diff --git a/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/auth/var/opt/nevisauth/default/conf/set_userextid_groovy_script_step.groovy b/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/auth/var/opt/nevisauth/default/conf/set_userextid_groovy_script_step.groovy
index 5ce6f26..5d1fc49 100644
--- a/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/auth/var/opt/nevisauth/default/conf/set_userextid_groovy_script_step.groovy
+++ b/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/auth/var/opt/nevisauth/default/conf/set_userextid_groovy_script_step.groovy
@@ -1,10 +1,10 @@
try {
def s = request.getAuthSession(true)
- LOG.info("operationsExtId: ${notes['saml.attributes.http://schemas.agov.ch/ws/2023/05/identity/claims/operationsUserExtId']}")
- LOG.info("operationsUserProfileExtIdList: ${notes['saml.attributes.http://schemas.agov.ch/ws/2023/05/identity/claims/operationsUserProfileExtId']}")
-
+ LOG.debug("operationsExtId: ${notes['saml.attributes.http://schemas.agov.ch/ws/2023/05/identity/claims/operationsUserExtId']}")
+ LOG.debug("operationsUserProfileExtIdList: ${notes['saml.attributes.http://schemas.agov.ch/ws/2023/05/identity/claims/operationsUserProfileExtId']}")
+ // set operation's account extId and profile extid
if (notes['saml.attributes.http://schemas.agov.ch/ws/2023/05/identity/claims/operationsUserExtId'] == null || notes['saml.attributes.http://schemas.agov.ch/ws/2023/05/identity/claims/operationsUserProfileExtId'] == null) {
LOG.error("[OPACCESS] User ${notes['saml.assertion.subject']} tried to access without operations account or profile")
response.setResult('error');
@@ -13,6 +13,20 @@ try {
response.setSessionAttribute('operationsExtId', notes['saml.attributes.http://schemas.agov.ch/ws/2023/05/identity/claims/operationsUserExtId'])
+ // extract additional attributes from assertion in session
+ if (notes['saml.attributes.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname']) {
+ response.setSessionAttribute('idp.firstName', notes['saml.attributes.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname'])
+ }
+ if (notes['saml.attributes.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname']) {
+ response.setSessionAttribute('idp.lastName', notes['saml.attributes.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname'])
+ }
+ if (notes['saml.attributes.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress']) {
+ response.setSessionAttribute('idp.email', notes['saml.attributes.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'])
+ }
+ if (notes['saml.attributes.http://schemas.agov.ch/ws/2023/05/identity/claims/languageOfCorrespondance']) {
+ response.setSessionAttribute('idp.language', notes['saml.attributes.http://schemas.agov.ch/ws/2023/05/identity/claims/languageOfCorrespondance'])
+ }
+
// we take the first one, if there is no profile in the operations unit
def unitAndProfileExtidPar = notes['saml.attributes.http://schemas.agov.ch/ws/2023/05/identity/claims/operationsUserProfileExtId']
.split(',').find{pairstr -> pairstr.split("\\\\")[1] == "130274ee-7e24-4050-9b94-d5717ef52ade" }
@@ -22,8 +36,21 @@ try {
{
LOG.info("[OPACCESS] User ${notes['saml.assertion.subject']} with opaccount ${notes['saml.attributes.http://schemas.agov.ch/ws/2023/05/identity/claims/operationsUserExtId']} has no operations profile, we use the first one")
}
-
response.setSessionAttribute('operationsProfileExtId', unitAndProfileExtidPar.split("\\\\")[0])
+
+ // ad role based on agov aq level
+ def acrToRoleMap = [ 'urn:qa.agov.ch:names:tc:ac:classes:100':'AGOV-Loi.level100',
+ 'urn:qa.agov.ch:names:tc:ac:classes:200':'AGOV-Loi.level200',
+ 'urn:qa.agov.ch:names:tc:ac:classes:300':'AGOV-Loi.level300',
+ 'urn:qa.agov.ch:names:tc:ac:classes:400':'AGOV-Loi.level400',
+ 'urn:qa.agov.ch:names:tc:ac:classes:500':'AGOV-Loi.level500'
+ ]
+
