            <!-- source: pattern://36af90d50b0d6ba66136dbde -->
            <KeyObject name="https://trustbroker.agov-d.azure.adnovum.net" certificate="/var/opt/keys/trust/auth-saml-idp-op-connector-trust-store/truststore.jks"/>
        </KeyStore>
    </SessionCoordinator>
    <!-- source: pattern://ac27dd7daad0ca2b7229bfaf -->
    <LocalOutOfContextDataStore reaperPeriod="60"/>
    <!-- source: pattern://2787b678d9cce5310a335419, pattern://fd3912c7af7a88b6342a4c78, pattern://12c979b6af0f15f1328656a4, pattern://24cbc652d3166c8374eda3cd, pattern://56955e7b6b92c254d7d1aae1, pattern://ac27dd7daad0ca2b7229bfaf, pattern://6df66943ca713eed2a25d935, pattern://6f9c9f982dcc7ef59a34f1f7, pattern://7518c6cc61e47eec6322ae17, pattern://ac27dd7daad0ca2b7229bfaf, pattern://6df66943ca713eed2a25d935, pattern://ac27dd7daad0ca2b7229bfaf, pattern://ac27dd7daad0ca2b7229bfaf -->
    <AuthEngine useLiteralDictionary="true" literalDictionaryLanguages="en,de,fr,it" inputLanguageCookie="LANG" compatLevel="none" addAutheLevelToSecRoles="true" classPath="/opt/nevisidmcl/nevisauth/lib:/opt/nevisauth/plugin" propagateSession="false">
        <!-- source: pattern://3fd09bb6cfbd34874595c263 -->
        <Domain name="IDENT-AuthenticationRealm" default="false" inactiveInterval="60" reauthInterval="0" resetAuthenticationCondition="${inargs:cancel}">
            <Entry method="authenticate" state="IDENT-AuthenticationRealm_IDENT-Process-and-Dispatch"/>
            <Entry method="authenticate" state="IDENT-AuthenticationRealm_IDENT-Process-and-Dispatch" selector="${request:currentResource:^http[s]?\u003A//[^/]+/process($|\?.*)$:true}"/>
            <Entry method="stepup" state="IDENT-AuthenticationRealm_Selector"/>
            <Entry method="stepup" state="IDENT-AuthenticationRealm_IDENT-Process-and-Dispatch" selector="${request:currentResource:^http[s]?\u003A//[^/]+/process($|\?.*)$:true}"/>
        </Domain>
        <!-- source: pattern://6df66943ca713eed2a25d935 -->
        <Domain name="OP-ONBRDNG-AuthenticationRealm" default="false" inactiveInterval="1200" reauthInterval="0" resetAuthenticationCondition="${inargs:cancel}">
            <Entry method="authenticate" state="OP-ONBRDNG-AuthenticationRealm_OP-ONBRDNG-PreProcessing"/>
            <Entry method="authenticate" state="OP-ONBRDNG-AuthenticationRealm_OP-ONBRDNG-PreProcessing" selector="${request:currentResource:^http[s]?\u003A//[^/]+/AUTH/ONBOARDING/.*$:true}"/>
            <Entry method="stepup" state="OP-ONBRDNG-AuthenticationRealm_Selector"/>
            <Entry method="stepup" state="OP-ONBRDNG-AuthenticationRealm_OP-ONBRDNG-PreProcessing" selector="${request:currentResource:^http[s]?\u003A//[^/]+/AUTH/ONBOARDING/.*$:true}"/>
        </Domain>
        <!-- source: pattern://6f9c9f982dcc7ef59a34f1f7 -->
        <Domain name="SAML_SP_nevisidm_admin_Realm" default="false" inactiveInterval="1800" reauthInterval="0" resetAuthenticationCondition="${inargs:cancel}">
            <Entry method="authenticate" state="SAML_SP_nevisidm_admin_Realm_Extract_Issuer"/>
            <Entry method="logout" state="SAML_SP_nevisidm_admin_Realm_Extract_Issuer"/>
            <Entry method="stepup" state="SAML_SP_nevisidm_admin_Realm_Extract_Issuer"/>
            <Entry method="stepup" state="SAML_SP_nevisidm_admin_Realm_NEVIS_SecToken" selector="${request:requiredRoles:^token.NEVIS_SecToken$:true}"/>
            <Entry method="unlock" state="SAML_SP_nevisidm_admin_Realm_Extract_Issuer"/>
        </Domain>
        <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
        <Domain name="SAML_SP_nevisidm_operations_Realm" default="false" inactiveInterval="1800" reauthInterval="0" resetAuthenticationCondition="${inargs:cancel}">
            <Entry method="authenticate" state="SAML_SP_nevisidm_operations_Realm_Extract_Issuer"/>
            <Entry method="logout" state="SAML_SP_nevisidm_operations_Realm_Extract_Issuer"/>
            <Entry method="stepup" state="SAML_SP_nevisidm_operations_Realm_Extract_Issuer"/>
            <Entry method="stepup" state="SAML_SP_nevisidm_operations_Realm_NEVIS_SecToken" selector="${request:requiredRoles:^token.NEVIS_SecToken$:true}"/>
            <Entry method="unlock" state="SAML_SP_nevisidm_operations_Realm_Extract_Issuer"/>
        </Domain>
        <AuthState name="IDENT-AuthenticationRealm_IDENT-Process-and-Dispatch" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false" resumeState="true">
            <!-- source: pattern://0f6977caedca600b17221f0a -->
            <ResultCond name="inavlidurl" next="IDENT-AuthenticationRealm_IDENT-Failed"/>
            <!-- source: pattern://0f6977caedca600b17221f0a -->
            <ResultCond name="processResponse" next="IDENT-AuthenticationRealm_IDENT-SamlServiceProvider-ProcessResponse"/>
            <!-- source: pattern://0f6977caedca600b17221f0a -->
            <ResultCond name="sendAuthnRequest" next="IDENT-AuthenticationRealm_IDENT-SamlServiceProvider-AuthnRequest"/>
            <!-- source: pattern://0f6977caedca600b17221f0a -->
            <Response value="AUTH_ERROR"/>
            <!-- source: pattern://0f6977caedca600b17221f0a -->
            <property name="scriptTraceGroup" value="AGOVOP-IDENT"/>
            <!-- source: pattern://0f6977caedca600b17221f0a -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/IdentProcessAndDispatch.groovy"/>
            <!-- source: pattern://0f6977caedca600b17221f0a -->
            <property name="parameter.rpcode.list" value="{&quot;f942502d-6c89-471b-af45-4d3806305e74&quot;: &quot;ch-agov-ident-work-epd-300&quot;, &quot;1ed07e93-2289-42ab-8feb-173ef8a8bdb6&quot;: &quot;ch-agov-ident-work-epd-400&quot;, &quot;4c81a70f-d0f6-455d-9bad-0837b42159ab&quot;: &quot;ch-agov-ident-work-dimilar-400&quot;}"/>
        </AuthState>
        <AuthState name="IDENT-AuthenticationRealm_IDENT-Failed" class="ch.nevis.esauth.auth.states.standard.AuthError" final="true">
            <!-- source: pattern://026e4ae8ef4cc5496a7fe8c6 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://026e4ae8ef4cc5496a7fe8c6 -->
                <Gui name="IDENT-Failed" label="title.login">
                    <!-- source: pattern://026e4ae8ef4cc5496a7fe8c6 -->
                    <GuiElem name="error" type="error" label="${notes:lasterrorinfo}" value="${notes:lasterror}"/>
                </Gui>
            </Response>
        </AuthState>
        <AuthState name="IDENT-AuthenticationRealm_IDENT-SamlServiceProvider-ProcessResponse" class="ch.nevis.esauth.auth.states.saml.ServiceProviderState" final="false" resumeState="false">
            <!-- source: pattern://ac1151fe6a973b135fd4a460 -->
            <ResultCond name="ok" next="IDENT-AuthenticationRealm_IDENT-Succeeded"/>
            <!-- source: pattern://ac1151fe6a973b135fd4a460 -->
            <ResultCond name="status-Requester" next="IDENT-AuthenticationRealm_IDENT-Failed-WithRetry"/>
            <!-- source: pattern://ac1151fe6a973b135fd4a460 -->
            <ResultCond name="status-Responder" next="IDENT-AuthenticationRealm_IDENT-Failed-WithRetry"/>
            <!-- source: pattern://ac1151fe6a973b135fd4a460 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://ac1151fe6a973b135fd4a460 -->
                <Gui name="NoGui"/>
            </Response>
            <propertyRef name="SAML_SP_nevisidm_operations_Realm_SAML_IDP_op_Connector_Connector"/>
            <!-- source: pattern://ac1151fe6a973b135fd4a460 -->
            <property name="idpURL" value="https://trustbroker.agov-d.azure.adnovum.net/adfs/ls"/>
            <!-- source: pattern://ac1151fe6a973b135fd4a460 -->
            <property name="consumerURL" value="https://ident.agov-w.azure.adnovum.net/process"/>
            <!-- source: pattern://ac1151fe6a973b135fd4a460 -->
            <property name="relayState" value=""/>
            <!-- source: pattern://ac1151fe6a973b135fd4a460 -->
            <property name="out.binding" value="none"/>
            <!-- source: pattern://ac1151fe6a973b135fd4a460 -->
            <property name="in.binding" value="auto"/>
            <!-- source: pattern://ac1151fe6a973b135fd4a460 -->
            <property name="in.relayState" value=""/>
            <!-- source: pattern://ac1151fe6a973b135fd4a460 -->
            <property name="in.audienceRegex" value="${session:agov.ident.entityId}"/>
            <!-- source: pattern://ac1151fe6a973b135fd4a460 -->
            <property name="in.audience.checkrequired" value="true"/>
            <!-- source: pattern://ac1151fe6a973b135fd4a460 -->
            <property name="in.map_issuer_certificate" value="false"/>
            <!-- source: pattern://ac1151fe6a973b135fd4a460 -->
            <property name="in.verify" value="Response Assertion"/>
        </AuthState>
        <AuthState name="IDENT-AuthenticationRealm_IDENT-SamlServiceProvider-AuthnRequest" class="ch.nevis.esauth.auth.states.saml.AssertionRequestState" final="false" resumeState="false">
            <!-- source: pattern://dce20cc904f88df4b77f93d9 -->
            <ResultCond name="default" next="IDENT-AuthenticationRealm_Authentication_Failed"/>
            <!-- source: pattern://dce20cc904f88df4b77f93d9 -->
            <ResultCond name="ok" next="IDENT-AuthenticationRealm_Prepare_Done"/>
            <!-- source: pattern://dce20cc904f88df4b77f93d9 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://dce20cc904f88df4b77f93d9 -->
                <Gui name="NoGui"/>
            </Response>
            <!-- source: pattern://dce20cc904f88df4b77f93d9 -->
            <property name="idpURL" value="https://trustbroker.agov-d.azure.adnovum.net/adfs/ls"/>
            <!-- source: pattern://dce20cc904f88df4b77f93d9 -->
            <property name="consumerURL" value="https://ident.agov-w.azure.adnovum.net/process"/>
            <!-- source: pattern://dce20cc904f88df4b77f93d9 -->
            <property name="out.binding" value="http-post"/>
            <!-- source: pattern://dce20cc904f88df4b77f93d9 -->
            <property name="out.requestType" value="AuthnRequest"/>
            <!-- source: pattern://dce20cc904f88df4b77f93d9 -->
            <property name="out.sign" value="AuthnRequest"/>
            <!-- source: pattern://dce20cc904f88df4b77f93d9 -->
            <property name="out.signatureKeyInfo" value="Certificate"/>
            <!-- source: pattern://dce20cc904f88df4b77f93d9 -->
            <property name="out.keystoreref" value="AGOV_IDENT_KS"/>
            <!-- source: pattern://dce20cc904f88df4b77f93d9 -->
            <property name="out.keyobjectref" value="AGOV_IDENT_SIGNER"/>
            <!-- source: pattern://dce20cc904f88df4b77f93d9 -->
            <property name="out.issuer" value="${sess:agov.ident.entityId}"/>
            <!-- source: pattern://dce20cc904f88df4b77f93d9 -->
            <property name="request.ttl" value="60"/>
            <!-- source: pattern://dce20cc904f88df4b77f93d9 -->
            <property name="relayState" value="${sess:agov.ident.rpcode}"/>
        </AuthState>
        <AuthState name="IDENT-AuthenticationRealm_IDENT-Succeeded" class="ch.nevis.esauth.auth.states.standard.AuthError" final="true">
            <!-- source: pattern://5f2cdff72cb899bff468ad90 -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://5f2cdff72cb899bff468ad90 -->
                <Gui name="IDENT-Succeeded" label="title.login">
                    <!-- source: pattern://5f2cdff72cb899bff468ad90 -->
                    <GuiElem name="info" type="info" label="not-used"/>
                </Gui>
            </Response>
        </AuthState>
        <AuthState name="IDENT-AuthenticationRealm_IDENT-Failed-WithRetry" class="ch.nevis.esauth.auth.states.standard.AuthError" final="true">
            <!-- source: pattern://ea2c110e0adfa95722c2cc99 -->
            <ResultCond name="continue" next="IDENT-AuthenticationRealm_IDENT-Process-and-Dispatch"/>
            <!-- source: pattern://ea2c110e0adfa95722c2cc99 -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://ea2c110e0adfa95722c2cc99 -->
                <Gui name="IDENT-Failed-WithRetry" label="title.login">
