<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE esauth-server SYSTEM "/opt/nevisauth/dtd/esauth4.dtd">
<esauth-server instance="auth">
    <!-- source: pattern://7022472ae407577ae604bbb8, pattern://cb8c63274fe346280de0ffd5, pattern://204c22beaccdfd22727af378, pattern://06aeae2d799e492f5580d03b -->
    <SessionCoordinator sessionInitialInactivityTimeout="600" sessionInactivityTimeout="28800" sessionMaxLifetime="28800" sessionIdPreGenerate="true">
        <!-- source: pattern://7022472ae407577ae604bbb8 -->
        <LocalSessionStore maxSessions="100000"/>
        <!-- source: pattern://7022472ae407577ae604bbb8 -->
        <TokenAssembler name="DefaultTokenAssembler">
            <Selector default="true"/>
            <!-- source: pattern://4fcfadb4a5c946ead7e6e995, pattern://cb8c63274fe346280de0ffd5, pattern://204c22beaccdfd22727af378, pattern://06aeae2d799e492f5580d03b -->
            <TokenSpec ttl="28800">
                <!-- source: pattern://7022472ae407577ae604bbb8 -->
                <field src="session" key="ch.nevis.session.sessid" as="sessid"/>
                <!-- source: pattern://7022472ae407577ae604bbb8 -->
                <field src="session" key="ch.nevis.session.userid" as="userid"/>
                <!-- source: pattern://7022472ae407577ae604bbb8 -->
                <field src="session" key="ch.nevis.session.authlevel" as="authLevel"/>
                <!-- source: pattern://7022472ae407577ae604bbb8 -->
                <field src="session" key="ch.nevis.session.esauthid" as="esauthid"/>
                <!-- source: pattern://7022472ae407577ae604bbb8 -->
                <field src="session" key="ch.nevis.session.entryid" as="entryid"/>
                <!-- source: pattern://7022472ae407577ae604bbb8 -->
                <field src="session" key="ch.nevis.session.loginid" as="loginId"/>
                <!-- source: pattern://7022472ae407577ae604bbb8 -->
                <field src="session" key="ch.nevis.session.domain" as="domain"/>
                <!-- source: pattern://7022472ae407577ae604bbb8 -->
                <field src="session" key="ch.nevis.session.secroles" as="roles"/>
            </TokenSpec>
            <!-- source: pattern://7022472ae407577ae604bbb8 -->
            <Signer key="DefaultSigner"/>
        </TokenAssembler>
        <!-- source: pattern://94e0b7b92ff2593f958c1eec -->
        <TokenAssembler name="Token_Auth_Realm_Mobile_FIDO_UAF_SecToken">
            <!-- source: pattern://94e0b7b92ff2593f958c1eec -->
            <Selector default="false"/>
            <!-- source: pattern://94e0b7b92ff2593f958c1eec -->
            <TokenSpec ttl="28800">
                <!-- source: pattern://94e0b7b92ff2593f958c1eec -->
                <field src="request" key="UserId" as="userid"/>
                <!-- source: pattern://94e0b7b92ff2593f958c1eec -->
                <field src="session" key="ch.nevis.session.loginid" as="loginId"/>
                <!-- source: pattern://94e0b7b92ff2593f958c1eec -->
                <field src="session" key="ch.adnovum.nevisidm.profileId" as="profileId"/>
                <!-- source: pattern://94e0b7b92ff2593f958c1eec -->
                <field src="session" key="ch.adnovum.nevisidm.clientId" as="clientId"/>
                <!-- source: pattern://94e0b7b92ff2593f958c1eec -->
                <field src="request" key="ActualRoles" as="roles"/>
            </TokenSpec>
            <!-- source: pattern://94e0b7b92ff2593f958c1eec -->
            <Signer key="Signer_SecToken"/>
        </TokenAssembler>
        <!-- source: pattern://94e0b7b92ff2593f958c1eec -->
        <TokenAssembler name="Token_NotUsed_Auth_Realm_SecToken">
            <!-- source: pattern://94e0b7b92ff2593f958c1eec -->
            <Selector default="false"/>
            <!-- source: pattern://94e0b7b92ff2593f958c1eec -->
            <TokenSpec ttl="28800">
                <!-- source: pattern://94e0b7b92ff2593f958c1eec -->
                <field src="request" key="UserId" as="userid"/>
                <!-- source: pattern://94e0b7b92ff2593f958c1eec -->
                <field src="session" key="ch.nevis.session.loginid" as="loginId"/>
                <!-- source: pattern://94e0b7b92ff2593f958c1eec -->
                <field src="session" key="ch.adnovum.nevisidm.profileId" as="profileId"/>
                <!-- source: pattern://94e0b7b92ff2593f958c1eec -->
                <field src="session" key="ch.adnovum.nevisidm.clientId" as="clientId"/>
                <!-- source: pattern://94e0b7b92ff2593f958c1eec -->
                <field src="request" key="ActualRoles" as="roles"/>
            </TokenSpec>
            <!-- source: pattern://94e0b7b92ff2593f958c1eec -->
            <Signer key="Signer_SecToken"/>
        </TokenAssembler>
        <!-- source: pattern://94e0b7b92ff2593f958c1eec -->
        <KeyStore name="DefaultKeyStore">
            <!-- source: pattern://7022472ae407577ae604bbb8 -->
            <KeyObject name="DefaultSigner" certificate="/var/opt/keys/own/auth-sh4r3d-internal-idp-auth-signer/cert.pem" privateKey="/var/opt/keys/own/auth-sh4r3d-internal-idp-auth-signer/keystore.jks" passPhrase="pipe:///var/opt/keys/own/auth-sh4r3d-internal-idp-auth-signer/keypass"/>
            <!-- source: pattern://7022472ae407577ae604bbb8 -->
            <KeyObject name="DefaultSignerTrust" certificate="/var/opt/keys/trust/auth-internal-idp-auth-signer-trust/truststore.jks"/>
            <!-- source: pattern://94e0b7b92ff2593f958c1eec -->
            <KeyObject name="Signer_SecToken" certificate="/var/opt/keys/own/auth-sh4r3d-internal-idp-auth-signer/cert.pem" privateKey="/var/opt/keys/own/auth-sh4r3d-internal-idp-auth-signer/keystore.jks" passPhrase="pipe:///var/opt/keys/own/auth-sh4r3d-internal-idp-auth-signer/keypass"/>
        </KeyStore>
        <!-- source: pattern://bcfe78c02cbe0588528bc3cb -->
        <KeyStore name="Ask_Mobile_Number">
            <!-- source: pattern://bcfe78c02cbe0588528bc3cb -->
            <KeyObject name="TlsTrustStore" certificate="/var/opt/keys/trust/env-ca/truststore.jks"/>
        </KeyStore>
        <!-- source: pattern://bcfe78c02cbe0588528bc3cb -->
        <KeyStore name="Ensure_Recovery_Code">
            <!-- source: pattern://bcfe78c02cbe0588528bc3cb -->
            <KeyObject name="TlsTrustStore" certificate="/var/opt/keys/trust/env-ca/truststore.jks"/>
        </KeyStore>
        <!-- source: pattern://bcfe78c02cbe0588528bc3cb -->
        <KeyStore name="Ensure_Account_State">
            <!-- source: pattern://bcfe78c02cbe0588528bc3cb -->
            <KeyObject name="TlsTrustStore" certificate="/var/opt/keys/trust/env-ca/truststore.jks"/>
        </KeyStore>
        <!-- source: pattern://947daa1313709b0f26a64432 -->
        <KeyStore name="EId_Compare_And_Update_IDM_Attributes">
            <!-- source: pattern://947daa1313709b0f26a64432 -->
            <KeyObject name="EId_Rest_Client_Trust_Store" certificate="/var/opt/keys/trust/env-ca/truststore.jks"/>
        </KeyStore>
        <!-- source: pattern://947daa1313709b0f26a64432 -->
        <KeyStore name="EId_Fetch_IDM_Attributes">
            <!-- source: pattern://947daa1313709b0f26a64432 -->
            <KeyObject name="EId_Rest_Client_Trust_Store" certificate="/var/opt/keys/trust/env-ca/truststore.jks"/>
        </KeyStore>
        <!-- source: pattern://947daa1313709b0f26a64432 -->
        <KeyStore name="EId_Select_AGOV_Account">
            <!-- source: pattern://947daa1313709b0f26a64432 -->
            <KeyObject name="EId_Rest_Client_Trust_Store" certificate="/var/opt/keys/trust/env-ca/truststore.jks"/>
        </KeyStore>
        <!-- source: pattern://95220b3005deb118adeb01aa -->
        <KeyStore name="Mobile_NLess_Auth">
            <!-- source: pattern://95220b3005deb118adeb01aa -->
            <KeyObject name="FIDO_UAF_Truststore" certificate="/var/opt/keys/trust/env-ca/truststore.jks"/>
        </KeyStore>
        <!-- source: pattern://0a15213c00dec3668fb94a65, pattern://c0f2c118a88327acce1687fe, pattern://8dbec5bb024707d73fca93ef -->
        <KeyStore name="Store_IDP_AGOV">
            <!-- source: pattern://c0f2c118a88327acce1687fe -->
            <KeyObject name="Signer_IDP_AGOV" certificate="/var/opt/keys/own/idp-pem-signer/cert.pem" privateKey="/var/opt/keys/own/idp-pem-signer/keystore.jks" passPhrase="pipe:///var/opt/keys/own/idp-pem-signer/keypass"/>
            <!-- source: pattern://0a15213c00dec3668fb94a65 -->
            <KeyObject name="https://trustbroker.agov-d.azure.adnovum.net" certificate="/var/opt/keys/trust/idp-pem-atb/truststore.jks"/>
            <!-- source: pattern://8dbec5bb024707d73fca93ef -->
            <KeyObject name="https://trustbroker-idp.agov-w.azure.adnovum.net" certificate="/var/opt/keys/trust/idp-pem-atb/truststore.jks"/>
        </KeyStore>
        <!-- source: pattern://cb8c63274fe346280de0ffd5 -->
        <KeyStore name="Auth_Realm_Mobile_FIDO_UAFKeyStore">
            <!-- source: pattern://cb8c63274fe346280de0ffd5 -->
            <KeyObject name="Auth_Realm_Mobile_FIDO_UAFClientKeyObject" certificate="/var/opt/keys/own/auth-auth-realm-mobile-fido-uaf-tls-client-nevisfido/cert.pem" privateKey="/var/opt/keys/own/auth-auth-realm-mobile-fido-uaf-tls-client-nevisfido/keystore.jks" passPhrase="pipe:///var/opt/keys/own/auth-auth-realm-mobile-fido-uaf-tls-client-nevisfido/keypass"/>
            <!-- source: pattern://cb8c63274fe346280de0ffd5 -->
            <KeyObject name="Auth_Realm_Mobile_FIDO_UAFServerKeyObject" certificate="/var/opt/keys/trust/auth-auth-realm-mobile-fido-uaf-tls-trust-nevisfido/truststore.jks" passPhrase="pipe:///var/opt/keys/trust/auth-auth-realm-mobile-fido-uaf-tls-trust-nevisfido/keypass"/>
        </KeyStore>
        <!-- source: pattern://95220b3005deb118adeb01aa -->
        <KeyStore name="Recovery_mobile_nless_auth">
            <!-- source: pattern://95220b3005deb118adeb01aa -->
            <KeyObject name="FIDO_UAF_Truststore" certificate="/var/opt/keys/trust/env-ca/truststore.jks"/>
        </KeyStore>
        <!-- source: pattern://b199c1561394770481c01e23 -->
        <KeyStore name="Recovery_Auth">
            <!-- source: pattern://b199c1561394770481c01e23 -->
            <KeyObject name="internal_tls_Truststore" certificate="/var/opt/keys/trust/env-ca/truststore.jks"/>
        </KeyStore>
    </SessionCoordinator>
    <!-- source: pattern://7022472ae407577ae604bbb8 -->
    <LocalOutOfContextDataStore reaperPeriod="60"/>
    <!-- source: pattern://204c22beaccdfd22727af378, pattern://06aeae2d799e492f5580d03b, pattern://7022472ae407577ae604bbb8, pattern://7022472ae407577ae604bbb8, pattern://9a8294b080ea769d22924af0, pattern://f393012a278e525956a362d3, pattern://c686c1bdd5355351f7f98cc8, pattern://7fb39bfd6c34685866a22180, pattern://b8bdab6e4634a1d81f20e5bb, pattern://cb8c63274fe346280de0ffd5, pattern://9a1d3c6052019748d3510261, pattern://ae023be7e097522c74e31d17, pattern://81ae3547acc02160f787a546, pattern://0327ca909dfcaf2d332da104, pattern://584964c837512845d7940809, pattern://e0fda9336be9c69dafc9b69e, pattern://7022472ae407577ae604bbb8, pattern://cb8c63274fe346280de0ffd5, pattern://204c22beaccdfd22727af378, pattern://06aeae2d799e492f5580d03b, pattern://7022472ae407577ae604bbb8 -->
    <AuthEngine useLiteralDictionary="true" literalDictionaryLanguages="en,de,fr,it" inputLanguageCookie="LANG" compatLevel="none" addAutheLevelToSecRoles="true" classPath="/var/opt/nevisauth/default/plugin:/opt/nevisidmcl/nevisauth/lib:/opt/nevisfidocl/nevisauth/lib:/opt/nevisauth/plugin" propagateSession="false">
        <!-- source: pattern://4fcfadb4a5c946ead7e6e995 -->
        <Domain name="Auth_Realm_Main_IDP" default="false" inactiveInterval="1800" reauthInterval="0" resetAuthenticationCondition="#{ (inargs.containsKey('SAMLRequest') and session.containsKey('ch.nevis.auth.saml.request.id')) ? 'restart' : '' }">
            <Entry method="authenticate" state="Auth_Realm_Main_IDP_IDP_Status_Check"/>
            <Entry method="authenticate" state="Auth_Realm_Main_IDP_IDP_Status_Check" selector="${request:currentResource:^http[s]?\u003A//[^/]+/SAML2/SSO/.*$:true}"/>
            <Entry method="logout" state="Auth_Realm_Main_IDP_IDP_Status_Check"/>
            <Entry method="logout" state="Auth_Realm_Main_IDP_IDP_Status_Check" selector="${request:currentResource:^http[s]?\u003A//[^/]+/SAML2/SSO/.*$:true}"/>
            <Entry method="stepup" state="Auth_Realm_Main_IDP_Selector"/>
            <Entry method="stepup" state="Auth_Realm_Main_IDP_IDP_Status_Check" selector="${request:currentResource:^http[s]?\u003A//[^/]+/SAML2/SSO/.*$:true}"/>
        </Domain>
        <!-- source: pattern://cb8c63274fe346280de0ffd5 -->
        <Domain name="Auth_Realm_Mobile_FIDO_UAF" default="false" inactiveInterval="7200" reauthInterval="0" resetAuthenticationCondition="${inargs:cancel}">
            <Entry method="authenticate" state="Auth_Realm_Mobile_FIDO_UAF_DirectFidoAuthRequired"/>
            <Entry method="authenticate" state="Auth_Realm_Mobile_FIDO_UAF_FidoUafAuthState" selector="/auth/fidouaf"/>
            <Entry method="stepup" state="Auth_Realm_Mobile_FIDO_UAF_FidoUafAuthState"/>
            <Entry method="stepup" state="Auth_Realm_Mobile_FIDO_UAF_SecToken" selector="${request:requiredRoles:^token.SecToken$:true}"/>
        </Domain>
        <!-- source: pattern://204c22beaccdfd22727af378 -->
        <Domain name="Auth_Realm_Recovery" default="false" inactiveInterval="7200" reauthInterval="0" resetAuthenticationCondition="#{ (inargs.containsKey('cd')) ? 'restart' : '' }">
            <Entry method="authenticate" state="Auth_Realm_Recovery_Recovery_Auth"/>
            <Entry method="authenticate" state="Auth_Realm_Recovery_Recovery_Auth" selector="${request:currentResource:^http[s]?\u003A//[^/]+/AUTH/RECOVERY/.*$:true}"/>
            <Entry method="stepup" state="Auth_Realm_Recovery_Selector"/>
            <Entry method="stepup" state="Auth_Realm_Recovery_Recovery_Auth" selector="${request:currentResource:^http[s]?\u003A//[^/]+/AUTH/RECOVERY/.*$:true}"/>
        </Domain>
        <!-- source: pattern://06aeae2d799e492f5580d03b -->
        <Domain name="NotUsed_Auth_Realm" default="false" inactiveInterval="7200" reauthInterval="0" resetAuthenticationCondition="${inargs:cancel}">
            <Entry method="authenticate" state="NotUsed_Auth_Realm_NotUsed_Pwd_Login"/>
            <Entry method="stepup" state="NotUsed_Auth_Realm_Selector"/>
        </Domain>
        <AuthState name="Auth_Realm_Main_IDP_IDP_Status_Check" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false" resumeState="false">
            <!-- source: pattern://7a913eec7f78ce674cd87854 -->
            <ResultCond name="continueAfterRepost" next="Auth_Realm_Main_IDP_Mobile_NLess_Auth"/>
            <!-- source: pattern://7a913eec7f78ce674cd87854 -->
            <ResultCond name="continueEidAfterRepost" next="Auth_Realm_Main_IDP_EId_Verification_Auth"/>
            <!-- source: pattern://7a913eec7f78ce674cd87854 -->
            <ResultCond name="ok" next="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_Preprocess_Done"/>
            <!-- source: pattern://7a913eec7f78ce674cd87854 -->
            <Response value="AUTH_ERROR"/>
            <!-- source: pattern://7a913eec7f78ce674cd87854 -->
            <property name="scriptTraceGroup" value="AGOV-ACCT"/>
            <!-- source: pattern://7a913eec7f78ce674cd87854 -->
            <property name="parameter.cookie.domain" value="auth.agov-w.azure.adnovum.net"/>
            <!-- source: pattern://7a913eec7f78ce674cd87854 -->
            <property name="parameter.eidEnabled" value="false"/>
            <!-- source: pattern://7a913eec7f78ce674cd87854 -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/idp_status_check.groovy"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_Mobile_NLess_Auth" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false" resumeState="true">
            <!-- source: pattern://f63c475c35b616b7c6c1901c -->
            <ResultCond name="default" next="Auth_Realm_Main_IDP_Mobile_NLess_Auth"/>
            <!-- source: pattern://f63c475c35b616b7c6c1901c -->
            <ResultCond name="eidLogin" next="Auth_Realm_Main_IDP_EId_Verification_Auth"/>
            <!-- source: pattern://f63c475c35b616b7c6c1901c -->
            <ResultCond name="fido2" next="Auth_Realm_Main_IDP_fido2_fetchCaptchaInfos"/>
            <!-- source: pattern://f63c475c35b616b7c6c1901c -->
            <ResultCond name="ok" next="Auth_Realm_Main_IDP_Mobile_NLess_Auth_Processing"/>
            <!-- source: pattern://f63c475c35b616b7c6c1901c -->
            <ResultCond name="registration" next="Auth_Realm_Main_IDP_createUUID"/>
            <!-- source: pattern://f63c475c35b616b7c6c1901c -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://f63c475c35b616b7c6c1901c -->
                <Gui name="mauth_usernameless">
                    <!-- source: pattern://f63c475c35b616b7c6c1901c -->
                    <GuiElem name="agov.appDisplayNameDE" type="hidden" value="${sess:agov.appDisplayNameDE}" optional="true"/>
                    <!-- source: pattern://f63c475c35b616b7c6c1901c -->
                    <GuiElem name="agov.appDisplayNameFR" type="hidden" value="${sess:agov.appDisplayNameFR}" optional="true"/>
                    <!-- source: pattern://f63c475c35b616b7c6c1901c -->
                    <GuiElem name="agov.appDisplayNameIT" type="hidden" value="${sess:agov.appDisplayNameIT}" optional="true"/>
                    <!-- source: pattern://f63c475c35b616b7c6c1901c -->
                    <GuiElem name="agov.appDisplayNameEN" type="hidden" value="${sess:agov.appDisplayNameEN}" optional="true"/>
                    <!-- source: pattern://f63c475c35b616b7c6c1901c -->
                    <GuiElem name="agov.appSamlRpEntityId" type="hidden" value="https://auth.agov-w.azure.adnovum.net/app-info/app-icon?entity-id=${sess:ch.nevis.auth.saml.request.scoping.requesterId}" optional="true"/>
                    <!-- source: pattern://f63c475c35b616b7c6c1901c -->
                    <GuiElem name="authRequestId" type="hidden" value="${sess:ch.nevis.auth.saml.request.id}" optional="true"/>
                    <!-- source: pattern://f63c475c35b616b7c6c1901c -->
                    <GuiElem name="lastLoginMethod" type="hidden" value="${sess:agov.lastLoginMethod}" optional="true"/>
                    <!-- source: pattern://f63c475c35b616b7c6c1901c -->
                    <GuiElem name="fallback" type="button" label="mobile_auth.cancel.button.label" value="true" optional="true"/>
                </Gui>
            </Response>
            <!-- source: pattern://f63c475c35b616b7c6c1901c -->
            <property name="scriptTraceGroup" value="AGOV-ACCT"/>
            <!-- source: pattern://f63c475c35b616b7c6c1901c -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/mobile_nless_auth.groovy"/>
            <!-- source: pattern://f63c475c35b616b7c6c1901c -->
            <property name="parameter.agovmeregistrationurl" value="https://ob.agov-w.azure.adnovum.net/mock-me/registration"/>
            <!-- source: pattern://f63c475c35b616b7c6c1901c -->
            <property name="parameter.recoveryurl" value="https://auth.agov-w.azure.adnovum.net/AUTH/RECOVERY/"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_EId_Verification_Auth" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false" resumeState="true">
            <!-- source: pattern://e335f57d4c64dfc97223697a -->
            <ResultCond name="agovLogin" next="Auth_Realm_Main_IDP_Mobile_NLess_Auth"/>
            <!-- source: pattern://e335f57d4c64dfc97223697a -->
            <ResultCond name="default" next="Auth_Realm_Main_IDP_EId_Verification_Auth"/>
            <!-- source: pattern://e335f57d4c64dfc97223697a -->
            <ResultCond name="error" next="Auth_Realm_Main_IDP_SendSamlResponseWithError"/>
            <!-- source: pattern://e335f57d4c64dfc97223697a -->
            <ResultCond name="ok" next="Auth_Realm_Main_IDP_EId_Passthrough_Switch"/>
            <!-- source: pattern://e335f57d4c64dfc97223697a -->
            <ResultCond name="register" next="Auth_Realm_Main_IDP_EId_Registration_Page"/>
            <!-- source: pattern://e335f57d4c64dfc97223697a -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://e335f57d4c64dfc97223697a -->
                <Gui name="eid_verification">
                    <!-- source: pattern://e335f57d4c64dfc97223697a -->
                    <GuiElem name="agov.appDisplayNameDE" type="hidden" value="${sess:agov.appDisplayNameDE}" optional="true"/>
                    <!-- source: pattern://e335f57d4c64dfc97223697a -->
                    <GuiElem name="agov.appDisplayNameFR" type="hidden" value="${sess:agov.appDisplayNameFR}" optional="true"/>
                    <!-- source: pattern://e335f57d4c64dfc97223697a -->
                    <GuiElem name="agov.appDisplayNameIT" type="hidden" value="${sess:agov.appDisplayNameIT}" optional="true"/>
                    <!-- source: pattern://e335f57d4c64dfc97223697a -->
                    <GuiElem name="agov.appDisplayNameEN" type="hidden" value="${sess:agov.appDisplayNameEN}" optional="true"/>
                    <!-- source: pattern://e335f57d4c64dfc97223697a -->
                    <GuiElem name="agov.appDisplayNameRM" type="hidden" value="${sess:agov.appDisplayNameRM}" optional="true"/>
                    <!-- source: pattern://e335f57d4c64dfc97223697a -->
                    <GuiElem name="agov.appSamlRpEntityId" type="hidden" value="https://auth.agov-w.azure.adnovum.net/app-info/app-icon?entity-id=${sess:ch.nevis.auth.saml.request.scoping.requesterId}" optional="true"/>
                    <!-- source: pattern://e335f57d4c64dfc97223697a -->
                    <GuiElem name="authRequestId" type="hidden" value="${sess:ch.nevis.auth.saml.request.id}" optional="true"/>
                    <!-- source: pattern://e335f57d4c64dfc97223697a -->
                    <GuiElem name="oid4vp" type="hidden" value="UNKNOWN" optional="true"/>
                    <!-- source: pattern://e335f57d4c64dfc97223697a -->
                    <GuiElem name="eidOnly" type="hidden" value="${sess:agov.requestedRoleLevel:^[56]00$:true}" optional="true"/>
                </Gui>
            </Response>
            <!-- source: pattern://e335f57d4c64dfc97223697a -->
            <property name="scriptTraceGroup" value="AGOV-ACCT"/>
            <!-- source: pattern://e335f57d4c64dfc97223697a -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/eid_verification_auth.groovy"/>
            <!-- source: pattern://e335f57d4c64dfc97223697a -->
            <property name="parameter.eidVerifierBaseUrl" value="https://verifier-management.agov-epr-lab.azure.adnovum.net"/>
            <!-- source: pattern://e335f57d4c64dfc97223697a -->
            <property name="parameter.eidUUIDNamespace" value="18b36d9e-078f-4711-9d1d-07a05505915f"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_Preprocess_Done" class="ch.nevis.esauth.auth.states.standard.ConditionalDispatcherState" final="false">
            <!-- source: pattern://03326b180687860ffe06a58c -->
            <ResultCond name="nomatch" next="Auth_Realm_Main_IDP_Auth_Failed"/>
            <!-- source: pattern://03326b180687860ffe06a58c -->
            <ResultCond name="ok" next="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_IDP_Dispatcher"/>
            <!-- source: pattern://03326b180687860ffe06a58c -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://03326b180687860ffe06a58c -->
                <Arg name="ch.nevis.isiweb4.response.status" value="403"/>
            </Response>
            <!-- source: pattern://03326b180687860ffe06a58c -->
            <property name="condition:ok" value="${request:currentResource:^http[s]?\u003A//[^/]+/SAML2/SSO/.*$:true}"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_fido2_fetchCaptchaInfos" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false">
            <!-- source: pattern://f39352769cb2a1c88e1a176d -->
            <ResultCond name="error" next="Auth_Realm_Main_IDP_Mobile_NLess_Auth"/>
            <!-- source: pattern://f39352769cb2a1c88e1a176d -->
            <ResultCond name="ok" next="Auth_Realm_Main_IDP_Email_Input"/>
            <!-- source: pattern://f39352769cb2a1c88e1a176d -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://f39352769cb2a1c88e1a176d -->
                <Arg name="ch.nevis.isiweb4.response.status" value="403"/>
            </Response>
            <!-- source: pattern://f39352769cb2a1c88e1a176d -->
            <property name="parameter.realIpHttpHeaderName" value="X-Forwarded-For"/>
            <!-- source: pattern://f39352769cb2a1c88e1a176d -->
            <property name="parameter.url" value="https://utility.agov-d.azure.adnovum.net/utility/api/v1/configinfo"/>
            <!-- source: pattern://f39352769cb2a1c88e1a176d -->
            <property name="scriptTraceGroup" value="AgovCaptcha"/>
            <!-- source: pattern://f39352769cb2a1c88e1a176d -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/fido2_fetchcaptchainfos.groovy"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_Mobile_NLess_Auth_Processing" class="ch.nevis.auth.fido.uaf.authstate.OutOfBandFidoUafAuthState" final="false" resumeState="false">
            <!-- source: pattern://f63c475c35b616b7c6c1901c -->
            <ResultCond name="dispatchFailed" next="Auth_Realm_Main_IDP_Mobile_NLess_Auth_Processing"/>
            <!-- source: pattern://f63c475c35b616b7c6c1901c -->
            <ResultCond name="error" next="Auth_Realm_Main_IDP_Mobile_NLess_Auth_Processing"/>
            <!-- source: pattern://f63c475c35b616b7c6c1901c -->
            <ResultCond name="failed" next="Auth_Realm_Main_IDP_Mobile_NLess_Auth"/>
            <!-- source: pattern://f63c475c35b616b7c6c1901c -->
            <ResultCond name="ok" next="Auth_Realm_Main_IDP_FidoUAF_VariableStep" authLevel="2"/>
            <!-- source: pattern://f63c475c35b616b7c6c1901c -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://f63c475c35b616b7c6c1901c -->
                <Arg name="ch.nevis.isiweb4.response.status" value="403"/>
            </Response>
            <!-- source: pattern://f63c475c35b616b7c6c1901c -->
            <property name="fidoUafServerUrl" value="https://fido-uaf:9443/nevisfido"/>
            <!-- source: pattern://f63c475c35b616b7c6c1901c -->
            <property name="dispatcher" value="link"/>
            <!-- source: pattern://f63c475c35b616b7c6c1901c -->
            <property name="httpclient.tls.trustStoreRef" value="Mobile_NLess_Auth"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_createUUID" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false">
            <!-- source: pattern://d76231eaa88cb1645ce44cf3 -->
            <ResultCond name="error" next="Auth_Realm_Main_IDP_Authentication_Failed"/>
            <!-- source: pattern://d76231eaa88cb1645ce44cf3 -->
            <ResultCond name="ok" next="Auth_Realm_Main_IDP_Redirect_to_Registration"/>
            <!-- source: pattern://d76231eaa88cb1645ce44cf3 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://d76231eaa88cb1645ce44cf3 -->
                <Arg name="ch.nevis.isiweb4.response.status" value="403"/>
            </Response>
            <!-- source: pattern://d76231eaa88cb1645ce44cf3 -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/createuuid.groovy"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_SendSamlResponseWithError" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false" resumeState="true">
            <!-- source: pattern://4c65de021d362462324a3a5f -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://4c65de021d362462324a3a5f -->
                <Gui name="NotUsed"/>
            </Response>
            <!-- source: pattern://4c65de021d362462324a3a5f -->
            <property name="parameter.cookie.domain" value="auth.agov-w.azure.adnovum.net"/>
            <!-- source: pattern://4c65de021d362462324a3a5f -->
            <property name="scriptTraceGroup" value="AGOV-ACCT"/>
            <!-- source: pattern://4c65de021d362462324a3a5f -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/SendSamlResponseWithError.groovy"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_EId_Passthrough_Switch" class="ch.nevis.esauth.auth.states.standard.ConditionalDispatcherState" final="false">
            <!-- source: pattern://3c1d57471850dccab77fd257 -->
            <ResultCond name="augmentation" next="Auth_Realm_Main_IDP_EId_Select_AGOV_Account"/>
            <!-- source: pattern://3c1d57471850dccab77fd257 -->
            <ResultCond name="nomatch" next="Auth_Realm_Main_IDP_SendSamlResponseWithError"/>
            <!-- source: pattern://3c1d57471850dccab77fd257 -->
            <ResultCond name="passthrough" next="Auth_Realm_Main_IDP_EId_Passthrough_Prepare_Assertion"/>
            <!-- source: pattern://3c1d57471850dccab77fd257 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://3c1d57471850dccab77fd257 -->
                <Arg name="ch.nevis.isiweb4.response.status" value="403"/>
            </Response>
            <!-- source: pattern://3c1d57471850dccab77fd257 -->