+ if (acrToRoleMap[session['ch.nevis.auth.saml.assertion.authnContextClassRef']?='none']) {
+ response.addActualRole(acrToRoleMap[session['ch.nevis.auth.saml.assertion.authnContextClassRef']])
+ }
+
+
response.setResult('ok');
} catch(Exception ex) {
diff --git a/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/idm-job/etc/nevis/k8s-nevisidm-batch-641ac4edf0c17383d3c0ea38.yaml b/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/idm-job/etc/nevis/k8s-nevisidm-batch-641ac4edf0c17383d3c0ea38.yaml
index 8a1e40d..c3ae7ae 100644
--- a/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/idm-job/etc/nevis/k8s-nevisidm-batch-641ac4edf0c17383d3c0ea38.yaml
+++ b/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/idm-job/etc/nevis/k8s-nevisidm-batch-641ac4edf0c17383d3c0ea38.yaml
@@ -46,7 +46,7 @@ spec:
podDisruptionBudget:
maxUnavailable: "50%"
git:
- tag: "r-85921ce48ff2018a206d8d347bce4588d9d5e8a1"
+ tag: "r-868174843070c36c5da54e3a43d558da046b6ce7"
dir: "DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/idm-job"
credentials: "git-credentials"
keystores:
diff --git a/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/idm-job/var/opt/nevisidm/default/conf/batch.xml b/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/idm-job/var/opt/nevisidm/default/conf/batch.xml
index 7ed0f10..b6dc743 100644
--- a/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/idm-job/var/opt/nevisidm/default/conf/batch.xml
+++ b/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/idm-job/var/opt/nevisidm/default/conf/batch.xml
@@ -5,12 +5,14 @@
+
+
@@ -72,6 +74,29 @@
+
+
+
+
+
+
+
+
+
+
+
+
@@ -84,4 +109,9 @@
+
+
+
+
+
diff --git a/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/idm/etc/nevis/k8s-nevisidm-admin-ba7c7a3b091df0c4b8ba0bb2.yaml b/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/idm/etc/nevis/k8s-nevisidm-admin-ba7c7a3b091df0c4b8ba0bb2.yaml
index 56e4942..329d1ac 100644
--- a/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/idm/etc/nevis/k8s-nevisidm-admin-ba7c7a3b091df0c4b8ba0bb2.yaml
+++ b/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/idm/etc/nevis/k8s-nevisidm-admin-ba7c7a3b091df0c4b8ba0bb2.yaml
@@ -46,7 +46,7 @@ spec:
podDisruptionBudget:
maxUnavailable: "50%"
git:
- tag: "r-85921ce48ff2018a206d8d347bce4588d9d5e8a1"
+ tag: "r-868174843070c36c5da54e3a43d558da046b6ce7"
dir: "DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/idm"
credentials: "git-credentials"
keystores:
diff --git a/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/idm/var/opt/nevisidm/default/conf/import/property/user_nevisidm_custom_property_verificationtransactionid.json b/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/idm/var/opt/nevisidm/default/conf/import/property/user_nevisidm_custom_property_verificationtransactionid.json
index de2cbdd..4cda42e 100644
--- a/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/idm/var/opt/nevisidm/default/conf/import/property/user_nevisidm_custom_property_verificationtransactionid.json
+++ b/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/idm/var/opt/nevisidm/default/conf/import/property/user_nevisidm_custom_property_verificationtransactionid.json
@@ -3,9 +3,9 @@
"scope": "USER_GLOBAL",
"encrypted": false,
"propagated": false,
-
+ "uniquenessScope": "ABSOLUTE",
"accessCreate": "READ_WRITE",
- "accessModify": "READ_WRITE",
+ "accessModify": "READ_ONLY",
"clientExtId": "9f30aa08-4c53-458c-b144-90c16dc5ed6e",
"maxLength": "50",
diff --git a/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/logrend/etc/nevis/k8s-nevislogrend-8401da6318c6915d689cdfc9.yaml b/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/logrend/etc/nevis/k8s-nevislogrend-8401da6318c6915d689cdfc9.yaml
index e5cd607..e776563 100644
--- a/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/logrend/etc/nevis/k8s-nevislogrend-8401da6318c6915d689cdfc9.yaml