                    <!-- source: pattern://ea2c110e0adfa95722c2cc99 -->
                    <GuiElem name="error" type="error"/>
                    <!-- source: pattern://ea2c110e0adfa95722c2cc99 -->
                    <GuiElem name="continue" type="button" label="continue.button.label" value="true"/>
                </Gui>
            </Response>
        </AuthState>
        <AuthState name="SAML_SP_nevisidm_operations_Realm_SAML_IDP_op_Connector_Connector" class="ch.nevis.esauth.auth.states.saml.ServiceProviderState" final="false" resumeState="true">
            <!-- source: pattern://36af90d50b0d6ba66136dbde -->
            <ResultCond name="LogoutFailed" next="SAML_SP_nevisidm_operations_Realm_Logout_Fail"/>
            <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
            <ResultCond name="logout" next="SAML_SP_nevisidm_operations_Realm_Logout_Done"/>
            <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
            <ResultCond name="logoutCompleted" next="SAML_SP_nevisidm_operations_Realm_Logout_Redirect"/>
            <!-- source: pattern://36af90d50b0d6ba66136dbde -->
            <ResultCond name="ok" next="SAML_SP_nevisidm_operations_Realm_Restore_Level"/>
            <!-- source: pattern://36af90d50b0d6ba66136dbde -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://36af90d50b0d6ba66136dbde -->
                <Arg name="ch.nevis.isiweb4.response.status" value="403"/>
            </Response>
            <!-- source: pattern://36af90d50b0d6ba66136dbde -->
            <property name="idpURL" value="https://trustbroker.agov-d.azure.adnovum.net/adfs/ls"/>
            <!-- source: pattern://36af90d50b0d6ba66136dbde -->
            <property name="in.binding" value="auto"/>
            <!-- source: pattern://36af90d50b0d6ba66136dbde -->
            <property name="in.map_issuer_certificate" value="true"/>
            <!-- source: pattern://36af90d50b0d6ba66136dbde -->
            <property name="in.verify" value="Response Assertion"/>
            <!-- source: pattern://36af90d50b0d6ba66136dbde -->
            <property name="in.max_age" value="60"/>
            <!-- source: pattern://36af90d50b0d6ba66136dbde -->
            <property name="in.audienceRegex" value="^https://op.agov-w.azure.adnovum.net/SAML2/ACS/.*$"/>
            <!-- source: pattern://36af90d50b0d6ba66136dbde -->
            <property name="in.tolerance" value="5"/>
            <!-- source: pattern://36af90d50b0d6ba66136dbde -->
            <property name="out.binding" value="http-post"/>
            <!-- source: pattern://36af90d50b0d6ba66136dbde -->
            <property name="out.ttl" value="60"/>
            <!-- source: pattern://36af90d50b0d6ba66136dbde -->
            <property name="out.signatureKeyInfo" value="Certificate"/>
            <!-- source: pattern://36af90d50b0d6ba66136dbde -->
            <property name="relayState" value="#{inargs.containsKey('RelayState') ? inargs.get('RelayState') : request['currentResource']}"/>
            <!-- source: pattern://36af90d50b0d6ba66136dbde -->
            <property name="logoutType" value="NONE"/>
            <!-- source: pattern://36af90d50b0d6ba66136dbde -->
            <property name="out.sign" value="AuthnRequest,LogoutRequest"/>
            <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
            <property name="out.authnContextClassRef" value="urn:qa.agov.ch:names:tc:ac:classes:100"/>
            <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
            <property name="consumerURL" value="${request:currentResource:(http.?.//[^/]+)/.*:$1/SAML2/ACS/}"/>
            <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
            <property name="out.issuer" value="https://op.agov-w.azure.adnovum.net/SAML2/ACS/"/>
            <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
            <property name="in.keystoreref" value="Store_SAML_SP_nevisidm_operations_Realm"/>
            <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
            <property name="out.keystoreref" value="Store_SAML_SP_nevisidm_operations_Realm"/>
            <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
            <property name="out.keyobjectref" value="Signer_SAML_SP_nevisidm_operations_Realm"/>
        </AuthState>
        <AuthState name="IDENT-AuthenticationRealm_Authentication_Failed" class="ch.nevis.esauth.auth.states.standard.AuthError" final="false">
            <!-- source: pattern://dce20cc904f88df4b77f93d9 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://dce20cc904f88df4b77f93d9 -->
                <Gui name="Error">
                    <!-- source: pattern://dce20cc904f88df4b77f93d9 -->
                    <GuiElem name="info" type="error" label="error_99"/>
                    <!-- source: pattern://dce20cc904f88df4b77f93d9 -->
                    <GuiElem name="submit" type="button" label="continue.button.label"/>
                </Gui>
            </Response>
        </AuthState>
        <AuthState name="IDENT-AuthenticationRealm_Prepare_Done" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false">
            <!-- source: pattern://026e4ae8ef4cc5496a7fe8c6, pattern://dce20cc904f88df4b77f93d9, pattern://5f2cdff72cb899bff468ad90, pattern://3fd09bb6cfbd34874595c263 -->
            <ResultCond name="default" next="IDENT-AuthenticationRealm_Auth_Done"/>
            <!-- source: pattern://026e4ae8ef4cc5496a7fe8c6, pattern://dce20cc904f88df4b77f93d9, pattern://5f2cdff72cb899bff468ad90, pattern://3fd09bb6cfbd34874595c263 -->
            <Response value="AUTH_DONE">
                <!-- source: pattern://026e4ae8ef4cc5496a7fe8c6, pattern://dce20cc904f88df4b77f93d9, pattern://5f2cdff72cb899bff468ad90, pattern://3fd09bb6cfbd34874595c263 -->
                <Gui name="ContinueResponse"/>
            </Response>
            <!-- source: pattern://026e4ae8ef4cc5496a7fe8c6, pattern://dce20cc904f88df4b77f93d9, pattern://5f2cdff72cb899bff468ad90, pattern://3fd09bb6cfbd34874595c263 -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/prepare_done.groovy"/>
        </AuthState>
        <AuthState name="SAML_SP_nevisidm_operations_Realm_Logout_Fail" class="ch.nevis.esauth.auth.states.standard.AuthGeneric" final="true">
            <!-- source: pattern://36af90d50b0d6ba66136dbde -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://36af90d50b0d6ba66136dbde -->
                <Gui name="empty"/>
            </Response>
        </AuthState>
        <AuthState name="SAML_SP_nevisidm_operations_Realm_Logout_Done" class="ch.nevis.esauth.auth.states.standard.AuthDone" final="false">
            <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
                <Gui name="ContinueResponse"/>
            </Response>
        </AuthState>
        <AuthState name="SAML_SP_nevisidm_operations_Realm_Logout_Redirect" class="ch.nevis.esauth.auth.states.standard.AuthGeneric" final="true">
            <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
                <Gui name="AuthDoneDialog">
                    <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
                    <GuiElem name="lasterror" type="error" label="${notes:lasterrorinfo}" value="${notes:lasterror}"/>
                    <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
                    <GuiElem name="continue" type="button" label="continue.button.label" value="true"/>
                </Gui>
                <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
                <Arg name="nevis.transfer.type" value="redirect"/>
                <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
                <Arg name="nevis.transfer.destination" value="/loggedout"/>
            </Response>
        </AuthState>
        <AuthState name="SAML_SP_nevisidm_operations_Realm_Restore_Level" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false">
            <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
            <ResultCond name="ok" next="SAML_SP_nevisidm_operations_Realm_set_userExtId_Groovy_Script_Step"/>
            <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
                <Arg name="ch.nevis.isiweb4.response.status" value="403"/>
            </Response>
            <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/saml_sp_level.groovy"/>
        </AuthState>
        <AuthState name="IDENT-AuthenticationRealm_Auth_Done" class="ch.nevis.esauth.auth.states.standard.AuthDone" final="false">
            <!-- source: pattern://026e4ae8ef4cc5496a7fe8c6, pattern://dce20cc904f88df4b77f93d9, pattern://5f2cdff72cb899bff468ad90, pattern://3fd09bb6cfbd34874595c263 -->
            <Response value="AUTH_DONE">
                <!-- source: pattern://026e4ae8ef4cc5496a7fe8c6, pattern://dce20cc904f88df4b77f93d9, pattern://5f2cdff72cb899bff468ad90, pattern://3fd09bb6cfbd34874595c263 -->
                <Gui name="ContinueResponse"/>
            </Response>
        </AuthState>
        <AuthState name="SAML_SP_nevisidm_operations_Realm_set_userExtId_Groovy_Script_Step" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false">
            <!-- source: pattern://488949a743edb1f46f73f232 -->
            <ResultCond name="error" next="SAML_SP_nevisidm_operations_Realm_Authentication_Failed"/>
            <!-- source: pattern://488949a743edb1f46f73f232 -->
            <ResultCond name="ok" next="SAML_SP_nevisidm_operations_Realm_fetch_User_Authentication_Step"/>
            <!-- source: pattern://488949a743edb1f46f73f232 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://488949a743edb1f46f73f232 -->
                <Arg name="ch.nevis.isiweb4.response.status" value="403"/>
            </Response>
            <!-- source: pattern://488949a743edb1f46f73f232 -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/set_userextid_groovy_script_step.groovy"/>
        </AuthState>
        <AuthState name="SAML_SP_nevisidm_operations_Realm_Authentication_Failed" class="ch.nevis.esauth.auth.states.standard.AuthError" final="false">
            <!-- source: pattern://700ec185425d8645fea2caf5 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://700ec185425d8645fea2caf5 -->
                <Gui name="Error">
                    <!-- source: pattern://700ec185425d8645fea2caf5 -->
                    <GuiElem name="info" type="error" label="error_99"/>
                    <!-- source: pattern://700ec185425d8645fea2caf5 -->
                    <GuiElem name="submit" type="button" label="continue.button.label"/>
                </Gui>
                <!-- source: pattern://700ec185425d8645fea2caf5 -->
                <Arg name="ch.nevis.isiweb4.response.status" value="403"/>
            </Response>
        </AuthState>
        <AuthState name="SAML_SP_nevisidm_operations_Realm_fetch_User_Authentication_Step" class="ch.nevis.idm.authstate.IdmUserVerifyState" final="false" resumeState="true">
            <!-- source: pattern://56955e7b6b92c254d7d1aae1 -->
            <ResultCond name="clientNotFound" next="SAML_SP_nevisidm_operations_Realm_Authentication_Failed"/>
            <!-- source: pattern://56955e7b6b92c254d7d1aae1 -->
            <ResultCond name="failed" next="SAML_SP_nevisidm_operations_Realm_Authentication_Failed"/>
            <!-- source: pattern://56955e7b6b92c254d7d1aae1 -->
            <ResultCond name="prospect" next="SAML_SP_nevisidm_operations_Realm_fetch_User_Authentication_Step_selectProfile"/>
            <!-- source: pattern://56955e7b6b92c254d7d1aae1 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://56955e7b6b92c254d7d1aae1 -->
                <Gui name="AuthFailDialog"/>
            </Response>
            <propertyRef name="nevisIDM_Connector"/>
            <!-- source: pattern://56955e7b6b92c254d7d1aae1 -->
            <property name="user.loginid" value="unknown"/>
            <!-- source: pattern://56955e7b6b92c254d7d1aae1 -->
            <property name="userExtId" value="${sess:operationsExtId}"/>
            <!-- source: pattern://56955e7b6b92c254d7d1aae1 -->