            <property name="condition:augmentation" value="${session:agov.requestedRoleLevel:^[12345]00$:true}"/>
            <!-- source: pattern://3c1d57471850dccab77fd257 -->
            <property name="condition:passthrough" value="${session:agov.requestedRoleLevel:600:true}"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_EId_Registration_Page" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false" resumeState="true">
            <!-- source: pattern://9e0cb3f3fd05315512afd46c -->
            <ResultCond name="back" next="Auth_Realm_Main_IDP_EId_Verification_Auth"/>
            <!-- source: pattern://9e0cb3f3fd05315512afd46c -->
            <ResultCond name="register" next="Auth_Realm_Main_IDP_createUUID"/>
            <!-- source: pattern://9e0cb3f3fd05315512afd46c -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://9e0cb3f3fd05315512afd46c -->
                <Gui name="eid_registration">
                    <!-- source: pattern://9e0cb3f3fd05315512afd46c -->
                    <GuiElem name="register" type="hidden" value="UNKNOWN" optional="true"/>
                    <!-- source: pattern://9e0cb3f3fd05315512afd46c -->
                    <GuiElem name="authRequestId" type="hidden" value="${sess:ch.nevis.auth.saml.request.id}" optional="true"/>
                </Gui>
            </Response>
            <!-- source: pattern://9e0cb3f3fd05315512afd46c -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/eid_registration.groovy"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_Auth_Failed" class="ch.nevis.esauth.auth.states.standard.AuthError" final="false">
            <!-- source: pattern://473f9d6b4ab9d61c1eb8c689 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://473f9d6b4ab9d61c1eb8c689 -->
                <Gui name="Error">
                    <!-- source: pattern://473f9d6b4ab9d61c1eb8c689 -->
                    <GuiElem name="info" type="error" label="error_99"/>
                    <!-- source: pattern://473f9d6b4ab9d61c1eb8c689 -->
                    <GuiElem name="submit" type="button" label="continue.button.label"/>
                </Gui>
            </Response>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_IDP_Dispatcher" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false" resumeState="true">
            <!-- source: pattern://73efd00d67082ff1eb927922 -->
            <ResultCond name="confirm" next="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_Logout_Confirm"/>
            <!-- source: pattern://73efd00d67082ff1eb927922 -->
            <ResultCond name="epd" next="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_EPD_IDP"/>
            <!-- source: pattern://73efd00d67082ff1eb927922 -->
            <ResultCond name="epd_artifact" next="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_EPD_Artifact_IDP"/>
            <!-- source: pattern://73efd00d67082ff1eb927922 -->
            <ResultCond name="main" next="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_AGOV_IDP"/>
            <!-- source: pattern://73efd00d67082ff1eb927922 -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://73efd00d67082ff1eb927922 -->
                <Gui name="saml_dispatcher" label="title.saml.failed">
                    <!-- source: pattern://73efd00d67082ff1eb927922 -->
                    <GuiElem name="lasterror" type="error" label="error.saml.failed"/>
                </Gui>
            </Response>
            <!-- source: pattern://73efd00d67082ff1eb927922 -->
            <property name="parameter.logoutConfirmation" value="false"/>
            <!-- source: pattern://73efd00d67082ff1eb927922 -->
            <property name="parameter.spInitiated" value="true"/>
            <!-- source: pattern://73efd00d67082ff1eb927922 -->
            <property name="parameter.epdMode" value="post"/>
            <!-- source: pattern://73efd00d67082ff1eb927922 -->
            <property name="parameter.atb" value="https://trustbroker.agov-d.azure.adnovum.net"/>
            <!-- source: pattern://73efd00d67082ff1eb927922 -->
            <property name="parameter.epd_atb" value="https://trustbroker-idp.agov-w.azure.adnovum.net"/>
            <!-- source: pattern://73efd00d67082ff1eb927922 -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/idp_dispatcher.groovy"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_Email_Input" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="true" resumeState="true">
            <!-- source: pattern://e3cac41e75980361d7d26bde -->
            <ResultCond name="cancel" next="Auth_Realm_Main_IDP_Mobile_NLess_Auth"/>
            <!-- source: pattern://e3cac41e75980361d7d26bde -->
            <ResultCond name="stay" next="Auth_Realm_Main_IDP_Email_Input"/>
            <!-- source: pattern://e3cac41e75980361d7d26bde -->
            <ResultCond name="timeout" next="Auth_Realm_Main_IDP_ReturnTimeoutButKeepSession"/>
            <!-- source: pattern://e3cac41e75980361d7d26bde -->
            <ResultCond name="verifyEmail" next="Auth_Realm_Main_IDP_fido2_fetchCaptchaResult"/>
            <!-- source: pattern://e3cac41e75980361d7d26bde -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://e3cac41e75980361d7d26bde -->
                <Gui name="user_input">
                    <!-- source: pattern://e3cac41e75980361d7d26bde -->
                    <GuiElem name="authRequestId" type="hidden" value="${sess:ch.nevis.auth.saml.request.id}" optional="true"/>
                    <!-- source: pattern://e3cac41e75980361d7d26bde -->
                    <GuiElem name="email" type="text" label="prompt.email" value="#{(inargs.getProperty('userInputValue_prompt.email') != null) ? inargs.getProperty('userInputValue_prompt.email') : session.get('ch.nevis.idm.User.email')}" optional="true"/>
                    <!-- source: pattern://e3cac41e75980361d7d26bde -->
                    <GuiElem name="captchaSettings.enabled" type="hidden" value="${sess:agov.fido2.captchaSettings.enabled}" optional="true"/>
                    <!-- source: pattern://e3cac41e75980361d7d26bde -->
                    <GuiElem name="friendlyCaptchaSettings.siteKey" type="hidden" value="${sess:agov.fido2.captchaSettings.siteKey}" optional="true"/>
                    <!-- source: pattern://e3cac41e75980361d7d26bde -->
                    <GuiElem name="friendlyCaptchaSettings.puzzleUrl" type="hidden" value="${sess:agov.fido2.captchaSettings.puzzleUrl}" optional="true"/>
                    <!-- source: pattern://e3cac41e75980361d7d26bde -->
                    <GuiElem name="cancelFido2" type="submit" label="cancel.button.label" value="cancelFido2"/>
                    <!-- source: pattern://e3cac41e75980361d7d26bde -->
                    <GuiElem name="submit" type="submit" label="submit.button.label" value="submit"/>
                </Gui>
            </Response>
            <!-- source: pattern://e3cac41e75980361d7d26bde -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/sanitizeAndDispatchEmailInput.groovy"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_FidoUAF_VariableStep" class="ch.nevis.esauth.auth.states.standard.TransformAttributes" final="false">
            <!-- source: pattern://56c67433c7a47b6cb06f011a -->
            <ResultCond name="ok" next="Auth_Realm_Main_IDP_Mobile_UserID_Verify"/>
            <!-- source: pattern://56c67433c7a47b6cb06f011a -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://56c67433c7a47b6cb06f011a -->
                <Arg name="ch.nevis.isiweb4.response.status" value="403"/>
            </Response>
            <!-- source: pattern://56c67433c7a47b6cb06f011a -->
            <property name="sess:authenticatedWith" value="urn:qa.agov.ch:names:tc:authfactor:accessapp"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_Authentication_Failed" class="ch.nevis.esauth.auth.states.standard.AuthError" final="false">
            <!-- source: pattern://b8bdab6e4634a1d81f20e5bb, pattern://d76231eaa88cb1645ce44cf3 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://b8bdab6e4634a1d81f20e5bb, pattern://d76231eaa88cb1645ce44cf3 -->
                <Gui name="Error">
                    <!-- source: pattern://b8bdab6e4634a1d81f20e5bb, pattern://d76231eaa88cb1645ce44cf3 -->
                    <GuiElem name="info" type="error" label="error_99"/>
                    <!-- source: pattern://b8bdab6e4634a1d81f20e5bb, pattern://d76231eaa88cb1645ce44cf3 -->
                    <GuiElem name="submit" type="button" label="continue.button.label"/>
                </Gui>
            </Response>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_Redirect_to_Registration" class="ch.nevis.esauth.auth.states.saml.IdentityProviderState" final="false" resumeState="false">
            <!-- source: pattern://bfd395eb0dab50aff2f2c01b -->
            <ResultCond name="ok" next="Auth_Realm_Main_IDP_Redirect_to_Registration_Handle_Redirect"/>
            <!-- source: pattern://bfd395eb0dab50aff2f2c01b -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://bfd395eb0dab50aff2f2c01b -->
                <Gui name="internal_error">
                    <!-- source: pattern://bfd395eb0dab50aff2f2c01b -->
                    <GuiElem name="transferId" type="hidden" value="${request:traceId}" optional="true"/>
                </Gui>
            </Response>
            <!-- source: pattern://bfd395eb0dab50aff2f2c01b -->
            <property name="in.binding" value="none"/>
            <!-- source: pattern://bfd395eb0dab50aff2f2c01b -->
            <property name="in.keystoreref" value=""/>
            <!-- source: pattern://bfd395eb0dab50aff2f2c01b -->
            <property name="in.keyobjectref" value=""/>
            <!-- source: pattern://bfd395eb0dab50aff2f2c01b -->
            <property name="out.binding" value="internal"/>
            <!-- source: pattern://bfd395eb0dab50aff2f2c01b -->
            <property name="out.sign" value="Response Assertion"/>
            <!-- source: pattern://bfd395eb0dab50aff2f2c01b -->
            <property name="out.signatureKeyInfo" value="Certificate"/>
            <!-- source: pattern://bfd395eb0dab50aff2f2c01b -->
            <property name="out.ttl" value="20"/>
            <!-- source: pattern://bfd395eb0dab50aff2f2c01b -->
            <property name="out.extension.Bearer" value="ch.nevis.esauth.auth.states.saml.extensions.SubjectConfirmationExtender"/>
            <!-- source: pattern://bfd395eb0dab50aff2f2c01b -->
            <property name="Bearer.ttl" value="20"/>
            <!-- source: pattern://bfd395eb0dab50aff2f2c01b -->
            <property name="out.keystoreref" value="Store_IDP_AGOV"/>
            <!-- source: pattern://bfd395eb0dab50aff2f2c01b -->
            <property name="out.keyobjectref" value="Signer_IDP_AGOV"/>
            <!-- source: pattern://bfd395eb0dab50aff2f2c01b -->
            <property name="spURL" value="https://ob.agov-w.azure.adnovum.net/mock-me/registration"/>
            <!-- source: pattern://bfd395eb0dab50aff2f2c01b -->
            <property name="acsUrlWhitelist.uris" value="not used"/>
            <!-- source: pattern://bfd395eb0dab50aff2f2c01b -->
            <property name="out.authnContextClassRef" value="urn:qa.agov.ch:names:tc:ac:classes:null"/>
            <!-- source: pattern://bfd395eb0dab50aff2f2c01b -->
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/05/identity/claims/requestedRoleLevel" value="urn:qa.agov.ch:names:tc:ac:classes:${sess:agov.requestedRoleLevel}"/>
            <!-- source: pattern://bfd395eb0dab50aff2f2c01b -->
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/09/identity/claim/rpEntityId" value="${sess:ch.nevis.auth.saml.request.scoping.requesterId}"/>
            <!-- source: pattern://bfd395eb0dab50aff2f2c01b -->
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/09/identity/claims/addressRequired" value="${sess:agov.appAddressRequired}"/>
            <!-- source: pattern://bfd395eb0dab50aff2f2c01b -->
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/09/identity/claim/allowedVerificationMethods" value="${sess:agov.appAllowedVerificationMethods}"/>
            <!-- source: pattern://bfd395eb0dab50aff2f2c01b -->
            <property name="out.attributeDelimiter" value=",\s*"/>
            <!-- source: pattern://bfd395eb0dab50aff2f2c01b -->
            <property name="out.subject" value="${sess:agov.subjectUUID}"/>
            <!-- source: pattern://bfd395eb0dab50aff2f2c01b -->
            <property name="out.subject.format" value="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"/>
            <!-- source: pattern://bfd395eb0dab50aff2f2c01b -->
            <property name="out.issuer" value="https://auth.agov-w.azure.adnovum.net/SAML2/"/>
            <!-- source: pattern://bfd395eb0dab50aff2f2c01b -->
            <property name="out.audienceRestriction" value="https://ob.agov-w.azure.adnovum.net/mock-me/registration"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_EId_Select_AGOV_Account" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false" resumeState="true">
            <!-- source: pattern://4f15bae09cbda04a7a515158 -->
            <ResultCond name="backToVerification" next="Auth_Realm_Main_IDP_EId_Verification_Auth"/>
            <!-- source: pattern://4f15bae09cbda04a7a515158 -->
            <ResultCond name="error" next="Auth_Realm_Main_IDP_SendSamlResponseWithError"/>
            <!-- source: pattern://4f15bae09cbda04a7a515158 -->
            <ResultCond name="firstLogin" next="Auth_Realm_Main_IDP_EId_Select_AGOV_Account_NotifyUser"/>
            <!-- source: pattern://4f15bae09cbda04a7a515158 -->
            <ResultCond name="noAccount" next="Auth_Realm_Main_IDP_Eid_Placeholder"/>
            <!-- source: pattern://4f15bae09cbda04a7a515158 -->
            <ResultCond name="ok" next="Auth_Realm_Main_IDP_EId_Fetch_IDM_Attributes"/>
            <!-- source: pattern://4f15bae09cbda04a7a515158 -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://4f15bae09cbda04a7a515158 -->
                <Gui name="eid_login_multiple_accounts">
                    <!-- source: pattern://4f15bae09cbda04a7a515158 -->
                    <GuiElem name="accountEmail" type="hidden" value="UNKNOWN" optional="true"/>
                    <!-- source: pattern://4f15bae09cbda04a7a515158 -->
                    <GuiElem name="login" type="submit" value="unknown" optional="true"/>
                    <!-- source: pattern://4f15bae09cbda04a7a515158 -->
                    <GuiElem name="cancelEid" type="submit" value="unknown" optional="true"/>
                </Gui>
            </Response>
            <!-- source: pattern://4f15bae09cbda04a7a515158 -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/eid_fetch_linked_accounts.groovy"/>
            <!-- source: pattern://4f15bae09cbda04a7a515158 -->
            <property name="scriptTraceGroup" value="AGOV-ACCT"/>
            <!-- source: pattern://4f15bae09cbda04a7a515158 -->
            <property name="parameter.baseUrl" value="https://idm.adn-agov-nevisidm-admin-01-uat:8989/nevisidm"/>
            <!-- source: pattern://4f15bae09cbda04a7a515158 -->
            <property name="parameter.clientExtId" value="cfa9c9b9-119f-4dff-9bb8-86d7c0cf2720"/>
            <!-- source: pattern://4f15bae09cbda04a7a515158 -->
            <property name="parameter.idm.httpclient.tls.trustStoreRef" value="EId_Select_AGOV_Account"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_EId_Passthrough_Prepare_Assertion" class="ch.nevis.esauth.auth.states.standard.TransformAttributes" final="false">
            <!-- source: pattern://6244fcef0dce49e7b09012de -->
            <ResultCond name="ok" next="Auth_Realm_Main_IDP_SendSamlResponseWithAssertion"/>
            <!-- source: pattern://6244fcef0dce49e7b09012de -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://6244fcef0dce49e7b09012de -->
                <Arg name="ch.nevis.isiweb4.response.status" value="403"/>
            </Response>
            <!-- source: pattern://6244fcef0dce49e7b09012de -->
            <property name="sess:ch.nevis.idm.User.birthDate" value="${sess:agov.eid.User.birthDate}"/>
            <!-- source: pattern://6244fcef0dce49e7b09012de -->
            <property name="sess:ch.nevis.idm.User.firstName" value="${sess:agov.eid.User.firstName}"/>
            <!-- source: pattern://6244fcef0dce49e7b09012de -->
            <property name="sess:ch.nevis.idm.User.gender" value="${sess:agov.eid.User.gender}"/>
            <!-- source: pattern://6244fcef0dce49e7b09012de -->
            <property name="sess:ch.nevis.idm.User.lastName" value="${sess:agov.eid.User.lastName}"/>
            <!-- source: pattern://6244fcef0dce49e7b09012de -->
            <property name="sess:ch.nevis.idm.User.prop.eIdNumber" value="${sess:agov.eid.User.eIdNumber}"/>
            <!-- source: pattern://6244fcef0dce49e7b09012de -->
            <property name="sess:ch.nevis.idm.User.prop.nationality" value="${sess:agov.eid.User.nationality}"/>
            <!-- source: pattern://6244fcef0dce49e7b09012de -->
            <property name="sess:ch.nevis.idm.User.prop.placeOfBirth" value="${sess:agov.eid.User.placeOfBirth}"/>
            <!-- source: pattern://6244fcef0dce49e7b09012de -->
            <property name="sess:ch.nevis.idm.User.prop.svnr" value="${sess:agov.eid.User.svnr}"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_Logout_Confirm" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false" resumeState="true">
            <!-- source: pattern://9196b809b539716b03ad8565 -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://9196b809b539716b03ad8565 -->
                <Gui name="saml_logout_confirm" label="title.logout.confirmation"/>
            </Response>
            <!-- source: pattern://9196b809b539716b03ad8565 -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/logout_confirm.groovy"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_EPD_IDP" class="ch.nevis.esauth.auth.states.saml.IdentityProviderState" final="false" resumeState="true">
            <!-- source: pattern://1d81bd987455a8e1ee044ccf -->
            <ResultCond name="IDP-initiated-ConcurrentLogout" next="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_Concurrent_Logout"/>
            <!-- source: pattern://1d81bd987455a8e1ee044ccf -->
            <ResultCond name="IDP-initiated-SingleLogout" next="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_Prepare_Done"/>
            <!-- source: pattern://1d81bd987455a8e1ee044ccf -->
            <ResultCond name="LogoutCompleted" next="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_Logout_Done"/>
            <!-- source: pattern://1d81bd987455a8e1ee044ccf -->
            <ResultCond name="LogoutFailed" next="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_Logout_Fail"/>
            <!-- source: pattern://1d81bd987455a8e1ee044ccf -->
            <ResultCond name="SP-initiated-ConcurrentLogout" next="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_Concurrent_Logout"/>
            <!-- source: pattern://1d81bd987455a8e1ee044ccf -->
            <ResultCond name="SP-initiated-SingleLogout" next="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_Prepare_Done"/>
            <!-- source: pattern://1d81bd987455a8e1ee044ccf -->
            <ResultCond name="authenticate:IDP-initiated-SSO" next="Auth_Realm_Main_IDP_RequestedRoleLevel"/>
            <!-- source: pattern://1d81bd987455a8e1ee044ccf -->
            <ResultCond name="authenticate:SP-initiated-SSO" next="Auth_Realm_Main_IDP_RequestedRoleLevel"/>
            <!-- source: pattern://1d81bd987455a8e1ee044ccf -->
            <ResultCond name="invalidAssertionConsumerUrl" next="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_EPD_IDP"/>
            <!-- source: pattern://1d81bd987455a8e1ee044ccf -->
            <ResultCond name="ok" next="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_Prepare_Done"/>
            <!-- source: pattern://1d81bd987455a8e1ee044ccf -->
            <ResultCond name="stepup:IDP-initiated-SSO" next="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_Selector"/>
            <!-- source: pattern://1d81bd987455a8e1ee044ccf -->
            <ResultCond name="stepup:SP-initiated-SSO" next="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_Selector"/>
            <!-- source: pattern://1d81bd987455a8e1ee044ccf -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://1d81bd987455a8e1ee044ccf -->
                <Gui name="saml_idp" label="title.saml.failed">
                    <!-- source: pattern://1d81bd987455a8e1ee044ccf -->
                    <GuiElem name="lasterror" type="error" label="error.saml.failed"/>
                </Gui>
            </Response>
            <!-- source: pattern://1d81bd987455a8e1ee044ccf -->
            <property name="session.participants-store.key" value="IDP_AGOV-session-participants"/>
            <!-- source: pattern://1d81bd987455a8e1ee044ccf -->
            <property name="logoutMode" value="ConcurrentLogout-Redirect"/>
            <!-- source: pattern://1d81bd987455a8e1ee044ccf -->
            <property name="logoutTrigger" value="#{request['currentResource'].contains('logout') || inargs.containsKey('logout') || inargs.containsKey('SAMLLogout')}"/>
            <!-- source: pattern://1d81bd987455a8e1ee044ccf -->
            <property name="out.binding" value="http-post"/>
            <!-- source: pattern://1d81bd987455a8e1ee044ccf -->
            <property name="out.post.relayStateEncoding" value="HTML"/>
            <!-- source: pattern://1d81bd987455a8e1ee044ccf -->
            <property name="out.sign" value="Response Assertion LogoutResponse"/>
            <!-- source: pattern://1d81bd987455a8e1ee044ccf -->
            <property name="out.signatureKeyInfo" value="Certificate"/>
            <!-- source: pattern://1d81bd987455a8e1ee044ccf -->
            <property name="out.ttl" value="30"/>
            <!-- source: pattern://1d81bd987455a8e1ee044ccf -->
            <property name="out.subject" value="${response:userId}"/>
            <!-- source: pattern://1d81bd987455a8e1ee044ccf -->
            <property name="out.subject.format" value="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"/>
            <!-- source: pattern://1d81bd987455a8e1ee044ccf -->
            <property name="out.extension.Bearer" value="ch.nevis.esauth.auth.states.saml.extensions.SubjectConfirmationExtender"/>
            <!-- source: pattern://1d81bd987455a8e1ee044ccf -->
            <property name="out.issuer" value="https://auth.agov-w.azure.adnovum.net/SAML2/"/>
            <!-- source: pattern://1d81bd987455a8e1ee044ccf -->
            <property name="out.keystoreref" value="Store_IDP_AGOV"/>
            <!-- source: pattern://1d81bd987455a8e1ee044ccf -->
            <property name="out.keyobjectref" value="Signer_IDP_AGOV"/>
            <!-- source: pattern://1d81bd987455a8e1ee044ccf -->
            <property name="spIssuer" value="https://trustbroker-idp.agov-w.azure.adnovum.net"/>
            <!-- source: pattern://1d81bd987455a8e1ee044ccf -->
            <property name="spURL" value="https://trustbroker-idp.agov-w.azure.adnovum.net/adfs/ls"/>
            <!-- source: pattern://1d81bd987455a8e1ee044ccf -->
            <property name="acsUrlWhitelist.uris" value="https://trustbroker-idp.agov-w.azure.adnovum.net/adfs/ls"/>
            <!-- source: pattern://1d81bd987455a8e1ee044ccf -->
            <property name="in.binding" value="auto"/>
            <!-- source: pattern://1d81bd987455a8e1ee044ccf -->
            <property name="in.max_age" value="60"/>
            <!-- source: pattern://1d81bd987455a8e1ee044ccf -->
            <property name="in.keystoreref" value="Store_IDP_AGOV"/>
            <!-- source: pattern://1d81bd987455a8e1ee044ccf -->
            <property name="out.authnContextClassRef" value="${sess:contextClassRefToSet}"/>
            <!-- source: pattern://1d81bd987455a8e1ee044ccf -->
            <property name="out.audienceRestriction" value="https://trustbroker-idp.agov-w.azure.adnovum.net"/>
            <!-- source: pattern://1d81bd987455a8e1ee044ccf -->
            <property name="out.attribute.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname" value="${sess:ch.nevis.idm.User.firstName}"/>
            <!-- source: pattern://1d81bd987455a8e1ee044ccf -->
            <property name="out.attribute.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname" value="${sess:ch.nevis.idm.User.lastName}"/>
            <!-- source: pattern://1d81bd987455a8e1ee044ccf -->
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/05/identity/claims/sex" value="${sess:ch.nevis.idm.User.gender}"/>
            <!-- source: pattern://1d81bd987455a8e1ee044ccf -->
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/05/identity/claims/dateOfBirth" value="${sess:ch.nevis.idm.User.birthDate:^(\d\d\d\d-\d\d-\d\d).*$}"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_EPD_Artifact_IDP" class="ch.nevis.esauth.auth.states.saml.IdentityProviderState" final="false" resumeState="true">
            <!-- source: pattern://5a75ffc73b91b88cfab6168e -->
            <ResultCond name="IDP-initiated-ConcurrentLogout" next="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_Concurrent_Logout"/>
            <!-- source: pattern://5a75ffc73b91b88cfab6168e -->
            <ResultCond name="IDP-initiated-SingleLogout" next="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_Prepare_Done"/>
            <!-- source: pattern://5a75ffc73b91b88cfab6168e -->
            <ResultCond name="LogoutCompleted" next="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_Logout_Done"/>
            <!-- source: pattern://5a75ffc73b91b88cfab6168e -->
            <ResultCond name="LogoutFailed" next="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_Logout_Fail"/>
            <!-- source: pattern://5a75ffc73b91b88cfab6168e -->
            <ResultCond name="SP-initiated-ConcurrentLogout" next="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_Concurrent_Logout"/>
            <!-- source: pattern://5a75ffc73b91b88cfab6168e -->
            <ResultCond name="SP-initiated-SingleLogout" next="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_Prepare_Done"/>
            <!-- source: pattern://5a75ffc73b91b88cfab6168e -->
            <ResultCond name="authenticate:IDP-initiated-SSO" next="Auth_Realm_Main_IDP_RequestedRoleLevel"/>
            <!-- source: pattern://5a75ffc73b91b88cfab6168e -->
            <ResultCond name="authenticate:SP-initiated-SSO" next="Auth_Realm_Main_IDP_RequestedRoleLevel"/>
            <!-- source: pattern://5a75ffc73b91b88cfab6168e -->
            <ResultCond name="invalidAssertionConsumerUrl" next="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_EPD_Artifact_IDP"/>
            <!-- source: pattern://5a75ffc73b91b88cfab6168e -->
            <ResultCond name="ok" next="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_Prepare_Done"/>
            <!-- source: pattern://5a75ffc73b91b88cfab6168e -->
            <ResultCond name="stepup:IDP-initiated-SSO" next="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_Selector"/>
            <!-- source: pattern://5a75ffc73b91b88cfab6168e -->
            <ResultCond name="stepup:SP-initiated-SSO" next="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_Selector"/>
            <!-- source: pattern://5a75ffc73b91b88cfab6168e -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://5a75ffc73b91b88cfab6168e -->
                <Gui name="saml_idp" label="title.saml.failed">
                    <!-- source: pattern://5a75ffc73b91b88cfab6168e -->
                    <GuiElem name="lasterror" type="error" label="error.saml.failed"/>
                </Gui>
            </Response>
            <!-- source: pattern://5a75ffc73b91b88cfab6168e -->
            <property name="session.participants-store.key" value="IDP_AGOV-session-participants"/>
            <!-- source: pattern://5a75ffc73b91b88cfab6168e -->
            <property name="logoutMode" value="ConcurrentLogout-Redirect"/>
            <!-- source: pattern://5a75ffc73b91b88cfab6168e -->
            <property name="logoutTrigger" value="#{request['currentResource'].contains('logout') || inargs.containsKey('logout') || inargs.containsKey('SAMLLogout')}"/>
            <!-- source: pattern://5a75ffc73b91b88cfab6168e -->
            <property name="out.binding" value="http-artifact"/>
            <!-- source: pattern://5a75ffc73b91b88cfab6168e -->
            <property name="out.artifactSourceId" value="0x49899452c60f53e500d7d8b221536c9745dfaf0f"/>
            <!-- source: pattern://5a75ffc73b91b88cfab6168e -->
            <property name="out.post.relayStateEncoding" value="HTML"/>
            <!-- source: pattern://5a75ffc73b91b88cfab6168e -->
            <property name="out.sign" value="Response Assertion LogoutResponse ArtifactResponse"/>
            <!-- source: pattern://5a75ffc73b91b88cfab6168e -->
            <property name="out.signatureKeyInfo" value="Certificate"/>
            <!-- source: pattern://5a75ffc73b91b88cfab6168e -->
            <property name="out.ttl" value="30"/>
            <!-- source: pattern://5a75ffc73b91b88cfab6168e -->