+++ b/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/logrend/etc/nevis/k8s-nevislogrend-8401da6318c6915d689cdfc9.yaml
@@ -44,7 +44,7 @@ spec:
podDisruptionBudget:
maxUnavailable: "50%"
git:
- tag: "r-85921ce48ff2018a206d8d347bce4588d9d5e8a1"
+ tag: "r-868174843070c36c5da54e3a43d558da046b6ce7"
dir: "DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/logrend"
credentials: "git-credentials"
podSecurity:
diff --git a/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/logrend/var/opt/nevislogrend/default/data/applications/OP-ONBRDNG-AuthenticationRealm/resources/conf/text.properties b/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/logrend/var/opt/nevislogrend/default/data/applications/OP-ONBRDNG-AuthenticationRealm/resources/conf/text.properties
index 06a56e2..da563e1 100644
--- a/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/logrend/var/opt/nevislogrend/default/data/applications/OP-ONBRDNG-AuthenticationRealm/resources/conf/text.properties
+++ b/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/logrend/var/opt/nevislogrend/default/data/applications/OP-ONBRDNG-AuthenticationRealm/resources/conf/text.properties
@@ -33,7 +33,7 @@ fido2_auth.instruction2=An authentication window will appear
fido2_auth.instruction3=Follow the instructions
fido2_auth.skipInstructions=Skip instructions next time
fido2_auth.switchLogin=SWITCH TO LOGIN WITH
-footer.link=https://agov.ch/?c=contact&l=en
+footer.link=https://agov.ch
footer.link.label=Contact
footer.text=Authentication service of Swiss authorities AGOV - a collaboration between cantons, their municipalities, and the federal administration. -
general.AGOVAccessApp=AGOV access app
diff --git a/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/logrend/var/opt/nevislogrend/default/data/applications/OP-ONBRDNG-AuthenticationRealm/resources/conf/text_de.properties b/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/logrend/var/opt/nevislogrend/default/data/applications/OP-ONBRDNG-AuthenticationRealm/resources/conf/text_de.properties
index ee7fc27..55707a7 100644
--- a/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/logrend/var/opt/nevislogrend/default/data/applications/OP-ONBRDNG-AuthenticationRealm/resources/conf/text_de.properties
+++ b/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/logrend/var/opt/nevislogrend/default/data/applications/OP-ONBRDNG-AuthenticationRealm/resources/conf/text_de.properties
@@ -33,7 +33,7 @@ fido2_auth.instruction2=Ein Authentifizierungsfenster wird erscheinen
fido2_auth.instruction3=Folgen Sie den Anweisungen
fido2_auth.skipInstructions=Anweisungen nächstes Mal überspringen
fido2_auth.switchLogin=WECHSEL ZU LOGIN MIT
-footer.link=https://agov.ch/?c=contact&l=de
+footer.link=https://agov.ch
footer.link.label=Kontakt
footer.text=Authentifizierungsdienst der Schweizer Behörden AGOV – eine Zusammenarbeit zwischen den Kantonen, deren Gemeinden und der Bundesverwaltung. -
general.AGOVAccessApp=AGOV access App
diff --git a/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/logrend/var/opt/nevislogrend/default/data/applications/OP-ONBRDNG-AuthenticationRealm/resources/conf/text_en.properties b/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/logrend/var/opt/nevislogrend/default/data/applications/OP-ONBRDNG-AuthenticationRealm/resources/conf/text_en.properties
index 06a56e2..da563e1 100644
--- a/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/logrend/var/opt/nevislogrend/default/data/applications/OP-ONBRDNG-AuthenticationRealm/resources/conf/text_en.properties
+++ b/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/logrend/var/opt/nevislogrend/default/data/applications/OP-ONBRDNG-AuthenticationRealm/resources/conf/text_en.properties
@@ -33,7 +33,7 @@ fido2_auth.instruction2=An authentication window will appear
