diff --git a/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/proxy-sp/etc/nevis/k8s-operations-nevisproxy-instance-bd83dfbd467e8211ffe71d28.yaml b/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/proxy-sp/etc/nevis/k8s-operations-nevisproxy-instance-bd83dfbd467e8211ffe71d28.yaml
index cb9f621..2372e1e 100644
--- a/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/proxy-sp/etc/nevis/k8s-operations-nevisproxy-instance-bd83dfbd467e8211ffe71d28.yaml
+++ b/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/proxy-sp/etc/nevis/k8s-operations-nevisproxy-instance-bd83dfbd467e8211ffe71d28.yaml
@@ -46,7 +46,7 @@ spec:
podDisruptionBudget:
maxUnavailable: "50%"
git:
- tag: "r-3341a3df2b54ab6368125d7df7c223019a1fb969"
+ tag: "r-f7d5f97ee0feefcae245dd0d18143b4d911b6bd8"
dir: "DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/proxy-sp"
credentials: "git-credentials"
keystores:
diff --git a/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/proxy-sp/var/opt/nevisproxy/default/host-op.agov-w.azure.adnovum.net/WEB-INF/csrf_default.lua b/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/proxy-sp/var/opt/nevisproxy/default/host-op.agov-w.azure.adnovum.net/WEB-INF/csrf_default.lua
deleted file mode 100644
index bc67a54..0000000
--- a/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/proxy-sp/var/opt/nevisproxy/default/host-op.agov-w.azure.adnovum.net/WEB-INF/csrf_default.lua
+++ /dev/null
@@ -1,73 +0,0 @@
-function contains(tab, val)
- for index, value in ipairs(tab) do
- if value == val then
- return true
- end
- end
- return false
-end
-
-function inputHeader(request, response)
-
- if (request:getMethod() == "GET" or request:getMethod() == "HEAD" or request:getMethod() == "OPTIONS" or request:getMethod() == "TRACE") then
- -- these requests are not sensitive (do not manipulate state) and are thus not checked
- return
- end
-
- -- patterns sets allowed domains or {}
- domains = {}
-
- host = request:getHeader("Host")
-
- if (host == nil) then
- -- Internet-based HTTP/1.1 servers MUST respond with a 400 (Bad Request) status code to any HTTP/1.1 request message which lacks a Host header field.
- request:getTracer():notice("VA05", "Missing Host header")
- response:setHeader("Content-Type", "text/plain")
- response:setBody("400 Bad Request")
- response:send(400)
- return
- end
-
- -- extract host name
- host = host:match('([^:]+)')
-
- referer = request:getHeader("Referer")
- if (referer ~= nil) then
- referer = referer:match('^%w+://([^/:]+)')
- if (referer ~= host and not contains(domains, referer)) then
- if (referer ~= nil) then
- request:getTracer():notice("VA01", "HTTP Referer header " .. referer .. " does not match host " .. host)
- else
- request:getTracer():notice("VA01", "HTTP Referer header " .. request:getHeader("Referer") .. " does not match pattern '^[a-zA-Z0-9]+://([^/:]+)'")
- end
- response:setHeader("Content-Type", "text/plain")
- response:setBody("403 Denied")
- response:send(403)
- return
- end
- end
-
- origin = request:getHeader("Origin")
- if (origin ~= nil) then
- origin = origin:match('^%w+://([^/:]+)')
- if (origin ~= host and not contains(domains, origin)) then
- if (origin ~= nil) then
- request:getTracer():notice("VA01", "HTTP Origin header " .. origin .. " does not match host " .. host)
- else
- request:getTracer():notice("VA01", "HTTP Origin header " .. request:getHeader("Origin") .. " does not match pattern '^[a-zA-Z0-9]+://([^/:]+)'")
- end
- response:setHeader("Content-Type", "text/plain")
- response:setBody("403 Denied")
- response:send(403)
- return
- end
- end
-
- if (origin == nil and referer == nil) then
- request:getTracer():info("VA05", "Referer or Origin header is required for sensitive requests")
- response:setHeader("Content-Type", "text/plain")
- response:setBody("403 Denied")
- response:send(403)
- return
- end
-end
\ No newline at end of file
