<AuthState name="${state.entry}" class="ch.nevis.esauth.auth.states.saml.IdentityProviderState" final="false" resumeState="false">
	<ResultCond name="ok" next="${state.entry}_Handle_Redirect"/>
    <!-- Change to AUTH_CONTINUE when we redirect back from agov me -->
	<Response value="AUTH_ERROR">
		<Gui name="internal_error">
			<GuiElem name="transferId" type="hidden" value="${request:traceId}" optional="true"/>
		</Gui>
	</Response>
	<property name="in.binding" value="none"/>
	<property name="out.binding" value="internal"/>
	<property name="out.sign" value="Response Assertion"/>
	<property name="out.signatureKeyInfo" value="Certificate"/>
	<!-- assertion validity time -->
	<property name="out.ttl" value="${param.assertionValidityTime}"/>
	<!-- subject confirmation: Bearer -->
	<property name="out.extension.Bearer" value="ch.nevis.esauth.auth.states.saml.extensions.SubjectConfirmationExtender"/>
	<property name="Bearer.ttl" value="${param.assertionValidityTime}"/>
	<property name="out.keystoreref" value="Store_IDP_AGOV"/>
	<property name="out.keyobjectref" value="Signer_IDP_AGOV"/>
	<property name="spURL" value="${param.agovmedirecturl}"/>
	<property name="acsUrlWhitelist.uris" value="not used"/>


	<!-- attributes -->

	<property name="out.attribute.http://schemas.agov.ch/ws/2023/05/identity/claims/authenticatedWith" value="${sess:agov.authenticatedWith}"/>
    <property name="out.attribute.http://schemas.agov.ch/ws/2023/05/identity/claims/requestedRoleLevel" value="${sess:agov.requestedRoleLevel}"/>
    <property name="out.attribute.http://schemas.agov.ch/ws/2023/09/identity/claim/rpEntityId" value="${sess:agov.rpEntityId}"/>
    
    <property name="out.attribute.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname" value="${sess:agov.eid.User.firstName}"/>
    <property name="out.attribute.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname" value="${sess:agov.eid.User.lastName}"/>
    <property name="out.attribute.http://schemas.agov.ch/ws/2023/05/identity/claims/socialSecurityNumber" value="${sess:agov.eid.User.svnr}"/>
    <property name="out.attribute.http://schemas.agov.ch/ws/2023/05/identity/claims/placeOfBirth" value="${sess:agov.eid.User.placeOfBirth}"/>
    <property name="out.attribute.http://schemas.agov.ch/ws/2025/07/identity/claims/placeOfOrigin" value="${sess:agov.eid.User.placeOfOrigin}"/>
    <property name="out.attribute.http://schemas.agov.ch/ws/2023/05/identity/claims/dateOfBirth" value="${sess:agov.eid.User.birthDate}"/>
    <property name="out.attribute.http://schemas.agov.ch/ws/2023/05/identity/claims/nationality" value="${sess:agov.eid.User.nationality}"/>
    <property name="out.attribute.http://schemas.agov.ch/ws/2023/05/identity/claims/eIdNumber" value="${sess:agov.eid.User.eIdNumber}"/>
    <property name="out.attribute.http://schemas.agov.ch/ws/2023/05/identity/claims/sex" value="${sess:agov.eid.User.gender}"/>

    <property name="out.attribute.http://schemas.agov.ch/ws/2023/05/identity/claims/qa/dateOfVerification" value="${sess:ValidFrom}"/>
    <property name="out.attribute.http://schemas.agov.ch/ws/2023/05/identity/claims/qa/validTillDate" value="${sess:ValidTo}"/>

    <property name="out.attribute.http://schemas.agov.ch/ws/2025/07/identity/claims/op/conversationId" value="${inctx:connection.HttpHeader.traceparent:^([0-9a-f]+)-([0-9a-f]+)-([0-9a-f]+)-([0-9a-f]+)$:$2}"/>
    <property name="out.authnContextClassRef" value="${sess:agov.authnContextClassRef}"/>
	<property name="out.subject" value="${sess:ch.adnovum.nevisidm.user.extId}"/> <!-- extId of the account to be linked -->
	<property name="out.subject.format" value="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"/>
	<property name="out.issuer" value="${param.issuer}"/>
    <property name="out.attributeDelimiter" value=",\s*" />
	<property name="out.audienceRestriction" value="${param.directAudience}"/>

</AuthState>

<AuthState name="${state.entry}_Handle_Redirect" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false" resumeState="true">
	<ResultCond name="ok" next="${state.done}"/>
	<Response value="AUTH_CONTINUE">
		<Gui name="not_used"/>
	</Response>
    <property name="scriptTraceGroup" value="AGOV-ACCT"/>
	<property name="parameter.agovmedirecturl" value="${param.agovmedirecturl}"/>
	<property name="script" value="file:///var/opt/nevisauth/default/conf/eid_account_linking_redirect_to_agovme.groovy"/>
</AuthState>