            <property name="client.name" value="OPERATIONS"/>
            <!-- source: pattern://56955e7b6b92c254d7d1aae1 -->
            <property name="detaillevel.user" value="HIGH"/>
            <!-- source: pattern://56955e7b6b92c254d7d1aae1 -->
            <property name="detaillevel.profile" value="HIGH"/>
            <!-- source: pattern://56955e7b6b92c254d7d1aae1 -->
            <property name="detaillevel.role" value="HIGH"/>
            <!-- source: pattern://56955e7b6b92c254d7d1aae1 -->
            <property name="detaillevel.authorization" value="HIGH"/>
            <!-- source: pattern://56955e7b6b92c254d7d1aae1 -->
            <property name="detaillevel.dataroom" value="HIGH"/>
        </AuthState>
        <AuthState name="SAML_SP_nevisidm_operations_Realm_fetch_User_Authentication_Step_selectProfile" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false" resumeState="true">
            <!-- source: pattern://56955e7b6b92c254d7d1aae1 -->
            <ResultCond name="error" next="SAML_SP_nevisidm_operations_Realm_Authentication_Failed"/>
            <!-- source: pattern://56955e7b6b92c254d7d1aae1 -->
            <ResultCond name="ok" next="SAML_SP_nevisidm_operations_Realm_fetch_User_Authentication_Step_IdmGetPropertiesState"/>
            <!-- source: pattern://56955e7b6b92c254d7d1aae1 -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://56955e7b6b92c254d7d1aae1 -->
                <Gui name="op_idmlogin_select_profile">
                    <!-- source: pattern://56955e7b6b92c254d7d1aae1 -->
                    <GuiElem name="lasterror" type="error" label="${notes:lasterrorinfo}" value="${notes:lasterror}" optional="true"/>
                    <!-- source: pattern://56955e7b6b92c254d7d1aae1 -->
                    <GuiElem name="submit" type="button" label="submit.button.label" value="go"/>
                </Gui>
            </Response>
            <!-- source: pattern://56955e7b6b92c254d7d1aae1 -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/selectIdmProfile.groovy"/>
        </AuthState>
        <AuthState name="nevisIDM_Connector" class="ch.nevis.esauth.auth.states.standard.AuthGeneric" final="false">
            <!-- source: pattern://12c979b6af0f15f1328656a4 -->
            <property name="login.service.connection.0" value="https://idm:8989/nevisidm/services/v1/LoginService"/>
            <!-- source: pattern://12c979b6af0f15f1328656a4 -->
            <property name="admin.service.connection.0" value="https://idm:8989/nevisidm/services/v1/AdminService"/>
        </AuthState>
        <AuthState name="SAML_SP_nevisidm_operations_Realm_fetch_User_Authentication_Step_IdmGetPropertiesState" class="ch.nevis.idm.authstate.IdmGetPropertiesState" final="false" resumeState="true">
            <!-- source: pattern://56955e7b6b92c254d7d1aae1 -->
            <ResultCond name="clientNotFound" next="SAML_SP_nevisidm_operations_Realm_Authentication_Failed"/>
            <!-- source: pattern://56955e7b6b92c254d7d1aae1 -->
            <ResultCond name="default" next="SAML_SP_nevisidm_operations_Realm_Authentication_Failed"/>
            <!-- source: pattern://56955e7b6b92c254d7d1aae1 -->
            <ResultCond name="ok" next="SAML_SP_nevisidm_operations_Realm_UpdateUserIfNeeded"/>
            <!-- source: pattern://56955e7b6b92c254d7d1aae1 -->
            <ResultCond name="showGui" next="SAML_SP_nevisidm_operations_Realm_Authentication_Failed"/>
            <!-- source: pattern://56955e7b6b92c254d7d1aae1 -->
            <Response value="AUTH_ERROR"/>
            <propertyRef name="nevisIDM_Connector"/>
            <!-- source: pattern://56955e7b6b92c254d7d1aae1 -->
            <property name="user.attributes" value="loginId,extId,firstName,name,email,language"/>
            <!-- source: pattern://56955e7b6b92c254d7d1aae1 -->
            <property name="chooseProfileFromSession" value="operationsProfileExtId"/>
            <!-- source: pattern://56955e7b6b92c254d7d1aae1 -->
            <property name="userExtId" value="${sess:operationsExtId}"/>
            <!-- source: pattern://56955e7b6b92c254d7d1aae1 -->
            <property name="client.name" value="OPERATIONS"/>
            <!-- source: pattern://56955e7b6b92c254d7d1aae1 -->
            <property name="detaillevel.user" value="HIGH"/>
            <!-- source: pattern://56955e7b6b92c254d7d1aae1 -->
            <property name="detaillevel.profile" value="HIGH"/>
            <!-- source: pattern://56955e7b6b92c254d7d1aae1 -->
            <property name="detaillevel.role" value="HIGH"/>
            <!-- source: pattern://56955e7b6b92c254d7d1aae1 -->
            <property name="detaillevel.authorization" value="HIGH"/>
            <!-- source: pattern://56955e7b6b92c254d7d1aae1 -->
            <property name="detaillevel.dataroom" value="HIGH"/>
        </AuthState>
        <AuthState name="SAML_SP_nevisidm_operations_Realm_UpdateUserIfNeeded" class="ch.nevis.esauth.auth.states.standard.ConditionalDispatcherState" final="false" resumeState="false">
            <!-- source: pattern://24cbc652d3166c8374eda3cd -->
            <ResultCond name="default" next="SAML_SP_nevisidm_operations_Realm_UpdateUserIfNeeded_Update"/>
            <!-- source: pattern://24cbc652d3166c8374eda3cd -->
            <ResultCond name="emailaddressDidntChange,givennameDidntChange,surnameDidntChange,languageDidntChange" next="SAML_SP_nevisidm_operations_Realm_Prepare_Done"/>
            <!-- source: pattern://24cbc652d3166c8374eda3cd -->
            <Response value="AUTH_ERROR"/>
            <!-- source: pattern://24cbc652d3166c8374eda3cd -->
            <property name="condition:emailaddressDidntChange" value="#{ !sess.containsKey('idp.email') or sess.get('idp.email').equals(sess.get('ch.nevis.idm.User.email')) }"/>
            <!-- source: pattern://24cbc652d3166c8374eda3cd -->
            <property name="condition:givennameDidntChange" value="#{ !sess.containsKey('idp.firstName') or sess.get('idp.firstName').equals(sess.get('ch.nevis.idm.User.firstName')) }"/>
            <!-- source: pattern://24cbc652d3166c8374eda3cd -->
            <property name="condition:surnameDidntChange" value="#{ !sess.containsKey('idp.lastName') or sess.get('idp.lastName').equals(sess.get('ch.nevis.idm.User.lastName')) }"/>
            <!-- source: pattern://24cbc652d3166c8374eda3cd -->
            <property name="condition:languageDidntChange" value="#{ !sess.containsKey('idp.language') or sess.get('idp.language').equals(sess.get('ch.nevis.idm.User.language')) }"/>
        </AuthState>
        <AuthState name="SAML_SP_nevisidm_operations_Realm_UpdateUserIfNeeded_Update" class="ch.nevis.idm.authstate.IdmSetPropertiesState" final="false" resumeState="false">
            <!-- source: pattern://24cbc652d3166c8374eda3cd -->
            <ResultCond name="emailExists" next="SAML_SP_nevisidm_operations_Realm_UpdateUserIfNeeded_AuditError"/>
            <!-- source: pattern://24cbc652d3166c8374eda3cd -->
            <ResultCond name="inputInvalid" next="SAML_SP_nevisidm_operations_Realm_UpdateUserIfNeeded_AuditError"/>
            <!-- source: pattern://24cbc652d3166c8374eda3cd -->
            <ResultCond name="inputMissing" next="SAML_SP_nevisidm_operations_Realm_UpdateUserIfNeeded_AuditError"/>
            <!-- source: pattern://24cbc652d3166c8374eda3cd -->
            <ResultCond name="loginIdExists" next="SAML_SP_nevisidm_operations_Realm_UpdateUserIfNeeded_AuditError"/>
            <!-- source: pattern://24cbc652d3166c8374eda3cd -->
            <ResultCond name="ok" next="SAML_SP_nevisidm_operations_Realm_UpdateUserIfNeeded_AuditUpdate"/>
            <!-- source: pattern://24cbc652d3166c8374eda3cd -->
            <ResultCond name="userIdExists" next="SAML_SP_nevisidm_operations_Realm_UpdateUserIfNeeded_AuditError"/>
            <!-- source: pattern://24cbc652d3166c8374eda3cd -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://24cbc652d3166c8374eda3cd -->
                <Arg name="ch.nevis.isiweb4.response.status" value="403"/>
            </Response>
            <propertyRef name="nevisIDM_Connector"/>
            <!-- source: pattern://24cbc652d3166c8374eda3cd -->
            <property name="user.loginid" value="${sess:ch.adnovum.nevisidm.user.loginId}"/>
            <!-- source: pattern://24cbc652d3166c8374eda3cd -->
            <property name="client.name" value="${sess:ch.adnovum.nevisidm.clientName}"/>
            <!-- source: pattern://24cbc652d3166c8374eda3cd -->
            <property name="user.attributes.optional" value="email,firstName,name,language"/>
            <!-- source: pattern://24cbc652d3166c8374eda3cd -->
            <property name="user.attributes.mandatory" value="remarks"/>
            <!-- source: pattern://24cbc652d3166c8374eda3cd -->
            <property name="user.attribute.email" value="${notes|saml.attributes.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress}"/>
            <!-- source: pattern://24cbc652d3166c8374eda3cd -->
            <property name="user.attribute.firstName" value="${notes|saml.attributes.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname}"/>
            <!-- source: pattern://24cbc652d3166c8374eda3cd -->
            <property name="user.attribute.name" value="${notes|saml.attributes.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname}"/>
            <!-- source: pattern://24cbc652d3166c8374eda3cd -->
            <property name="user.attribute.language" value="${notes|saml.attributes.http://schemas.agov.ch/ws/2023/05/identity/claims/languageOfCorrespondance}"/>
            <!-- source: pattern://24cbc652d3166c8374eda3cd -->
            <property name="user.attribute.remarks" value="Updated based on assertion '${sess:ch.nevis.auth.saml.assertion.id}' (Request-ID: ${inctx:connection.HttpHeader.X-Request-ID})"/>
            <!-- source: pattern://24cbc652d3166c8374eda3cd -->
            <property name="user.attributes.overwrite" value="email,firstName,name,language,remarks"/>
            <!-- source: pattern://24cbc652d3166c8374eda3cd -->
            <property name="allowInvalidUserEmails" value="true"/>
        </AuthState>
        <AuthState name="SAML_SP_nevisidm_operations_Realm_Prepare_Done" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false">
            <!-- source: pattern://7518c6cc61e47eec6322ae17, pattern://271d024334021208b71ac80a -->
            <ResultCond name="default" next="SAML_SP_nevisidm_operations_Realm_Redirect_RelayState"/>
            <!-- source: pattern://7518c6cc61e47eec6322ae17, pattern://271d024334021208b71ac80a -->
            <Response value="AUTH_DONE">
                <!-- source: pattern://7518c6cc61e47eec6322ae17, pattern://271d024334021208b71ac80a -->
                <Gui name="ContinueResponse"/>
            </Response>
            <!-- source: pattern://7518c6cc61e47eec6322ae17, pattern://271d024334021208b71ac80a -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/prepare_done.groovy"/>
        </AuthState>
        <AuthState name="SAML_SP_nevisidm_operations_Realm_UpdateUserIfNeeded_AuditError" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false" resumeState="false">
            <!-- source: pattern://24cbc652d3166c8374eda3cd -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://24cbc652d3166c8374eda3cd -->
                <Arg name="ch.nevis.isiweb4.response.status" value="403"/>
            </Response>
            <!-- source: pattern://24cbc652d3166c8374eda3cd -->
            <property name="scriptTraceGroup" value="AGOVOP-ACCT"/>
            <!-- source: pattern://24cbc652d3166c8374eda3cd -->
            <property name="script" value="  def user = session['ch.adnovum.nevisidm.user.extId'] ?: 'unknown'; def sourceIp = request.getLoginContext()['connection.HttpHeader.X-Real-IP'] ?: 'unknown'; def userAgent = request.getLoginContext()['connection.HttpHeader.user-agent'] ?: request.getLoginContext()['connection.HttpHeader.User-Agent'] ?: 'unknown'; LOG.error(&quot;Event='USERUPDATE', User=${user}, SourceIp=${sourceIp}, UserAgent='${userAgent}', error='failed to update user in IDM', lasterrorinfo='${lasterrorinfo}'&quot;); response.setStatus(ch.nevis.esauth.auth.engine.AuthResponse.AUTH_ERROR);   "/>