diff --git a/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/proxy-sp/var/opt/nevisproxy/default/host-op.agov-w.azure.adnovum.net/WEB-INF/security_web_application_canarypage_backend.conf b/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/proxy-sp/var/opt/nevisproxy/default/host-op.agov-w.azure.adnovum.net/WEB-INF/security_web_application_canarypage_backend.conf
deleted file mode 100644
index 7b19be5..0000000
--- a/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/proxy-sp/var/opt/nevisproxy/default/host-op.agov-w.azure.adnovum.net/WEB-INF/security_web_application_canarypage_backend.conf
+++ /dev/null
@@ -1,18 +0,0 @@
-# load modsecurity
-Include /var/opt/nevisproxy/default/host-op.agov-w.azure.adnovum.net/WEB-INF/modsecurity.conf
-
-# apply whitelist modifications - must be done before loading other rules (replaces REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf)
-
-
-# apply application-specific paranoia level
-SecAction "id:900000,phase:1,nolog,pass,t:none,setvar:tx.paranoia_level=1"
-
-# load the rule set of the virtual host
-Include /var/opt/nevisproxy/default/host-op.agov-w.azure.adnovum.net/WEB-INF/rules.conf
-
-# apply rule exceptions (replaces RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf)
-
-
-# set mode
-SecRuleEngine On
-
diff --git a/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/proxy-sp/var/opt/nevisproxy/default/host-op.agov-w.azure.adnovum.net/WEB-INF/security_web_application_canarypage_frontend.conf b/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/proxy-sp/var/opt/nevisproxy/default/host-op.agov-w.azure.adnovum.net/WEB-INF/security_web_application_canarypage_frontend.conf
deleted file mode 100644
index 7b19be5..0000000
--- a/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/proxy-sp/var/opt/nevisproxy/default/host-op.agov-w.azure.adnovum.net/WEB-INF/security_web_application_canarypage_frontend.conf
+++ /dev/null
@@ -1,18 +0,0 @@
-# load modsecurity
-Include /var/opt/nevisproxy/default/host-op.agov-w.azure.adnovum.net/WEB-INF/modsecurity.conf
-
-# apply whitelist modifications - must be done before loading other rules (replaces REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf)
-
-
-# apply application-specific paranoia level
-SecAction "id:900000,phase:1,nolog,pass,t:none,setvar:tx.paranoia_level=1"
-
-# load the rule set of the virtual host
-Include /var/opt/nevisproxy/default/host-op.agov-w.azure.adnovum.net/WEB-INF/rules.conf
-
-# apply rule exceptions (replaces RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf)
-
-
-# set mode
-SecRuleEngine On
-
diff --git a/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/proxy-sp/var/opt/nevisproxy/default/host-op.agov-w.azure.adnovum.net/WEB-INF/web.xml b/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/proxy-sp/var/opt/nevisproxy/default/host-op.agov-w.azure.adnovum.net/WEB-INF/web.xml
index c753b92..0f009c6 100644
--- a/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/proxy-sp/var/opt/nevisproxy/default/host-op.agov-w.azure.adnovum.net/WEB-INF/web.xml
+++ b/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/proxy-sp/var/opt/nevisproxy/default/host-op.agov-w.azure.adnovum.net/WEB-INF/web.xml
@@ -66,7 +66,7 @@
false
-
+
Authentication_SAML_SP_nevisidm_operations_Realm
ch::nevis::isiweb4::filter::auth::IdentityCreationFilter
@@ -116,36 +116,6 @@
false
-
-
- Authorization_Forbidden_Roles_nevisIdm.Root_SAML_SP_nevisidm_operations_Realm
- ch::nevis::isiweb4::filter::auth::SecurityRoleFilter
-
-
- DynamicRoleAcquire
- false
-
-
-
- RolesForbidden
- nevisIdm.Root
-
-
-
-
- Authorization_Required_Roles_nevisIdm.Helpdesk_nevisIdm.TemplateAdmin_nevisIdm.UserAndUnitAdmin_nevisIdm.AppAdmin_nevisIdm.UserAdmin_nevisIdm.AppOwner_nevisIdm.EnterpriseRoleAdmin_nevisIdm.ClientRoot_SAML_SP_nevisidm_operations_Realm
- ch::nevis::isiweb4::filter::auth::SecurityRoleFilter