            <property name="out.subject" value="${response:userId}"/>
            <!-- source: pattern://5a75ffc73b91b88cfab6168e -->
            <property name="out.subject.format" value="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"/>
            <!-- source: pattern://5a75ffc73b91b88cfab6168e -->
            <property name="out.extension.Bearer" value="ch.nevis.esauth.auth.states.saml.extensions.SubjectConfirmationExtender"/>
            <!-- source: pattern://5a75ffc73b91b88cfab6168e -->
            <property name="out.issuer" value="https://auth.agov-w.azure.adnovum.net/SAML2/"/>
            <!-- source: pattern://5a75ffc73b91b88cfab6168e -->
            <property name="out.keystoreref" value="Store_IDP_AGOV"/>
            <!-- source: pattern://5a75ffc73b91b88cfab6168e -->
            <property name="out.keyobjectref" value="Signer_IDP_AGOV"/>
            <!-- source: pattern://5a75ffc73b91b88cfab6168e -->
            <property name="spIssuer" value="https://trustbroker-idp.agov-w.azure.adnovum.net"/>
            <!-- source: pattern://5a75ffc73b91b88cfab6168e -->
            <property name="spURL" value="https://trustbroker-idp.agov-w.azure.adnovum.net/adfs/ls"/>
            <!-- source: pattern://5a75ffc73b91b88cfab6168e -->
            <property name="acsUrlWhitelist.uris" value="https://trustbroker-idp.agov-w.azure.adnovum.net/adfs/ls"/>
            <!-- source: pattern://5a75ffc73b91b88cfab6168e -->
            <property name="in.binding" value="auto"/>
            <!-- source: pattern://5a75ffc73b91b88cfab6168e -->
            <property name="in.max_age" value="60"/>
            <!-- source: pattern://5a75ffc73b91b88cfab6168e -->
            <property name="in.keystoreref" value="Store_IDP_AGOV"/>
            <!-- source: pattern://5a75ffc73b91b88cfab6168e -->
            <property name="out.authnContextClassRef" value="${sess:contextClassRefToSet}"/>
            <!-- source: pattern://5a75ffc73b91b88cfab6168e -->
            <property name="out.audienceRestriction" value="https://trustbroker-idp.agov-w.azure.adnovum.net"/>
            <!-- source: pattern://5a75ffc73b91b88cfab6168e -->
            <property name="out.attribute.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname" value="${sess:ch.nevis.idm.User.firstName}"/>
            <!-- source: pattern://5a75ffc73b91b88cfab6168e -->
            <property name="out.attribute.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname" value="${sess:ch.nevis.idm.User.lastName}"/>
            <!-- source: pattern://5a75ffc73b91b88cfab6168e -->
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/05/identity/claims/sex" value="${sess:ch.nevis.idm.User.gender}"/>
            <!-- source: pattern://5a75ffc73b91b88cfab6168e -->
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/05/identity/claims/dateOfBirth" value="${sess:ch.nevis.idm.User.birthDate:^(\d\d\d\d-\d\d-\d\d).*$}"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_AGOV_IDP" class="ch.nevis.esauth.auth.states.saml.IdentityProviderState" final="false" resumeState="true">
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <ResultCond name="IDP-initiated-ConcurrentLogout" next="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_Concurrent_Logout"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <ResultCond name="IDP-initiated-SingleLogout" next="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_Prepare_Done"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <ResultCond name="LogoutCompleted" next="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_Logout_Done"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <ResultCond name="LogoutFailed" next="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_Logout_Fail"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <ResultCond name="SP-initiated-ConcurrentLogout" next="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_Concurrent_Logout"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <ResultCond name="SP-initiated-SingleLogout" next="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_Prepare_Done"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <ResultCond name="authenticate:IDP-initiated-SSO" next="Auth_Realm_Main_IDP_RequestedRoleLevel"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <ResultCond name="authenticate:SP-initiated-SSO" next="Auth_Realm_Main_IDP_RequestedRoleLevel"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <ResultCond name="invalidAssertionConsumerUrl" next="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_AGOV_IDP"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <ResultCond name="ok" next="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_Prepare_Done"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <ResultCond name="stepup:IDP-initiated-SSO" next="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_Selector"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <ResultCond name="stepup:SP-initiated-SSO" next="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_Selector"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
                <Gui name="saml_idp" label="title.saml.failed">
                    <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
                    <GuiElem name="lasterror" type="error" label="error.saml.failed"/>
                </Gui>
            </Response>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <property name="session.participants-store.key" value="IDP_AGOV-session-participants"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <property name="logoutMode" value="ConcurrentLogout-Redirect"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <property name="logoutTrigger" value="#{request['currentResource'].contains('logout') || inargs.containsKey('logout') || inargs.containsKey('SAMLLogout')}"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <property name="out.binding" value="http-post"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <property name="out.post.relayStateEncoding" value="HTML"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <property name="out.sign" value="Response Assertion"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <property name="out.signatureKeyInfo" value="Certificate"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <property name="out.ttl" value="30"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <property name="out.subject" value="${response:userId}"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <property name="out.subject.format" value="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <property name="out.extension.Bearer" value="ch.nevis.esauth.auth.states.saml.extensions.SubjectConfirmationExtender"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <property name="out.issuer" value="https://auth.agov-w.azure.adnovum.net/SAML2/"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <property name="out.keystoreref" value="Store_IDP_AGOV"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <property name="out.keyobjectref" value="Signer_IDP_AGOV"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <property name="spIssuer" value="https://trustbroker.agov-d.azure.adnovum.net"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <property name="spURL" value="https://trustbroker.agov-d.azure.adnovum.net/adfs/ls"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <property name="acsUrlWhitelist.uris" value="https://trustbroker.agov-d.azure.adnovum.net/adfs/ls"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <property name="in.binding" value="auto"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <property name="in.max_age" value="60"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <property name="in.keystoreref" value="Store_IDP_AGOV"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <property name="out.authnContextClassRef" value="${sess:contextClassRefToSet}"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <property name="out.audienceRestriction" value="https://trustbroker.agov-d.azure.adnovum.net"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <property name="out.attribute.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" value="${sess:ch.nevis.idm.User.email}"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/05/identity/claims/languageOfCorrespondance" value="${sess:ch.nevis.idm.User.language}"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <property name="out.attribute.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname" value="${sess:ch.nevis.idm.User.firstName}"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <property name="out.attribute.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname" value="${sess:ch.nevis.idm.User.lastName}"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/05/identity/claims/dateOfBirth" value="${sess:ch.nevis.idm.User.birthDate:^(\d\d\d\d-\d\d-\d\d).*$}"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/05/identity/claims/sex" value="${sess:ch.nevis.idm.User.gender}"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/05/identity/claims/socialSecurityNumber" value="#{ (sess['agov.appSvnrAllowed'] == 'true') ? sess['ch.nevis.idm.User.prop.svnr'] : ''}"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/05/identity/claims/placeOfBirth" value="#{ (sess['agov.appSvnrAllowed'] == 'true') ? sess['ch.nevis.idm.User.prop.placeOfBirth'] : ''}"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/05/identity/claims/eIdNumber" value="${sess:ch.nevis.idm.User.prop.eIdNumber}"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/05/identity/claims/qa/dateOfVerification" value="${sess:ValidFrom}"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/05/identity/claims/qa/validTillDate" value="${sess:ValidTo}"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/05/identity/claims/qa/verificationMethod" value="#{ ''.concat(sess.get('idVerification')).replace('SelfPaid', '') }"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/05/identity/claims/nationality" value="#{ sess.containsKey('ch.nevis.idm.User.prop.nationality') ? sess['ch.nevis.idm.User.prop.nationality'].toUpperCase(): '' }"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/05/identity/claims/authenticatedWith" value="${sess:authenticatedWith}"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/08/identity/claims/emailVerified" value="true"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/08/identity/claims/address/street" value="#{ (sess['agov.appAddressRequired'] == 'true') ? sess['ch.nevis.idm.User.street'] : '' }"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/08/identity/claims/address/houseNumber" value="#{ (sess['agov.appAddressRequired'] == 'true') ? sess['ch.nevis.idm.User.houseNumber'] : '' }"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/08/identity/claims/address/zipCode" value="#{ (sess['agov.appAddressRequired'] == 'true') ? sess['ch.nevis.idm.User.postalCode'] : '' }"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/08/identity/claims/address/town" value="#{ (sess['agov.appAddressRequired'] == 'true') ? sess['ch.nevis.idm.User.city'] : '' }"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <property name="out.attribute.http://schemas.agov.ch/ws/2024/02/identity/claims/address/country" value="#{ (sess['agov.appAddressRequired'] == 'true') ? sess['ch.nevis.idm.User.country'].toUpperCase() : '' }"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <property name="out.attribute.http://schemas.agov.ch/ws/2024/02/identity/claims/address/qa/verificationMethod" value="#{ (sess['agov.appAddressRequired'] == 'true') ? ''.concat(sess.get('agov.adressVerification')).replace('Location', 'Domicile') : '' }"/>
            <!-- source: pattern://92cb6d5256008a32f12ceb93 -->
            <property name="out.attribute.http://schemas.agov.ch/ws/2024/02/identity/claims/address/countryName" value="#{ (sess['agov.appAddressRequired'] == 'true') ? sess['agov.countryName'] : ''}"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_ReturnTimeoutButKeepSession" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false" resumeState="true">
            <!-- source: pattern://826166d230a6a4849f2837ae -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://826166d230a6a4849f2837ae -->
                <Gui name="NotUsed"/>
            </Response>
            <!-- source: pattern://826166d230a6a4849f2837ae -->
            <property name="parameter.cookie.domain" value="auth.agov-w.azure.adnovum.net"/>
            <!-- source: pattern://826166d230a6a4849f2837ae -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/returnTimeoutButKeepSession.groovy"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_fido2_fetchCaptchaResult" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false">
            <!-- source: pattern://699f22cf1cd4ad08bd973f31 -->
            <ResultCond name="error" next="Auth_Realm_Main_IDP_Email_Input"/>
            <!-- source: pattern://699f22cf1cd4ad08bd973f31 -->
            <ResultCond name="exit.1" next="Auth_Realm_Main_IDP_Email_Input"/>
            <!-- source: pattern://699f22cf1cd4ad08bd973f31 -->
            <ResultCond name="ok" next="Auth_Realm_Main_IDP_Fido_Email_Verify"/>
            <!-- source: pattern://699f22cf1cd4ad08bd973f31 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://699f22cf1cd4ad08bd973f31 -->
                <Arg name="ch.nevis.isiweb4.response.status" value="403"/>
            </Response>
            <!-- source: pattern://699f22cf1cd4ad08bd973f31 -->
            <property name="parameter.url" value="https://utility.agov-d.azure.adnovum.net/utility/api/v2/captcha/"/>
            <!-- source: pattern://699f22cf1cd4ad08bd973f31 -->
            <property name="scriptTraceGroup" value="AgovCaptcha"/>
            <!-- source: pattern://699f22cf1cd4ad08bd973f31 -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/fido2_fetchcaptcharesult.groovy"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_Mobile_UserID_Verify" class="ch.nevis.idm.authstate.IdmUserVerifyState" final="false" resumeState="false">
            <!-- source: pattern://c686c1bdd5355351f7f98cc8 -->
            <ResultCond name="clientNotFound" next="Auth_Realm_Main_IDP_AuthnFailed_Client_NotFound"/>
            <!-- source: pattern://c686c1bdd5355351f7f98cc8 -->
            <ResultCond name="failed" next="Auth_Realm_Main_IDP_SendSamlResponseWithError"/>
            <!-- source: pattern://c686c1bdd5355351f7f98cc8 -->
            <ResultCond name="prospect" next="Auth_Realm_Main_IDP_Mobile_UserID_Verify_IdmGetPropertiesState"/>
            <!-- source: pattern://c686c1bdd5355351f7f98cc8 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://c686c1bdd5355351f7f98cc8 -->
                <Gui name="internal_error">
                    <!-- source: pattern://c686c1bdd5355351f7f98cc8 -->
                    <GuiElem name="transferId" type="hidden" value="${request:traceId}" optional="true"/>
                </Gui>
            </Response>
            <propertyRef name="nevisIDM_Connector"/>
            <!-- source: pattern://c686c1bdd5355351f7f98cc8 -->
            <property name="user.loginid" value="unknown"/>
            <!-- source: pattern://c686c1bdd5355351f7f98cc8 -->
            <property name="userExtId" value="${request:UserId}"/>
            <!-- source: pattern://c686c1bdd5355351f7f98cc8 -->
            <property name="client.name" value="agov"/>
            <!-- source: pattern://c686c1bdd5355351f7f98cc8 -->
            <property name="detaillevel.user" value="HIGH"/>
            <!-- source: pattern://c686c1bdd5355351f7f98cc8 -->
            <property name="detaillevel.profile" value="HIGH"/>
            <!-- source: pattern://c686c1bdd5355351f7f98cc8 -->
            <property name="detaillevel.role" value="MEDIUM"/>
            <!-- source: pattern://c686c1bdd5355351f7f98cc8 -->
            <property name="detaillevel.authorization" value="HIGH"/>
            <!-- source: pattern://c686c1bdd5355351f7f98cc8 -->
            <property name="detaillevel.dataroom" value="LOW"/>
            <!-- source: pattern://c686c1bdd5355351f7f98cc8 -->
            <property name="detaillevel.credential" value="HIGH"/>
            <!-- source: pattern://c686c1bdd5355351f7f98cc8 -->
            <property name="detaillevel.property" value="HIGH"/>
            <!-- source: pattern://c686c1bdd5355351f7f98cc8 -->
            <property name="detaillevel.unit" value="LOW"/>
            <!-- source: pattern://c686c1bdd5355351f7f98cc8 -->
            <property name="detaillevel.default" value="EXCLUDE"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_Redirect_to_Registration_Handle_Redirect" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false" resumeState="true">
            <!-- source: pattern://bfd395eb0dab50aff2f2c01b -->
            <ResultCond name="agovLogin" next="Auth_Realm_Main_IDP_Mobile_NLess_Auth"/>
            <!-- source: pattern://bfd395eb0dab50aff2f2c01b -->
            <ResultCond name="eidLogin" next="Auth_Realm_Main_IDP_EId_Verification_Auth"/>
            <!-- source: pattern://bfd395eb0dab50aff2f2c01b -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://bfd395eb0dab50aff2f2c01b -->
                <Gui name="not_used"/>
            </Response>
            <!-- source: pattern://bfd395eb0dab50aff2f2c01b -->
            <property name="scriptTraceGroup" value="AGOV-ACCT"/>
            <!-- source: pattern://bfd395eb0dab50aff2f2c01b -->
            <property name="parameter.agovmedirecturl" value="https://ob.agov-w.azure.adnovum.net/mock-me/registration"/>
            <!-- source: pattern://bfd395eb0dab50aff2f2c01b -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/handleRedirectRegistration.groovy"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_EId_Select_AGOV_Account_NotifyUser" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false" resumeState="true">
            <!-- source: pattern://4f15bae09cbda04a7a515158 -->
            <ResultCond name="error" next="Auth_Realm_Main_IDP_SendSamlResponseWithError"/>
            <!-- source: pattern://4f15bae09cbda04a7a515158 -->
            <ResultCond name="ok" next="Auth_Realm_Main_IDP_EId_Fetch_IDM_Attributes"/>
            <!-- source: pattern://4f15bae09cbda04a7a515158 -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/eid_notify_user_first_login.groovy"/>
            <!-- source: pattern://4f15bae09cbda04a7a515158 -->
            <property name="parameter.baseUrl" value="https://idm.adn-agov-nevisidm-admin-01-uat:8989/nevisidm"/>
            <!-- source: pattern://4f15bae09cbda04a7a515158 -->
            <property name="parameter.clientExtId" value="cfa9c9b9-119f-4dff-9bb8-86d7c0cf2720"/>
            <!-- source: pattern://4f15bae09cbda04a7a515158 -->
            <property name="parameter.idm.httpclient.tls.trustStoreRef" value="EId_Select_AGOV_Account"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_Eid_Placeholder" class="ch.nevis.esauth.auth.states.standard.AuthGeneric" final="false" resumeState="true">
            <!-- source: pattern://47f8f6ef24f62431fbe1b530 -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://47f8f6ef24f62431fbe1b530 -->
                <Gui name="Eid_Placeholder" label="eID Placeholder">
                    <!-- source: pattern://47f8f6ef24f62431fbe1b530 -->
                    <GuiElem name="infotext" type="info" label="${session:eid.placeholder.text}"/>
                </Gui>
            </Response>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_EId_Fetch_IDM_Attributes" class="ch.nevis.idm.authstate.IdmUserVerifyState" final="false" resumeState="false">
            <!-- source: pattern://b8bdab6e4634a1d81f20e5bb -->
            <ResultCond name="clientNotFound" next="Auth_Realm_Main_IDP_Authentication_Failed"/>
            <!-- source: pattern://b8bdab6e4634a1d81f20e5bb -->
            <ResultCond name="default" next="Auth_Realm_Main_IDP_Authentication_Failed"/>
            <!-- source: pattern://b8bdab6e4634a1d81f20e5bb -->
            <ResultCond name="failed" next="Auth_Realm_Main_IDP_Authentication_Failed"/>
            <!-- source: pattern://b8bdab6e4634a1d81f20e5bb -->
            <ResultCond name="prospect" next="Auth_Realm_Main_IDP_EId_Fetch_IDM_Attributes_getProperties"/>
            <!-- source: pattern://b8bdab6e4634a1d81f20e5bb -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://b8bdab6e4634a1d81f20e5bb -->
                <Gui name="internal_error">
                    <!-- source: pattern://b8bdab6e4634a1d81f20e5bb -->
                    <GuiElem name="transferId" type="hidden" value="${request:traceId}" optional="true"/>
                </Gui>
            </Response>
            <propertyRef name="nevisIDM_Connector"/>
            <!-- source: pattern://b8bdab6e4634a1d81f20e5bb -->
            <property name="userExtId" value="${session:agov.eid.linkedAccountExtId}"/>
            <!-- source: pattern://b8bdab6e4634a1d81f20e5bb -->
            <property name="clientExtId" value="cfa9c9b9-119f-4dff-9bb8-86d7c0cf2720"/>
            <!-- source: pattern://b8bdab6e4634a1d81f20e5bb -->
            <property name="presetNoteValues" value="false"/>
            <!-- source: pattern://b8bdab6e4634a1d81f20e5bb -->
            <property name="detaillevel.user" value="HIGH"/>
            <!-- source: pattern://b8bdab6e4634a1d81f20e5bb -->
            <property name="detaillevel.profile" value="HIGH"/>
            <!-- source: pattern://b8bdab6e4634a1d81f20e5bb -->
            <property name="detaillevel.role" value="MEDIUM"/>
            <!-- source: pattern://b8bdab6e4634a1d81f20e5bb -->
            <property name="detaillevel.authorization" value="HIGH"/>
            <!-- source: pattern://b8bdab6e4634a1d81f20e5bb -->
            <property name="detaillevel.dataroom" value="LOW"/>
            <!-- source: pattern://b8bdab6e4634a1d81f20e5bb -->
            <property name="detaillevel.credential" value="HIGH"/>
            <!-- source: pattern://b8bdab6e4634a1d81f20e5bb -->
            <property name="detaillevel.property" value="HIGH"/>
            <!-- source: pattern://b8bdab6e4634a1d81f20e5bb -->
            <property name="detaillevel.unit" value="LOW"/>
            <!-- source: pattern://b8bdab6e4634a1d81f20e5bb -->
            <property name="detaillevel.default" value="EXCLUDE"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_SendSamlResponseWithAssertion" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false" resumeState="true">
            <!-- source: pattern://b87d0d2b640e8e545ad70234 -->
            <ResultCond name="ok" next="Auth_Realm_Main_IDP_Prepare_Done"/>
            <!-- source: pattern://b87d0d2b640e8e545ad70234 -->
            <Response value="AUTH_DONE">
                <!-- source: pattern://b87d0d2b640e8e545ad70234 -->
                <Gui name="not_used"/>
            </Response>
            <!-- source: pattern://b87d0d2b640e8e545ad70234 -->
            <property name="parameter.cookie.domain" value="auth.agov-w.azure.adnovum.net"/>
            <!-- source: pattern://b87d0d2b640e8e545ad70234 -->
            <property name="scriptTraceGroup" value="AGOV-ACCT"/>
            <!-- source: pattern://b87d0d2b640e8e545ad70234 -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/SendSamlResponseWithAssertion.groovy"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_Concurrent_Logout" class="ch.nevis.esauth.auth.states.standard.AuthLogout" final="false" resumeState="false">
            <!-- source: pattern://db4eead0bb25b03205afd79f -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://db4eead0bb25b03205afd79f -->
                <Gui name="saml_logout" label="title.logout">
                    <!-- source: pattern://db4eead0bb25b03205afd79f -->
                    <GuiElem name="saml.logoutURLs" type="hidden" value="${outargs:saml.logoutURLs}" optional="true"/>
                    <!-- source: pattern://db4eead0bb25b03205afd79f -->
                    <GuiElem name="saml.logoutURL" type="hidden" value="#{ session.containsKey('saml.logoutURL') ? session.get('saml.logoutURL') : '/' }" optional="true"/>
                </Gui>
            </Response>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_Prepare_Done" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false" resumeState="true">
            <!-- source: pattern://2f81f8b878ef787fc5cc284a -->
            <ResultCond name="default" next="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_Authorization"/>
            <!-- source: pattern://2f81f8b878ef787fc5cc284a -->
            <Response value="AUTH_DONE">
                <!-- source: pattern://2f81f8b878ef787fc5cc284a -->
                <Gui name="ContinueResponse"/>
            </Response>
            <!-- source: pattern://2f81f8b878ef787fc5cc284a -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/prepare_done.groovy"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_Logout_Done" class="ch.nevis.esauth.auth.states.standard.AuthGeneric" final="true" resumeState="true">
            <!-- source: pattern://06515d4815de4afde6f8116a -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://06515d4815de4afde6f8116a -->
                <Gui name="empty"/>
            </Response>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_Logout_Fail" class="ch.nevis.esauth.auth.states.standard.AuthGeneric" final="true" resumeState="true">
            <!-- source: pattern://3f719a1e5c1447ee46c69cb2 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://3f719a1e5c1447ee46c69cb2 -->
                <Gui name="empty"/>
            </Response>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_RequestedRoleLevel" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false">
            <!-- source: pattern://68665057549fd887ea09fb86 -->
            <ResultCond name="error" next="Auth_Realm_Main_IDP_SendSamlResponseWithError"/>
            <!-- source: pattern://68665057549fd887ea09fb86 -->
            <ResultCond name="exit.1" next="Auth_Realm_Main_IDP_EId_Verification_Auth"/>
            <!-- source: pattern://68665057549fd887ea09fb86 -->
            <ResultCond name="ok" next="Auth_Realm_Main_IDP_Mobile_NLess_Auth"/>
            <!-- source: pattern://68665057549fd887ea09fb86 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://68665057549fd887ea09fb86 -->
                <Arg name="ch.nevis.isiweb4.response.status" value="403"/>
            </Response>
            <!-- source: pattern://68665057549fd887ea09fb86 -->
            <property name="parameter.bestTokenAddressWhitelist" value="https://testapp-01.agov-d.azure.adnovum.net/test/api/saml2/service-provider-metadata/agovidp, OidcPlayground, https://admin.agov-w.azure.adnovum.net/SAML2/ACS/"/>
            <!-- source: pattern://68665057549fd887ea09fb86 -->
            <property name="parameter.bestTokenSvnrWhitelist" value="https://testapp-01.agov-d.azure.adnovum.net/test/api/saml2/service-provider-metadata/agovidp, OidcPlayground, https://op.agov-w.azure.adnovum.net/SAML2/ACS/"/>
            <!-- source: pattern://68665057549fd887ea09fb86 -->
            <property name="parameter.eidEnabled" value="false"/>
            <!-- source: pattern://68665057549fd887ea09fb86 -->
            <property name="parameter.url" value="https://utility.agov-d.azure.adnovum.net/connect/billing/relying-party"/>
            <!-- source: pattern://68665057549fd887ea09fb86 -->
            <property name="scriptTraceGroup" value="AGOV-ACCT"/>
            <!-- source: pattern://68665057549fd887ea09fb86 -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/requestedrolelevel.groovy"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_Selector" class="ch.nevis.esauth.auth.states.standard.ConditionalDispatcherState" final="false" resumeState="true">
            <!-- source: pattern://5f7e44f4fb2e3f710e4a3e91 -->
            <ResultCond name="nomatch" next="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_Prepare_Done"/>
            <!-- source: pattern://5f7e44f4fb2e3f710e4a3e91 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://5f7e44f4fb2e3f710e4a3e91 -->
                <Arg name="ch.nevis.isiweb4.response.status" value="403"/>
            </Response>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_Fido_Email_Verify" class="ch.nevis.idm.authstate.IdmUserVerifyState" final="false" resumeState="false">
            <!-- source: pattern://7fb39bfd6c34685866a22180 -->
            <ResultCond name="clientNotFound" next="Auth_Realm_Main_IDP_AuthnFailed_Client_NotFound"/>
            <!-- source: pattern://7fb39bfd6c34685866a22180 -->
            <ResultCond name="failed" next="Auth_Realm_Main_IDP_Fido_Email_Verify_FailedEmailState"/>
            <!-- source: pattern://7fb39bfd6c34685866a22180 -->
            <ResultCond name="prospect" next="Auth_Realm_Main_IDP_Fido_Email_Verify_IdmGetPropertiesState"/>
            <!-- source: pattern://7fb39bfd6c34685866a22180 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://7fb39bfd6c34685866a22180 -->
                <Gui name="internal_error">
                    <!-- source: pattern://7fb39bfd6c34685866a22180 -->