        </AuthState>
        <AuthState name="SAML_SP_nevisidm_operations_Realm_UpdateUserIfNeeded_AuditUpdate" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false" resumeState="false">
            <!-- source: pattern://24cbc652d3166c8374eda3cd -->
            <ResultCond name="default" next="SAML_SP_nevisidm_operations_Realm_Prepare_Done"/>
            <!-- source: pattern://24cbc652d3166c8374eda3cd -->
            <Response value="AUTH_CONTINUE"/>
            <!-- source: pattern://24cbc652d3166c8374eda3cd -->
            <property name="scriptTraceGroup" value="AGOVOP-ACCT"/>
            <!-- source: pattern://24cbc652d3166c8374eda3cd -->
            <property name="script" value="  def user = session['ch.adnovum.nevisidm.user.extId'] ?: 'unknown'; def sourceIp = request.getLoginContext()['connection.HttpHeader.X-Real-IP'] ?: 'unknown'; def userAgent = request.getLoginContext()['connection.HttpHeader.user-agent'] ?: request.getLoginContext()['connection.HttpHeader.User-Agent'] ?: 'unknown'; LOG.info(&quot;Event='USERUPDATE', User=${user}, SourceIp=${sourceIp}, UserAgent='${userAgent}'&quot;);   "/>
        </AuthState>
        <AuthState name="SAML_SP_nevisidm_operations_Realm_Redirect_RelayState" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false">
            <ResultCond name="default" next="SAML_SP_nevisidm_operations_Realm_Auth_Done"/>
            <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
            <Response value="AUTH_DONE">
                <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
                <Gui name="ContinueResponse"/>
            </Response>
            <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/redirect_relay_state.groovy"/>
        </AuthState>
        <AuthState name="SAML_SP_nevisidm_operations_Realm_Auth_Done" class="ch.nevis.esauth.auth.states.standard.AuthDone" final="false">
            <!-- source: pattern://7518c6cc61e47eec6322ae17, pattern://271d024334021208b71ac80a -->
            <Response value="AUTH_DONE">
                <!-- source: pattern://7518c6cc61e47eec6322ae17, pattern://271d024334021208b71ac80a -->
                <Gui name="ContinueResponse"/>
            </Response>
        </AuthState>
        <AuthState name="IDENT-AuthenticationRealm_Selector" class="ch.nevis.esauth.auth.states.standard.ConditionalDispatcherState" final="false">
            <!-- source: pattern://3fd09bb6cfbd34874595c263 -->
            <ResultCond name="nomatch" next="IDENT-AuthenticationRealm_Prepare_Done"/>
            <!-- source: pattern://3fd09bb6cfbd34874595c263 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://3fd09bb6cfbd34874595c263 -->
                <Arg name="ch.nevis.isiweb4.response.status" value="403"/>
            </Response>
        </AuthState>
        <AuthState name="OP-ONBRDNG-AuthenticationRealm_OP-ONBRDNG-PreProcessing" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false" resumeState="true">
            <!-- source: pattern://2787b678d9cce5310a335419 -->
            <ResultCond name="processResponse" next="OP-ONBRDNG-AuthenticationRealm_OP-ONBRDNG-SamlServiceProvider-ProcessResponse"/>
            <!-- source: pattern://2787b678d9cce5310a335419 -->
            <ResultCond name="sendAuthnRequest" next="OP-ONBRDNG-AuthenticationRealm_OP-ONBRDNG-SamlServiceProvider-AuthnRequest"/>
            <!-- source: pattern://2787b678d9cce5310a335419 -->
            <ResultCond name="verifyTicket" next="OP-ONBRDNG-AuthenticationRealm_OP-ONBRDNG-PreProcessing_VerifyURLTicket"/>
            <!-- source: pattern://2787b678d9cce5310a335419 -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://2787b678d9cce5310a335419 -->
                <Gui name="op_onbrdng_intro" label="op-onboarding.intro.title">
                    <!-- source: pattern://2787b678d9cce5310a335419 -->
                    <GuiElem name="lasterror" type="error" label="${notes:lasterrorinfo}" value="${notes:lasterror}"/>
                    <!-- source: pattern://2787b678d9cce5310a335419 -->
                    <GuiElem name="submit" type="button" label="continue.button.label" value="go"/>
                </Gui>
            </Response>
            <!-- source: pattern://2787b678d9cce5310a335419 -->
            <property name="scriptTraceGroup" value="AGOVOP-ACCT"/>
            <!-- source: pattern://2787b678d9cce5310a335419 -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/OpOnbrdng-PreProcessing.groovy"/>
            <!-- source: pattern://2787b678d9cce5310a335419 -->
            <property name="parameter.cookie.domain" value="agov-w.azure.adnovum.net"/>
        </AuthState>
        <AuthState name="OP-ONBRDNG-AuthenticationRealm_OP-ONBRDNG-SamlServiceProvider-ProcessResponse" class="ch.nevis.esauth.auth.states.saml.ServiceProviderState" final="false" resumeState="false">
            <!-- source: pattern://9be76d365909bb2ec294569c -->
            <ResultCond name="ok" next="OP-ONBRDNG-AuthenticationRealm_OP-ONBRDNG-PostProcessing" authLevel="auth.strong"/>
            <!-- source: pattern://9be76d365909bb2ec294569c -->
            <ResultCond name="status-Requester" next="OP-ONBRDNG-AuthenticationRealm_OP-ONBRDNG-PostProcessing"/>
            <!-- source: pattern://9be76d365909bb2ec294569c -->
            <ResultCond name="status-Responder" next="OP-ONBRDNG-AuthenticationRealm_OP-ONBRDNG-PostProcessing"/>
            <!-- source: pattern://9be76d365909bb2ec294569c -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://9be76d365909bb2ec294569c -->
                <Gui name="NoGui"/>
            </Response>
            <propertyRef name="SAML_SP_nevisidm_operations_Realm_SAML_IDP_op_Connector_Connector"/>
            <!-- source: pattern://9be76d365909bb2ec294569c -->
            <property name="idpURL" value="https://trustbroker.agov-d.azure.adnovum.net/adfs/ls"/>
            <!-- source: pattern://9be76d365909bb2ec294569c -->
            <property name="consumerURL" value="https://op.agov-w.azure.adnovum.net/AUTH/ONBOARDING/"/>
            <!-- source: pattern://9be76d365909bb2ec294569c -->
            <property name="relayState" value=""/>
            <!-- source: pattern://9be76d365909bb2ec294569c -->
            <property name="out.binding" value="none"/>
            <!-- source: pattern://9be76d365909bb2ec294569c -->
            <property name="in.binding" value="auto"/>
            <!-- source: pattern://9be76d365909bb2ec294569c -->
            <property name="in.relayState" value=""/>
            <!-- source: pattern://9be76d365909bb2ec294569c -->
            <property name="in.audienceRegex" value="https://op.agov-w.azure.adnovum.net/AUTH/ONBOARDING"/>
            <!-- source: pattern://9be76d365909bb2ec294569c -->
            <property name="in.audience.checkrequired" value="true"/>
            <!-- source: pattern://9be76d365909bb2ec294569c -->
            <property name="in.map_issuer_certificate" value="false"/>
            <!-- source: pattern://9be76d365909bb2ec294569c -->
            <property name="in.verify" value="Response Assertion"/>
        </AuthState>
        <AuthState name="OP-ONBRDNG-AuthenticationRealm_OP-ONBRDNG-SamlServiceProvider-AuthnRequest" class="ch.nevis.esauth.auth.states.saml.AssertionRequestState" final="false" resumeState="false">
            <!-- source: pattern://d56823f55065139ba437dc5c -->
            <ResultCond name="default" next="OP-ONBRDNG-AuthenticationRealm_OP-ONBRDNG-PreProcessing"/>
            <!-- source: pattern://d56823f55065139ba437dc5c -->
            <ResultCond name="ok" next="OP-ONBRDNG-AuthenticationRealm_OP-ONBRDNG-PostProcessing" authLevel="auth.strong"/>
            <!-- source: pattern://d56823f55065139ba437dc5c -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://d56823f55065139ba437dc5c -->
                <Gui name="NoGui"/>
            </Response>
            <propertyRef name="SAML_SP_nevisidm_operations_Realm_SAML_IDP_op_Connector_Connector"/>
            <!-- source: pattern://d56823f55065139ba437dc5c -->
            <property name="idpURL" value="https://trustbroker.agov-d.azure.adnovum.net/adfs/ls"/>
            <!-- source: pattern://d56823f55065139ba437dc5c -->
            <property name="consumerURL" value="https://op.agov-w.azure.adnovum.net/AUTH/ONBOARDING/"/>
            <!-- source: pattern://d56823f55065139ba437dc5c -->
            <property name="out.binding" value="http-post"/>
            <!-- source: pattern://d56823f55065139ba437dc5c -->
            <property name="out.requestType" value="AuthnRequest"/>
            <!-- source: pattern://d56823f55065139ba437dc5c -->
            <property name="out.sign" value="AuthnRequest"/>
            <!-- source: pattern://d56823f55065139ba437dc5c -->
            <property name="out.signatureKeyInfo" value="Certificate"/>
            <!-- source: pattern://d56823f55065139ba437dc5c -->
            <property name="out.issuer" value="https://op.agov-w.azure.adnovum.net/AUTH/ONBOARDING"/>
            <!-- source: pattern://d56823f55065139ba437dc5c -->
            <property name="request.RequestedAuthnContext.AuthnContextClassRef" value="${sess:agov.op.onboarding.ctxClass}"/>
            <!-- source: pattern://d56823f55065139ba437dc5c -->
            <property name="request.RequestedAuthnContext.Comparison" value="minimum"/>
            <!-- source: pattern://d56823f55065139ba437dc5c -->
            <property name="request.ttl" value="60"/>
            <!-- source: pattern://d56823f55065139ba437dc5c -->
            <property name="relayState" value=""/>
        </AuthState>
        <AuthState name="OP-ONBRDNG-AuthenticationRealm_OP-ONBRDNG-PreProcessing_VerifyURLTicket" class="ch.nevis.idm.authstate.IdmURLTicketVerifyState" final="false" resumeState="false">
            <!-- source: pattern://2787b678d9cce5310a335419 -->
            <ResultCond name="failed" next="OP-ONBRDNG-AuthenticationRealm_OP-ONBRDNG-PreProcessing_VerifyURLTicket_Failed"/>
            <!-- source: pattern://2787b678d9cce5310a335419 -->
            <ResultCond name="lockWarn" next="OP-ONBRDNG-AuthenticationRealm_OP-ONBRDNG-PreProcessing_VerifyURLTicket_Failed"/>
            <!-- source: pattern://2787b678d9cce5310a335419 -->
            <ResultCond name="locked" next="OP-ONBRDNG-AuthenticationRealm_OP-ONBRDNG-PreProcessing_VerifyURLTicket_Failed"/>
            <!-- source: pattern://2787b678d9cce5310a335419 -->
            <ResultCond name="nowLocked" next="OP-ONBRDNG-AuthenticationRealm_OP-ONBRDNG-PreProcessing_VerifyURLTicket_Failed"/>
            <!-- source: pattern://2787b678d9cce5310a335419 -->
            <ResultCond name="ok" next="OP-ONBRDNG-AuthenticationRealm_OP-ONBRDNG-PreProcessing_IdmPostProcessing" authLevel="auth.weak"/>
            <!-- source: pattern://2787b678d9cce5310a335419 -->
            <ResultCond name="tmpLocked" next="OP-ONBRDNG-AuthenticationRealm_OP-ONBRDNG-PreProcessing_VerifyURLTicket_Failed"/>
            <!-- source: pattern://2787b678d9cce5310a335419 -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://2787b678d9cce5310a335419 -->
                <Gui name="NoGui"/>
            </Response>
            <propertyRef name="nevisIDM_Connector"/>
            <!-- source: pattern://2787b678d9cce5310a335419 -->
            <property name="client.name" value="OPERATIONS"/>
            <!-- source: pattern://2787b678d9cce5310a335419 -->
            <property name="user.ticket" value="${sess:agov.op.onboarding.code}"/>
            <!-- source: pattern://2787b678d9cce5310a335419 -->
            <property name="user.loginid" value="${sess:agov.op.onboarding.code}"/>
        </AuthState>
        <AuthState name="OP-ONBRDNG-AuthenticationRealm_OP-ONBRDNG-PostProcessing" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false" resumeState="true">
            <!-- source: pattern://fd3912c7af7a88b6342a4c78 -->