-
-
- DynamicRoleAcquire
- false
-
-
-
- RolesRequired
- nevisIdm.Helpdesk nevisIdm.TemplateAdmin nevisIdm.UserAndUnitAdmin nevisIdm.AppAdmin nevisIdm.UserAdmin nevisIdm.AppOwner nevisIdm.EnterpriseRoleAdmin nevisIdm.ClientRoot
-
-
CSRFRewrite_nevisIDM_Operations_Administration_GUI
@@ -161,21 +131,6 @@
replacement
-
-
- CSRF_Default
- ch::nevis::isiweb4::filter::lua::LuaFilter
-
-
- Script.InputHeaderFunctionName
- inputHeader
-
-
-
- Script.Path
- /var/opt/nevisproxy/default/host-op.agov-w.azure.adnovum.net/WEB-INF/csrf_default.lua
-
-
DefaultErrorFilter
@@ -225,26 +180,6 @@
/var/opt/nevisproxy/default/host-op.agov-w.azure.adnovum.net/WEB-INF/security_op-onbrdng-modsecuritysettings.conf
-
-
- ModSecurity_Web_Application_canaryPage_backend
- ch::nevis::nevisproxy::filter::modsecurity::ModsecurityFilter
-
-
- ConfigFile
- /var/opt/nevisproxy/default/host-op.agov-w.azure.adnovum.net/WEB-INF/security_web_application_canarypage_backend.conf
-
-
-
-
- ModSecurity_Web_Application_canaryPage_frontend
- ch::nevis::nevisproxy::filter::modsecurity::ModsecurityFilter
-
-
- ConfigFile
- /var/opt/nevisproxy/default/host-op.agov-w.azure.adnovum.net/WEB-INF/security_web_application_canarypage_frontend.conf
-
-
ModSecurity_nevisIDM_Operations_Administration_GUI
@@ -471,7 +406,7 @@
120
-
+
SessionHandler_SAML_SP_nevisidm_operations_Realm
ch::nevis::nevisproxy::filter::session::SessionManagementFilter
@@ -593,17 +528,6 @@
/nevisidm/*
-
- SessionHandler_SAML_SP_nevisidm_operations_Realm
- /canary/api/*
-
-
-
- SessionHandler_SAML_SP_nevisidm_operations_Realm
- /canary/*
- ^/canary/api/.*$
-
-
SAML_AllowCORS_SAML_SP_nevisidm_operations_Realm
/SAML2/ACS/*
@@ -628,28 +552,6 @@
ModSecurity_OP-ONBRDNG-ModSecuritySettings
/AUTH/ONBOARDING/*
-
-
- ModSecurity_Web_Application_canaryPage_backend
- /canary/api/*
-
-
-
- CSRF_Default
- /canary/api/*
-
-
-
- CSRF_Default
- /canary/*
- ^/canary/api/.*$
-
-
-
- ModSecurity_Web_Application_canaryPage_frontend
- /canary/*
- ^/canary/api/.*$
-
Authentication_SAML_SP_nevisidm_operations_Realm
@@ -661,17 +563,6 @@
/nevisidm/*
-
- Authentication_SAML_SP_nevisidm_operations_Realm
- /canary/api/*
-
-
-
- Authentication_SAML_SP_nevisidm_operations_Realm
- /canary/*
- ^/canary/api/.*$
-
-
SAML_SAML_SP_nevisidm_operations_Realm
/SAML2/ACS/*
@@ -691,16 +582,6 @@
Requirement_NEVIS_SecToken_SAML_SP_nevisidm_operations_Realm
/nevisidm/*
-
-
- Authorization_Required_Roles_nevisIdm.Helpdesk_nevisIdm.TemplateAdmin_nevisIdm.UserAndUnitAdmin_nevisIdm.AppAdmin_nevisIdm.UserAdmin_nevisIdm.AppOwner_nevisIdm.EnterpriseRoleAdmin_nevisIdm.ClientRoot_SAML_SP_nevisidm_operations_Realm
- /nevisidm/*
-
-
-
- Authorization_Forbidden_Roles_nevisIdm.Root_SAML_SP_nevisidm_operations_Realm
- /nevisidm/*
-
Token_NEVIS_SecToken
@@ -858,78 +739,6 @@
/var/opt/keys/own/proxy-sp-saml-sp-nevisidm-operations-realm-identity/key.pem
-
-
- Connector_Web_Application_canaryPage_backend
-
- ch::nevis::isiweb4::servlet::connector::http::HttpsConnectorServlet
-
-
- AllowedMethods
- ALL-HTTP,ALL-WEBDAV,-TRACE,-CONNECT
-
-
-
- AutoRewrite
- header
-
-
-
- CookieManager
- retain:^.*$
-
-
-
- DNSCache.ttl
- 60
-
-
-
- InetAddress
- canary-application-be.adn-agov-canary-01-dev:8081
-
-
-
- UseSSL
- false
-
-
-
-
- Connector_Web_Application_canaryPage_frontend
-
- ch::nevis::isiweb4::servlet::connector::http::HttpsConnectorServlet
-
-
- AllowedMethods
- ALL-HTTP,ALL-WEBDAV,-TRACE,-CONNECT
-
-
-
- AutoRewrite
- header
-
-
-
- CookieManager
- retain:^.*$
-
-
-
- DNSCache.ttl
- 60
-
-
-
- InetAddress
- canary-application-fe.adn-agov-canary-01-dev:8080
-
-
-
- UseSSL
- false
-
-
Connector_nevisIDM_Operations_Administration_GUI
@@ -1050,16 +859,6 @@
Hosting_Default
/SAML2/stepup/*
-
-
- Connector_Web_Application_canaryPage_frontend
- /canary/*
-
-
-
- Connector_Web_Application_canaryPage_backend
- /canary/api/*
-
Connector_GreenMail