fido2_auth.instruction3=Follow the instructions
fido2_auth.skipInstructions=Skip instructions next time
fido2_auth.switchLogin=SWITCH TO LOGIN WITH
-footer.link=https://agov.ch/?c=contact&l=en
+footer.link=https://agov.ch
footer.link.label=Contact
footer.text=Authentication service of Swiss authorities AGOV - a collaboration between cantons, their municipalities, and the federal administration. -
general.AGOVAccessApp=AGOV access app
diff --git a/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/logrend/var/opt/nevislogrend/default/data/applications/OP-ONBRDNG-AuthenticationRealm/resources/conf/text_fr.properties b/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/logrend/var/opt/nevislogrend/default/data/applications/OP-ONBRDNG-AuthenticationRealm/resources/conf/text_fr.properties
index fe73719..853e28e 100644
--- a/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/logrend/var/opt/nevislogrend/default/data/applications/OP-ONBRDNG-AuthenticationRealm/resources/conf/text_fr.properties
+++ b/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/logrend/var/opt/nevislogrend/default/data/applications/OP-ONBRDNG-AuthenticationRealm/resources/conf/text_fr.properties
@@ -33,7 +33,7 @@ fido2_auth.instruction2=Une fenêtre d'authentification s'affichera
fido2_auth.instruction3=Suivez les instructions
fido2_auth.skipInstructions=Passer les instructions la fois suivante
fido2_auth.switchLogin=S'AUTHENTIFIER AVEC
-footer.link=https://agov.ch/?c=contact&l=fr
+footer.link=https://agov.ch
footer.link.label=Contact
footer.text=Service d'authentification des autorités suisses AGOV - une collaboration entre les cantons, leurs communes et l'administration fédérale. -
general.AGOVAccessApp=Application AGOV access
diff --git a/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/logrend/var/opt/nevislogrend/default/data/applications/OP-ONBRDNG-AuthenticationRealm/resources/conf/text_it.properties b/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/logrend/var/opt/nevislogrend/default/data/applications/OP-ONBRDNG-AuthenticationRealm/resources/conf/text_it.properties
index 38de7d9..297c2a2 100644
--- a/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/logrend/var/opt/nevislogrend/default/data/applications/OP-ONBRDNG-AuthenticationRealm/resources/conf/text_it.properties
+++ b/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/logrend/var/opt/nevislogrend/default/data/applications/OP-ONBRDNG-AuthenticationRealm/resources/conf/text_it.properties
@@ -33,7 +33,7 @@ fido2_auth.instruction2=A breve si aprirà una finestra per l'autenticazio
fido2_auth.instruction3=Seguire le istruzioni.
fido2_auth.skipInstructions=Non mostrare più le istruzioni
fido2_auth.switchLogin=ACCEDERE CON
-footer.link=https://agov.ch/?c=contact&l=it
+footer.link=https://agov.ch
footer.link.label=Contatto
footer.text=Servizio di autenticazione delle autorità Svizzere AGOV - una collaborazione tra Cantoni, Comuni e l'Amministrazione federale. -
general.AGOVAccessApp=App AGOV access
diff --git a/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/logrend/var/opt/nevislogrend/default/data/applications/OP-ONBRDNG-AuthenticationRealm/webdata/template/footer.vm b/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/logrend/var/opt/nevislogrend/default/data/applications/OP-ONBRDNG-AuthenticationRealm/webdata/template/footer.vm
index 6536284..c7265db 100644
--- a/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/logrend/var/opt/nevislogrend/default/data/applications/OP-ONBRDNG-AuthenticationRealm/webdata/template/footer.vm
+++ b/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/logrend/var/opt/nevislogrend/default/data/applications/OP-ONBRDNG-AuthenticationRealm/webdata/template/footer.vm
@@ -3,7 +3,7 @@
$text.get("footer.text")
$text.get("footer.link.label")
- 1.7.1.27-20241029T194727Z
+ 1.7.3.19-20241106T155949Z