            <ResultCond name="createSamlFedCredential" next="OP-ONBRDNG-AuthenticationRealm_OP-ONBRDNG-PostProcessing_SamlFedCredential"/>
            <!-- source: pattern://fd3912c7af7a88b6342a4c78 -->
            <ResultCond name="done" next="OP-ONBRDNG-AuthenticationRealm_op_onbrdng_success"/>
            <!-- source: pattern://fd3912c7af7a88b6342a4c78 -->
            <ResultCond name="failure" next="OP-ONBRDNG-AuthenticationRealm_OP-ONBRDNG-PreProcessing"/>
            <!-- source: pattern://fd3912c7af7a88b6342a4c78 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://fd3912c7af7a88b6342a4c78 -->
                <Gui name="op_onbrdng_error" label="op-onboarding.process.title">
                    <!-- source: pattern://fd3912c7af7a88b6342a4c78 -->
                    <GuiElem name="info" type="info" label="op-onboarding.process.message"/>
                    <!-- source: pattern://fd3912c7af7a88b6342a4c78 -->
                    <GuiElem name="lasterror" type="error" label="${notes:lasterrorinfo}" value="${notes:lasterror}"/>
                </Gui>
            </Response>
            <!-- source: pattern://fd3912c7af7a88b6342a4c78 -->
            <property name="scriptTraceGroup" value="AGOVOP-ACCT"/>
            <!-- source: pattern://fd3912c7af7a88b6342a4c78 -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/OpOnbrdng-PostProcessing.groovy"/>
        </AuthState>
        <AuthState name="OP-ONBRDNG-AuthenticationRealm_OP-ONBRDNG-PreProcessing_VerifyURLTicket_Failed" class="ch.nevis.esauth.auth.states.standard.TransformAttributes" final="false" resumeState="false">
            <!-- source: pattern://2787b678d9cce5310a335419 -->
            <ResultCond name="default" next="OP-ONBRDNG-AuthenticationRealm_OP-ONBRDNG-PreProcessing"/>
            <!-- source: pattern://2787b678d9cce5310a335419 -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://2787b678d9cce5310a335419 -->
                <Gui name="NoGui"/>
            </Response>
            <!-- source: pattern://2787b678d9cce5310a335419 -->
            <property name="notes:lasterror" value="9904"/>
            <!-- source: pattern://2787b678d9cce5310a335419 -->
            <property name="notes:lasterrorinfo" value="Problem with URL-ticket (${notes:lasttransition}): ${notes:lasterrorinfo}"/>
        </AuthState>
        <AuthState name="OP-ONBRDNG-AuthenticationRealm_OP-ONBRDNG-PreProcessing_IdmPostProcessing" class="ch.nevis.idm.authstate.IdmGetPropertiesState" final="false" resumeState="false">
            <!-- source: pattern://2787b678d9cce5310a335419 -->
            <ResultCond name="clientNotFound" next="OP-ONBRDNG-AuthenticationRealm_OP-ONBRDNG-PreProcessing_IdmPostProcessing_Failed"/>
            <!-- source: pattern://2787b678d9cce5310a335419 -->
            <ResultCond name="default" next="OP-ONBRDNG-AuthenticationRealm_OP-ONBRDNG-PreProcessing_IdmPostProcessing_Failed"/>
            <!-- source: pattern://2787b678d9cce5310a335419 -->
            <ResultCond name="ok" next="OP-ONBRDNG-AuthenticationRealm_OP-ONBRDNG-PreProcessing" authLevel="auth.normal"/>
            <!-- source: pattern://2787b678d9cce5310a335419 -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://2787b678d9cce5310a335419 -->
                <Gui name="NoGui"/>
            </Response>
            <propertyRef name="nevisIDM_Connector"/>
            <!-- source: pattern://2787b678d9cce5310a335419 -->
            <property name="detaillevel.default" value="MEDIUM"/>
            <!-- source: pattern://2787b678d9cce5310a335419 -->
            <property name="detaillevel.user" value="MEDIUM"/>
            <!-- source: pattern://2787b678d9cce5310a335419 -->
            <property name="detaillevel.profile" value="MEDIUM"/>
            <!-- source: pattern://2787b678d9cce5310a335419 -->
            <property name="detaillevel.credential" value="MEDIUM"/>
            <!-- source: pattern://2787b678d9cce5310a335419 -->
            <property name="detaillevel.saml_federation" value="MEDIUM"/>
            <!-- source: pattern://2787b678d9cce5310a335419 -->
            <property name="chooseDefaultProfile" value="true"/>
            <!-- source: pattern://2787b678d9cce5310a335419 -->
            <property name="user.attributes" value="firstName,name,email,language"/>
            <!-- source: pattern://2787b678d9cce5310a335419 -->
            <property name="user.cred.saml_federation1.issuerNameId" value=" true"/>
            <!-- source: pattern://2787b678d9cce5310a335419 -->
            <property name="user.cred.saml_federation1.subjectNameId" value="true"/>
            <!-- source: pattern://2787b678d9cce5310a335419 -->
            <property name="user.cred.saml_federation2.issuerNameId" value="true"/>
            <!-- source: pattern://2787b678d9cce5310a335419 -->
            <property name="user.cred.saml_federation2.subjectNameId" value="true"/>
            <!-- source: pattern://2787b678d9cce5310a335419 -->
            <property name="user.cred.saml_federation3.issuerNameId" value="true"/>
            <!-- source: pattern://2787b678d9cce5310a335419 -->
            <property name="user.cred.saml_federation3.subjectNameId" value="true"/>
        </AuthState>
        <AuthState name="OP-ONBRDNG-AuthenticationRealm_OP-ONBRDNG-PostProcessing_SamlFedCredential" class="ch.nevis.idm.authstate.IdmCreateCredentialState" final="false" resumeState="false">
            <!-- source: pattern://fd3912c7af7a88b6342a4c78 -->
            <ResultCond name="credentialExists" next="OP-ONBRDNG-AuthenticationRealm_OP-ONBRDNG-PostProcessing_SamlFedCredential_Failed"/>
            <!-- source: pattern://fd3912c7af7a88b6342a4c78 -->
            <ResultCond name="default" next="OP-ONBRDNG-AuthenticationRealm_OP-ONBRDNG-PostProcessing_SamlFedCredential_Failed"/>
            <!-- source: pattern://fd3912c7af7a88b6342a4c78 -->
            <ResultCond name="failed" next="OP-ONBRDNG-AuthenticationRealm_OP-ONBRDNG-PostProcessing_SamlFedCredential_Failed"/>
            <!-- source: pattern://fd3912c7af7a88b6342a4c78 -->
            <ResultCond name="ok" next="OP-ONBRDNG-AuthenticationRealm_OP-ONBRDNG-PostProcessing"/>
            <!-- source: pattern://fd3912c7af7a88b6342a4c78 -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://fd3912c7af7a88b6342a4c78 -->
                <Gui name="NoGui"/>
            </Response>
            <propertyRef name="nevisIDM_Connector"/>
            <!-- source: pattern://fd3912c7af7a88b6342a4c78 -->
            <property name="user.loginId" value="${sess:ch.adnovum.nevisidm.user.loginId}"/>
            <!-- source: pattern://fd3912c7af7a88b6342a4c78 -->
            <property name="client.name" value="${sess:ch.adnovum.nevisidm.user.clientName}"/>
            <!-- source: pattern://fd3912c7af7a88b6342a4c78 -->
            <property name="cred.type" value="saml_federation"/>
            <!-- source: pattern://fd3912c7af7a88b6342a4c78 -->
            <property name="cred.modificationComment" value="Automatically on-boarded based on assertionId: '${sess:ch.nevis.auth.saml.assertion.id}'"/>
            <!-- source: pattern://fd3912c7af7a88b6342a4c78 -->
            <property name="cred.state" value="ACTIVE"/>
            <!-- source: pattern://fd3912c7af7a88b6342a4c78 -->
            <property name="cred.issuerNameId" value="${sess:agov.op.onboarding.homeName}"/>
            <!-- source: pattern://fd3912c7af7a88b6342a4c78 -->
            <property name="cred.subjectNameId" value="${sess:agov.op.onboarding.subject}"/>
            <!-- source: pattern://fd3912c7af7a88b6342a4c78 -->
            <property name="operationIfExists" value="ADD"/>
        </AuthState>
        <AuthState name="OP-ONBRDNG-AuthenticationRealm_op_onbrdng_success" class="ch.nevis.esauth.auth.states.standard.AuthError" final="true">
            <!-- source: pattern://50ca1ad35a73847a81e2ece8 -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://50ca1ad35a73847a81e2ece8 -->
                <Gui name="op_onbrdng_success" label="op-onboarding.done.title">
                    <!-- source: pattern://50ca1ad35a73847a81e2ece8 -->
                    <GuiElem name="info" type="info" label="op-onboarding.done.message"/>
                </Gui>
            </Response>
        </AuthState>
        <AuthState name="OP-ONBRDNG-AuthenticationRealm_OP-ONBRDNG-PreProcessing_IdmPostProcessing_Failed" class="ch.nevis.esauth.auth.states.standard.TransformAttributes" final="false" resumeState="false">
            <!-- source: pattern://2787b678d9cce5310a335419 -->
            <ResultCond name="default" next="OP-ONBRDNG-AuthenticationRealm_OP-ONBRDNG-PreProcessing"/>
            <!-- source: pattern://2787b678d9cce5310a335419 -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://2787b678d9cce5310a335419 -->
                <Gui name="NoGui"/>
            </Response>
            <!-- source: pattern://2787b678d9cce5310a335419 -->
            <property name="notes:lasterror" value="9905"/>
            <!-- source: pattern://2787b678d9cce5310a335419 -->
            <property name="notes:lasterrorinfo" value="Problem with operations account (${sess:ch.adnovum.nevisidm.user.extId}): ${notes:lasterrorinfo}"/>
        </AuthState>
        <AuthState name="OP-ONBRDNG-AuthenticationRealm_OP-ONBRDNG-PostProcessing_SamlFedCredential_Failed" class="ch.nevis.esauth.auth.states.standard.TransformAttributes" final="false" resumeState="false">
            <!-- source: pattern://fd3912c7af7a88b6342a4c78 -->
            <ResultCond name="default" next="OP-ONBRDNG-AuthenticationRealm_OP-ONBRDNG-PreProcessing"/>
            <!-- source: pattern://fd3912c7af7a88b6342a4c78 -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://fd3912c7af7a88b6342a4c78 -->
                <Gui name="NoGui"/>
            </Response>
            <!-- source: pattern://fd3912c7af7a88b6342a4c78 -->
            <property name="notes:lasterror" value="9905"/>
            <!-- source: pattern://fd3912c7af7a88b6342a4c78 -->
            <property name="notes:lasterrorinfo" value="Problem with creation of SamlFed credential: ${notes:lasttransition} - ${notes:lasterrorinfo}"/>
        </AuthState>
        <AuthState name="OP-ONBRDNG-AuthenticationRealm_Selector" class="ch.nevis.esauth.auth.states.standard.ConditionalDispatcherState" final="false">
            <!-- source: pattern://6df66943ca713eed2a25d935 -->
            <ResultCond name="nomatch" next="OP-ONBRDNG-AuthenticationRealm_Prepare_Done"/>
            <!-- source: pattern://6df66943ca713eed2a25d935 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://6df66943ca713eed2a25d935 -->
                <Arg name="ch.nevis.isiweb4.response.status" value="403"/>
            </Response>
        </AuthState>
        <AuthState name="OP-ONBRDNG-AuthenticationRealm_Prepare_Done" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false">
            <!-- source: pattern://50ca1ad35a73847a81e2ece8, pattern://6df66943ca713eed2a25d935 -->
            <ResultCond name="default" next="OP-ONBRDNG-AuthenticationRealm_Auth_Done"/>
            <!-- source: pattern://50ca1ad35a73847a81e2ece8, pattern://6df66943ca713eed2a25d935 -->
            <Response value="AUTH_DONE">
                <!-- source: pattern://50ca1ad35a73847a81e2ece8, pattern://6df66943ca713eed2a25d935 -->
                <Gui name="ContinueResponse"/>
            </Response>
            <!-- source: pattern://50ca1ad35a73847a81e2ece8, pattern://6df66943ca713eed2a25d935 -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/prepare_done.groovy"/>
        </AuthState>
        <AuthState name="OP-ONBRDNG-AuthenticationRealm_Auth_Done" class="ch.nevis.esauth.auth.states.standard.AuthDone" final="false">
            <!-- source: pattern://50ca1ad35a73847a81e2ece8, pattern://6df66943ca713eed2a25d935 -->
            <Response value="AUTH_DONE">
                <!-- source: pattern://50ca1ad35a73847a81e2ece8, pattern://6df66943ca713eed2a25d935 -->
                <Gui name="ContinueResponse"/>
            </Response>
        </AuthState>