                    <GuiElem name="transferId" type="hidden" value="${system:random.bytes.16}" optional="true"/>
                </Gui>
            </Response>
            <propertyRef name="nevisIDM_Connector"/>
            <!-- source: pattern://7fb39bfd6c34685866a22180 -->
            <property name="user.loginId" value="${inargs:userInputValue_prompt.email}"/>
            <!-- source: pattern://7fb39bfd6c34685866a22180 -->
            <property name="user.loginType" value="EMAIL"/>
            <!-- source: pattern://7fb39bfd6c34685866a22180 -->
            <property name="client.name" value="agov"/>
            <!-- source: pattern://7fb39bfd6c34685866a22180 -->
            <property name="presetNoteValues" value="false"/>
            <!-- source: pattern://7fb39bfd6c34685866a22180 -->
            <property name="detaillevel.user" value="HIGH"/>
            <!-- source: pattern://7fb39bfd6c34685866a22180 -->
            <property name="detaillevel.profile" value="HIGH"/>
            <!-- source: pattern://7fb39bfd6c34685866a22180 -->
            <property name="detaillevel.role" value="MEDIUM"/>
            <!-- source: pattern://7fb39bfd6c34685866a22180 -->
            <property name="detaillevel.authorization" value="HIGH"/>
            <!-- source: pattern://7fb39bfd6c34685866a22180 -->
            <property name="detaillevel.dataroom" value="LOW"/>
            <!-- source: pattern://7fb39bfd6c34685866a22180 -->
            <property name="detaillevel.credential" value="HIGH"/>
            <!-- source: pattern://7fb39bfd6c34685866a22180 -->
            <property name="detaillevel.property" value="HIGH"/>
            <!-- source: pattern://7fb39bfd6c34685866a22180 -->
            <property name="detaillevel.unit" value="LOW"/>
            <!-- source: pattern://7fb39bfd6c34685866a22180 -->
            <property name="detaillevel.default" value="EXCLUDE"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_AuthnFailed_Client_NotFound" class="ch.nevis.esauth.auth.states.standard.TransformAttributes" final="false">
            <!-- source: pattern://0b3ce3ceec7bfca3ea524983 -->
            <ResultCond name="ok" next="Auth_Realm_Main_IDP_SendSamlResponseWithError"/>
            <!-- source: pattern://0b3ce3ceec7bfca3ea524983 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://0b3ce3ceec7bfca3ea524983 -->
                <Arg name="ch.nevis.isiweb4.response.status" value="403"/>
            </Response>
            <!-- source: pattern://0b3ce3ceec7bfca3ea524983 -->
            <property name="notes:saml.errorCode" value="urn:oasis:names:tc:SAML:2.0:status:AuthnFailed"/>
            <!-- source: pattern://0b3ce3ceec7bfca3ea524983 -->
            <property name="notes:saml.errorMessage" value="permanent error, not linked to user, but to system , Request ID: ${request:traceId}"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_Mobile_UserID_Verify_IdmGetPropertiesState" class="ch.nevis.idm.authstate.IdmGetPropertiesState" final="false" resumeState="false">
            <!-- source: pattern://c686c1bdd5355351f7f98cc8 -->
            <ResultCond name="clientNotFound" next="Auth_Realm_Main_IDP_AuthnFailed_Client_NotFound"/>
            <!-- source: pattern://c686c1bdd5355351f7f98cc8 -->
            <ResultCond name="default" next="Auth_Realm_Main_IDP_SendSamlResponseWithError"/>
            <!-- source: pattern://c686c1bdd5355351f7f98cc8 -->
            <ResultCond name="ok" next="Auth_Realm_Main_IDP_Ensure_Account_State"/>
            <!-- source: pattern://c686c1bdd5355351f7f98cc8 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://c686c1bdd5355351f7f98cc8 -->
                <Gui name="internal_error">
                    <!-- source: pattern://c686c1bdd5355351f7f98cc8 -->
                    <GuiElem name="transferId" type="hidden" value="${request:traceId}" optional="true"/>
                </Gui>
            </Response>
            <propertyRef name="nevisIDM_Connector"/>
            <!-- source: pattern://c686c1bdd5355351f7f98cc8 -->
            <property name="user.attributes" value="loginId,extId,firstName,name,email,gender,birthDate,language,sex,addressLine1,postalCode,city,country,street,houseNumber,locality,mobile"/>
            <!-- source: pattern://c686c1bdd5355351f7f98cc8 -->
            <property name="user.properties" value="eIdNumber,placeOfBirth,svnr,nationality"/>
            <!-- source: pattern://c686c1bdd5355351f7f98cc8 -->
            <property name="user.cred.context_password1.state" value="true"/>
            <!-- source: pattern://c686c1bdd5355351f7f98cc8 -->
            <property name="user.cred.context_password1.context" value="true"/>
            <!-- source: pattern://c686c1bdd5355351f7f98cc8 -->
            <property name="chooseDefaultProfile" value="true"/>
            <!-- source: pattern://c686c1bdd5355351f7f98cc8 -->
            <property name="forceDataReload" value="true"/>
            <!-- source: pattern://c686c1bdd5355351f7f98cc8 -->
            <property name="userExtId" value="${sess:ch.nevis.session.userid}"/>
            <!-- source: pattern://c686c1bdd5355351f7f98cc8 -->
            <property name="client.name" value="agov"/>
            <!-- source: pattern://c686c1bdd5355351f7f98cc8 -->
            <property name="detaillevel.user" value="HIGH"/>
            <!-- source: pattern://c686c1bdd5355351f7f98cc8 -->
            <property name="detaillevel.profile" value="HIGH"/>
            <!-- source: pattern://c686c1bdd5355351f7f98cc8 -->
            <property name="detaillevel.role" value="HIGH"/>
            <!-- source: pattern://c686c1bdd5355351f7f98cc8 -->
            <property name="detaillevel.authorization" value="HIGH"/>
            <!-- source: pattern://c686c1bdd5355351f7f98cc8 -->
            <property name="detaillevel.dataroom" value="HIGH"/>
            <!-- source: pattern://c686c1bdd5355351f7f98cc8 -->
            <property name="detaillevel.credential" value="HIGH"/>
            <!-- source: pattern://c686c1bdd5355351f7f98cc8 -->
            <property name="detaillevel.property" value="HIGH"/>
            <!-- source: pattern://c686c1bdd5355351f7f98cc8 -->
            <property name="detaillevel.unit" value="LOW"/>
            <!-- source: pattern://c686c1bdd5355351f7f98cc8 -->
            <property name="detaillevel.default" value="EXCLUDE"/>
        </AuthState>
        <AuthState name="nevisIDM_Connector" class="ch.nevis.esauth.auth.states.standard.AuthGeneric" final="false">
            <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
            <property name="login.service.connection.0" value="https://idm.adn-agov-nevisidm-admin-01-uat:8989/nevisidm/services/v1/LoginService"/>
            <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
            <property name="admin.service.connection.0" value="https://idm.adn-agov-nevisidm-admin-01-uat:8989/nevisidm/services/v1/AdminService"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_EId_Fetch_IDM_Attributes_getProperties" class="ch.nevis.idm.authstate.IdmGetPropertiesState" final="false" resumeState="false">
            <!-- source: pattern://b8bdab6e4634a1d81f20e5bb -->
            <ResultCond name="clientNotFound" next="Auth_Realm_Main_IDP_Authentication_Failed"/>
            <!-- source: pattern://b8bdab6e4634a1d81f20e5bb -->
            <ResultCond name="default" next="Auth_Realm_Main_IDP_Authentication_Failed"/>
            <!-- source: pattern://b8bdab6e4634a1d81f20e5bb -->
            <ResultCond name="ok" next="Auth_Realm_Main_IDP_EId_Compare_And_Update_IDM_Attributes"/>
            <!-- source: pattern://b8bdab6e4634a1d81f20e5bb -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://b8bdab6e4634a1d81f20e5bb -->
                <Gui name="internal_error">
                    <!-- source: pattern://b8bdab6e4634a1d81f20e5bb -->
                    <GuiElem name="transferId" type="hidden" value="${request:traceId}" optional="true"/>
                </Gui>
            </Response>
            <propertyRef name="nevisIDM_Connector"/>
            <!-- source: pattern://b8bdab6e4634a1d81f20e5bb -->
            <property name="clientExtId" value="cfa9c9b9-119f-4dff-9bb8-86d7c0cf2720"/>
            <!-- source: pattern://b8bdab6e4634a1d81f20e5bb -->
            <property name="user.attributes" value="loginId,extId,firstName,name,email,mobile,birthDate, gender, language, street, houseNumber, postalCode, city, country"/>
            <!-- source: pattern://b8bdab6e4634a1d81f20e5bb -->
            <property name="user.properties" value="eIdNumber,nationality,placeOfBirth,svnr"/>
            <!-- source: pattern://b8bdab6e4634a1d81f20e5bb -->
            <property name="chooseDefaultProfile" value="true"/>
            <!-- source: pattern://b8bdab6e4634a1d81f20e5bb -->
            <property name="forceDataReload" value="false"/>
            <!-- source: pattern://b8bdab6e4634a1d81f20e5bb -->
            <property name="userExtId" value="${session:agov.eid.linkedAccountExtId}"/>
            <!-- source: pattern://b8bdab6e4634a1d81f20e5bb -->
            <property name="detaillevel.user" value="HIGH"/>
            <!-- source: pattern://b8bdab6e4634a1d81f20e5bb -->
            <property name="detaillevel.profile" value="HIGH"/>
            <!-- source: pattern://b8bdab6e4634a1d81f20e5bb -->
            <property name="detaillevel.role" value="HIGH"/>
            <!-- source: pattern://b8bdab6e4634a1d81f20e5bb -->
            <property name="detaillevel.authorization" value="HIGH"/>
            <!-- source: pattern://b8bdab6e4634a1d81f20e5bb -->
            <property name="detaillevel.dataroom" value="HIGH"/>
            <!-- source: pattern://b8bdab6e4634a1d81f20e5bb -->
            <property name="detaillevel.credential" value="HIGH"/>
            <!-- source: pattern://b8bdab6e4634a1d81f20e5bb -->
            <property name="detaillevel.property" value="HIGH"/>
            <!-- source: pattern://b8bdab6e4634a1d81f20e5bb -->
            <property name="detaillevel.unit" value="LOW"/>
            <!-- source: pattern://b8bdab6e4634a1d81f20e5bb -->
            <property name="detaillevel.default" value="EXCLUDE"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_Prepare_Done" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false">
            <!-- source: pattern://6061abea33a234fad73897b7, pattern://4fcfadb4a5c946ead7e6e995 -->
            <ResultCond name="default" next="Auth_Realm_Main_IDP_Auth_Done"/>
            <!-- source: pattern://6061abea33a234fad73897b7, pattern://4fcfadb4a5c946ead7e6e995 -->
            <Response value="AUTH_DONE">
                <!-- source: pattern://6061abea33a234fad73897b7, pattern://4fcfadb4a5c946ead7e6e995 -->
                <Gui name="ContinueResponse"/>
            </Response>
            <!-- source: pattern://6061abea33a234fad73897b7, pattern://4fcfadb4a5c946ead7e6e995 -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/prepare_done.groovy"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_Authorization" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false" resumeState="true">
            <!-- source: pattern://596e3e37c4d524690ea35897 -->
            <ResultCond name="forbidden_0" next="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_Authorization"/>
            <!-- source: pattern://596e3e37c4d524690ea35897 -->
            <ResultCond name="forbidden_1" next="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_Authorization"/>
            <!-- source: pattern://596e3e37c4d524690ea35897 -->
            <ResultCond name="ok" next="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_Auth_Done_GUI"/>
            <!-- source: pattern://596e3e37c4d524690ea35897 -->
            <ResultCond name="stepup" next="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_Selector"/>
            <!-- source: pattern://596e3e37c4d524690ea35897 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://596e3e37c4d524690ea35897 -->
                <Arg name="ch.nevis.isiweb4.response.status" value="403"/>
            </Response>
            <!-- source: pattern://596e3e37c4d524690ea35897 -->
            <property name="parameter.paths" value="^http[s]?\u003A//[^/]+/SAML2/SSO/.*$"/>
            <!-- source: pattern://596e3e37c4d524690ea35897 -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/authorization.groovy"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_Fido_Email_Verify_FailedEmailState" class="ch.nevis.esauth.auth.states.standard.TransformAttributes" final="false" resumeState="true">
            <!-- source: pattern://7fb39bfd6c34685866a22180 -->
            <ResultCond name="default" next="Auth_Realm_Main_IDP_FIDO2_Authentication"/>
            <!-- source: pattern://7fb39bfd6c34685866a22180 -->
            <Response value="AUTH_CONTINUE"/>
            <!-- source: pattern://7fb39bfd6c34685866a22180 -->
            <property name="sess:ch.adnovum.nevisidm.user.extId" value="4a9b6cf8-0093-3416-8db8-0f063aa85d14"/>
            <!-- source: pattern://7fb39bfd6c34685866a22180 -->
            <property name="sess:ch.nevis.idm.User.email" value="${inargs:userInputValue_prompt.email}"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_Fido_Email_Verify_IdmGetPropertiesState" class="ch.nevis.idm.authstate.IdmGetPropertiesState" final="false" resumeState="false">
            <!-- source: pattern://7fb39bfd6c34685866a22180 -->
            <ResultCond name="clientNotFound" next="Auth_Realm_Main_IDP_AuthnFailed_Client_NotFound"/>
            <!-- source: pattern://7fb39bfd6c34685866a22180 -->
            <ResultCond name="default" next="Auth_Realm_Main_IDP_SendSamlResponseWithError"/>
            <!-- source: pattern://7fb39bfd6c34685866a22180 -->
            <ResultCond name="ok" next="Auth_Realm_Main_IDP_FIDO2_Authentication"/>
            <!-- source: pattern://7fb39bfd6c34685866a22180 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://7fb39bfd6c34685866a22180 -->
                <Gui name="internal_error">
                    <!-- source: pattern://7fb39bfd6c34685866a22180 -->
                    <GuiElem name="transferId" type="hidden" value="${request:traceId}" optional="true"/>
                </Gui>
            </Response>
            <propertyRef name="nevisIDM_Connector"/>
            <!-- source: pattern://7fb39bfd6c34685866a22180 -->
            <property name="forceDataReload" value="true"/>
            <!-- source: pattern://7fb39bfd6c34685866a22180 -->
            <property name="user.attributes" value="loginId,extId,firstName,name,email,gender,birthDate,language,sex,addressLine1,postalCode,city,country,street,houseNumber,locality,mobile"/>
            <!-- source: pattern://7fb39bfd6c34685866a22180 -->
            <property name="user.properties" value="eIdNumber,placeOfBirth,svnr,nationality"/>
            <!-- source: pattern://7fb39bfd6c34685866a22180 -->
            <property name="user.cred.context_password1.state" value="true"/>
            <!-- source: pattern://7fb39bfd6c34685866a22180 -->
            <property name="user.cred.context_password1.context" value="true"/>
            <!-- source: pattern://7fb39bfd6c34685866a22180 -->
            <property name="userExtId" value="${sess:ch.nevis.session.userid}"/>
            <!-- source: pattern://7fb39bfd6c34685866a22180 -->
            <property name="chooseDefaultProfile" value="true"/>
            <!-- source: pattern://7fb39bfd6c34685866a22180 -->
            <property name="client.name" value="agov"/>
            <!-- source: pattern://7fb39bfd6c34685866a22180 -->
            <property name="detaillevel.user" value="HIGH"/>
            <!-- source: pattern://7fb39bfd6c34685866a22180 -->
            <property name="detaillevel.profile" value="HIGH"/>
            <!-- source: pattern://7fb39bfd6c34685866a22180 -->
            <property name="detaillevel.role" value="MEDIUM"/>
            <!-- source: pattern://7fb39bfd6c34685866a22180 -->
            <property name="detaillevel.authorization" value="HIGH"/>
            <!-- source: pattern://7fb39bfd6c34685866a22180 -->
            <property name="detaillevel.dataroom" value="LOW"/>
            <!-- source: pattern://7fb39bfd6c34685866a22180 -->
            <property name="detaillevel.credential" value="HIGH"/>
            <!-- source: pattern://7fb39bfd6c34685866a22180 -->
            <property name="detaillevel.property" value="HIGH"/>
            <!-- source: pattern://7fb39bfd6c34685866a22180 -->
            <property name="detaillevel.unit" value="LOW"/>
            <!-- source: pattern://7fb39bfd6c34685866a22180 -->
            <property name="detaillevel.default" value="EXCLUDE"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_Ensure_Account_State" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false" resumeState="false">
            <!-- source: pattern://f393012a278e525956a362d3 -->
            <ResultCond name="done" next="Auth_Realm_Main_IDP_Ensure_Recovery_Code"/>
            <!-- source: pattern://f393012a278e525956a362d3 -->
            <ResultCond name="failed" next="Auth_Realm_Main_IDP_SendSamlResponseWithError"/>
            <!-- source: pattern://f393012a278e525956a362d3 -->
            <ResultCond name="reload" next="Auth_Realm_Main_IDP_Ensure_Account_State_Reload"/>
            <!-- source: pattern://f393012a278e525956a362d3 -->
            <Response value="AUTH_CONTINUE"/>
            <!-- source: pattern://f393012a278e525956a362d3 -->
            <property name="scriptTraceGroup" value="AGOV-ACCT"/>
            <!-- source: pattern://f393012a278e525956a362d3 -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/ensureAccountState.groovy"/>
            <!-- source: pattern://f393012a278e525956a362d3 -->
            <property name="parameter.idm.baseUrl" value="https://idm.adn-agov-nevisidm-admin-01-uat:8989/nevisidm/api"/>
            <!-- source: pattern://f393012a278e525956a362d3 -->
            <property name="parameter.unitExtid" value="1000"/>
            <!-- source: pattern://f393012a278e525956a362d3 -->
            <property name="parameter.level100.roleExtid" value="791c2247-2c86-447e-98c2-2655e1fc3f8a"/>
            <!-- source: pattern://f393012a278e525956a362d3 -->
            <property name="parameter.idm.httpclient.tls.trustStoreRef" value="Ensure_Account_State"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_EId_Compare_And_Update_IDM_Attributes" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false" resumeState="true">
            <!-- source: pattern://306ce091fd87bad6174d9e8b -->
            <ResultCond name="audited" next="Auth_Realm_Main_IDP_EId_Compare_And_Update_IDM_Attributes_NotifyUser"/>
            <!-- source: pattern://306ce091fd87bad6174d9e8b -->
            <ResultCond name="error" next="Auth_Realm_Main_IDP_SendSamlResponseWithError"/>
            <!-- source: pattern://306ce091fd87bad6174d9e8b -->
            <ResultCond name="noChange" next="Auth_Realm_Main_IDP_EId_Compare_And_Update_IDM_Attributes_UpdateLoginInfo"/>
            <!-- source: pattern://306ce091fd87bad6174d9e8b -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/eid_compare_and_update_idm_attributes.groovy"/>
            <!-- source: pattern://306ce091fd87bad6174d9e8b -->
            <property name="parameter.baseUrl" value="https://idm.adn-agov-nevisidm-admin-01-uat:8989/nevisidm"/>
            <!-- source: pattern://306ce091fd87bad6174d9e8b -->
            <property name="parameter.clientExtId" value="cfa9c9b9-119f-4dff-9bb8-86d7c0cf2720"/>
            <!-- source: pattern://306ce091fd87bad6174d9e8b -->
            <property name="parameter.idm.httpclient.tls.trustStoreRef" value="EId_Compare_And_Update_IDM_Attributes"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_Auth_Done" class="ch.nevis.esauth.auth.states.standard.AuthDone" final="false">
            <!-- source: pattern://6061abea33a234fad73897b7, pattern://4fcfadb4a5c946ead7e6e995 -->
            <Response value="AUTH_DONE">
                <!-- source: pattern://6061abea33a234fad73897b7, pattern://4fcfadb4a5c946ead7e6e995 -->
                <Gui name="ContinueResponse"/>
            </Response>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_Auth_Realm_Main_IDP_Custom_Auth_Done_GUI" class="ch.nevis.esauth.auth.states.standard.AuthDone" final="false" resumeState="true">
            <!-- source: pattern://cf0e8f8de1c8ac7345c5a6bb -->
            <Response value="AUTH_DONE">
                <!-- source: pattern://cf0e8f8de1c8ac7345c5a6bb -->
                <Gui name="ContinueResponse"/>
            </Response>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_FIDO2_Authentication" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false" resumeState="true">
            <!-- source: pattern://302b0fa3c5c3d1d17e9b1004 -->
            <ResultCond name="cancel" next="Auth_Realm_Main_IDP_OnCancel_Dispatch"/>
            <!-- source: pattern://302b0fa3c5c3d1d17e9b1004 -->
            <ResultCond name="error" next="Auth_Realm_Main_IDP_Email_Input"/>
            <!-- source: pattern://302b0fa3c5c3d1d17e9b1004 -->
            <ResultCond name="ok" next="Auth_Realm_Main_IDP_Fido2_VariableStep"/>
            <!-- source: pattern://302b0fa3c5c3d1d17e9b1004 -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://302b0fa3c5c3d1d17e9b1004 -->
                <Gui name="fido2_auth" label="title.login.fido2"/>
                <!-- source: pattern://302b0fa3c5c3d1d17e9b1004 -->
                <Arg name="fido2UserVerification" value="required"/>
            </Response>
            <!-- source: pattern://302b0fa3c5c3d1d17e9b1004 -->
            <property name="parameter.cancel" value="OnCancel_Dispatch"/>
            <!-- source: pattern://302b0fa3c5c3d1d17e9b1004 -->
            <property name="parameter.fido" value="fido2:9443"/>
            <!-- source: pattern://302b0fa3c5c3d1d17e9b1004 -->
            <property name="parameter.rpId" value="agov-w.azure.adnovum.net"/>
            <!-- source: pattern://302b0fa3c5c3d1d17e9b1004 -->
            <property name="scriptTraceGroup" value="AGOV-ACCT"/>
            <!-- source: pattern://302b0fa3c5c3d1d17e9b1004 -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/fido2_auth.groovy"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_Ensure_Recovery_Code" class="ch.nevis.esauth.auth.states.jwt.JWTToken" final="false" resumeState="false">
            <!-- source: pattern://9ff0369f3cf662f95d94ff09 -->
            <ResultCond name="ok" next="Auth_Realm_Main_IDP_Ensure_Recovery_Code_decryptCode"/>
            <!-- source: pattern://9ff0369f3cf662f95d94ff09 -->
            <Response value="AUTH_ERROR"/>
            <!-- source: pattern://9ff0369f3cf662f95d94ff09 -->
            <property name="token.algorithm" value="RS256"/>
            <!-- source: pattern://9ff0369f3cf662f95d94ff09 -->
            <property name="out.issuer" value="ag"/>
            <!-- source: pattern://9ff0369f3cf662f95d94ff09 -->
            <property name="out.subject" value="${sess:ch.adnovum.nevisidm.user.extId}"/>
            <!-- source: pattern://9ff0369f3cf662f95d94ff09 -->
            <property name="out.custom.sessionId" value="${sess:ch.nevis.session.conversationId}"/>
            <!-- source: pattern://9ff0369f3cf662f95d94ff09 -->
            <property name="out.include.not_before" value="true"/>
            <!-- source: pattern://9ff0369f3cf662f95d94ff09 -->
            <property name="out.time_to_live" value="1200"/>
            <!-- source: pattern://9ff0369f3cf662f95d94ff09 -->
            <property name="keystoreref" value="DefaultKeyStore"/>
            <!-- source: pattern://9ff0369f3cf662f95d94ff09 -->
            <property name="keyobjectref" value="DefaultSigner"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_Ensure_Account_State_Reload" class="ch.nevis.idm.authstate.IdmGetPropertiesState" final="false" resumeState="false">
            <!-- source: pattern://f393012a278e525956a362d3 -->
            <ResultCond name="default" next="Auth_Realm_Main_IDP_SendSamlResponseWithError"/>
            <!-- source: pattern://f393012a278e525956a362d3 -->
            <ResultCond name="ok" next="Auth_Realm_Main_IDP_Ensure_Recovery_Code"/>
            <!-- source: pattern://f393012a278e525956a362d3 -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://f393012a278e525956a362d3 -->
                <Gui name="internal_error">
                    <!-- source: pattern://f393012a278e525956a362d3 -->
                    <GuiElem name="transferId" type="hidden" value="${request:traceId}" optional="true"/>
                </Gui>
            </Response>
            <propertyRef name="nevisIDM_Connector"/>
            <!-- source: pattern://f393012a278e525956a362d3 -->
            <property name="client.name" value="agov"/>
            <!-- source: pattern://f393012a278e525956a362d3 -->
            <property name="user.attributes" value="loginId,extId,firstName,name,email,gender,birthDate,language,sex,addressLine1,postalCode,city,country,street,houseNumber,locality,mobile"/>
            <!-- source: pattern://f393012a278e525956a362d3 -->
            <property name="user.properties" value="eIdNumber,placeOfBirth,svnr,nationality"/>
            <!-- source: pattern://f393012a278e525956a362d3 -->
            <property name="user.cred.context_password1.state" value="true"/>
            <!-- source: pattern://f393012a278e525956a362d3 -->
            <property name="user.cred.context_password1.context" value="true"/>
            <!-- source: pattern://f393012a278e525956a362d3 -->
            <property name="chooseDefaultProfile" value="true"/>
            <!-- source: pattern://f393012a278e525956a362d3 -->
            <property name="forceDataReload" value="true"/>
            <!-- source: pattern://f393012a278e525956a362d3 -->
            <property name="detaillevel.user" value="HIGH"/>
            <!-- source: pattern://f393012a278e525956a362d3 -->
            <property name="detaillevel.profile" value="HIGH"/>
            <!-- source: pattern://f393012a278e525956a362d3 -->
            <property name="detaillevel.role" value="MEDIUM"/>
            <!-- source: pattern://f393012a278e525956a362d3 -->
            <property name="detaillevel.authorization" value="HIGH"/>
            <!-- source: pattern://f393012a278e525956a362d3 -->
            <property name="detaillevel.dataroom" value="LOW"/>
            <!-- source: pattern://f393012a278e525956a362d3 -->
            <property name="detaillevel.credential" value="HIGH"/>
            <!-- source: pattern://f393012a278e525956a362d3 -->
            <property name="detaillevel.property" value="HIGH"/>
            <!-- source: pattern://f393012a278e525956a362d3 -->
            <property name="detaillevel.unit" value="LOW"/>
            <!-- source: pattern://f393012a278e525956a362d3 -->
            <property name="detaillevel.default" value="EXCLUDE"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_EId_Compare_And_Update_IDM_Attributes_NotifyUser" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false" resumeState="true">
            <!-- source: pattern://306ce091fd87bad6174d9e8b -->
            <ResultCond name="error" next="Auth_Realm_Main_IDP_SendSamlResponseWithError"/>
            <!-- source: pattern://306ce091fd87bad6174d9e8b -->
            <ResultCond name="ok" next="Auth_Realm_Main_IDP_EId_Compare_And_Update_IDM_Attributes_UpdateLoginInfo"/>
            <!-- source: pattern://306ce091fd87bad6174d9e8b -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/eid_notify_user_idm_change.groovy"/>
            <!-- source: pattern://306ce091fd87bad6174d9e8b -->
            <property name="parameter.baseUrl" value="https://idm.adn-agov-nevisidm-admin-01-uat:8989/nevisidm"/>
            <!-- source: pattern://306ce091fd87bad6174d9e8b -->
            <property name="parameter.clientExtId" value="cfa9c9b9-119f-4dff-9bb8-86d7c0cf2720"/>
            <!-- source: pattern://306ce091fd87bad6174d9e8b -->
            <property name="parameter.idm.httpclient.tls.trustStoreRef" value="EId_Compare_And_Update_IDM_Attributes"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_EId_Compare_And_Update_IDM_Attributes_UpdateLoginInfo" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false" resumeState="true">
            <!-- source: pattern://306ce091fd87bad6174d9e8b -->
            <ResultCond name="error" next="Auth_Realm_Main_IDP_SendSamlResponseWithError"/>
            <!-- source: pattern://306ce091fd87bad6174d9e8b -->
            <ResultCond name="ok" next="Auth_Realm_Main_IDP_SendSamlResponseWithAssertion"/>
            <!-- source: pattern://306ce091fd87bad6174d9e8b -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/eid_update_login_info.groovy"/>
            <!-- source: pattern://306ce091fd87bad6174d9e8b -->
            <property name="parameter.baseUrl" value="https://idm.adn-agov-nevisidm-admin-01-uat:8989/nevisidm"/>
            <!-- source: pattern://306ce091fd87bad6174d9e8b -->
            <property name="parameter.clientExtId" value="cfa9c9b9-119f-4dff-9bb8-86d7c0cf2720"/>
            <!-- source: pattern://306ce091fd87bad6174d9e8b -->
