diff --git a/patterns/06515d4815de4afde6f8116a_authStatesFile/logout_done.xml b/patterns/06515d4815de4afde6f8116a_authStatesFile/logout_done.xml new file mode 100644 index 0000000..f15ac40 --- /dev/null +++ b/patterns/06515d4815de4afde6f8116a_authStatesFile/logout_done.xml @@ -0,0 +1,5 @@ + + + + + \ No newline at end of file diff --git a/patterns/1d81bd987455a8e1ee044ccf_authStatesFile/epd_idp.xml b/patterns/1d81bd987455a8e1ee044ccf_authStatesFile/epd_idp.xml new file mode 100644 index 0000000..a74ef90 --- /dev/null +++ b/patterns/1d81bd987455a8e1ee044ccf_authStatesFile/epd_idp.xml @@ -0,0 +1,68 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/patterns/2cdd910036aa06b102863a4f_scriptFile/checkLoa.gy b/patterns/2cdd910036aa06b102863a4f_scriptFile/checkLoa.gy index dc2bc6c..313cce5 100644 --- a/patterns/2cdd910036aa06b102863a4f_scriptFile/checkLoa.gy +++ b/patterns/2cdd910036aa06b102863a4f_scriptFile/checkLoa.gy @@ -162,33 +162,22 @@ try { for (String role : getUserAGOVLoiRoles()) { - if (role.startsWith('level')) { - def roleLevel = role.substring(5) - int roleLevelNumber = Integer.parseInt(roleLevel) - if (highestRoleLevelNumber< roleLevelNumber) { - highestRoleLevelNumber=roleLevelNumber - } + if (role.startsWith('level')) { + def roleLevel = role.substring(5) + int roleLevelNumber = Integer.parseInt(roleLevel) + + if (highestRoleLevelNumber< roleLevelNumber) { + highestRoleLevelNumber=roleLevelNumber } - } - + } + } LOG.debug('CheckLoa: Highest role Level ' + highestRoleLevelNumber.toString() +' contextclassref ' + requestedRoleLevelNumber.toString()) - LOG.debug('CheckLoa: Compare ' + (highestRoleLevelNumber>=requestedRoleLevelNumber)) + LOG.debug('CheckLoa: Compare ' + (highestRoleLevelNumber>=requestedRoleLevelNumber)) //set attribute Actual Role Level session.setAttribute('agov.actualRoleLevel', '' + highestRoleLevelNumber) LOG.debug('CheckLoa: actual role level (agov) '+ highestRoleLevelNumber) - - // Best Token Available only if account's AQlevel is high enough - if ((session.getAttribute('agov.appAddressRequired') == 'true') && (highestRoleLevelNumber < 200)) { - LOG.debug("Best Token: Address requested but account has to low AQ (${highestRoleLevelNumber})") - session.setAttribute('agov.appAddressRequired', 'false') - } - if ((session.getAttribute('agov.appSvnrAllowed') == 'true') && (highestRoleLevelNumber < 400)) { - LOG.debug("Best Token: SVNr requested but account has to low AQ (${highestRoleLevelNumber})") - session.setAttribute('agov.appSvnrAllowed', 'false') - } - if (highestRoleLevelNumber > 0) { // set attribute contextClassRefToSet session.setAttribute('contextClassRefToSet','urn:qa.agov.ch:names:tc:ac:classes:' .concat(highestRoleLevelNumber.toString())) diff --git a/patterns/2f81f8b878ef787fc5cc284a_authStatesFile/prepare_done.xml b/patterns/2f81f8b878ef787fc5cc284a_authStatesFile/prepare_done.xml new file mode 100644 index 0000000..ae10ec6 --- /dev/null +++ b/patterns/2f81f8b878ef787fc5cc284a_authStatesFile/prepare_done.xml @@ -0,0 +1,7 @@ + + + + + + + \ No newline at end of file diff --git a/patterns/2f81f8b878ef787fc5cc284a_resources/prepare_done.groovy b/patterns/2f81f8b878ef787fc5cc284a_resources/prepare_done.groovy new file mode 100644 index 0000000..21ef836 --- /dev/null +++ b/patterns/2f81f8b878ef787fc5cc284a_resources/prepare_done.groovy @@ -0,0 +1,23 @@ +// nevisProxy replaces the entire AUTH: scope when new outargs are returned by nevisAuth. +// Thus, we have to store tokens in the session (as a String) and restore them on subsequent step-ups. + +// restore tokens +session.each { key, value -> + if (key.startsWith('outarg.token.')) { + def name = key.substring(7) + if (outargs.containsKey(name)) { + LOG.debug("not restoring token (outarg: $name) from session: outarg already set") + } + else { + LOG.debug("restoring token (outarg: $name) from session") + outargs.put(name, value) + } + } +} + +// store tokens +outargs.each { name, value -> + if (name.startsWith('token.')) { + session.put('outarg.' + name, value) + } +} \ No newline at end of