        <AuthState name="SAML_SP_nevisidm_admin_Realm_Extract_Issuer" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false">
            <!-- source: pattern://6f9c9f982dcc7ef59a34f1f7 -->
            <ResultCond name="ok" next="SAML_SP_nevisidm_admin_Realm_IDP_Selection"/>
            <!-- source: pattern://6f9c9f982dcc7ef59a34f1f7 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://6f9c9f982dcc7ef59a34f1f7 -->
                <Arg name="ch.nevis.isiweb4.response.status" value="403"/>
            </Response>
            <!-- source: pattern://6f9c9f982dcc7ef59a34f1f7 -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/saml_sp_nevisidm_admin_realm_extract_issuer.groovy"/>
        </AuthState>
        <AuthState name="SAML_SP_nevisidm_admin_Realm_IDP_Selection" class="ch.nevis.esauth.auth.states.standard.ConditionalDispatcherState" final="false">
            <!-- source: pattern://6f9c9f982dcc7ef59a34f1f7 -->
            <ResultCond name="authenticate:https\u003A//trustbroker.agov-d.azure.adnovum.net_continuation" next="SAML_SP_nevisidm_admin_Realm_SAML_IDP_admin_Connector_Connector"/>
            <!-- source: pattern://6f9c9f982dcc7ef59a34f1f7 -->
            <ResultCond name="authenticate:https\u003A//trustbroker.agov-d.azure.adnovum.net_entry" next="SAML_SP_nevisidm_admin_Realm_SAML_IDP_admin_Connector_Connector"/>
            <!-- source: pattern://6f9c9f982dcc7ef59a34f1f7 -->
            <ResultCond name="authenticate:https\u003A//trustbroker.agov-d.azure.adnovum.net_entry,https\u003A//trustbroker.agov-d.azure.adnovum.net_continuation" next="SAML_SP_nevisidm_admin_Realm_SAML_IDP_admin_Connector_Connector"/>
            <!-- source: pattern://6f9c9f982dcc7ef59a34f1f7 -->
            <ResultCond name="logout:https\u003A//trustbroker.agov-d.azure.adnovum.net_continuation" next="SAML_SP_nevisidm_admin_Realm_SAML_IDP_admin_Connector_Connector"/>
            <!-- source: pattern://6f9c9f982dcc7ef59a34f1f7 -->
            <ResultCond name="logout:https\u003A//trustbroker.agov-d.azure.adnovum.net_entry" next="SAML_SP_nevisidm_admin_Realm_SAML_IDP_admin_Connector_Connector"/>
            <!-- source: pattern://6f9c9f982dcc7ef59a34f1f7 -->
            <ResultCond name="logout:https\u003A//trustbroker.agov-d.azure.adnovum.net_entry,https\u003A//trustbroker.agov-d.azure.adnovum.net_continuation" next="SAML_SP_nevisidm_admin_Realm_SAML_IDP_admin_Connector_Connector"/>
            <!-- source: pattern://6f9c9f982dcc7ef59a34f1f7 -->
            <ResultCond name="stepup:https\u003A//trustbroker.agov-d.azure.adnovum.net_continuation" next="SAML_SP_nevisidm_admin_Realm_SAML_IDP_admin_Connector_Force_Auth"/>
            <!-- source: pattern://6f9c9f982dcc7ef59a34f1f7 -->
            <ResultCond name="stepup:https\u003A//trustbroker.agov-d.azure.adnovum.net_entry" next="SAML_SP_nevisidm_admin_Realm_SAML_IDP_admin_Connector_Force_Auth"/>
            <!-- source: pattern://6f9c9f982dcc7ef59a34f1f7 -->
            <ResultCond name="stepup:https\u003A//trustbroker.agov-d.azure.adnovum.net_entry,https\u003A//trustbroker.agov-d.azure.adnovum.net_continuation" next="SAML_SP_nevisidm_admin_Realm_SAML_IDP_admin_Connector_Force_Auth"/>
            <!-- source: pattern://6f9c9f982dcc7ef59a34f1f7 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://6f9c9f982dcc7ef59a34f1f7 -->
                <Arg name="ch.nevis.isiweb4.response.status" value="403"/>
            </Response>
            <!-- source: pattern://6f9c9f982dcc7ef59a34f1f7 -->
            <property name="selectBestTransition" value="true"/>
            <!-- source: pattern://6f9c9f982dcc7ef59a34f1f7 -->
            <property name="condition:https\u003A//trustbroker.agov-d.azure.adnovum.net_entry" value="#{true}"/>
            <!-- source: pattern://6f9c9f982dcc7ef59a34f1f7 -->
            <property name="condition:https\u003A//trustbroker.agov-d.azure.adnovum.net_continuation" value="${sess:saml.inbound.issuer:^https\u003A//trustbroker.agov-d.azure.adnovum.net$}"/>
        </AuthState>
        <AuthState name="SAML_SP_nevisidm_admin_Realm_SAML_IDP_admin_Connector_Connector" class="ch.nevis.esauth.auth.states.saml.ServiceProviderState" final="false" resumeState="true">
            <!-- source: pattern://7e94f2eb346f07f78440e884 -->
            <ResultCond name="LogoutFailed" next="SAML_SP_nevisidm_admin_Realm_Logout_Fail"/>
            <!-- source: pattern://6f9c9f982dcc7ef59a34f1f7 -->
            <ResultCond name="logout" next="SAML_SP_nevisidm_admin_Realm_Logout_Done"/>
            <!-- source: pattern://6f9c9f982dcc7ef59a34f1f7 -->
            <ResultCond name="logoutCompleted" next="SAML_SP_nevisidm_admin_Realm_Logout_Redirect"/>
            <!-- source: pattern://7e94f2eb346f07f78440e884 -->
            <ResultCond name="ok" next="SAML_SP_nevisidm_admin_Realm_Restore_Level"/>
            <!-- source: pattern://7e94f2eb346f07f78440e884 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://7e94f2eb346f07f78440e884 -->
                <Arg name="ch.nevis.isiweb4.response.status" value="403"/>
            </Response>
            <!-- source: pattern://7e94f2eb346f07f78440e884 -->
            <property name="idpURL" value="https://trustbroker.agov-d.azure.adnovum.net/adfs/ls"/>
            <!-- source: pattern://7e94f2eb346f07f78440e884 -->
            <property name="in.binding" value="auto"/>
            <!-- source: pattern://7e94f2eb346f07f78440e884 -->
            <property name="in.map_issuer_certificate" value="true"/>
            <!-- source: pattern://7e94f2eb346f07f78440e884 -->
            <property name="in.verify" value="Response Assertion"/>
            <!-- source: pattern://7e94f2eb346f07f78440e884 -->
            <property name="in.max_age" value="60"/>
            <!-- source: pattern://7e94f2eb346f07f78440e884 -->
            <property name="in.audienceRegex" value="^https://admin.agov-w.azure.adnovum.net/SAML2/ACS/.*$"/>
            <!-- source: pattern://7e94f2eb346f07f78440e884 -->
            <property name="in.tolerance" value="5"/>
            <!-- source: pattern://7e94f2eb346f07f78440e884 -->
            <property name="out.binding" value="http-post"/>
            <!-- source: pattern://7e94f2eb346f07f78440e884 -->
            <property name="out.ttl" value="60"/>
            <!-- source: pattern://7e94f2eb346f07f78440e884 -->
            <property name="out.signatureKeyInfo" value="Certificate"/>
            <!-- source: pattern://7e94f2eb346f07f78440e884 -->
            <property name="relayState" value="#{inargs.containsKey('RelayState') ? inargs.get('RelayState') : request['currentResource']}"/>
            <!-- source: pattern://7e94f2eb346f07f78440e884 -->
            <property name="logoutType" value="NONE"/>
            <!-- source: pattern://7e94f2eb346f07f78440e884 -->
            <property name="out.sign" value="AuthnRequest,LogoutRequest"/>
            <!-- source: pattern://6f9c9f982dcc7ef59a34f1f7 -->
            <property name="out.authnContextClassRef" value="urn:qa.agov.ch:names:tc:ac:classes:100"/>
            <!-- source: pattern://6f9c9f982dcc7ef59a34f1f7 -->
            <property name="consumerURL" value="${request:currentResource:(http.?.//[^/]+)/.*:$1/SAML2/ACS/}"/>
            <!-- source: pattern://6f9c9f982dcc7ef59a34f1f7 -->
            <property name="out.issuer" value="https://admin.agov-w.azure.adnovum.net/SAML2/ACS/"/>
            <!-- source: pattern://6f9c9f982dcc7ef59a34f1f7 -->
            <property name="in.keystoreref" value="Store_SAML_SP_nevisidm_admin_Realm"/>
            <!-- source: pattern://6f9c9f982dcc7ef59a34f1f7 -->
            <property name="out.keystoreref" value="Store_SAML_SP_nevisidm_admin_Realm"/>
            <!-- source: pattern://6f9c9f982dcc7ef59a34f1f7 -->
            <property name="out.keyobjectref" value="Signer_SAML_SP_nevisidm_admin_Realm"/>
        </AuthState>
        <AuthState name="SAML_SP_nevisidm_admin_Realm_SAML_IDP_admin_Connector_Force_Auth" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false">
            <!-- source: pattern://7e94f2eb346f07f78440e884 -->
            <ResultCond name="default" next="SAML_SP_nevisidm_admin_Realm_SAML_IDP_admin_Connector_Connector"/>
            <!-- source: pattern://7e94f2eb346f07f78440e884 -->
            <ResultCond name="done" next="SAML_SP_nevisidm_admin_Realm_Prepare_Done"/>
            <!-- source: pattern://7e94f2eb346f07f78440e884 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://7e94f2eb346f07f78440e884 -->
                <Arg name="ch.nevis.isiweb4.response.status" value="403"/>
            </Response>
            <!-- source: pattern://7e94f2eb346f07f78440e884 -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/saml_sp_stepup.groovy"/>
        </AuthState>
        <AuthState name="SAML_SP_nevisidm_admin_Realm_Logout_Fail" class="ch.nevis.esauth.auth.states.standard.AuthGeneric" final="true">
            <!-- source: pattern://7e94f2eb346f07f78440e884 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://7e94f2eb346f07f78440e884 -->
                <Gui name="empty"/>
            </Response>
        </AuthState>
        <AuthState name="SAML_SP_nevisidm_admin_Realm_Logout_Done" class="ch.nevis.esauth.auth.states.standard.AuthDone" final="false">
            <!-- source: pattern://6f9c9f982dcc7ef59a34f1f7 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://6f9c9f982dcc7ef59a34f1f7 -->
                <Gui name="ContinueResponse"/>
            </Response>
        </AuthState>
        <AuthState name="SAML_SP_nevisidm_admin_Realm_Logout_Redirect" class="ch.nevis.esauth.auth.states.standard.AuthGeneric" final="true">
            <!-- source: pattern://6f9c9f982dcc7ef59a34f1f7 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://6f9c9f982dcc7ef59a34f1f7 -->
                <Gui name="AuthDoneDialog">
                    <!-- source: pattern://6f9c9f982dcc7ef59a34f1f7 -->
                    <GuiElem name="lasterror" type="error" label="${notes:lasterrorinfo}" value="${notes:lasterror}"/>
                    <!-- source: pattern://6f9c9f982dcc7ef59a34f1f7 -->
                    <GuiElem name="continue" type="button" label="continue.button.label" value="true"/>
                </Gui>
                <!-- source: pattern://6f9c9f982dcc7ef59a34f1f7 -->
                <Arg name="nevis.transfer.type" value="redirect"/>
                <!-- source: pattern://6f9c9f982dcc7ef59a34f1f7 -->
                <Arg name="nevis.transfer.destination" value="/loggedout"/>
            </Response>
        </AuthState>
        <AuthState name="SAML_SP_nevisidm_admin_Realm_Restore_Level" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false">
            <!-- source: pattern://6f9c9f982dcc7ef59a34f1f7 -->
            <ResultCond name="ok" next="SAML_SP_nevisidm_admin_Realm_saveEmailFromAssertionToSession"/>
            <!-- source: pattern://6f9c9f982dcc7ef59a34f1f7 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://6f9c9f982dcc7ef59a34f1f7 -->
                <Arg name="ch.nevis.isiweb4.response.status" value="403"/>
            </Response>
            <!-- source: pattern://6f9c9f982dcc7ef59a34f1f7 -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/saml_sp_level.groovy"/>
        </AuthState>
        <AuthState name="SAML_SP_nevisidm_admin_Realm_Prepare_Done" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false">
            <!-- source: pattern://a7b62b3dea12ecfc81ecc855, pattern://6f9c9f982dcc7ef59a34f1f7, pattern://271d024334021208b71ac80a -->
            <ResultCond name="default" next="SAML_SP_nevisidm_admin_Realm_Redirect_RelayState"/>
            <!-- source: pattern://a7b62b3dea12ecfc81ecc855, pattern://6f9c9f982dcc7ef59a34f1f7, pattern://271d024334021208b71ac80a -->
            <Response value="AUTH_DONE">
                <!-- source: pattern://a7b62b3dea12ecfc81ecc855, pattern://6f9c9f982dcc7ef59a34f1f7, pattern://271d024334021208b71ac80a -->
                <Gui name="ContinueResponse"/>
            </Response>