            <property name="parameter.idm.httpclient.tls.trustStoreRef" value="EId_Compare_And_Update_IDM_Attributes"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_OnCancel_Dispatch" class="ch.nevis.esauth.auth.states.standard.ConditionalDispatcherState" final="false">
            <!-- source: pattern://af4ec934e8efbef422f03926 -->
            <ResultCond name="AccessApp" next="Auth_Realm_Main_IDP_Mobile_NLess_Auth"/>
            <!-- source: pattern://af4ec934e8efbef422f03926 -->
            <ResultCond name="Edit" next="Auth_Realm_Main_IDP_clear_request_session"/>
            <!-- source: pattern://af4ec934e8efbef422f03926 -->
            <ResultCond name="nomatch" next="Auth_Realm_Main_IDP_clear_request_session"/>
            <!-- source: pattern://af4ec934e8efbef422f03926 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://af4ec934e8efbef422f03926 -->
                <Arg name="ch.nevis.isiweb4.response.status" value="403"/>
            </Response>
            <!-- source: pattern://af4ec934e8efbef422f03926 -->
            <property name="condition:AccessApp" value="${inargs:cancel_fido2:access_app:true}"/>
            <!-- source: pattern://af4ec934e8efbef422f03926 -->
            <property name="condition:Edit" value="${inargs:cancel_fido2:cancel_fido2:true}"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_Fido2_VariableStep" class="ch.nevis.esauth.auth.states.standard.TransformAttributes" final="false">
            <!-- source: pattern://1a7583c6caa3b5c36599b25e -->
            <ResultCond name="ok" next="Auth_Realm_Main_IDP_Ensure_Account_State"/>
            <!-- source: pattern://1a7583c6caa3b5c36599b25e -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://1a7583c6caa3b5c36599b25e -->
                <Arg name="ch.nevis.isiweb4.response.status" value="403"/>
            </Response>
            <!-- source: pattern://1a7583c6caa3b5c36599b25e -->
            <property name="sess:authenticatedWith" value="urn:qa.agov.ch:names:tc:authfactor:fido"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_Ensure_Recovery_Code_decryptCode" class="ch.nevis.esauth.auth.states.standard.TransformAttributes" final="false" resumeState="true">
            <!-- source: pattern://9ff0369f3cf662f95d94ff09 -->
            <ResultCond name="default" next="Auth_Realm_Main_IDP_Ensure_Recovery_Code_Process"/>
            <!-- source: pattern://9ff0369f3cf662f95d94ff09 -->
            <Response value="AUTH_CONTINUE"/>
            <!-- source: pattern://9ff0369f3cf662f95d94ff09 -->
            <property name="cryptoKey" value="secret://8jzQ1+F4HHvx7/tKFYRZb2/hFmyXjzt1HXgMJz+Tb16qSMh5Yv2QNnDH0JqsXHAoqtvZu1Nlo5A="/>
            <!-- source: pattern://9ff0369f3cf662f95d94ff09 -->
            <property name="cryptoAlgorithm" value="AES/CTR/PKCS5Padding"/>
            <!-- source: pattern://9ff0369f3cf662f95d94ff09 -->
            <property name="${sess:agov.new.recovery.code.cipher}?notes:agov.new.recovery.code:decrypt-b64" value="${sess:agov.new.recovery.code.cipher}"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_clear_request_session" class="ch.nevis.esauth.auth.states.standard.TransformAttributes" final="false">
            <!-- source: pattern://8c28e8f3352491ef7c5315fc -->
            <ResultCond name="ok" next="Auth_Realm_Main_IDP_Email_Input"/>
            <!-- source: pattern://8c28e8f3352491ef7c5315fc -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://8c28e8f3352491ef7c5315fc -->
                <Arg name="ch.nevis.isiweb4.response.status" value="403"/>
            </Response>
            <!-- source: pattern://8c28e8f3352491ef7c5315fc -->
            <property name="request:loginId" value=""/>
            <!-- source: pattern://8c28e8f3352491ef7c5315fc -->
            <property name="sess:ch.adnovum.nevisidm.profileExtId" value=""/>
            <!-- source: pattern://8c28e8f3352491ef7c5315fc -->
            <property name="sess:ch.adnovum.nevisidm.profileId" value=""/>
            <!-- source: pattern://8c28e8f3352491ef7c5315fc -->
            <property name="sess:ch.adnovum.nevisidm.profileName" value=""/>
            <!-- source: pattern://8c28e8f3352491ef7c5315fc -->
            <property name="removeOnEmptyValue" value="true"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_Ensure_Recovery_Code_Process" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false" resumeState="false">
            <!-- source: pattern://9ff0369f3cf662f95d94ff09 -->
            <ResultCond name="done" next="Auth_Realm_Main_IDP_Ask_Mobile_Number"/>
            <!-- source: pattern://9ff0369f3cf662f95d94ff09 -->
            <ResultCond name="encryptCode" next="Auth_Realm_Main_IDP_Ensure_Recovery_Code_encryptCode"/>
            <!-- source: pattern://9ff0369f3cf662f95d94ff09 -->
            <ResultCond name="failed" next="Auth_Realm_Main_IDP_Ask_Mobile_Number"/>
            <!-- source: pattern://9ff0369f3cf662f95d94ff09 -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://9ff0369f3cf662f95d94ff09 -->
                <Gui name="recovery_code" label="general.entryCode">
                    <!-- source: pattern://9ff0369f3cf662f95d94ff09 -->
                    <GuiElem name="isiwebpasswd" type="hidden" value="#{ notes.getProperty('agov.new.recovery.code', inargs.getProperty('isiwebpasswd')) }" optional="true"/>
                    <!-- source: pattern://9ff0369f3cf662f95d94ff09 -->
                    <GuiElem name="validTil" type="hidden" value="${sess:agov.new.recovery.code.validTil}" optional="true"/>
                    <!-- source: pattern://9ff0369f3cf662f95d94ff09 -->
                    <GuiElem name="pdfAuthToken" type="hidden" value="${sess:agov.new.recovery.code.pdfAuthToken}" length="4096" optional="true"/>
                    <!-- source: pattern://9ff0369f3cf662f95d94ff09 -->
                    <GuiElem name="authRequestId" type="hidden" value="${sess:ch.nevis.auth.saml.request.id}" optional="true"/>
                    <!-- source: pattern://9ff0369f3cf662f95d94ff09 -->
                    <GuiElem name="submit" type="button" label="continue.button.label" value="submit"/>
                </Gui>
            </Response>
            <!-- source: pattern://9ff0369f3cf662f95d94ff09 -->
            <property name="scriptTraceGroup" value="AGOV-ACCT"/>
            <!-- source: pattern://9ff0369f3cf662f95d94ff09 -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/ensureRecoveryCode.groovy"/>
            <!-- source: pattern://9ff0369f3cf662f95d94ff09 -->
            <property name="parameter.utility-service.baseUrl" value="https://utility.agov-d.azure.adnovum.net/utility"/>
            <!-- source: pattern://9ff0369f3cf662f95d94ff09 -->
            <property name="parameter.idm.httpclient.tls.trustStoreRef" value="Ensure_Recovery_Code"/>
            <!-- source: pattern://9ff0369f3cf662f95d94ff09 -->
            <property name="parameter.cookie.domain" value="auth.agov-w.azure.adnovum.net"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_Ask_Mobile_Number" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false" resumeState="true">
            <!-- source: pattern://6d83506dfcc430c12d81dfa3 -->
            <ResultCond name="done" next="Auth_Realm_Main_IDP_CheckLoa"/>
            <!-- source: pattern://6d83506dfcc430c12d81dfa3 -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://6d83506dfcc430c12d81dfa3 -->
                <Gui name="ask_mobile_number" label="general.askMobileNumber">
                    <!-- source: pattern://6d83506dfcc430c12d81dfa3 -->
                    <GuiElem name="mobile" type="text" label="mobile number" optional="true"/>
                    <!-- source: pattern://6d83506dfcc430c12d81dfa3 -->
                    <GuiElem name="skip" type="text" label="skip me" value="false" optional="true"/>
                    <!-- source: pattern://6d83506dfcc430c12d81dfa3 -->
                    <GuiElem name="authRequestId" type="hidden" value="${sess:ch.nevis.auth.saml.request.id}" optional="true"/>
                    <!-- source: pattern://6d83506dfcc430c12d81dfa3 -->
                    <GuiElem name="submit" type="button" label="continue.button.label" value="submit"/>
                </Gui>
            </Response>
            <!-- source: pattern://6d83506dfcc430c12d81dfa3 -->
            <property name="scriptTraceGroup" value="AGOV-ACCT"/>
            <!-- source: pattern://6d83506dfcc430c12d81dfa3 -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/askMobileNumber.groovy"/>
            <!-- source: pattern://6d83506dfcc430c12d81dfa3 -->
            <property name="parameter.baseUrl" value="https://idm.adn-agov-nevisidm-01-dev:8989/nevisidm/api"/>
            <!-- source: pattern://6d83506dfcc430c12d81dfa3 -->
            <property name="parameter.idm.httpclient.tls.keyObjectRef" value="DefaultKeyStore"/>
            <!-- source: pattern://6d83506dfcc430c12d81dfa3 -->
            <property name="parameter.idm.httpclient.tls.trustStoreRef" value="Ask_Mobile_Number"/>
            <!-- source: pattern://6d83506dfcc430c12d81dfa3 -->
            <property name="parameter.cookie.domain" value="auth.agov-w.azure.adnovum.net"/>
            <!-- source: pattern://6d83506dfcc430c12d81dfa3 -->
            <property name="parameter.ask_mobile_number_enabled" value="true"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_Ensure_Recovery_Code_encryptCode" class="ch.nevis.esauth.auth.states.standard.TransformAttributes" final="false" resumeState="false">
            <!-- source: pattern://9ff0369f3cf662f95d94ff09 -->
            <ResultCond name="default" next="Auth_Realm_Main_IDP_Ensure_Recovery_Code_Process"/>
            <!-- source: pattern://9ff0369f3cf662f95d94ff09 -->
            <Response value="AUTH_CONTINUE"/>
            <!-- source: pattern://9ff0369f3cf662f95d94ff09 -->
            <property name="cryptoKey" value="secret://8jzQ1+F4HHvx7/tKFYRZb2/hFmyXjzt1HXgMJz+Tb16qSMh5Yv2QNnDH0JqsXHAoqtvZu1Nlo5A="/>
            <!-- source: pattern://9ff0369f3cf662f95d94ff09 -->
            <property name="cryptoAlgorithm" value="AES/CTR/PKCS5Padding"/>
            <!-- source: pattern://9ff0369f3cf662f95d94ff09 -->
            <property name="!${sess:agov.new.recovery.code.cipher}?sess:agov.new.recovery.code.cipher:encrypt-b64" value="${notes:agov.new.recovery.code}"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_CheckLoa" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false">
            <!-- source: pattern://2cdd910036aa06b102863a4f -->
            <ResultCond name="error" next="Auth_Realm_Main_IDP_AuthnFailed_Zero_RoleLvl"/>
            <!-- source: pattern://2cdd910036aa06b102863a4f -->
            <ResultCond name="exit.1" next="Auth_Realm_Main_IDP_Insufficient_LoaInfo"/>
            <!-- source: pattern://2cdd910036aa06b102863a4f -->
            <ResultCond name="exit.2" next="Auth_Realm_Main_IDP_Recovery_ongoing"/>
            <!-- source: pattern://2cdd910036aa06b102863a4f -->
            <ResultCond name="ok" next="Auth_Realm_Main_IDP_Fetch_Country_Name"/>
            <!-- source: pattern://2cdd910036aa06b102863a4f -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://2cdd910036aa06b102863a4f -->
                <Arg name="ch.nevis.isiweb4.response.status" value="403"/>
            </Response>
            <!-- source: pattern://2cdd910036aa06b102863a4f -->
            <property name="scriptTraceGroup" value="AGOV-ACCT"/>
            <!-- source: pattern://2cdd910036aa06b102863a4f -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/checkloa.groovy"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_AuthnFailed_Zero_RoleLvl" class="ch.nevis.esauth.auth.states.standard.TransformAttributes" final="false">
            <!-- source: pattern://50b861438e79c2332862d3ca -->
            <ResultCond name="ok" next="Auth_Realm_Main_IDP_SendSamlResponseWithError"/>
            <!-- source: pattern://50b861438e79c2332862d3ca -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://50b861438e79c2332862d3ca -->
                <Arg name="ch.nevis.isiweb4.response.status" value="403"/>
            </Response>
            <!-- source: pattern://50b861438e79c2332862d3ca -->
            <property name="notes:saml.errorCode" value="urn:oasis:names:tc:SAML:2.0:status:AuthnFailed"/>
            <!-- source: pattern://50b861438e79c2332862d3ca -->
            <property name="notes:saml.errorInfo" value="Please consult the support page on how to check your account status"/>
            <!-- source: pattern://50b861438e79c2332862d3ca -->
            <property name="notes:saml.errorMessage" value="Your account verification status is expired or invalid , Request ID: ${request:traceId}"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_Insufficient_LoaInfo" class="ch.nevis.esauth.auth.states.standard.ConditionalDispatcherState" final="true" resumeState="true">
            <!-- source: pattern://d1298ac82e8bab66583d5571 -->
            <ResultCond name="cancel" next="Auth_Realm_Main_IDP_NoAuthnContext"/>
            <!-- source: pattern://d1298ac82e8bab66583d5571 -->
            <ResultCond name="submit" next="Auth_Realm_Main_IDP_Redirect_to_IDVerification"/>
            <!-- source: pattern://d1298ac82e8bab66583d5571 -->
            <ResultCond name="timeout" next="Auth_Realm_Main_IDP_ReturnTimeoutButKeepSession"/>
            <!-- source: pattern://d1298ac82e8bab66583d5571 -->
            <ResultCond name="timeout,cancel" next="Auth_Realm_Main_IDP_ReturnTimeoutButKeepSession"/>
            <!-- source: pattern://d1298ac82e8bab66583d5571 -->
            <ResultCond name="timeout,submit" next="Auth_Realm_Main_IDP_ReturnTimeoutButKeepSession"/>
            <!-- source: pattern://d1298ac82e8bab66583d5571 -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://d1298ac82e8bab66583d5571 -->
                <Gui name="loainfo">
                    <!-- source: pattern://d1298ac82e8bab66583d5571 -->
                    <GuiElem name="authRequestId" type="hidden" value="${sess:ch.nevis.auth.saml.request.id}" optional="true"/>
                    <!-- source: pattern://d1298ac82e8bab66583d5571 -->
                    <GuiElem name="loainfo" type="hidden" value="${sess:agov.requestedRoleLevel}" optional="true"/>
                </Gui>
            </Response>
            <!-- source: pattern://d1298ac82e8bab66583d5571 -->
            <property name="condition:cancel" value="${inargs:goToOriginApp}==goToOriginApp"/>
            <!-- source: pattern://d1298ac82e8bab66583d5571 -->
            <property name="condition:submit" value="${inargs:goToRegistration}==goToRegistration"/>
            <!-- source: pattern://d1298ac82e8bab66583d5571 -->
            <property name="condition:timeout" value="#{ (inargs.containsKey('authRequestId') and inargs.getProperty('authRequestId') != sess.get('ch.nevis.auth.saml.request.id')) ? 'TIMEOUT' : '' }==TIMEOUT"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_Recovery_ongoing" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="true" resumeState="true">
            <!-- source: pattern://1d38203c48e017b5b3812385 -->
            <ResultCond name="ok" next="Auth_Realm_Main_IDP_Recovery_redirectAgovMe"/>
            <!-- source: pattern://1d38203c48e017b5b3812385 -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://1d38203c48e017b5b3812385 -->
                <Gui name="recovery_on_going" label="not.used.label">
                    <!-- source: pattern://1d38203c48e017b5b3812385 -->
                    <GuiElem name="authRequestId" type="hidden" label="not.used.label" value="${sess:ch.nevis.auth.saml.request.id}" optional="true"/>
                    <!-- source: pattern://1d38203c48e017b5b3812385 -->
                    <GuiElem name="recovery" type="button" label="not.used" value="recovery" optional="true"/>
                </Gui>
            </Response>
            <!-- source: pattern://1d38203c48e017b5b3812385 -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/recovery_ongoing.groovy"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_Fetch_Country_Name" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false">
            <!-- source: pattern://4c7ad5e93c0ed94844e6bbfe -->
            <ResultCond name="error" next="Auth_Realm_Main_IDP_SendSamlResponseWithAssertion"/>
            <!-- source: pattern://4c7ad5e93c0ed94844e6bbfe -->
            <ResultCond name="ok" next="Auth_Realm_Main_IDP_SendSamlResponseWithAssertion"/>
            <!-- source: pattern://4c7ad5e93c0ed94844e6bbfe -->
            <Response value="AUTH_CONTINUE"/>
            <!-- source: pattern://4c7ad5e93c0ed94844e6bbfe -->
            <property name="parameter.baseurl" value="https://utility.agov-d.azure.adnovum.net/utility/"/>
            <!-- source: pattern://4c7ad5e93c0ed94844e6bbfe -->
            <property name="scriptTraceGroup" value="AGOV-ACCT"/>
            <!-- source: pattern://4c7ad5e93c0ed94844e6bbfe -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/fetch_country_name.groovy"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_NoAuthnContext" class="ch.nevis.esauth.auth.states.standard.TransformAttributes" final="false">
            <!-- source: pattern://1793638a6715537e8f491f25 -->
            <ResultCond name="ok" next="Auth_Realm_Main_IDP_SendSamlResponseWithError"/>
            <!-- source: pattern://1793638a6715537e8f491f25 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://1793638a6715537e8f491f25 -->
                <Arg name="ch.nevis.isiweb4.response.status" value="403"/>
            </Response>
            <!-- source: pattern://1793638a6715537e8f491f25 -->
            <property name="notes:saml.errorCode" value="urn:oasis:names:tc:SAML:2.0:status:NoAuthnContext"/>
            <!-- source: pattern://1793638a6715537e8f491f25 -->
            <property name="notes:saml.errorMessage" value="The user's account didn't achieve the minimal required quality level of ${sess:agov.requestedRoleLevel} , Request ID: ${request:traceId}"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_Redirect_to_IDVerification" class="ch.nevis.esauth.auth.states.saml.IdentityProviderState" final="false" resumeState="false">
            <!-- source: pattern://cdb228eccc12b4b1dea20d9d -->
            <ResultCond name="ok" next="Auth_Realm_Main_IDP_Redirect_to_IDVerification_Handle_Redirect"/>
            <!-- source: pattern://cdb228eccc12b4b1dea20d9d -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://cdb228eccc12b4b1dea20d9d -->
                <Gui name="internal_error">
                    <!-- source: pattern://cdb228eccc12b4b1dea20d9d -->
                    <GuiElem name="transferId" type="hidden" value="${request:traceId}" optional="true"/>
                </Gui>
            </Response>
            <!-- source: pattern://cdb228eccc12b4b1dea20d9d -->
            <property name="in.binding" value="none"/>
            <!-- source: pattern://cdb228eccc12b4b1dea20d9d -->
            <property name="out.binding" value="internal"/>
            <!-- source: pattern://cdb228eccc12b4b1dea20d9d -->
            <property name="out.sign" value="Response Assertion"/>
            <!-- source: pattern://cdb228eccc12b4b1dea20d9d -->
            <property name="out.signatureKeyInfo" value="Certificate"/>
            <!-- source: pattern://cdb228eccc12b4b1dea20d9d -->
            <property name="out.ttl" value="20"/>
            <!-- source: pattern://cdb228eccc12b4b1dea20d9d -->
            <property name="out.extension.Bearer" value="ch.nevis.esauth.auth.states.saml.extensions.SubjectConfirmationExtender"/>
            <!-- source: pattern://cdb228eccc12b4b1dea20d9d -->
            <property name="Bearer.ttl" value="20"/>
            <!-- source: pattern://cdb228eccc12b4b1dea20d9d -->
            <property name="out.keystoreref" value="Store_IDP_AGOV"/>
            <!-- source: pattern://cdb228eccc12b4b1dea20d9d -->
            <property name="out.keyobjectref" value="Signer_IDP_AGOV"/>
            <!-- source: pattern://cdb228eccc12b4b1dea20d9d -->
            <property name="spURL" value="https://ob.agov-w.azure.adnovum.net/mock-me/process"/>
            <!-- source: pattern://cdb228eccc12b4b1dea20d9d -->
            <property name="acsUrlWhitelist.uris" value="not used"/>
            <!-- source: pattern://cdb228eccc12b4b1dea20d9d -->
            <property name="out.authnContextClassRef" value="urn:qa.agov.ch:names:tc:ac:classes:${sess:agov.actualRoleLevel}"/>
            <!-- source: pattern://cdb228eccc12b4b1dea20d9d -->
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/05/identity/claims/authenticatedWith" value="${sess:authenticatedWith}"/>
            <!-- source: pattern://cdb228eccc12b4b1dea20d9d -->
            <property name="out.attribute.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" value="${sess:ch.nevis.idm.User.email}"/>
            <!-- source: pattern://cdb228eccc12b4b1dea20d9d -->
            <property name="out.attribute.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname" value="${sess:ch.nevis.idm.User.firstName}"/>
            <!-- source: pattern://cdb228eccc12b4b1dea20d9d -->
            <property name="out.attribute.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname" value="${sess:ch.nevis.idm.User.lastName}"/>
            <!-- source: pattern://cdb228eccc12b4b1dea20d9d -->
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/05/identity/claims/requestedRoleLevel" value="urn:qa.agov.ch:names:tc:ac:classes:${sess:agov.requestedRoleLevel}"/>
            <!-- source: pattern://cdb228eccc12b4b1dea20d9d -->
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/09/identity/claim/rpEntityId" value="${sess:ch.nevis.auth.saml.request.scoping.requesterId}"/>
            <!-- source: pattern://cdb228eccc12b4b1dea20d9d -->
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/09/identity/claim/allowedVerificationMethods" value="${sess:agov.appAllowedVerificationMethods}"/>
            <!-- source: pattern://cdb228eccc12b4b1dea20d9d -->
            <property name="out.attributeDelimiter" value=",\s*"/>
            <!-- source: pattern://cdb228eccc12b4b1dea20d9d -->
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/09/identity/claims/addressRequired" value="${sess:agov.appAddressRequired}"/>
            <!-- source: pattern://cdb228eccc12b4b1dea20d9d -->
            <property name="out.subject" value="${response:userId}"/>
            <!-- source: pattern://cdb228eccc12b4b1dea20d9d -->
            <property name="out.subject.format" value="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"/>
            <!-- source: pattern://cdb228eccc12b4b1dea20d9d -->
            <property name="out.issuer" value="https://auth.agov-w.azure.adnovum.net/SAML2/"/>
            <!-- source: pattern://cdb228eccc12b4b1dea20d9d -->
            <property name="out.audienceRestriction" value="https://ob.agov-w.azure.adnovum.net/mock-me/process"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_Recovery_redirectAgovMe" class="ch.nevis.esauth.auth.states.saml.IdentityProviderState" final="false" resumeState="false">
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <ResultCond name="ok" next="Auth_Realm_Main_IDP_Recovery_redirectAgovMe_Handle_Redirect"/>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://6061abea33a234fad73897b7 -->
                <Gui name="internal_error">
                    <!-- source: pattern://6061abea33a234fad73897b7 -->
                    <GuiElem name="transferId" type="hidden" value="${request:traceId}" optional="true"/>
                </Gui>
            </Response>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <property name="in.binding" value="none"/>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <property name="out.binding" value="internal"/>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <property name="out.sign" value="Response Assertion"/>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <property name="out.signatureKeyInfo" value="Certificate"/>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <property name="out.ttl" value="20"/>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <property name="out.extension.Bearer" value="ch.nevis.esauth.auth.states.saml.extensions.SubjectConfirmationExtender"/>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <property name="Bearer.ttl" value="20"/>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <property name="out.keystoreref" value="Store_IDP_AGOV"/>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <property name="out.keyobjectref" value="Signer_IDP_AGOV"/>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <property name="spURL" value="https://ob.agov-w.azure.adnovum.net/mock-me/process"/>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <property name="acsUrlWhitelist.uris" value="not used"/>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <property name="out.authnContextClassRef" value="${sess:agov.recovery.authnContextClassRef}"/>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/05/identity/claims/authenticatedWith" value="${sess:agov.recovery.authenticatedWith}"/>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/11/identity/claims/currentAgovAq" value="${sess:agov.recovery.currentAgovAq}"/>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <property name="out.attribute.http://schemas.agov.ch/ws/2024/01/identity/claims/currentIdVerification" value="${sess:agov.recovery.currentIdVerification}"/>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/05/identity/claims/qa/dateOfVerification" value="${sess:agov.recovery.currentAgovAqRoleValidFrom}"/>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <property name="out.attributeDelimiter" value=",\s*"/>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <property name="out.subject" value="${sess:ch.adnovum.nevisidm.user.extId}"/>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <property name="out.subject.format" value="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"/>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <property name="out.issuer" value="https://auth.agov-w.azure.adnovum.net/SAML2/"/>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <property name="out.audienceRestriction" value="https://ob.agov-w.azure.adnovum.net/mock-me/process"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_Redirect_to_IDVerification_Handle_Redirect" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false" resumeState="true">
            <!-- source: pattern://cdb228eccc12b4b1dea20d9d -->
            <ResultCond name="ok" next="Auth_Realm_Main_IDP_Fetch_Attributes"/>
            <!-- source: pattern://cdb228eccc12b4b1dea20d9d -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://cdb228eccc12b4b1dea20d9d -->
                <Gui name="not_used"/>
            </Response>
            <!-- source: pattern://cdb228eccc12b4b1dea20d9d -->
            <property name="scriptTraceGroup" value="AGOV-ACCT"/>
            <!-- source: pattern://cdb228eccc12b4b1dea20d9d -->
            <property name="parameter.agovmedirecturl" value="https://ob.agov-w.azure.adnovum.net/mock-me/process"/>
            <!-- source: pattern://cdb228eccc12b4b1dea20d9d -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/handleRedirect.groovy"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_Recovery_redirectAgovMe_Handle_Redirect" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false" resumeState="false">
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <ResultCond name="ok" next="Auth_Realm_Main_IDP_Prepare_Done"/>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://6061abea33a234fad73897b7 -->
                <Gui name="not_used"/>
            </Response>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <property name="scriptTraceGroup" value="AGOV-ACCT"/>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <property name="parameter.agovmedirecturl" value="https://ob.agov-w.azure.adnovum.net/mock-me/process"/>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/handleRedirectRecovery.groovy"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_Fetch_Attributes" class="ch.nevis.idm.authstate.IdmGetPropertiesState" final="false" resumeState="false">
            <!-- source: pattern://9a8294b080ea769d22924af0 -->
            <ResultCond name="insufficientLoa" next="Auth_Realm_Main_IDP_Insufficient_LoaInfo"/>
            <!-- source: pattern://9a8294b080ea769d22924af0 -->
            <ResultCond name="noRoleLevel" next="Auth_Realm_Main_IDP_AuthnFailed_Zero_RoleLvl"/>
            <!-- source: pattern://9a8294b080ea769d22924af0 -->
            <ResultCond name="ok" next="Auth_Realm_Main_IDP_Fetch_Attributes_Check_new_LOA"/>
            <!-- source: pattern://9a8294b080ea769d22924af0 -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://9a8294b080ea769d22924af0 -->
                <Gui name="internal_error">
                    <!-- source: pattern://9a8294b080ea769d22924af0 -->
                    <GuiElem name="transferId" type="hidden" value="${request:traceId}" optional="true"/>
                </Gui>
            </Response>
            <propertyRef name="nevisIDM_Connector"/>
            <!-- source: pattern://9a8294b080ea769d22924af0 -->
            <property name="client.name" value="agov"/>