            <!-- source: pattern://a7b62b3dea12ecfc81ecc855, pattern://6f9c9f982dcc7ef59a34f1f7, pattern://271d024334021208b71ac80a -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/prepare_done.groovy"/>
        </AuthState>
        <AuthState name="SAML_SP_nevisidm_admin_Realm_saveEmailFromAssertionToSession" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false">
            <!-- source: pattern://fbf7b18179dda28d420420fd -->
            <ResultCond name="error" next="SAML_SP_nevisidm_admin_Realm_Authentication_Failed"/>
            <!-- source: pattern://fbf7b18179dda28d420420fd -->
            <ResultCond name="ok" next="SAML_SP_nevisidm_admin_Realm_admin_nevisIDM_Password_Login"/>
            <!-- source: pattern://fbf7b18179dda28d420420fd -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://fbf7b18179dda28d420420fd -->
                <Arg name="ch.nevis.isiweb4.response.status" value="403"/>
            </Response>
            <!-- source: pattern://fbf7b18179dda28d420420fd -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/saveemailfromassertiontosession.groovy"/>
        </AuthState>
        <AuthState name="SAML_SP_nevisidm_admin_Realm_Redirect_RelayState" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false">
            <ResultCond name="default" next="SAML_SP_nevisidm_admin_Realm_Auth_Done"/>
            <!-- source: pattern://6f9c9f982dcc7ef59a34f1f7 -->
            <Response value="AUTH_DONE">
                <!-- source: pattern://6f9c9f982dcc7ef59a34f1f7 -->
                <Gui name="ContinueResponse"/>
            </Response>
            <!-- source: pattern://6f9c9f982dcc7ef59a34f1f7 -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/redirect_relay_state.groovy"/>
        </AuthState>
        <AuthState name="SAML_SP_nevisidm_admin_Realm_Authentication_Failed" class="ch.nevis.esauth.auth.states.standard.AuthError" final="false">
            <!-- source: pattern://a7b62b3dea12ecfc81ecc855, pattern://fbf7b18179dda28d420420fd -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://a7b62b3dea12ecfc81ecc855, pattern://fbf7b18179dda28d420420fd -->
                <Gui name="Error">
                    <!-- source: pattern://a7b62b3dea12ecfc81ecc855, pattern://fbf7b18179dda28d420420fd -->
                    <GuiElem name="info" type="error" label="error_99"/>
                    <!-- source: pattern://a7b62b3dea12ecfc81ecc855, pattern://fbf7b18179dda28d420420fd -->
                    <GuiElem name="submit" type="button" label="continue.button.label"/>
                </Gui>
            </Response>
        </AuthState>
        <AuthState name="SAML_SP_nevisidm_admin_Realm_admin_nevisIDM_Password_Login" class="ch.nevis.idm.authstate.IdmPasswordVerifyState" final="false">
            <!-- source: pattern://12c979b6af0f15f1328656a4 -->
            <ResultCond name="clientNotFound" next="SAML_SP_nevisidm_admin_Realm_admin_nevisIDM_Password_Login"/>
            <!-- source: pattern://12c979b6af0f15f1328656a4 -->
            <ResultCond name="disabled" next="SAML_SP_nevisidm_admin_Realm_admin_nevisIDM_Password_Login"/>
            <!-- source: pattern://12c979b6af0f15f1328656a4 -->
            <ResultCond name="failed" next="SAML_SP_nevisidm_admin_Realm_admin_nevisIDM_Password_Login"/>
            <!-- source: pattern://12c979b6af0f15f1328656a4 -->
            <ResultCond name="lockWarn" next="SAML_SP_nevisidm_admin_Realm_admin_nevisIDM_Password_Login"/>
            <!-- source: pattern://12c979b6af0f15f1328656a4 -->
            <ResultCond name="locked" next="SAML_SP_nevisidm_admin_Realm_admin_nevisIDM_Password_Login"/>
            <!-- source: pattern://12c979b6af0f15f1328656a4 -->
            <ResultCond name="nowLocked" next="SAML_SP_nevisidm_admin_Realm_admin_nevisIDM_Password_Login"/>
            <!-- source: pattern://12c979b6af0f15f1328656a4 -->
            <ResultCond name="ok" next="SAML_SP_nevisidm_admin_Realm_admin_nevisIDM_Password_Login-IdmPostProcessing" authLevel="1"/>
            <!-- source: pattern://12c979b6af0f15f1328656a4 -->
            <ResultCond name="pwChange" next="SAML_SP_nevisidm_admin_Realm_admin_nevisIDM_Password_Login-IdmPasswordChange"/>
            <!-- source: pattern://12c979b6af0f15f1328656a4 -->
            <ResultCond name="tmpLocked" next="SAML_SP_nevisidm_admin_Realm_admin_nevisIDM_Password_Login"/>
            <!-- source: pattern://12c979b6af0f15f1328656a4 -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://12c979b6af0f15f1328656a4 -->
                <Gui name="AuthUidPwDialog" label="title.login">
                    <!-- source: pattern://12c979b6af0f15f1328656a4 -->
                    <GuiElem name="lasterror" type="error" label="${notes:lasterrorinfo}" value="${notes:lasterror}"/>
                    <!-- source: pattern://12c979b6af0f15f1328656a4 -->
                    <GuiElem name="info" type="info" label="info.login"/>
                    <!-- source: pattern://12c979b6af0f15f1328656a4 -->
                    <GuiElem name="isiwebuserid" type="text" label="prompt.userid" value="${notes.loginid}"/>
                    <!-- source: pattern://12c979b6af0f15f1328656a4 -->
                    <GuiElem name="isiwebpasswd" type="pw-text" label="prompt.password"/>
                    <!-- source: pattern://12c979b6af0f15f1328656a4 -->
                    <GuiElem name="submit" type="button" label="continue.button.label"/>
                </Gui>
            </Response>
            <propertyRef name="nevisIDM_Connector"/>
            <!-- source: pattern://12c979b6af0f15f1328656a4 -->
            <property name="user.loginType" value="LOGINID"/>
            <!-- source: pattern://12c979b6af0f15f1328656a4 -->
            <property name="client.name" value="Default"/>
        </AuthState>
        <AuthState name="SAML_SP_nevisidm_admin_Realm_Auth_Done" class="ch.nevis.esauth.auth.states.standard.AuthDone" final="false">
            <!-- source: pattern://a7b62b3dea12ecfc81ecc855, pattern://6f9c9f982dcc7ef59a34f1f7, pattern://271d024334021208b71ac80a -->
            <Response value="AUTH_DONE">
                <!-- source: pattern://a7b62b3dea12ecfc81ecc855, pattern://6f9c9f982dcc7ef59a34f1f7, pattern://271d024334021208b71ac80a -->
                <Gui name="ContinueResponse"/>
            </Response>
        </AuthState>
        <AuthState name="SAML_SP_nevisidm_admin_Realm_admin_nevisIDM_Password_Login-IdmPostProcessing" class="ch.nevis.idm.authstate.IdmGetPropertiesState" final="false">
            <!-- source: pattern://12c979b6af0f15f1328656a4 -->
            <ResultCond name="SOAP:showGui" next="SAML_SP_nevisidm_admin_Realm_Log_Login_User"/>
            <!-- source: pattern://12c979b6af0f15f1328656a4 -->
            <ResultCond name="default" next="SAML_SP_nevisidm_admin_Realm_Log_Login_User"/>
            <!-- source: pattern://12c979b6af0f15f1328656a4 -->
            <ResultCond name="ok" next="SAML_SP_nevisidm_admin_Realm_Log_Login_User" startOver="true"/>
            <!-- source: pattern://12c979b6af0f15f1328656a4 -->
            <ResultCond name="showGui" next="SAML_SP_nevisidm_admin_Realm_admin_nevisIDM_Password_Login-IdmPostProcessing"/>
            <!-- source: pattern://12c979b6af0f15f1328656a4 -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://12c979b6af0f15f1328656a4 -->
                <Gui name="AuthProfileSelectionDialog">
                    <!-- source: pattern://12c979b6af0f15f1328656a4 -->
                    <GuiElem name="lasterror" type="error" label="${notes:lasterrorinfo}" value="${notes:lasterror}"/>
                </Gui>
            </Response>
            <propertyRef name="nevisIDM_Connector"/>
            <!-- source: pattern://12c979b6af0f15f1328656a4 -->
            <property name="user.attributes" value="mobile, email, extId"/>
            <!-- source: pattern://12c979b6af0f15f1328656a4 -->
            <property name="detaillevel.default" value="EXCLUDE"/>
            <!-- source: pattern://12c979b6af0f15f1328656a4 -->
            <property name="detaillevel.user" value="MEDIUM"/>
        </AuthState>
        <AuthState name="SAML_SP_nevisidm_admin_Realm_admin_nevisIDM_Password_Login-IdmPasswordChange" class="ch.nevis.idm.authstate.IdmChangePasswordState" final="false">
            <!-- source: pattern://12c979b6af0f15f1328656a4 -->
            <ResultCond name="default" next="SAML_SP_nevisidm_admin_Realm_admin_nevisIDM_Password_Login-IdmPasswordChange"/>
            <!-- source: pattern://12c979b6af0f15f1328656a4 -->
            <ResultCond name="ok" next="SAML_SP_nevisidm_admin_Realm_admin_nevisIDM_Password_Login-IdmPostProcessing" authLevel="1"/>
            <!-- source: pattern://12c979b6af0f15f1328656a4 -->
            <ResultCond name="policyFailure" next="SAML_SP_nevisidm_admin_Realm_admin_nevisIDM_Password_Login-IdmPasswordChange"/>
            <!-- source: pattern://12c979b6af0f15f1328656a4 -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://12c979b6af0f15f1328656a4 -->
                <Gui name="AuthUidPwDialog" label="title.pwchange.label">
                    <!-- source: pattern://12c979b6af0f15f1328656a4 -->
                    <GuiElem name="lasterror" type="error" label="${notes:lasterrorinfo}" value="${notes:lasterror}"/>
                    <!-- source: pattern://12c979b6af0f15f1328656a4 -->
                    <GuiElem name="policyFailure.allowLoginIdPasswordViolated" type="error" label="${notes.policyFailure.allowLoginIdPasswordViolated}"/>
                    <!-- source: pattern://12c979b6af0f15f1328656a4 -->
                    <GuiElem name="policyFailure.regex.minLength" type="error" label="${notes.policyFailure.regex.minLength}"/>
                    <!-- source: pattern://12c979b6af0f15f1328656a4 -->
                    <GuiElem name="policyFailure.regex.maxLength" type="error" label="${notes.policyFailure.regex.maxLength}"/>
                    <!-- source: pattern://12c979b6af0f15f1328656a4 -->
                    <GuiElem name="policyFailure.regex.upper" type="error" label="${notes.policyFailure.regex.upper}"/>
                    <!-- source: pattern://12c979b6af0f15f1328656a4 -->
                    <GuiElem name="policyFailure.regex.lower" type="error" label="${notes.policyFailure.regex.lower}"/>
                    <!-- source: pattern://12c979b6af0f15f1328656a4 -->
                    <GuiElem name="policyFailure.regex.numeric" type="error" label="${notes.policyFailure.regex.numeric}"/>
                    <!-- source: pattern://12c979b6af0f15f1328656a4 -->
                    <GuiElem name="policyFailure.regex.nonLetter" type="error" label="${notes.policyFailure.regex.nonLetter}"/>
                    <!-- source: pattern://12c979b6af0f15f1328656a4 -->
                    <GuiElem name="policyFailure.regex.nonAlnum" type="error" label="${notes.policyFailure.regex.nonAlnum}"/>
                    <!-- source: pattern://12c979b6af0f15f1328656a4 -->
                    <GuiElem name="policyFailure.regex.control" type="error" label="${notes.policyFailure.regex.control}"/>
                    <!-- source: pattern://12c979b6af0f15f1328656a4 -->
                    <GuiElem name="policyFailure.regex.nonGraph" type="error" label="${notes.policyFailure.regex.nonGraph}"/>
                    <!-- source: pattern://12c979b6af0f15f1328656a4 -->
                    <GuiElem name="policyFailure.regex.nonAscii" type="error" label="${notes.policyFailure.regex.nonAscii}"/>
                    <!-- source: pattern://12c979b6af0f15f1328656a4 -->
                    <GuiElem name="policyFailure.dictionary" type="error" label="${notes.policyFailure.dictionary}"/>
                    <!-- source: pattern://12c979b6af0f15f1328656a4 -->
                    <GuiElem name="policyFailure.history.History" type="error" label="${notes.policyFailure.history.History}"/>
                    <!-- source: pattern://12c979b6af0f15f1328656a4 -->
                    <GuiElem name="policyFailure.regex.maxCharacterRepetitions" type="error" label="${notes.policyFailure.regex.maxCharacterRepetitions}"/>
                    <!-- source: pattern://12c979b6af0f15f1328656a4 -->
                    <GuiElem name="policyInfo.title" type="info" label="#{!notes.containsKey('lasterror') || notes.lasterror != '4' ? 'policyInfo.title' : ''}"/>
                    <!-- source: pattern://12c979b6af0f15f1328656a4 -->
                    <GuiElem name="policyInfo.regex.minLength" type="info" label="${notes.policyInfo.regex.minLength}"/>
                    <!-- source: pattern://12c979b6af0f15f1328656a4 -->
                    <GuiElem name="policyInfo.regex.maxLength" type="info" label="${notes.policyInfo.regex.maxLength}"/>
                    <!-- source: pattern://12c979b6af0f15f1328656a4 -->
                    <GuiElem name="policyInfo.regex.upper" type="info" label="#{notes['policyInfo.regex.upper'].contains('upper[0]') ? '' : notes['policyInfo.regex.upper']}"/>
                    <!-- source: pattern://12c979b6af0f15f1328656a4 -->
                    <GuiElem name="policyInfo.regex.lower" type="info" label="#{notes['policyInfo.regex.lower'].contains('lower[0]') ? '' : notes['policyInfo.regex.lower']}"/>
                    <!-- source: pattern://12c979b6af0f15f1328656a4 -->
                    <GuiElem name="policyInfo.regex.numeric" type="info" label="#{notes['policyInfo.regex.numeric'].contains('numeric[0]') ? '' : notes['policyInfo.regex.numeric']}"/>
                    <!-- source: pattern://12c979b6af0f15f1328656a4 -->
                    <GuiElem name="policyInfo.regex.nonLetter" type="info" label="#{notes['policyInfo.regex.nonLetter'].contains('nonLetter[0]') ? '' : notes['policyInfo.regex.nonLetter']}"/>
                    <!-- source: pattern://12c979b6af0f15f1328656a4 -->
                    <GuiElem name="policyInfo.regex.nonAlnum" type="info" label="#{notes['policyInfo.regex.nonAlnum'].contains('nonAlnum[0]') ? '' : notes['policyInfo.regex.nonAlnum']}"/>
                    <!-- source: pattern://12c979b6af0f15f1328656a4 -->
                    <GuiElem name="policyInfo.regex.control" type="info" label="#{notes['policyInfo.regex.control'].contains('control[0]') ? '' : notes['policyInfo.regex.control']}"/>
                    <!-- source: pattern://12c979b6af0f15f1328656a4 -->
                    <GuiElem name="policyInfo.regex.nonGraph" type="info" label="#{notes['policyInfo.regex.nonGraph'].contains('nonGraph[0]') ? '' : notes['policyInfo.regex.nonGraph']}"/>
                    <!-- source: pattern://12c979b6af0f15f1328656a4 -->
                    <GuiElem name="policyInfo.regex.nonAscii" type="info" label="#{notes['policyInfo.regex.nonAscii'].contains('nonAscii[0]') ? '' : notes['policyInfo.regex.nonAscii']}"/>
                    <!-- source: pattern://12c979b6af0f15f1328656a4 -->
                    <GuiElem name="policyInfo.dictionary" type="info" label="${notes.policyInfo.dictionary}"/>
                    <!-- source: pattern://12c979b6af0f15f1328656a4 -->
                    <GuiElem name="policyInfo.history.History" type="info" label="${notes.policyInfo.history.History}"/>
                    <!-- source: pattern://12c979b6af0f15f1328656a4 -->
                    <GuiElem name="policyInfo.regex.maxCharacterRepetitions" type="info" label="${notes.policyInfo.regex.maxCharacterRepetitions}"/>
                    <!-- source: pattern://12c979b6af0f15f1328656a4 -->
                    <GuiElem name="isiwebpasswd" type="pw-text" label="prompt.password"/>
                    <!-- source: pattern://12c979b6af0f15f1328656a4 -->
                    <GuiElem name="isiwebnewpw1" type="pw-text" label="prompt.newpassword"/>
                    <!-- source: pattern://12c979b6af0f15f1328656a4 -->
                    <GuiElem name="isiwebnewpw2" type="pw-text" label="prompt.newpassword.confirm"/>
                    <!-- source: pattern://12c979b6af0f15f1328656a4 -->
                    <GuiElem name="submit" type="submit" label="button.submit"/>
                </Gui>
            </Response>
            <propertyRef name="nevisIDM_Connector"/>
            <!-- source: pattern://12c979b6af0f15f1328656a4 -->
            <property name="legacyLitDictMode" value="false"/>
        </AuthState>
        <AuthState name="SAML_SP_nevisidm_admin_Realm_Log_Login_User" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false">
            <!-- source: pattern://a7b62b3dea12ecfc81ecc855 -->
            <ResultCond name="error" next="SAML_SP_nevisidm_admin_Realm_Authentication_Failed"/>
            <!-- source: pattern://a7b62b3dea12ecfc81ecc855 -->
            <ResultCond name="ok" next="SAML_SP_nevisidm_admin_Realm_Prepare_Done"/>
            <!-- source: pattern://a7b62b3dea12ecfc81ecc855 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://a7b62b3dea12ecfc81ecc855 -->
                <Arg name="ch.nevis.isiweb4.response.status" value="403"/>
            </Response>
            <!-- source: pattern://a7b62b3dea12ecfc81ecc855 -->
            <property name="scriptTraceGroup" value="AGOVOP-ACCT"/>
            <!-- source: pattern://a7b62b3dea12ecfc81ecc855 -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/log_login_user.groovy"/>
        </AuthState>
        <AuthState name="SAML_SP_nevisidm_admin_Realm_NEVIS_SecToken" class="ch.nevis.esauth.auth.states.sectoken.TokenAssemblerState" final="false">
            <!-- source: pattern://271d024334021208b71ac80a -->
            <ResultCond name="default" next="SAML_SP_nevisidm_admin_Realm_Prepare_Done" authLevel="token.NEVIS_SecToken"/>
            <!-- source: pattern://271d024334021208b71ac80a -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://271d024334021208b71ac80a -->
                <Arg name="ch.nevis.isiweb4.response.status" value="403"/>
            </Response>
            <!-- source: pattern://271d024334021208b71ac80a -->
            <property name="assembler" value="Token_SAML_SP_nevisidm_admin_Realm_NEVIS_SecToken"/>
            <!-- source: pattern://271d024334021208b71ac80a -->
            <property name="key" value="token.NEVIS_SecToken"/>
            <!-- source: pattern://271d024334021208b71ac80a -->
            <property name="generateNow" value="true"/>
        </AuthState>
        <AuthState name="SAML_SP_nevisidm_operations_Realm_Extract_Issuer" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false">
            <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
            <ResultCond name="ok" next="SAML_SP_nevisidm_operations_Realm_IDP_Selection"/>
            <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
                <Arg name="ch.nevis.isiweb4.response.status" value="403"/>
            </Response>
            <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/saml_sp_nevisidm_operations_realm_extract_issuer.groovy"/>
        </AuthState>
        <AuthState name="SAML_SP_nevisidm_operations_Realm_IDP_Selection" class="ch.nevis.esauth.auth.states.standard.ConditionalDispatcherState" final="false">
            <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
            <ResultCond name="authenticate:https\u003A//trustbroker.agov-d.azure.adnovum.net_continuation" next="SAML_SP_nevisidm_operations_Realm_SAML_IDP_op_Connector_Connector"/>
            <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
            <ResultCond name="authenticate:https\u003A//trustbroker.agov-d.azure.adnovum.net_entry" next="SAML_SP_nevisidm_operations_Realm_SAML_IDP_op_Connector_Connector"/>
            <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
            <ResultCond name="authenticate:https\u003A//trustbroker.agov-d.azure.adnovum.net_entry,https\u003A//trustbroker.agov-d.azure.adnovum.net_continuation" next="SAML_SP_nevisidm_operations_Realm_SAML_IDP_op_Connector_Connector"/>
            <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
            <ResultCond name="logout:https\u003A//trustbroker.agov-d.azure.adnovum.net_continuation" next="SAML_SP_nevisidm_operations_Realm_SAML_IDP_op_Connector_Connector"/>
            <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
            <ResultCond name="logout:https\u003A//trustbroker.agov-d.azure.adnovum.net_entry" next="SAML_SP_nevisidm_operations_Realm_SAML_IDP_op_Connector_Connector"/>
            <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
            <ResultCond name="logout:https\u003A//trustbroker.agov-d.azure.adnovum.net_entry,https\u003A//trustbroker.agov-d.azure.adnovum.net_continuation" next="SAML_SP_nevisidm_operations_Realm_SAML_IDP_op_Connector_Connector"/>
            <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
            <ResultCond name="stepup:https\u003A//trustbroker.agov-d.azure.adnovum.net_continuation" next="SAML_SP_nevisidm_operations_Realm_SAML_IDP_op_Connector_Force_Auth"/>
            <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
            <ResultCond name="stepup:https\u003A//trustbroker.agov-d.azure.adnovum.net_entry" next="SAML_SP_nevisidm_operations_Realm_SAML_IDP_op_Connector_Force_Auth"/>
            <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
            <ResultCond name="stepup:https\u003A//trustbroker.agov-d.azure.adnovum.net_entry,https\u003A//trustbroker.agov-d.azure.adnovum.net_continuation" next="SAML_SP_nevisidm_operations_Realm_SAML_IDP_op_Connector_Force_Auth"/>
            <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
                <Arg name="ch.nevis.isiweb4.response.status" value="403"/>
            </Response>
            <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
            <property name="selectBestTransition" value="true"/>
            <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
            <property name="condition:https\u003A//trustbroker.agov-d.azure.adnovum.net_entry" value="#{true}"/>
            <!-- source: pattern://7518c6cc61e47eec6322ae17 -->
            <property name="condition:https\u003A//trustbroker.agov-d.azure.adnovum.net_continuation" value="${sess:saml.inbound.issuer:^https\u003A//trustbroker.agov-d.azure.adnovum.net$}"/>
        </AuthState>
        <AuthState name="SAML_SP_nevisidm_operations_Realm_SAML_IDP_op_Connector_Force_Auth" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false">
            <!-- source: pattern://36af90d50b0d6ba66136dbde -->
            <ResultCond name="default" next="SAML_SP_nevisidm_operations_Realm_SAML_IDP_op_Connector_Connector"/>
            <!-- source: pattern://36af90d50b0d6ba66136dbde -->
            <ResultCond name="done" next="SAML_SP_nevisidm_operations_Realm_Prepare_Done"/>
            <!-- source: pattern://36af90d50b0d6ba66136dbde -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://36af90d50b0d6ba66136dbde -->
                <Arg name="ch.nevis.isiweb4.response.status" value="403"/>
            </Response>
            <!-- source: pattern://36af90d50b0d6ba66136dbde -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/saml_sp_stepup.groovy"/>
        </AuthState>
        <AuthState name="SAML_SP_nevisidm_operations_Realm_NEVIS_SecToken" class="ch.nevis.esauth.auth.states.sectoken.TokenAssemblerState" final="false">
            <!-- source: pattern://271d024334021208b71ac80a -->
            <ResultCond name="default" next="SAML_SP_nevisidm_operations_Realm_Prepare_Done" authLevel="token.NEVIS_SecToken"/>
            <!-- source: pattern://271d024334021208b71ac80a -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://271d024334021208b71ac80a -->
                <Arg name="ch.nevis.isiweb4.response.status" value="403"/>
            </Response>
            <!-- source: pattern://271d024334021208b71ac80a -->
            <property name="assembler" value="Token_SAML_SP_nevisidm_operations_Realm_NEVIS_SecToken"/>
            <!-- source: pattern://271d024334021208b71ac80a -->
            <property name="key" value="token.NEVIS_SecToken"/>
            <!-- source: pattern://271d024334021208b71ac80a -->
            <property name="generateNow" value="true"/>
        </AuthState>
    </AuthEngine>
</esauth-server>