            <!-- source: pattern://9a8294b080ea769d22924af0 -->
            <property name="user.attributes" value="loginId,extId,firstName,name,email,gender,birthDate,language,sex,addressLine1,postalCode,city,country,street,houseNumber,locality,mobile"/>
            <!-- source: pattern://9a8294b080ea769d22924af0 -->
            <property name="user.properties" value="eIdNumber,placeOfBirth,svnr,nationality"/>
            <!-- source: pattern://9a8294b080ea769d22924af0 -->
            <property name="user.cred.context_password1.state" value="true"/>
            <!-- source: pattern://9a8294b080ea769d22924af0 -->
            <property name="chooseDefaultProfile" value="true"/>
            <!-- source: pattern://9a8294b080ea769d22924af0 -->
            <property name="forceDataReload" value="true"/>
            <!-- source: pattern://9a8294b080ea769d22924af0 -->
            <property name="userExtId" value="${sess:ch.nevis.session.userid}"/>
            <!-- source: pattern://9a8294b080ea769d22924af0 -->
            <property name="detaillevel.user" value="HIGH"/>
            <!-- source: pattern://9a8294b080ea769d22924af0 -->
            <property name="detaillevel.profile" value="HIGH"/>
            <!-- source: pattern://9a8294b080ea769d22924af0 -->
            <property name="detaillevel.role" value="MEDIUM"/>
            <!-- source: pattern://9a8294b080ea769d22924af0 -->
            <property name="detaillevel.authorization" value="HIGH"/>
            <!-- source: pattern://9a8294b080ea769d22924af0 -->
            <property name="detaillevel.dataroom" value="LOW"/>
            <!-- source: pattern://9a8294b080ea769d22924af0 -->
            <property name="detaillevel.credential" value="HIGH"/>
            <!-- source: pattern://9a8294b080ea769d22924af0 -->
            <property name="detaillevel.property" value="HIGH"/>
            <!-- source: pattern://9a8294b080ea769d22924af0 -->
            <property name="detaillevel.unit" value="LOW"/>
            <!-- source: pattern://9a8294b080ea769d22924af0 -->
            <property name="detaillevel.default" value="EXCLUDE"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_Fetch_Attributes_Check_new_LOA" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false" resumeState="false">
            <!-- source: pattern://9a8294b080ea769d22924af0 -->
            <ResultCond name="insufficientLoa" next="Auth_Realm_Main_IDP_Insufficient_LoaInfo"/>
            <!-- source: pattern://9a8294b080ea769d22924af0 -->
            <ResultCond name="ok" next="Auth_Realm_Main_IDP_SendSamlResponseWithAssertion"/>
            <!-- source: pattern://9a8294b080ea769d22924af0 -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://9a8294b080ea769d22924af0 -->
                <Gui name="not_used"/>
            </Response>
            <!-- source: pattern://9a8294b080ea769d22924af0 -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/checkInsufficientLoa.groovy"/>
        </AuthState>
        <AuthState name="Auth_Realm_Main_IDP_Selector" class="ch.nevis.esauth.auth.states.standard.ConditionalDispatcherState" final="false">
            <!-- source: pattern://4fcfadb4a5c946ead7e6e995 -->
            <ResultCond name="nomatch" next="Auth_Realm_Main_IDP_Prepare_Done"/>
            <!-- source: pattern://4fcfadb4a5c946ead7e6e995 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://4fcfadb4a5c946ead7e6e995 -->
                <Arg name="ch.nevis.isiweb4.response.status" value="403"/>
            </Response>
        </AuthState>
        <AuthState name="Auth_Realm_Mobile_FIDO_UAF_DirectFidoAuthRequired" class="ch.nevis.esauth.auth.states.directResponse.DirectResponseState" final="true" resumeState="false">
            <!-- source: pattern://cb8c63274fe346280de0ffd5 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://cb8c63274fe346280de0ffd5 -->
                <Gui name="none"/>
            </Response>
            <!-- source: pattern://cb8c63274fe346280de0ffd5 -->
            <property name="content" value="Unauthorized"/>
            <!-- source: pattern://cb8c63274fe346280de0ffd5 -->
            <property name="contentType" value="text/plain;charset=utf-8"/>
            <!-- source: pattern://cb8c63274fe346280de0ffd5 -->
            <property name="statusCode" value="401"/>
            <!-- source: pattern://cb8c63274fe346280de0ffd5 -->
            <property name="header.WWW-Authenticate" value="FIDO realm=&quot;${request:domain}&quot;"/>
        </AuthState>
        <AuthState name="Auth_Realm_Mobile_FIDO_UAF_FidoUafAuthState" class="ch.nevis.auth.fido.uaf.authstate.FidoUafAuthState" final="false" resumeState="false">
            <!-- source: pattern://cb8c63274fe346280de0ffd5 -->
            <ResultCond name="error" next="Auth_Realm_Mobile_FIDO_UAF_DirectAuthError"/>
            <!-- source: pattern://cb8c63274fe346280de0ffd5 -->
            <ResultCond name="failed" next="Auth_Realm_Mobile_FIDO_UAF_DirectAuthError"/>
            <!-- source: pattern://cb8c63274fe346280de0ffd5 -->
            <ResultCond name="ok" next="Auth_Realm_Mobile_FIDO_UAF_DirectAuthDone"/>
            <!-- source: pattern://cb8c63274fe346280de0ffd5 -->
            <property name="fidoUafUsername" value="${inargs:o.username.v}"/>
            <!-- source: pattern://cb8c63274fe346280de0ffd5 -->
            <property name="fidoUafServerUrl" value="https://fido-uaf:9443/nevisfido"/>
            <!-- source: pattern://cb8c63274fe346280de0ffd5 -->
            <property name="httpclient.tls.trustStoreRef" value="Auth_Realm_Mobile_FIDO_UAFKeyStore"/>
            <!-- source: pattern://cb8c63274fe346280de0ffd5 -->
            <property name="httpclient.tls.keyObjectRef" value="Auth_Realm_Mobile_FIDO_UAFKeyStore/Auth_Realm_Mobile_FIDO_UAFClientKeyObject"/>
            <!-- source: pattern://cb8c63274fe346280de0ffd5 -->
            <property name="fidoUafTransactions" value="${inargs:o.transaction.v}"/>
        </AuthState>
        <AuthState name="Auth_Realm_Mobile_FIDO_UAF_DirectAuthError" class="ch.nevis.esauth.auth.states.directResponse.DirectResponseState" final="true" resumeState="false">
            <!-- source: pattern://cb8c63274fe346280de0ffd5 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://cb8c63274fe346280de0ffd5 -->
                <Gui name="none"/>
            </Response>
            <!-- source: pattern://cb8c63274fe346280de0ffd5 -->
            <property name="content" value="{&quot;status&quot;:&quot;failed&quot;}"/>
            <!-- source: pattern://cb8c63274fe346280de0ffd5 -->
            <property name="contentType" value="application/json"/>
            <!-- source: pattern://cb8c63274fe346280de0ffd5 -->
            <property name="statusCode" value="401"/>
            <!-- source: pattern://cb8c63274fe346280de0ffd5 -->
            <property name="header.WWW-Authenticate" value="FIDO realm=&quot;${request:domain}&quot;"/>
        </AuthState>
        <AuthState name="Auth_Realm_Mobile_FIDO_UAF_DirectAuthDone" class="ch.nevis.esauth.auth.states.directResponse.DirectResponseState" final="true" resumeState="false">
            <!-- source: pattern://cb8c63274fe346280de0ffd5 -->
            <Response value="AUTH_DONE"/>
            <!-- source: pattern://cb8c63274fe346280de0ffd5 -->
            <property name="content" value="{&quot;status&quot;:&quot;completed&quot;,&quot;extId&quot;:&quot;${sess:ch.nevis.idm.User.extId}&quot;}"/>
            <!-- source: pattern://cb8c63274fe346280de0ffd5 -->
            <property name="contentType" value="application/json"/>
            <!-- source: pattern://cb8c63274fe346280de0ffd5 -->
            <property name="statusCode" value="200"/>
        </AuthState>
        <AuthState name="Auth_Realm_Mobile_FIDO_UAF_SecToken" class="ch.nevis.esauth.auth.states.sectoken.TokenAssemblerState" final="false">
            <!-- source: pattern://94e0b7b92ff2593f958c1eec -->
            <ResultCond name="default" next="Auth_Realm_Mobile_FIDO_UAF_Prepare_Done" authLevel="token.SecToken"/>
            <!-- source: pattern://94e0b7b92ff2593f958c1eec -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://94e0b7b92ff2593f958c1eec -->
                <Arg name="ch.nevis.isiweb4.response.status" value="403"/>
            </Response>
            <!-- source: pattern://94e0b7b92ff2593f958c1eec -->
            <property name="assembler" value="Token_Auth_Realm_Mobile_FIDO_UAF_SecToken"/>
            <!-- source: pattern://94e0b7b92ff2593f958c1eec -->
            <property name="key" value="token.SecToken"/>
            <!-- source: pattern://94e0b7b92ff2593f958c1eec -->
            <property name="generateNow" value="true"/>
        </AuthState>
        <AuthState name="Auth_Realm_Mobile_FIDO_UAF_Prepare_Done" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false">
            <!-- source: pattern://cb8c63274fe346280de0ffd5 -->
            <ResultCond name="default" next="Auth_Realm_Mobile_FIDO_UAF_Auth_Done"/>
            <!-- source: pattern://cb8c63274fe346280de0ffd5 -->
            <Response value="AUTH_DONE">
                <!-- source: pattern://cb8c63274fe346280de0ffd5 -->
                <Gui name="ContinueResponse"/>
            </Response>
            <!-- source: pattern://cb8c63274fe346280de0ffd5 -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/prepare_done.groovy"/>
        </AuthState>
        <AuthState name="Auth_Realm_Mobile_FIDO_UAF_Auth_Done" class="ch.nevis.esauth.auth.states.standard.AuthDone" final="false">
            <!-- source: pattern://cb8c63274fe346280de0ffd5 -->
            <Response value="AUTH_DONE">
                <!-- source: pattern://cb8c63274fe346280de0ffd5 -->
                <Gui name="ContinueResponse"/>
            </Response>
        </AuthState>
        <AuthState name="Auth_Realm_Recovery_Recovery_Auth" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false" resumeState="false">
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="default" next="Auth_Realm_Recovery_Recovery_Auth_dispatch"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <Response value="AUTH_CONTINUE"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/initializeRecovery.groovy"/>
        </AuthState>
        <AuthState name="Auth_Realm_Recovery_Recovery_Auth_dispatch" class="ch.nevis.esauth.auth.states.standard.ConditionalDispatcherState" final="false" resumeState="true">
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="cancel" next="Auth_Realm_Recovery_Recovery_handleCode"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="cancel, hasCaptchaInfos" next="Auth_Realm_Recovery_Recovery_handleCode"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="default" next="Auth_Realm_Recovery_Recovery_fetchCaptchaInfos"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="hasCaptchaInfos" next="Auth_Realm_Recovery_Recovery_Auth_loginFactorQuestion"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="hasCaptchaInfos, continue" next="Auth_Realm_Recovery_Recovery_fetchCaptchaResult"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="hasCaptchaInfos, invalidUrlTicket" next="Auth_Realm_Recovery_Recovery_Auth_enterEmail"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="hasCode" next="Auth_Realm_Recovery_Recovery_handleCode"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="hasCode, hasCaptchaInfos" next="Auth_Realm_Recovery_Recovery_handleCode"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="hasCode, hasSessionCode" next="Auth_Realm_Recovery_Recovery_handleCode"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="hasSessionCode" next="Auth_Realm_Recovery_Recovery_Auth_verifyUrlTicketIntro"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="hasSessionCode, hasCaptchaInfos" next="Auth_Realm_Recovery_Recovery_Auth_verifyUrlTicketIntro"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="invalidUrl" next="Auth_Realm_Recovery_Recovery_Auth_ticketInvalid"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="invalidUrl, hasCaptchaInfos" next="Auth_Realm_Recovery_Recovery_Auth_ticketInvalid"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="invalidUrl, hasCaptchaInfos, invalidUrlTicket" next="Auth_Realm_Recovery_Recovery_Auth_enterEmail"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="invalidUrl, hasCode" next="Auth_Realm_Recovery_Recovery_Auth_invalidateCode"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="invalidUrl, hasCode, hasCaptchaInfos" next="Auth_Realm_Recovery_Recovery_Auth_invalidateCode"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="invalidUrl, hasCode, hasCaptchaInfos, invalidUrlTicket" next="Auth_Realm_Recovery_Recovery_Auth_enterEmail"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="invalidUrl, invalidUrlTicket" next="Auth_Realm_Recovery_Recovery_fetchCaptchaInfos"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="invalidUrlTicket" next="Auth_Realm_Recovery_Recovery_fetchCaptchaInfos"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://584964c837512845d7940809 -->
                <Gui name="NoGui"/>
            </Response>
            <!-- source: pattern://584964c837512845d7940809 -->
            <property name="condition:cancel" value="#{inargs.containsKey('cancel')}"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <property name="condition:hasCode" value="#{inargs.containsKey('cd')}"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <property name="condition:hasSessionCode" value="#{sess.get('agov.recovery.code')}"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <property name="condition:invalidUrl" value="#{!inctx.getProperty('connection.actualURL').matches('^https://[^/]*/AUTH/RECOVERY/(\\?|\\?&amp;?language=[a-z][a-z]|\\?cd=.+)?$')}"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <property name="condition:invalidUrlTicket" value="${notes:invalidUrlTicket}"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <property name="condition:hasCaptchaInfos" value="#{sess.get('agov.recovery.captchaSettings.puzzleUrl')}"/>
        </AuthState>
        <AuthState name="Auth_Realm_Recovery_Recovery_handleCode" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false">
            <!-- source: pattern://db4acd487dc7e8b82de8abb4 -->
            <ResultCond name="error" next="Auth_Realm_Recovery_Authentication_Failed"/>
            <!-- source: pattern://db4acd487dc7e8b82de8abb4 -->
            <ResultCond name="exit.1" next="Auth_Realm_Recovery_Recovery_Auth"/>
            <!-- source: pattern://db4acd487dc7e8b82de8abb4 -->
            <ResultCond name="ok" next="Auth_Realm_Recovery_Recovery_Auth"/>
            <!-- source: pattern://db4acd487dc7e8b82de8abb4 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://db4acd487dc7e8b82de8abb4 -->
                <Arg name="ch.nevis.isiweb4.response.status" value="403"/>
            </Response>
            <!-- source: pattern://db4acd487dc7e8b82de8abb4 -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/recovery_handlecode.groovy"/>
        </AuthState>
        <AuthState name="Auth_Realm_Recovery_Recovery_fetchCaptchaInfos" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false">
            <!-- source: pattern://bea3ca0c85381d07d632be52 -->
            <ResultCond name="error" next="Auth_Realm_Recovery_Authentication_Failed"/>
            <!-- source: pattern://bea3ca0c85381d07d632be52 -->
            <ResultCond name="ok" next="Auth_Realm_Recovery_Recovery_Auth"/>
            <!-- source: pattern://bea3ca0c85381d07d632be52 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://bea3ca0c85381d07d632be52 -->
                <Arg name="ch.nevis.isiweb4.response.status" value="403"/>
            </Response>
            <!-- source: pattern://bea3ca0c85381d07d632be52 -->
            <property name="parameter.realIpHttpHeaderName" value="X-Forwarded-For"/>
            <!-- source: pattern://bea3ca0c85381d07d632be52 -->
            <property name="parameter.url" value="https://utility.agov-d.azure.adnovum.net/utility/api/v1/configinfo"/>
            <!-- source: pattern://bea3ca0c85381d07d632be52 -->
            <property name="scriptTraceGroup" value="AgovCaptcha"/>
            <!-- source: pattern://bea3ca0c85381d07d632be52 -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/recovery_fetchcaptchainfos.groovy"/>
        </AuthState>
        <AuthState name="Auth_Realm_Recovery_Recovery_Auth_loginFactorQuestion" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="true" resumeState="true">
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="doCancel" next="Auth_Realm_Recovery_Recovery_handleCode"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="loginFactorNo" next="Auth_Realm_Recovery_Recovery_Auth_reasonSelection"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="loginFactorYes" next="Auth_Realm_Recovery_Recovery_Auth_reasonSelection"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://584964c837512845d7940809 -->
                <Gui name="recovery_questionnaire_loginfactor">
                    <!-- source: pattern://584964c837512845d7940809 -->
                    <GuiElem name="intro" type="info" label="recovery.intro.message"/>
                    <!-- source: pattern://584964c837512845d7940809 -->
                    <GuiElem name="authRequestId" type="hidden" value="${sess:ch.nevis.auth.saml.request.id}" optional="true"/>
                    <!-- source: pattern://584964c837512845d7940809 -->
                    <GuiElem name="cancel" type="submit" label="cancel.button.label" value="cancel"/>
                    <!-- source: pattern://584964c837512845d7940809 -->
                    <GuiElem name="submit" type="submit" label="submit.button.label" value="submit"/>
                </Gui>
            </Response>
            <!-- source: pattern://584964c837512845d7940809 -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/questionnaireLfProcessing.groovy"/>
        </AuthState>
        <AuthState name="Auth_Realm_Recovery_Recovery_fetchCaptchaResult" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false">
            <!-- source: pattern://717094cbd4ddbadeab4b2cc1 -->
            <ResultCond name="error" next="Auth_Realm_Recovery_Recovery_Auth"/>
            <!-- source: pattern://717094cbd4ddbadeab4b2cc1 -->
            <ResultCond name="exit.1" next="Auth_Realm_Recovery_Recovery_Auth"/>
            <!-- source: pattern://717094cbd4ddbadeab4b2cc1 -->
            <ResultCond name="ok" next="Auth_Realm_Recovery_Recovery_verifyEmail"/>
            <!-- source: pattern://717094cbd4ddbadeab4b2cc1 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://717094cbd4ddbadeab4b2cc1 -->
                <Arg name="ch.nevis.isiweb4.response.status" value="403"/>
            </Response>
            <!-- source: pattern://717094cbd4ddbadeab4b2cc1 -->
            <property name="parameter.url" value="https://utility.agov-d.azure.adnovum.net/utility/api/v2/captcha/"/>
            <!-- source: pattern://717094cbd4ddbadeab4b2cc1 -->
            <property name="scriptTraceGroup" value="AgovCaptcha"/>
            <!-- source: pattern://717094cbd4ddbadeab4b2cc1 -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/recovery_fetchcaptcharesult.groovy"/>
        </AuthState>
        <AuthState name="Auth_Realm_Recovery_Recovery_Auth_enterEmail" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="true" resumeState="true">
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="cancel" next="Auth_Realm_Recovery_Recovery_handleCode"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="stay" next="Auth_Realm_Recovery_Recovery_Auth_enterEmail"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="verifyEmail" next="Auth_Realm_Recovery_Recovery_Auth_saveEmail"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://584964c837512845d7940809 -->
                <Gui name="recovery_intro_email">
                    <!-- source: pattern://584964c837512845d7940809 -->
                    <GuiElem name="intro" type="info" label="recovery.intro.message"/>
                    <!-- source: pattern://584964c837512845d7940809 -->
                    <GuiElem name="authRequestId" type="hidden" value="${sess:ch.nevis.auth.saml.request.id}" optional="true"/>
                    <!-- source: pattern://584964c837512845d7940809 -->
                    <GuiElem name="lasterror" type="error" label="${notes:lasterrorinfo}" value="${notes:lasterror}"/>
                    <!-- source: pattern://584964c837512845d7940809 -->
                    <GuiElem name="email" type="text" label="prompt.email" value="#{(sess.containsKey('agov.recovery.email'))?sess.get('agov.recovery.email'):inargs.getProperty('email', '')}" optional="true"/>
                    <!-- source: pattern://584964c837512845d7940809 -->
                    <GuiElem name="captchaSettings.enabled" type="hidden" value="${sess:agov.recovery.captchaSettings.enabled}" optional="true"/>
                    <!-- source: pattern://584964c837512845d7940809 -->
                    <GuiElem name="friendlyCaptchaSettings.siteKey" type="hidden" value="${sess:agov.recovery.captchaSettings.siteKey}" optional="true"/>
                    <!-- source: pattern://584964c837512845d7940809 -->
                    <GuiElem name="friendlyCaptchaSettings.puzzleUrl" type="hidden" value="${sess:agov.recovery.captchaSettings.puzzleUrl}" optional="true"/>
                    <!-- source: pattern://584964c837512845d7940809 -->
                    <GuiElem name="cancel" type="submit" label="cancel.button.label" value="cancel"/>
                    <!-- source: pattern://584964c837512845d7940809 -->
                    <GuiElem name="submit" type="submit" label="submit.button.label" value="submit"/>
                </Gui>
            </Response>
            <!-- source: pattern://584964c837512845d7940809 -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/sanitizeAndDispatchRecoveryEmailInput.groovy"/>
        </AuthState>
        <AuthState name="Auth_Realm_Recovery_Recovery_Auth_verifyUrlTicketIntro" class="ch.nevis.esauth.auth.states.standard.ConditionalDispatcherState" final="true" resumeState="true">
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="confirm" next="Auth_Realm_Recovery_Recovery_Auth_verifyUrlTicket"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://584964c837512845d7940809 -->
                <Gui name="recovery_start_info">
                    <!-- source: pattern://584964c837512845d7940809 -->
                    <GuiElem name="intro" type="info" label="recovery.intro.message"/>
                    <!-- source: pattern://584964c837512845d7940809 -->
                    <GuiElem name="authRequestId" type="hidden" value="${sess:ch.nevis.auth.saml.request.id}" optional="true"/>
                    <!-- source: pattern://584964c837512845d7940809 -->
                    <GuiElem name="email" type="text" label="prompt.email" value="${sess:ch.nevis.session.loginid}" optional="true"/>
                    <!-- source: pattern://584964c837512845d7940809 -->
                    <GuiElem name="cancel" type="submit" label="cancel.button.label" value="cancel"/>
                    <!-- source: pattern://584964c837512845d7940809 -->
                    <GuiElem name="submit" type="submit" label="submit.button.label" value="submit"/>
                </Gui>
            </Response>
            <!-- source: pattern://584964c837512845d7940809 -->
            <property name="condition:confirm" value="#{inargs.containsKey('confirm') &amp;&amp; inargs.getProperty('confirm') eq 'confirm'}"/>
        </AuthState>
        <AuthState name="Auth_Realm_Recovery_Recovery_Auth_ticketInvalid" class="ch.nevis.esauth.auth.states.standard.AuthGeneric" final="true" resumeState="true">
            <!-- source: pattern://584964c837512845d7940809 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://584964c837512845d7940809 -->
                <Arg name="nevis.transfer.type" value="redirect"/>
                <!-- source: pattern://584964c837512845d7940809 -->
                <Arg name="nevis.transfer.destination" value="/AUTH/RECOVERY/"/>
            </Response>
        </AuthState>
        <AuthState name="Auth_Realm_Recovery_Recovery_Auth_invalidateCode" class="ch.nevis.esauth.auth.states.standard.TransformAttributes" final="false" resumeState="false">
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="default" next="Auth_Realm_Recovery_Recovery_Auth"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <Response value="AUTH_CONTINUE"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <property name="sess:agov.recovery.code" value=""/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <property name="removeOnEmptyValue" value="true"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <property name="notes:invalidUrlTicket" value="was invalid"/>
        </AuthState>
        <AuthState name="Auth_Realm_Recovery_Authentication_Failed" class="ch.nevis.esauth.auth.states.standard.AuthError" final="false">
            <!-- source: pattern://bea3ca0c85381d07d632be52, pattern://db4acd487dc7e8b82de8abb4 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://bea3ca0c85381d07d632be52, pattern://db4acd487dc7e8b82de8abb4 -->
                <Gui name="Error">
                    <!-- source: pattern://bea3ca0c85381d07d632be52, pattern://db4acd487dc7e8b82de8abb4 -->
                    <GuiElem name="info" type="error" label="error_99"/>
                    <!-- source: pattern://bea3ca0c85381d07d632be52, pattern://db4acd487dc7e8b82de8abb4 -->
                    <GuiElem name="submit" type="button" label="continue.button.label"/>
                </Gui>
            </Response>
        </AuthState>
        <AuthState name="Auth_Realm_Recovery_Recovery_Auth_reasonSelection" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="true" resumeState="true">
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="doCancel" next="Auth_Realm_Recovery_Recovery_Auth_loginFactorQuestion"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="invalidReasons" next="Auth_Realm_Recovery_Recovery_Auth_noRecovery"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="validReasons" next="Auth_Realm_Recovery_Recovery_Auth_instructions"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://584964c837512845d7940809 -->
                <Gui name="recovery_questionnaire_reason_selection">
                    <!-- source: pattern://584964c837512845d7940809 -->
                    <GuiElem name="intro" type="info" label="recovery.intro.message"/>
                    <!-- source: pattern://584964c837512845d7940809 -->
                    <GuiElem name="authRequestId" type="hidden" value="${sess:ch.nevis.auth.saml.request.id}" optional="true"/>
                    <!-- source: pattern://584964c837512845d7940809 -->
                    <GuiElem name="reason" type="hidden" value="None" optional="true"/>
                    <!-- source: pattern://584964c837512845d7940809 -->
                    <GuiElem name="question" type="hidden" value="${sess:agov.recovery.moreThanOneLf}" optional="true"/>
                    <!-- source: pattern://584964c837512845d7940809 -->
                    <GuiElem name="cancel" type="submit" label="cancel.button.label" value="cancel"/>
                    <!-- source: pattern://584964c837512845d7940809 -->
                    <GuiElem name="continue" type="submit" label="submit.button.label" value="submit"/>
                </Gui>
            </Response>
            <!-- source: pattern://584964c837512845d7940809 -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/questionnaireReasonProcessing.groovy"/>
        </AuthState>
        <AuthState name="Auth_Realm_Recovery_Recovery_verifyEmail" class="ch.nevis.idm.authstate.IdmUserVerifyState" final="false" resumeState="false">
            <!-- source: pattern://0327ca909dfcaf2d332da104 -->
            <ResultCond name="clientNotFound" next="Auth_Realm_Recovery_Recovery_sendEmail031"/>
            <!-- source: pattern://0327ca909dfcaf2d332da104 -->
            <ResultCond name="default" next="Auth_Realm_Recovery_Recovery_sendEmail031"/>
            <!-- source: pattern://0327ca909dfcaf2d332da104 -->
            <ResultCond name="failed" next="Auth_Realm_Recovery_Recovery_sendEmail031"/>
            <!-- source: pattern://0327ca909dfcaf2d332da104 -->
            <ResultCond name="prospect" next="Auth_Realm_Recovery_Recovery_loadUser"/>
            <!-- source: pattern://0327ca909dfcaf2d332da104 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://0327ca909dfcaf2d332da104 -->
                <Gui name="internal_error">
                    <!-- source: pattern://0327ca909dfcaf2d332da104 -->
                    <GuiElem name="transferId" type="hidden" value="${request:traceId}" optional="true"/>
                </Gui>
            </Response>
            <propertyRef name="nevisIDM_Connector"/>
            <!-- source: pattern://0327ca909dfcaf2d332da104 -->
            <property name="user.loginId" value="${inargs:email}"/>
            <!-- source: pattern://0327ca909dfcaf2d332da104 -->
            <property name="user.loginType" value="EMAIL"/>
            <!-- source: pattern://0327ca909dfcaf2d332da104 -->
            <property name="client.name" value="agov"/>
            <!-- source: pattern://0327ca909dfcaf2d332da104 -->
            <property name="presetNoteValues" value="false"/>
            <!-- source: pattern://0327ca909dfcaf2d332da104 -->
            <property name="detaillevel.profile" value="HIGH"/>
            <!-- source: pattern://0327ca909dfcaf2d332da104 -->
            <property name="detaillevel.role" value="HIGH"/>
            <!-- source: pattern://0327ca909dfcaf2d332da104 -->
            <property name="detaillevel.authorization" value="HIGH"/>
            <!-- source: pattern://0327ca909dfcaf2d332da104 -->
            <property name="detaillevel.dataroom" value="HIGH"/>
        </AuthState>
        <AuthState name="Auth_Realm_Recovery_Recovery_Auth_saveEmail" class="ch.nevis.esauth.auth.states.standard.TransformAttributes" final="false" resumeState="true">
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="default" next="Auth_Realm_Recovery_Recovery_fetchCaptchaResult"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <Response value="AUTH_CONTINUE"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <property name="sess:agov.recovery.email" value="${inargs:email}"/>
        </AuthState>
        <AuthState name="Auth_Realm_Recovery_Recovery_Auth_verifyUrlTicket" class="ch.nevis.idm.authstate.IdmURLTicketVerifyState" final="false" resumeState="true">
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="failed" next="Auth_Realm_Recovery_Recovery_Auth_invalidateCode"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="lockWarn" next="Auth_Realm_Recovery_Recovery_Auth_invalidateCode"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="locked" next="Auth_Realm_Recovery_Recovery_Auth_invalidateCode"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="nowLocked" next="Auth_Realm_Recovery_Recovery_Auth_invalidateCode"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="ok" next="Auth_Realm_Recovery_Recovery_Auth_IdmGetPropertiesStateTicket" authLevel="auth.weak"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="tmpLocked" next="Auth_Realm_Recovery_Recovery_Auth_invalidateCode"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://584964c837512845d7940809 -->
                <Gui name="NoGui"/>
            </Response>
            <propertyRef name="nevisIDM_Connector"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <property name="user.ticket" value="${session:agov.recovery.code}"/>
        </AuthState>
        <AuthState name="Auth_Realm_Recovery_Recovery_Auth_noRecovery" class="ch.nevis.esauth.auth.states.standard.ConditionalDispatcherState" final="true" resumeState="true">
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="cancel" next="Auth_Realm_Recovery_Recovery_Auth_logReason"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://584964c837512845d7940809 -->
                <Gui name="recovery_questionnaire_no_recovery">
                    <!-- source: pattern://584964c837512845d7940809 -->
                    <GuiElem name="intro" type="info" label="recovery.intro.message"/>
                    <!-- source: pattern://584964c837512845d7940809 -->
                    <GuiElem name="authRequestId" type="hidden" value="${sess:ch.nevis.auth.saml.request.id}" optional="true"/>
                    <!-- source: pattern://584964c837512845d7940809 -->
                    <GuiElem name="cancel" type="submit" label="cancel.button.label" value="cancel"/>
                </Gui>
            </Response>
            <!-- source: pattern://584964c837512845d7940809 -->
            <property name="condition:cancel" value="${inargs:cancel}==cancel"/>
        </AuthState>
        <AuthState name="Auth_Realm_Recovery_Recovery_Auth_instructions" class="ch.nevis.esauth.auth.states.standard.ConditionalDispatcherState" final="true" resumeState="true">
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="cancel" next="Auth_Realm_Recovery_Recovery_Auth_loginFactorQuestion"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="continue" next="Auth_Realm_Recovery_Recovery_Auth_enterEmail"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://584964c837512845d7940809 -->
                <Gui name="recovery_questionnaire_instructions">
                    <!-- source: pattern://584964c837512845d7940809 -->
                    <GuiElem name="intro" type="info" label="recovery.intro.message"/>
                    <!-- source: pattern://584964c837512845d7940809 -->
                    <GuiElem name="authRequestId" type="hidden" value="${sess:ch.nevis.auth.saml.request.id}" optional="true"/>
                    <!-- source: pattern://584964c837512845d7940809 -->
                    <GuiElem name="cancel" type="submit" label="cancel.button.label" value="cancel"/>
                    <!-- source: pattern://584964c837512845d7940809 -->
                    <GuiElem name="submit" type="submit" label="submit.button.label" value="submit"/>
                </Gui>
            </Response>
            <!-- source: pattern://584964c837512845d7940809 -->
            <property name="condition:cancel" value="${inargs:cancel}==cancel"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <property name="condition:continue" value="${inargs:continue}==continue"/>
        </AuthState>
        <AuthState name="Auth_Realm_Recovery_Recovery_sendEmail031" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false">
            <!-- source: pattern://9f443ce76f9522dfae4c3aa0 -->
            <ResultCond name="error" next="Auth_Realm_Recovery_Auth_Failed"/>
            <!-- source: pattern://9f443ce76f9522dfae4c3aa0 -->
            <ResultCond name="ok" next="Auth_Realm_Recovery_Recovery_emailSent_screen"/>
            <!-- source: pattern://9f443ce76f9522dfae4c3aa0 -->
            <Response value="AUTH_CONTINUE"/>
            <!-- source: pattern://9f443ce76f9522dfae4c3aa0 -->
            <property name="parameter.url" value="https://utility.agov-d.azure.adnovum.net/utility/api/v1/email/031"/>
            <!-- source: pattern://9f443ce76f9522dfae4c3aa0 -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/recovery_sendemail031.groovy"/>
        </AuthState>
        <AuthState name="Auth_Realm_Recovery_Recovery_loadUser" class="ch.nevis.idm.authstate.IdmGetPropertiesState" final="false" resumeState="false">
            <!-- source: pattern://81ae3547acc02160f787a546 -->
            <ResultCond name="clientNotFound" next="Auth_Realm_Recovery_Recovery_emailSent_screen"/>
            <!-- source: pattern://81ae3547acc02160f787a546 -->
            <ResultCond name="default" next="Auth_Realm_Recovery_Recovery_emailSent_screen"/>
            <!-- source: pattern://81ae3547acc02160f787a546 -->
            <ResultCond name="ok" next="Auth_Realm_Recovery_Recovery_checkAccountState"/>
            <!-- source: pattern://81ae3547acc02160f787a546 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://81ae3547acc02160f787a546 -->
                <Gui name="internal_error">
                    <!-- source: pattern://81ae3547acc02160f787a546 -->
                    <GuiElem name="transferId" type="hidden" value="${request:traceId}" optional="true"/>
                </Gui>
            </Response>
            <propertyRef name="nevisIDM_Connector"/>
            <!-- source: pattern://81ae3547acc02160f787a546 -->
            <property name="forceDataReload" value="true"/>
            <!-- source: pattern://81ae3547acc02160f787a546 -->
            <property name="user.attributes" value="loginId,extId,firstName,name,email,gender,birthDate,language,sex,addressLine1,postalCode,city,country,street,houseNumber,locality,mobile"/>
            <!-- source: pattern://81ae3547acc02160f787a546 -->
            <property name="user.properties" value="eIdNumber,placeOfBirth,svnr,nationality"/>
            <!-- source: pattern://81ae3547acc02160f787a546 -->
            <property name="userExtId" value="${sess:ch.nevis.session.userid}"/>
            <!-- source: pattern://81ae3547acc02160f787a546 -->
            <property name="chooseDefaultProfile" value="true"/>
            <!-- source: pattern://81ae3547acc02160f787a546 -->
            <property name="client.name" value="agov"/>
            <!-- source: pattern://81ae3547acc02160f787a546 -->
            <property name="detaillevel.profile" value="HIGH"/>
            <!-- source: pattern://81ae3547acc02160f787a546 -->
            <property name="detaillevel.role" value="HIGH"/>
            <!-- source: pattern://81ae3547acc02160f787a546 -->
            <property name="detaillevel.authorization" value="HIGH"/>
            <!-- source: pattern://81ae3547acc02160f787a546 -->
            <property name="detaillevel.dataroom" value="HIGH"/>
        </AuthState>
        <AuthState name="Auth_Realm_Recovery_Recovery_Auth_IdmGetPropertiesStateTicket" class="ch.nevis.idm.authstate.IdmGetPropertiesState" final="false" resumeState="false">
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="clientNotFound" next="Auth_Realm_Recovery_Auth_Failed"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="default" next="Auth_Realm_Recovery_Auth_Failed"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="ok" next="Auth_Realm_Recovery_Recovery_Auth_verifyUser"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://584964c837512845d7940809 -->
                <Gui name="internal_error">
                    <!-- source: pattern://584964c837512845d7940809 -->
                    <GuiElem name="transferId" type="hidden" value="${request:traceId}" optional="true"/>
                </Gui>
            </Response>
            <propertyRef name="nevisIDM_Connector"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <property name="forceDataReload" value="true"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <property name="user.attributes" value="loginId,extId,firstName,name,email,gender,birthDate,language,sex,addressLine1,postalCode,city,country,street,houseNumber,locality,mobile"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <property name="user.properties" value="eIdNumber,placeOfBirth,svnr,nationality"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <property name="userExtId" value="${request:userid}"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <property name="chooseDefaultProfile" value="true"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <property name="client.name" value="agov"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <property name="detaillevel.profile" value="HIGH"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <property name="detaillevel.role" value="HIGH"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <property name="detaillevel.authorization" value="HIGH"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <property name="detaillevel.dataroom" value="HIGH"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <property name="detaillevel.credential" value="HIGH"/>
        </AuthState>
        <AuthState name="Auth_Realm_Recovery_Recovery_Auth_logReason" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false" resumeState="false">
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="ok" next="Auth_Realm_Recovery_Recovery_handleCode"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://584964c837512845d7940809 -->
                <Gui name="not_used"/>
            </Response>
            <!-- source: pattern://584964c837512845d7940809 -->
            <property name="scriptTraceGroup" value="AGOV-ACCT"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/logRecoveryReason.groovy"/>
        </AuthState>
        <AuthState name="Auth_Realm_Recovery_Auth_Failed" class="ch.nevis.esauth.auth.states.standard.AuthError" final="false">
            <!-- source: pattern://473f9d6b4ab9d61c1eb8c689 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://473f9d6b4ab9d61c1eb8c689 -->
                <Gui name="Error">
                    <!-- source: pattern://473f9d6b4ab9d61c1eb8c689 -->
                    <GuiElem name="info" type="error" label="error_99"/>
                    <!-- source: pattern://473f9d6b4ab9d61c1eb8c689 -->
                    <GuiElem name="submit" type="button" label="continue.button.label"/>
                </Gui>
            </Response>
        </AuthState>
        <AuthState name="Auth_Realm_Recovery_Recovery_emailSent_screen" class="ch.nevis.esauth.auth.states.standard.ConditionalDispatcherState" final="true" resumeState="true">
            <!-- source: pattern://6364d27d1ca954be8ef7cb46 -->
            <ResultCond name="default" next="Auth_Realm_Recovery_Recovery_emailSent_screen"/>
            <!-- source: pattern://6364d27d1ca954be8ef7cb46 -->
            <ResultCond name="hasCode" next="Auth_Realm_Recovery_Recovery_handleCode"/>
            <!-- source: pattern://6364d27d1ca954be8ef7cb46 -->
            <ResultCond name="noEmail" next="Auth_Realm_Recovery_Recovery_emailSent_screen_noEmail"/>
            <!-- source: pattern://6364d27d1ca954be8ef7cb46 -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://6364d27d1ca954be8ef7cb46 -->
                <Gui name="recovery_intro_email_sent">
                    <!-- source: pattern://6364d27d1ca954be8ef7cb46 -->
                    <GuiElem name="authRequestId" type="hidden" value="${sess:ch.nevis.auth.saml.request.id}" optional="true"/>
                    <!-- source: pattern://6364d27d1ca954be8ef7cb46 -->
                    <GuiElem name="noEmail" type="submit" label="not used" value="not used" optional="true"/>
                </Gui>
            </Response>
            <!-- source: pattern://6364d27d1ca954be8ef7cb46 -->
            <property name="condition:noEmail" value="#{inargs.containsKey('noEmail')}"/>
            <!-- source: pattern://6364d27d1ca954be8ef7cb46 -->
            <property name="condition:hasCode" value="#{inargs.containsKey('cd')}"/>
        </AuthState>
        <AuthState name="Auth_Realm_Recovery_Recovery_checkAccountState" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false" resumeState="true">
            <!-- source: pattern://249d97a8932fe97d36112ff3 -->
            <ResultCond name="error" next="Auth_Realm_Recovery_Auth_Failed"/>
            <!-- source: pattern://249d97a8932fe97d36112ff3 -->
            <ResultCond name="notFullyRegistered" next="Auth_Realm_Recovery_Recovery_sendEmail031b"/>
            <!-- source: pattern://249d97a8932fe97d36112ff3 -->
            <ResultCond name="ok" next="Auth_Realm_Recovery_Recovery_createURLTicket"/>
            <!-- source: pattern://249d97a8932fe97d36112ff3 -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://249d97a8932fe97d36112ff3 -->
                <Gui name="NoGui"/>
            </Response>
            <!-- source: pattern://249d97a8932fe97d36112ff3 -->
            <property name="scriptTraceGroup" value="Recovery"/>
            <!-- source: pattern://249d97a8932fe97d36112ff3 -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/recovery-checkAccount.groovy"/>
        </AuthState>
        <AuthState name="Auth_Realm_Recovery_Recovery_Auth_verifyUser" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false" resumeState="true">
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="alreadyInRecovery" next="Auth_Realm_Recovery_Recovery_ongoing"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="error" next="Auth_Realm_Recovery_Auth_Failed"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="needCode" next="Auth_Realm_Recovery_Recovery_Auth_IdmUserIdPasswordLogin"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="notFullyRegistered" next="Auth_Realm_Recovery_Recovery_sendEmail031b"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="ok" next="Auth_Realm_Recovery_Recovery_Auth_prepareRedirect"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://584964c837512845d7940809 -->
                <Gui name="Recovery_AuthDialog" label="op-onboarding.intro.title">
                    <!-- source: pattern://584964c837512845d7940809 -->
                    <GuiElem name="info" type="info" label="op-onboarding.intro.message"/>
                    <!-- source: pattern://584964c837512845d7940809 -->
                    <GuiElem name="lasterror" type="error" label="${notes:lasterrorinfo}" value="${notes:lasterror}"/>
                    <!-- source: pattern://584964c837512845d7940809 -->
                    <GuiElem name="submit" type="button" label="continue.button.label" value="go"/>
                </Gui>
            </Response>
            <!-- source: pattern://584964c837512845d7940809 -->
            <property name="parameter.baseUrl" value="idm.adn-agov-nevisidm-admin-01-uat"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <property name="parameter.idm.httpclient.tls.trustStoreRef" value="Recovery_Auth"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <property name="scriptTraceGroup" value="Recovery"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/recovery-processing.groovy"/>
        </AuthState>
        <AuthState name="Auth_Realm_Recovery_Recovery_emailSent_screen_noEmail" class="ch.nevis.esauth.auth.states.standard.TransformAttributes" final="false" resumeState="false">
            <!-- source: pattern://6364d27d1ca954be8ef7cb46 -->
            <ResultCond name="default" next="Auth_Realm_Recovery_Recovery_Auth"/>
            <!-- source: pattern://6364d27d1ca954be8ef7cb46 -->
            <Response value="AUTH_CONTINUE"/>
            <!-- source: pattern://6364d27d1ca954be8ef7cb46 -->
            <property name="sess:agov.recovery.code" value=""/>
            <!-- source: pattern://6364d27d1ca954be8ef7cb46 -->
            <property name="removeOnEmptyValue" value="true"/>
            <!-- source: pattern://6364d27d1ca954be8ef7cb46 -->
            <property name="notes:invalidUrlTicket" value="not received"/>
        </AuthState>
        <AuthState name="Auth_Realm_Recovery_Recovery_sendEmail031b" class="ch.nevis.idm.authstate.IdmUserNotifyState" final="false" resumeState="false">
            <!-- source: pattern://ae023be7e097522c74e31d17 -->
            <ResultCond name="default" next="Auth_Realm_Recovery_Recovery_emailSent_screen"/>
            <!-- source: pattern://ae023be7e097522c74e31d17 -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://ae023be7e097522c74e31d17 -->
                <Gui name="NoGui"/>
            </Response>
            <!-- source: pattern://ae023be7e097522c74e31d17 -->
            <property name="sendingMethod" value="EMAIL"/>
            <!-- source: pattern://ae023be7e097522c74e31d17 -->
            <property name="notificationType" value="USER_NOTIFICATION_1"/>
        </AuthState>
        <AuthState name="Auth_Realm_Recovery_Recovery_createURLTicket" class="ch.nevis.idm.authstate.IdmCreateCredentialState" final="false" resumeState="true">
            <!-- source: pattern://9a1d3c6052019748d3510261 -->
            <ResultCond name="credentialExists" next="Auth_Realm_Recovery_Recovery_emailSent_screen"/>
            <!-- source: pattern://9a1d3c6052019748d3510261 -->
            <ResultCond name="failed" next="Auth_Realm_Recovery_Recovery_emailSent_screen"/>
            <!-- source: pattern://9a1d3c6052019748d3510261 -->
            <ResultCond name="ok" next="Auth_Realm_Recovery_Recovery_createURLTicket_logReason"/>
            <!-- source: pattern://9a1d3c6052019748d3510261 -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://9a1d3c6052019748d3510261 -->
                <Gui name="NoGui"/>
            </Response>
            <!-- source: pattern://9a1d3c6052019748d3510261 -->
            <property name="cred.type" value="url_ticket"/>
            <!-- source: pattern://9a1d3c6052019748d3510261 -->
            <property name="cred.modificationComment" value="New ticket ordered"/>
            <!-- source: pattern://9a1d3c6052019748d3510261 -->
            <property name="recreateIfExists" value="true"/>
        </AuthState>
        <AuthState name="Auth_Realm_Recovery_Recovery_ongoing" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="true" resumeState="true">
            <!-- source: pattern://1d38203c48e017b5b3812385 -->
            <ResultCond name="ok" next="Auth_Realm_Recovery_Recovery_redirectAgovMe"/>
            <!-- source: pattern://1d38203c48e017b5b3812385 -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://1d38203c48e017b5b3812385 -->
                <Gui name="recovery_on_going" label="not.used.label">
                    <!-- source: pattern://1d38203c48e017b5b3812385 -->
                    <GuiElem name="authRequestId" type="hidden" label="not.used.label" value="${sess:ch.nevis.auth.saml.request.id}" optional="true"/>
                    <!-- source: pattern://1d38203c48e017b5b3812385 -->
                    <GuiElem name="recovery" type="button" label="not.used" value="recovery" optional="true"/>
                </Gui>
            </Response>
            <!-- source: pattern://1d38203c48e017b5b3812385 -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/recovery_ongoing.groovy"/>
        </AuthState>
        <AuthState name="Auth_Realm_Recovery_Recovery_Auth_IdmUserIdPasswordLogin" class="ch.nevis.idm.authstate.IdmPasswordVerifyState" final="true" resumeState="true">
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="clientNotFound" next="Auth_Realm_Recovery_Auth_Failed"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="disabled" next="Auth_Realm_Recovery_Recovery_Auth_saveDetailStatus"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="failed" next="Auth_Realm_Recovery_Recovery_Auth_saveDetailStatus"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="lockWarn" next="Auth_Realm_Recovery_Recovery_Auth_saveDetailStatus"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="locked" next="Auth_Realm_Recovery_Recovery_Auth_saveDetailStatus"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="no_code-true" next="Auth_Realm_Recovery_Recovery_Auth_codeSkipped"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="nowLocked" next="Auth_Realm_Recovery_Recovery_Auth_saveDetailStatus"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="ok" next="Auth_Realm_Recovery_Recovery_Auth_codeVerified"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="pwChange" next="Auth_Realm_Recovery_Recovery_Auth_saveDetailStatus"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="tmpLocked" next="Auth_Realm_Recovery_Recovery_Auth_saveDetailStatus"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://584964c837512845d7940809 -->
                <Gui name="recovery_check_code">
                    <!-- source: pattern://584964c837512845d7940809 -->
                    <GuiElem name="lasterror" type="error" label="${notes:lasterrorinfo}" value="#{ notes.containsKey('lasterror') ? ((notes.getProperty('lasterror') == '1' or notes.getProperty('lasterror') == '3') ? 'check' : 'locked' ): '' }"/>
                    <!-- source: pattern://584964c837512845d7940809 -->
                    <GuiElem name="code" type="pw-text" label="not-used" value="hide-input-in-logs" optional="true"/>
                    <!-- source: pattern://584964c837512845d7940809 -->
                    <GuiElem name="no_code" type="checkbox" label="not-used" value="true" optional="true"/>
                    <!-- source: pattern://584964c837512845d7940809 -->
                    <GuiElem name="authRequestId" type="hidden" value="${sess:ch.nevis.auth.saml.request.id}" optional="true"/>
                </Gui>
            </Response>
            <propertyRef name="nevisIDM_Connector"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <property name="user.loginType" value="LOGINID"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <property name="credential.type" value="contextPassword"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <property name="credential.context" value="RECOVERY"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <property name="user.password" value="#{inargs.getProperty('code').replace('-', '')}"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <property name="user.loginid" value="${sess:ch.adnovum.nevisidm.user.loginId}"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <property name="client.name" value="agov"/>
        </AuthState>
        <AuthState name="Auth_Realm_Recovery_Recovery_Auth_prepareRedirect" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false" resumeState="true">
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="back" next="Auth_Realm_Recovery_Recovery_Auth_IdmGetPropertiesStateTicket"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="redirect" next="Auth_Realm_Recovery_Recovery_authWithNewCredentials"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <Response value="AUTH_CONTINUE"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <property name="scriptTraceGroup" value="Recovery"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/recovery-prepareRedirect.groovy"/>
        </AuthState>
        <AuthState name="Auth_Realm_Recovery_Recovery_createURLTicket_logReason" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false" resumeState="false">
            <!-- source: pattern://9a1d3c6052019748d3510261 -->
            <ResultCond name="ok" next="Auth_Realm_Recovery_Recovery_emailSent_screen"/>
            <!-- source: pattern://9a1d3c6052019748d3510261 -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://9a1d3c6052019748d3510261 -->
                <Gui name="not_used"/>
            </Response>
            <!-- source: pattern://9a1d3c6052019748d3510261 -->
            <property name="scriptTraceGroup" value="AGOV-ACCT"/>
            <!-- source: pattern://9a1d3c6052019748d3510261 -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/logRecoveryReason.groovy"/>
        </AuthState>
        <AuthState name="Auth_Realm_Recovery_Recovery_redirectAgovMe" class="ch.nevis.esauth.auth.states.saml.IdentityProviderState" final="false" resumeState="false">
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <ResultCond name="ok" next="Auth_Realm_Recovery_Recovery_redirectAgovMe_Handle_Redirect"/>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://6061abea33a234fad73897b7 -->
                <Gui name="internal_error">
                    <!-- source: pattern://6061abea33a234fad73897b7 -->
                    <GuiElem name="transferId" type="hidden" value="${request:traceId}" optional="true"/>
                </Gui>
            </Response>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <property name="in.binding" value="none"/>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <property name="out.binding" value="internal"/>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <property name="out.sign" value="Response Assertion"/>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <property name="out.signatureKeyInfo" value="Certificate"/>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <property name="out.ttl" value="20"/>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <property name="out.extension.Bearer" value="ch.nevis.esauth.auth.states.saml.extensions.SubjectConfirmationExtender"/>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <property name="Bearer.ttl" value="20"/>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <property name="out.keystoreref" value="Store_IDP_AGOV"/>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <property name="out.keyobjectref" value="Signer_IDP_AGOV"/>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <property name="spURL" value="https://ob.agov-w.azure.adnovum.net/mock-me/process"/>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <property name="acsUrlWhitelist.uris" value="not used"/>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <property name="out.authnContextClassRef" value="${sess:agov.recovery.authnContextClassRef}"/>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/05/identity/claims/authenticatedWith" value="${sess:agov.recovery.authenticatedWith}"/>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/11/identity/claims/currentAgovAq" value="${sess:agov.recovery.currentAgovAq}"/>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <property name="out.attribute.http://schemas.agov.ch/ws/2024/01/identity/claims/currentIdVerification" value="${sess:agov.recovery.currentIdVerification}"/>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/05/identity/claims/qa/dateOfVerification" value="${sess:agov.recovery.currentAgovAqRoleValidFrom}"/>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <property name="out.attributeDelimiter" value=",\s*"/>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <property name="out.subject" value="${sess:ch.adnovum.nevisidm.user.extId}"/>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <property name="out.subject.format" value="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"/>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <property name="out.issuer" value="https://auth.agov-w.azure.adnovum.net/SAML2/"/>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <property name="out.audienceRestriction" value="https://ob.agov-w.azure.adnovum.net/mock-me/process"/>
        </AuthState>
        <AuthState name="Auth_Realm_Recovery_Recovery_Auth_saveDetailStatus" class="ch.nevis.esauth.auth.states.standard.TransformAttributes" final="false" resumeState="false">
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="default" next="Auth_Realm_Recovery_Recovery_Auth_IdmUserIdPasswordLogin"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <Response value="AUTH_CONTINUE"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <property name="sess:agov.recovery.codeDetailStatus" value="${notes:lasterrorinfo} (${notes:lasterror})"/>
        </AuthState>
        <AuthState name="Auth_Realm_Recovery_Recovery_Auth_codeSkipped" class="ch.nevis.esauth.auth.states.standard.TransformAttributes" final="false" resumeState="false">
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="default" next="Auth_Realm_Recovery_Recovery_Auth_prepareRedirect"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <Response value="AUTH_CONTINUE"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <property name="sess:agov.recovery.codeStatus" value="skipped"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <property name="${sess:agov.recovery.codeDetailStatus}==n/a?sess:agov.recovery.codeDetailStatus" value="directly skipped by user"/>
        </AuthState>
        <AuthState name="Auth_Realm_Recovery_Recovery_Auth_codeVerified" class="ch.nevis.esauth.auth.states.standard.TransformAttributes" final="false" resumeState="false">
            <!-- source: pattern://584964c837512845d7940809 -->
            <ResultCond name="default" next="Auth_Realm_Recovery_Recovery_Auth_prepareRedirect"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <Response value="AUTH_CONTINUE"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <property name="sess:agov.recovery.authenticatedWith" value="urn:qa.agov.ch:names:tc:authfactor:emailAndCode"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <property name="sess:agov.recovery.codeStatus" value="verified"/>
            <!-- source: pattern://584964c837512845d7940809 -->
            <property name="sess:agov.recovery.codeDetailStatus" value="n/a"/>
        </AuthState>
        <AuthState name="Auth_Realm_Recovery_Recovery_authWithNewCredentials" class="ch.nevis.esauth.auth.states.standard.ConditionalDispatcherState" final="false" resumeState="false">
            <!-- source: pattern://c1c0941f54cc36340578ff5f -->
            <ResultCond name="default" next="Auth_Realm_Recovery_Auth_Failed"/>
            <!-- source: pattern://c1c0941f54cc36340578ff5f -->
            <ResultCond name="loginWithFido2" next="Auth_Realm_Recovery_Recovery_fido2Login"/>
            <!-- source: pattern://c1c0941f54cc36340578ff5f -->
            <ResultCond name="loginWithFidoUAF" next="Auth_Realm_Recovery_Recovery_mobile_nless_auth"/>
            <!-- source: pattern://c1c0941f54cc36340578ff5f -->
            <ResultCond name="notNeeded" next="Auth_Realm_Recovery_Recovery_redirectAgovMe"/>
            <!-- source: pattern://c1c0941f54cc36340578ff5f -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://c1c0941f54cc36340578ff5f -->
                <Gui name="AuthErrorDialog"/>
            </Response>
            <!-- source: pattern://c1c0941f54cc36340578ff5f -->
            <property name="condition:loginWithFido2" value="${sess:agov.recovery.newLoginFactor}==FIDO2"/>
            <!-- source: pattern://c1c0941f54cc36340578ff5f -->
            <property name="condition:loginWithFidoUAF" value="${sess:agov.recovery.newLoginFactor}==ACCESS_APP"/>
            <!-- source: pattern://c1c0941f54cc36340578ff5f -->
            <property name="condition:notNeeded" value="${sess:agov.recovery.newLoginFactor}==NONE"/>
        </AuthState>
        <AuthState name="Auth_Realm_Recovery_Recovery_redirectAgovMe_Handle_Redirect" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false" resumeState="false">
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <ResultCond name="ok" next="Auth_Realm_Recovery_Prepare_Done"/>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://6061abea33a234fad73897b7 -->
                <Gui name="not_used"/>
            </Response>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <property name="scriptTraceGroup" value="AGOV-ACCT"/>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <property name="parameter.agovmedirecturl" value="https://ob.agov-w.azure.adnovum.net/mock-me/process"/>
            <!-- source: pattern://6061abea33a234fad73897b7 -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/handleRedirectRecovery.groovy"/>
        </AuthState>
        <AuthState name="Auth_Realm_Recovery_Recovery_fido2Login" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false" resumeState="true">
            <!-- source: pattern://54c1b68431bc2e03b61edcaa -->
            <ResultCond name="cancel" next="Auth_Realm_Recovery_Auth_Failed"/>
            <!-- source: pattern://54c1b68431bc2e03b61edcaa -->
            <ResultCond name="error" next="Auth_Realm_Recovery_Auth_Failed"/>
            <!-- source: pattern://54c1b68431bc2e03b61edcaa -->
            <ResultCond name="ok" next="Auth_Realm_Recovery_Recovery_redirectAgovMe"/>
            <!-- source: pattern://54c1b68431bc2e03b61edcaa -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://54c1b68431bc2e03b61edcaa -->
                <Gui name="recovery_fidokey_auth" label="title.login.fido2">
                    <!-- source: pattern://54c1b68431bc2e03b61edcaa -->
                    <GuiElem name="securityKey" type="hidden" value="${sess:agov.recovery.securityKey}" optional="true"/>
                </Gui>
                <!-- source: pattern://54c1b68431bc2e03b61edcaa -->
                <Arg name="fido2UserVerification" value="required"/>
            </Response>
            <!-- source: pattern://54c1b68431bc2e03b61edcaa -->
            <property name="parameter.cancel" value="OnCancel_Dispatch"/>
            <!-- source: pattern://54c1b68431bc2e03b61edcaa -->
            <property name="parameter.fido" value="fido2:9443"/>
            <!-- source: pattern://54c1b68431bc2e03b61edcaa -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/recovery_fido2_auth.groovy"/>
        </AuthState>
        <AuthState name="Auth_Realm_Recovery_Recovery_mobile_nless_auth" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false" resumeState="true">
            <!-- source: pattern://4bc453bf68139ee87966b0c7 -->
            <ResultCond name="default" next="Auth_Realm_Recovery_Recovery_mobile_nless_auth"/>
            <!-- source: pattern://4bc453bf68139ee87966b0c7 -->
            <ResultCond name="ok" next="Auth_Realm_Recovery_Recovery_mobile_nless_auth_Processing"/>
            <!-- source: pattern://4bc453bf68139ee87966b0c7 -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://4bc453bf68139ee87966b0c7 -->
                <Gui name="recovery_accessapp_auth">
                    <!-- source: pattern://4bc453bf68139ee87966b0c7 -->
                    <GuiElem name="authRequestId" type="hidden" value="${sess:ch.nevis.auth.saml.request.id}" optional="true"/>
                    <!-- source: pattern://4bc453bf68139ee87966b0c7 -->
                    <GuiElem name="fallback" type="button" label="mobile_auth.cancel.button.label" value="true" optional="true"/>
                    <!-- source: pattern://4bc453bf68139ee87966b0c7 -->
                    <GuiElem name="accessApp" type="hidden" value="${sess:agov.recovery.accessapp}" optional="true"/>
                </Gui>
            </Response>
            <!-- source: pattern://4bc453bf68139ee87966b0c7 -->
            <property name="scriptTraceGroup" value="AGOV-ACCT"/>
            <!-- source: pattern://4bc453bf68139ee87966b0c7 -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/Recovery_mobile_nless_auth.groovy"/>
            <!-- source: pattern://4bc453bf68139ee87966b0c7 -->
            <property name="parameter.agovmeregistrationurl" value="https://ob.agov-w.azure.adnovum.net/mock-me/registration"/>
            <!-- source: pattern://4bc453bf68139ee87966b0c7 -->
            <property name="parameter.recoveryurl" value="https://auth.agov-w.azure.adnovum.net/AUTH/RECOVERY/"/>
        </AuthState>
        <AuthState name="Auth_Realm_Recovery_Prepare_Done" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false">
            <!-- source: pattern://6061abea33a234fad73897b7, pattern://204c22beaccdfd22727af378 -->
            <ResultCond name="default" next="Auth_Realm_Recovery_Auth_Done"/>
            <!-- source: pattern://6061abea33a234fad73897b7, pattern://204c22beaccdfd22727af378 -->
            <Response value="AUTH_DONE">
                <!-- source: pattern://6061abea33a234fad73897b7, pattern://204c22beaccdfd22727af378 -->
                <Gui name="ContinueResponse"/>
            </Response>
            <!-- source: pattern://6061abea33a234fad73897b7, pattern://204c22beaccdfd22727af378 -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/prepare_done.groovy"/>
        </AuthState>
        <AuthState name="Auth_Realm_Recovery_Recovery_mobile_nless_auth_Processing" class="ch.nevis.auth.fido.uaf.authstate.OutOfBandFidoUafAuthState" final="false" resumeState="false">
            <!-- source: pattern://4bc453bf68139ee87966b0c7 -->
            <ResultCond name="error" next="Auth_Realm_Recovery_Recovery_mobile_nless_auth_Processing"/>
            <!-- source: pattern://4bc453bf68139ee87966b0c7 -->
            <ResultCond name="failed" next="Auth_Realm_Recovery_Recovery_mobile_nless_auth"/>
            <!-- source: pattern://4bc453bf68139ee87966b0c7 -->
            <ResultCond name="ok" next="Auth_Realm_Recovery_Recovery_mobile_nless_auth_PostProcessing"/>
            <!-- source: pattern://4bc453bf68139ee87966b0c7 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://4bc453bf68139ee87966b0c7 -->
                <Arg name="ch.nevis.isiweb4.response.status" value="403"/>
            </Response>
            <!-- source: pattern://4bc453bf68139ee87966b0c7 -->
            <property name="fidoUafServerUrl" value="https://fido-uaf:9443/nevisfido"/>
            <!-- source: pattern://4bc453bf68139ee87966b0c7 -->
            <property name="dispatcher" value="link"/>
            <!-- source: pattern://4bc453bf68139ee87966b0c7 -->
            <property name="httpclient.tls.trustStoreRef" value="Recovery_mobile_nless_auth"/>
            <!-- source: pattern://4bc453bf68139ee87966b0c7 -->
            <property name="fidoUafUsername" value="${sess:ch.nevis.idm.User.extId}"/>
            <!-- source: pattern://4bc453bf68139ee87966b0c7 -->
            <property name="dispatchTargetId" value="${sess:agov.recovery.accessapp.dispatchTargetId}"/>
        </AuthState>
        <AuthState name="Auth_Realm_Recovery_Auth_Done" class="ch.nevis.esauth.auth.states.standard.AuthDone" final="false">
            <!-- source: pattern://6061abea33a234fad73897b7, pattern://204c22beaccdfd22727af378 -->
            <Response value="AUTH_DONE">
                <!-- source: pattern://6061abea33a234fad73897b7, pattern://204c22beaccdfd22727af378 -->
                <Gui name="ContinueResponse"/>
            </Response>
        </AuthState>
        <AuthState name="Auth_Realm_Recovery_Recovery_mobile_nless_auth_PostProcessing" class="ch.nevis.esauth.auth.states.standard.TransformAttributes" final="false" resumeState="false">
            <!-- source: pattern://4bc453bf68139ee87966b0c7 -->
            <ResultCond name="default" next="Auth_Realm_Recovery_Recovery_redirectAgovMe"/>
            <!-- source: pattern://4bc453bf68139ee87966b0c7 -->
            <Response value="AUTH_CONTINUE"/>
            <!-- source: pattern://4bc453bf68139ee87966b0c7 -->
            <property name="sess:agov.recovery.authenticatedWith" value="urn:qa.agov.ch:names:tc:authfactor:accessapp"/>
        </AuthState>
        <AuthState name="Auth_Realm_Recovery_Selector" class="ch.nevis.esauth.auth.states.standard.ConditionalDispatcherState" final="false">
            <!-- source: pattern://204c22beaccdfd22727af378 -->
            <ResultCond name="nomatch" next="Auth_Realm_Recovery_Recovery_Auth"/>
            <!-- source: pattern://204c22beaccdfd22727af378 -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://204c22beaccdfd22727af378 -->
                <Arg name="ch.nevis.isiweb4.response.status" value="403"/>
            </Response>
        </AuthState>
        <AuthState name="NotUsed_Auth_Realm_NotUsed_Pwd_Login" class="ch.nevis.idm.authstate.IdmPasswordVerifyState" final="false">
            <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
            <ResultCond name="clientNotFound" next="NotUsed_Auth_Realm_NotUsed_Pwd_Login"/>
            <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
            <ResultCond name="disabled" next="NotUsed_Auth_Realm_NotUsed_Pwd_Login"/>
            <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
            <ResultCond name="failed" next="NotUsed_Auth_Realm_NotUsed_Pwd_Login"/>
            <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
            <ResultCond name="lockWarn" next="NotUsed_Auth_Realm_NotUsed_Pwd_Login"/>
            <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
            <ResultCond name="locked" next="NotUsed_Auth_Realm_NotUsed_Pwd_Login"/>
            <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
            <ResultCond name="nowLocked" next="NotUsed_Auth_Realm_NotUsed_Pwd_Login"/>
            <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
            <ResultCond name="ok" next="NotUsed_Auth_Realm_NotUsed_Pwd_Login-IdmPostProcessing" authLevel="1"/>
            <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
            <ResultCond name="pwChange" next="NotUsed_Auth_Realm_NotUsed_Pwd_Login-IdmPasswordChange"/>
            <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
            <ResultCond name="tmpLocked" next="NotUsed_Auth_Realm_NotUsed_Pwd_Login"/>
            <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
                <Gui name="AuthUidPwDialog" label="title.login">
                    <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
                    <GuiElem name="lasterror" type="error" label="${notes:lasterrorinfo}" value="${notes:lasterror}"/>
                    <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
                    <GuiElem name="info" type="info" label="info.login"/>
                    <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
                    <GuiElem name="isiwebuserid" type="text" label="prompt.userid" value="${notes.loginid}"/>
                    <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
                    <GuiElem name="isiwebpasswd" type="pw-text" label="prompt.password"/>
                    <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
                    <GuiElem name="submit" type="button" label="continue.button.label"/>
                </Gui>
            </Response>
            <propertyRef name="nevisIDM_Connector"/>
            <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
            <property name="user.loginType" value="LOGINID"/>
            <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
            <property name="client.name" value="Default"/>
        </AuthState>
        <AuthState name="NotUsed_Auth_Realm_NotUsed_Pwd_Login-IdmPostProcessing" class="ch.nevis.idm.authstate.IdmGetPropertiesState" final="false">
            <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
            <ResultCond name="SOAP:showGui" next="NotUsed_Auth_Realm_Prepare_Done"/>
            <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
            <ResultCond name="default" next="NotUsed_Auth_Realm_Prepare_Done"/>
            <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
            <ResultCond name="ok" next="NotUsed_Auth_Realm_Prepare_Done" startOver="true"/>
            <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
            <ResultCond name="showGui" next="NotUsed_Auth_Realm_NotUsed_Pwd_Login-IdmPostProcessing"/>
            <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
                <Gui name="AuthProfileSelectionDialog">
                    <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
                    <GuiElem name="lasterror" type="error" label="${notes:lasterrorinfo}" value="${notes:lasterror}"/>
                </Gui>
            </Response>
            <propertyRef name="nevisIDM_Connector"/>
            <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
            <property name="user.attributes" value="mobile, email, extId"/>
            <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
            <property name="detaillevel.default" value="EXCLUDE"/>
            <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
            <property name="detaillevel.user" value="MEDIUM"/>
        </AuthState>
        <AuthState name="NotUsed_Auth_Realm_NotUsed_Pwd_Login-IdmPasswordChange" class="ch.nevis.idm.authstate.IdmChangePasswordState" final="false">
            <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
            <ResultCond name="default" next="NotUsed_Auth_Realm_NotUsed_Pwd_Login-IdmPasswordChange"/>
            <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
            <ResultCond name="ok" next="NotUsed_Auth_Realm_NotUsed_Pwd_Login-IdmPostProcessing" authLevel="1"/>
            <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
            <ResultCond name="policyFailure" next="NotUsed_Auth_Realm_NotUsed_Pwd_Login-IdmPasswordChange"/>
            <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
            <Response value="AUTH_CONTINUE">
                <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
                <Gui name="AuthUidPwDialog" label="title.pwchange.label">
                    <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
                    <GuiElem name="lasterror" type="error" label="${notes:lasterrorinfo}" value="${notes:lasterror}"/>
                    <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
                    <GuiElem name="policyFailure.allowLoginIdPasswordViolated" type="error" label="${notes.policyFailure.allowLoginIdPasswordViolated}"/>
                    <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
                    <GuiElem name="policyFailure.regex.minLength" type="error" label="${notes.policyFailure.regex.minLength}"/>
                    <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
                    <GuiElem name="policyFailure.regex.maxLength" type="error" label="${notes.policyFailure.regex.maxLength}"/>
                    <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
                    <GuiElem name="policyFailure.regex.upper" type="error" label="${notes.policyFailure.regex.upper}"/>
                    <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
                    <GuiElem name="policyFailure.regex.lower" type="error" label="${notes.policyFailure.regex.lower}"/>
                    <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
                    <GuiElem name="policyFailure.regex.numeric" type="error" label="${notes.policyFailure.regex.numeric}"/>
                    <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
                    <GuiElem name="policyFailure.regex.nonLetter" type="error" label="${notes.policyFailure.regex.nonLetter}"/>
                    <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
                    <GuiElem name="policyFailure.regex.nonAlnum" type="error" label="${notes.policyFailure.regex.nonAlnum}"/>
                    <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
                    <GuiElem name="policyFailure.regex.control" type="error" label="${notes.policyFailure.regex.control}"/>
                    <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
                    <GuiElem name="policyFailure.regex.nonGraph" type="error" label="${notes.policyFailure.regex.nonGraph}"/>
                    <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
                    <GuiElem name="policyFailure.regex.nonAscii" type="error" label="${notes.policyFailure.regex.nonAscii}"/>
                    <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
                    <GuiElem name="policyFailure.dictionary" type="error" label="${notes.policyFailure.dictionary}"/>
                    <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
                    <GuiElem name="policyFailure.history.History" type="error" label="${notes.policyFailure.history.History}"/>
                    <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
                    <GuiElem name="policyFailure.regex.maxCharacterRepetitions" type="error" label="${notes.policyFailure.regex.maxCharacterRepetitions}"/>
                    <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
                    <GuiElem name="policyInfo.title" type="info" label="#{!notes.containsKey('lasterror') || notes.lasterror != '4' ? 'policyInfo.title' : ''}"/>
                    <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
                    <GuiElem name="policyInfo.regex.minLength" type="info" label="${notes.policyInfo.regex.minLength}"/>
                    <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
                    <GuiElem name="policyInfo.regex.maxLength" type="info" label="${notes.policyInfo.regex.maxLength}"/>
                    <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
                    <GuiElem name="policyInfo.regex.upper" type="info" label="#{notes['policyInfo.regex.upper'].contains('upper[0]') ? '' : notes['policyInfo.regex.upper']}"/>
                    <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
                    <GuiElem name="policyInfo.regex.lower" type="info" label="#{notes['policyInfo.regex.lower'].contains('lower[0]') ? '' : notes['policyInfo.regex.lower']}"/>
                    <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
                    <GuiElem name="policyInfo.regex.numeric" type="info" label="#{notes['policyInfo.regex.numeric'].contains('numeric[0]') ? '' : notes['policyInfo.regex.numeric']}"/>
                    <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
                    <GuiElem name="policyInfo.regex.nonLetter" type="info" label="#{notes['policyInfo.regex.nonLetter'].contains('nonLetter[0]') ? '' : notes['policyInfo.regex.nonLetter']}"/>
                    <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
                    <GuiElem name="policyInfo.regex.nonAlnum" type="info" label="#{notes['policyInfo.regex.nonAlnum'].contains('nonAlnum[0]') ? '' : notes['policyInfo.regex.nonAlnum']}"/>
                    <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
                    <GuiElem name="policyInfo.regex.control" type="info" label="#{notes['policyInfo.regex.control'].contains('control[0]') ? '' : notes['policyInfo.regex.control']}"/>
                    <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
                    <GuiElem name="policyInfo.regex.nonGraph" type="info" label="#{notes['policyInfo.regex.nonGraph'].contains('nonGraph[0]') ? '' : notes['policyInfo.regex.nonGraph']}"/>
                    <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
                    <GuiElem name="policyInfo.regex.nonAscii" type="info" label="#{notes['policyInfo.regex.nonAscii'].contains('nonAscii[0]') ? '' : notes['policyInfo.regex.nonAscii']}"/>
                    <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
                    <GuiElem name="policyInfo.dictionary" type="info" label="${notes.policyInfo.dictionary}"/>
                    <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
                    <GuiElem name="policyInfo.history.History" type="info" label="${notes.policyInfo.history.History}"/>
                    <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
                    <GuiElem name="policyInfo.regex.maxCharacterRepetitions" type="info" label="${notes.policyInfo.regex.maxCharacterRepetitions}"/>
                    <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
                    <GuiElem name="isiwebpasswd" type="pw-text" label="prompt.password"/>
                    <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
                    <GuiElem name="isiwebnewpw1" type="pw-text" label="prompt.newpassword"/>
                    <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
                    <GuiElem name="isiwebnewpw2" type="pw-text" label="prompt.newpassword.confirm"/>
                    <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
                    <GuiElem name="submit" type="submit" label="button.submit"/>
                </Gui>
            </Response>
            <propertyRef name="nevisIDM_Connector"/>
            <!-- source: pattern://e0fda9336be9c69dafc9b69e -->
            <property name="legacyLitDictMode" value="false"/>
        </AuthState>
        <AuthState name="NotUsed_Auth_Realm_Prepare_Done" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false">
            <!-- source: pattern://e0fda9336be9c69dafc9b69e, pattern://94e0b7b92ff2593f958c1eec, pattern://06aeae2d799e492f5580d03b -->
            <ResultCond name="default" next="NotUsed_Auth_Realm_Auth_Done"/>
            <!-- source: pattern://e0fda9336be9c69dafc9b69e, pattern://94e0b7b92ff2593f958c1eec, pattern://06aeae2d799e492f5580d03b -->
            <Response value="AUTH_DONE">
                <!-- source: pattern://e0fda9336be9c69dafc9b69e, pattern://94e0b7b92ff2593f958c1eec, pattern://06aeae2d799e492f5580d03b -->
                <Gui name="ContinueResponse"/>
            </Response>
            <!-- source: pattern://e0fda9336be9c69dafc9b69e, pattern://94e0b7b92ff2593f958c1eec, pattern://06aeae2d799e492f5580d03b -->
            <property name="script" value="file:///var/opt/nevisauth/default/conf/prepare_done.groovy"/>
        </AuthState>
        <AuthState name="NotUsed_Auth_Realm_Auth_Done" class="ch.nevis.esauth.auth.states.standard.AuthDone" final="false">
            <!-- source: pattern://e0fda9336be9c69dafc9b69e, pattern://94e0b7b92ff2593f958c1eec, pattern://06aeae2d799e492f5580d03b -->
            <Response value="AUTH_DONE">
                <!-- source: pattern://e0fda9336be9c69dafc9b69e, pattern://94e0b7b92ff2593f958c1eec, pattern://06aeae2d799e492f5580d03b -->
                <Gui name="ContinueResponse"/>
            </Response>
        </AuthState>
        <AuthState name="NotUsed_Auth_Realm_Selector" class="ch.nevis.esauth.auth.states.standard.ConditionalDispatcherState" final="false">
            <!-- source: pattern://06aeae2d799e492f5580d03b -->
            <ResultCond name="SecToken" next="NotUsed_Auth_Realm_SecToken"/>
            <!-- source: pattern://06aeae2d799e492f5580d03b -->
            <ResultCond name="nomatch" next="NotUsed_Auth_Realm_Prepare_Done"/>
            <!-- source: pattern://06aeae2d799e492f5580d03b -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://06aeae2d799e492f5580d03b -->
                <Arg name="ch.nevis.isiweb4.response.status" value="403"/>
            </Response>
            <!-- source: pattern://06aeae2d799e492f5580d03b -->
            <property name="condition:SecToken" value="${request:requiredRoles:^token.SecToken$:true}"/>
        </AuthState>
        <AuthState name="NotUsed_Auth_Realm_SecToken" class="ch.nevis.esauth.auth.states.sectoken.TokenAssemblerState" final="false">
            <!-- source: pattern://94e0b7b92ff2593f958c1eec -->
            <ResultCond name="default" next="NotUsed_Auth_Realm_Prepare_Done" authLevel="token.SecToken"/>
            <!-- source: pattern://94e0b7b92ff2593f958c1eec -->
            <Response value="AUTH_ERROR">
                <!-- source: pattern://94e0b7b92ff2593f958c1eec -->
                <Arg name="ch.nevis.isiweb4.response.status" value="403"/>
            </Response>
            <!-- source: pattern://94e0b7b92ff2593f958c1eec -->
            <property name="assembler" value="Token_NotUsed_Auth_Realm_SecToken"/>
            <!-- source: pattern://94e0b7b92ff2593f958c1eec -->
            <property name="key" value="token.SecToken"/>
            <!-- source: pattern://94e0b7b92ff2593f958c1eec -->
            <property name="generateNow" value="true"/>
        </AuthState>
    </AuthEngine>
    <!-- source: pattern://ab5a82719993921822e95751 -->
    <WebService name="ArtifactResolutionService" class="ch.nevis.esauth.auth.adapter.saml.ArtifactResolutionService" uri="/nevisauth/services/artifactresolution" SSODomain="Auth_Realm_Main_IDP">
        <!-- source: pattern://ab5a82719993921822e95751 -->
        <property name="issuer" value="Auth_Realm_Main_IDP_Custom_EPD_Artifact_IDP"/>
        <!-- source: pattern://ab5a82719993921822e95751 -->
        <property name="out.keystoreref" value="Store_IDP_AGOV"/>
        <!-- source: pattern://ab5a82719993921822e95751 -->
        <property name="out.keyobjectref" value="Signer_IDP_AGOV"/>
    </WebService>
</esauth-server>