file diff --git a/patterns/3f719a1e5c1447ee46c69cb2_authStatesFile/logout_fail.xml b/patterns/3f719a1e5c1447ee46c69cb2_authStatesFile/logout_fail.xml new file mode 100644 index 0000000..f15ac40 --- /dev/null +++ b/patterns/3f719a1e5c1447ee46c69cb2_authStatesFile/logout_fail.xml @@ -0,0 +1,5 @@ + + + + + \ No newline at end of file diff --git a/patterns/596e3e37c4d524690ea35897_authStatesFile/authorization.xml b/patterns/596e3e37c4d524690ea35897_authStatesFile/authorization.xml new file mode 100644 index 0000000..c0fdc65 --- /dev/null +++ b/patterns/596e3e37c4d524690ea35897_authStatesFile/authorization.xml @@ -0,0 +1,13 @@ + + + + + + + + + + + + + \ No newline at end of file diff --git a/patterns/596e3e37c4d524690ea35897_resources/authorization.groovy b/patterns/596e3e37c4d524690ea35897_resources/authorization.groovy new file mode 100644 index 0000000..868d0a2 --- /dev/null +++ b/patterns/596e3e37c4d524690ea35897_resources/authorization.groovy @@ -0,0 +1,180 @@ +boolean isEnabled() { + def paths = parameters.get("paths") + if (paths && !paths.isEmpty()) { + for (path in paths.split(',')) { + String url = request.currentResource + if (url.matches(path)) { + return true + } + } + } + return false +} + +boolean isLevel(String role) { + if (role != null && role.isNumber()) { + def number = Integer.parseInt(role) + if (number > 0 && number <= 9) { + return true + } + } + return false +} + +int getCurrentLevel() { + int level = 1 // level 1 is reached by definition on successful authentication + // levels are stored as roles once the authentication is done + for (String role : response.getActualRoles()) { + if (isLevel(role)) { + Integer number = Integer.parseInt(role) + if (number > level) { + level = number + } + } + } + LOG.debug("current level: $level") + return level +} + +Integer getRequestedLevel() { + // try to determine required level based on SAML request (SP-initiated) + def context = session['ch.nevis.auth.saml.request.authnContextClassRef'] + if (context == null) { + // this is expected for non-Nevis SAML partners + LOG.debug("unable to determine required authentication level: no AuthnContext") + return null + } + String prefix = 'urn:nevis:level:' + Integer level = null + if (context.contains(prefix)) { + def start = context.indexOf(prefix) // the prefix can appear anywhere in the context but only once + def remainder = context.substring(start + prefix.length()) + for (String candidate : remainder.split(',')) { + if (!candidate.isNumber()) { + continue // must be an actual role + } + def number = Integer.parseInt(candidate) + if (level == null || number < level) { + level = number + } + } + } + if (level == null) { + // an AuthnContext has been sent but it does not contain the required authentication level + LOG.debug("unable to determine required authentication level from request: $context") + } + else { + LOG.info("extracted required authentication level from request: $context -> $level") + } + return level +} + +Integer getRequiredLevel(levels, String issuer) { + // try to determine required level based on request + def level = getRequestedLevel() + if (level != null) { + LOG.info("required authentication level from request: $level") + return level + } + // else determine required level based on configuration (IDP-initiated or no authnContextClassRef sent) + if (issuer != null && levels.containsKey(issuer)) { + level = levels[issuer] + LOG.debug("required authentication level for issuer $issuer defined as $level") + return level + } + // else return null + LOG.debug("required authentication level for issuer $issuer is not defined") + return null +} + +void setAuthnContext() { + def parts = [] as Set + def authLevel = response.getAuthLevel() + if (authLevel != null) { + if (isLevel(authLevel)) { + parts.add("urn:nevis:level:$authLevel") + } + else { // might be legacy auth.weak / auth.strong + parts.add(authLevel) + } + } + for (String role : response.getActualRoles()) { + if (isLevel(role)) { // previous authLevels might have been added to the roles already + parts.add("urn:nevis:level:$role") + } + // levels can also be normal roles so we add them always + parts.add(role) + } + def value = parts.sort().join(",") + LOG.debug("calculated AuthnContextClassRef for SAML Response: $value") + session['saml.idp.response.authncontext'] = value +} + +boolean stepupRequired(levels, String issuer) { + + Integer requiredLevel = getRequiredLevel(levels, issuer) + if (requiredLevel == null) { + LOG.info("unable to determine required authentication level for request from issuer $issuer") + setAuthnContext() + return false + } + + Integer currentLevel = getCurrentLevel() + if (currentLevel >= requiredLevel) { + LOG.info("required authentication level $requiredLevel has been reached (current level $currentLevel)") + setAuthnContext() + return false + } + + LOG.info("required authentication level $requiredLevel has not been reached (current level $currentLevel) - session upgrade needed") + request.setRequiredRoles("$requiredLevel") + return true +} + +boolean hasAnyRequiredRole(i2r, issuer) { + if (issuer != null && i2r.containsKey(issuer)) { + def roles = i2r[issuer] + for (role in response.getActualRoles()) { + if (roles.contains(role)) { + return true + } + } + } +} + +if (!isEnabled()) { + LOG.info("skipping SAML authorization checks.") + response.setResult('ok') // skip execution + return +} + +// issuer set by IdentityProviderState (SP-initiated) +def issuer = session['ch.nevis.auth.saml.request.issuer'] + +// issuer to minimum required authentication level +def i2l = [:] + + +if (stepupRequired(i2l, issuer)) { + LOG.info("authentication level stepup required.") + response.setResult("stepup") + return // we are done for now +} + +// issuer to list of required roles +def i2r = [:] + + +// issuer to ResultCond name +def i2e = [:] +i2e.put('https://trustbroker.agov-epr-lab.azure.adnovum.net', 'forbidden_0') +i2e.put('https://trustbroker-idp.agov-epr-lab.azure.adnovum.net', 'forbidden_1') + + +if (!i2r.isEmpty() && !hasAnyRequiredRole(i2r, issuer)) { + LOG.info("required roles check failed.") + response.setResult(i2e[issuer]) + return // we are done +} + +response.setResult('ok') \ No newline at end of file diff --git a/patterns/5a75ffc73b91b88cfab6168e_authStatesFile/epd_artifact_idp.xml b/patterns/5a75ffc73b91b88cfab6168e_authStatesFile/epd_artifact_idp.xml new file mode 100644 index 0000000..9cd7979 --- /dev/null +++ b/patterns/5a75ffc73b91b88cfab6168e_authStatesFile/epd_artifact_idp.xml @@ -0,0 +1,74 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/patterns/5f7e44f4fb2e3f710e4a3e91_authStatesFile/custom_selector.xml b/patterns/5f7e44f4fb2e3f710e4a3e91_authStatesFile/custom_selector.xml new file mode 100644 index 0000000..d26613d --- /dev/null +++ b/patterns/5f7e44f4fb2e3f710e4a3e91_authStatesFile/custom_selector.xml @@ -0,0 +1,6 @@ + + + + + + \ No newline at end of file diff --git a/patterns/73efd00d67082ff1eb927922_authStatesFile/idp_dispatcher.xml b/patterns/73efd00d67082ff1eb927922_authStatesFile/idp_dispatcher.xml new file mode 100644 index 0000000..d496674 --- /dev/null +++ b/patterns/73efd00d67082ff1eb927922_authStatesFile/idp_dispatcher.xml @@ -0,0 +1,21 @@ + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/patterns/73efd00d67082ff1eb927922_resources/idp_dispatcher.groovy b/patterns/73efd00d67082ff1eb927922_resources/idp_dispatcher.groovy new file mode 100644 index 0000000..20a9e7e --- /dev/null +++ b/patterns/73efd00d67082ff1eb927922_resources/idp_dispatcher.groovy @@ -0,0 +1,168 @@ +import groovy.xml.XmlSlurper +import groovy.xml.slurpersupport.GPathResult +import groovy.xml.slurpersupport.NodeChild + +import java.util.zip.Inflater +import java.util.zip.InflaterInputStream + +/** + * Gets the value of the Referer header. + * If the header is missing the fallback is returned + * + * This method is used when SAML IDP / Dispatch Error Redirect is not set + * + * @param fallback - value to return if the Referer header is missing + * @return value of header or fallback + */ +def getReferer(String fallback) { + return request.getHttpHeader('Referer') ?: fallback +} + +def redirect(String url) { + outargs.put('nevis.transfer.type', 'redirect') + outargs.put('nevis.transfer.destination', url) +} + +/** + * Extracts the content of the Issuer element from a parsed SAML message. + * The Issuer is optional according to SAML specification but we need it for dispatching. + * + * @param xml - as parsed by Groovy XmlSlurper + * @return text content of Issuer element converted or null + */ +String getIssuer(GPathResult xml) { + return xml.depthFirst().find { GPathResult node -> { + node.name().endsWith(":Issuer") || node.name().equalsIgnoreCase("Issuer") + } + }?.text() +} + +String getIssuer(String value) { + if (value == null) { + return + } + String text + byte[] decoded + def parser = new XmlSlurper() + // if value is raw xml then continue otherwise try to parse the base64 encoding + if (value.startsWith("<")) { + text = new String(value) + } + else { + decoded = value.decodeBase64() + text = new String(decoded) + LOG.info("received SAML request $value") + } + + // after decoded, if redirect binding, we need to parse string to xml + if (text.startsWith("<")) { + LOG.debug("assuming POST/SOAP binding") + // plain String (POST/SOAP parameter) + def xml = parser.parseText(text) + return getIssuer(xml) + } + else { + LOG.debug("assuming redirect binding") + // should be deflate encoded (query parameter) + def is = new InflaterInputStream(new ByteArrayInputStream(decoded), new Inflater(true)) + def xml = parser.parse(is) + return getIssuer(xml) + } +} + +def dispatchIssuer(i2s, String issuer) { + def result = i2s.get(issuer) + if (result == null) { + LOG.info("No SP found for issuer '$issuer'. Hint: check SAML SP Connector patterns.") + } + + // dispatch different idp if artifact binding is enabled + if(parameters.get('epdMode') == 'artifact' && result == 'epd'){ + LOG.debug("EPD: Artifact mode") + result = result + "_artifact" + }else{ + LOG.debug("EPD: POST mode") + } + response.setResult(result) + session.put("saml.inbound.issuer", issuer) + session.put('saml.idp.result', result) // remember decision for sub-sequent requests without a SAML message + +} + +def dispatchMessage(i2s, String message) { + def issuer = getIssuer(message) + if (issuer == null) { + LOG.info("No issuer found in incoming SAML message. Giving up.") + } + session.put("saml.inbound.issuer", issuer) + dispatchIssuer(i2s, issuer) +} + +if (parameters.get('logoutConfirmation') == 'true' && "stepup" == request.getMethod()) { + String url = request.currentResource + def path = new URL(url).getPath() + if (path.endsWith("/logout")) { + // next AuthState will show a logout confirmation GUI + response.setResult('confirm') + return + } +} + +// ensure session exists +if (request.getSession(false) == null) { + session = request.getSession(true).getData() +} + +// issuer (any case) -> ResultCond name +def i2s = new TreeMap(String.CASE_INSENSITIVE_ORDER) + + +i2s.put(parameters.get('atb'), 'main') +i2s.put(parameters.get('epd_atb'), 'epd') + +if (parameters.get('spInitiated') == 'true' && inargs.containsKey('SAMLRequest')) { // SP-initiated authentication + LOG.debug("found SAMLRequest parameter for SP-initiated authentication") + String message = inargs.get('SAMLRequest') + dispatchMessage(i2s, message) + return +} + +if (inargs.containsKey('SAMLResponse')) { // response to IDP-initiated SAML Logout + LOG.debug("found SAMLResponse parameter") + String message = inargs.get('SAMLResponse') + dispatchMessage(i2s, message) + return +} + +if (parameters.get('spInitiated') == 'true' && inargs.containsKey('soapheader')) { // SP-initiated SOAP with soapheader + LOG.debug("found soapheader parameter for SP-initiated") + String message = inargs.get('soapheader') + dispatchMessage(i2s, message) + return +} + +if (parameters.get('spInitiated') == 'true' && inargs.containsKey('')) { // SP-initiated SOAP with empty + LOG.debug("found empty parameter for SP-initiated SOAP message") + String message = inargs.get('') + dispatchMessage(i2s, message) + return +} + +String issuer = inargs['Issuer'] ?: inargs['issuer'] +if (parameters.get('idpInitiated') == 'true' && issuer != null) { // IDP-initiated authentication + LOG.debug("found Issuer parameter for IDP-initiated authentication") + dispatchIssuer(i2s, issuer) + return +} + +// used as fallback in case of ?logout (we need an IdentityProviderState) +if (inargs.containsKey("logout") && session.containsKey('saml.idp.result')) { + def result = session.get('saml.idp.result') + LOG.debug("dispatching to last used ResultCond: $result") + response.setResult(result) + return +} + +def location = getReferer('/') +LOG.info("Unable to dispatch request. Giving up and redirecting (back) to $location") +redirect(location) \ No newline at end of file diff --git a/patterns/9196b809b539716b03ad8565_authStatesFile/logout_confirm.xml b/patterns/9196b809b539716b03ad8565_authStatesFile/logout_confirm.xml new file mode 100644 index 0000000..bf2dfd2 --- /dev/null +++ b/patterns/9196b809b539716b03ad8565_authStatesFile/logout_confirm.xml @@ -0,0 +1,6 @@ + + + + + + \ No newline at end of file diff --git a/patterns/9196b809b539716b03ad8565_resources/logout_confirm.groovy b/patterns/9196b809b539716b03ad8565_resources/logout_confirm.groovy new file mode 100644 index 0000000..6ac4e4a --- /dev/null +++ b/patterns/9196b809b539716b03ad8565_resources/logout_confirm.groovy @@ -0,0 +1,64 @@ +def redirect(location) { + outargs.put('nevis.transfer.type', 'redirect') + outargs.put('nevis.transfer.destination', location) +} + +def getReturnURL() { + if (inargs.containsKey('return')) { + return inargs.get('return') + } + // determine returnURL based on Referer header (if present and not pointing to this page) + def referer = request.getHttpHeader('Referer') + if (referer == null) { + LOG.debug('no Referer header found') + return null + } + // strip query String for comparison + String previous = referer.contains('?') ? referer.substring(0, referer.indexOf("?")) : referer + def current = request.getCurrentResource() + if (current.startsWith(previous)) { + LOG.debug("Referer header $referer cannot be used as return URL - cyclic redirect") + return null + } + return referer +} + +if (inargs.containsKey('logout-confirm')) { + def current = request.getCurrentResource() + // user has confirmed logout -> replace /logout with /?logout + String location + if (current.contains('?')) { + location = current.replace("/logout?", "/?logout&") + } + else { + location = current.replace("/logout", "/?logout") + } + redirect(location) + return +} + +if (inargs.containsKey('logout-abort')) { + // user has aborted logout -> redirect to stored return URL + def location = session.get('logout-abort-url') + redirect(location) + return +} + +// user has not clicked any button -> render GUI +response.setGuiName('saml_logout_confirm') +response.setGuiLabel('title.logout.confirmation') +// not setting a target as the API has been removed +response.addInfoGuiField('info', 'info.logout.confirmation', null) +response.addButtonGuiField('logout-confirm', 'continue.button.label', 'true') + +def returnURL = getReturnURL() + +if (returnURL != null) { + // store return URL in session + session.put('logout-abort-url', returnURL) +} + +if (session.containsKey('logout-abort-url')) { + // add cancel button to go back + response.addButtonGuiField('logout-abort', 'cancel.button.label', 'true') +} \ No newline at end of file diff --git a/patterns/92cb6d5256008a32f12ceb93_authStatesFile/agov_idp.xml b/patterns/92cb6d5256008a32f12ceb93_authStatesFile/agov_idp.xml new file mode 100644 index 0000000..a4182e8 --- /dev/null +++ b/patterns/92cb6d5256008a32f12ceb93_authStatesFile/agov_idp.xml @@ -0,0 +1,89 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/patterns/Auth_Realm_Main_IDP_4fcfadb4a5c946ead7e6e995.yml b/patterns/Auth_Realm_Main_IDP_4fcfadb4a5c946ead7e6e995.yml index 11b6966..0907cf2 100644 --- a/patterns/Auth_Realm_Main_IDP_4fcfadb4a5c946ead7e6e995.yml +++ b/patterns/Auth_Realm_Main_IDP_4fcfadb4a5c946ead7e6e995.yml @@ -9,7 +9,9 @@ pattern: \ the session), we reset the state engine and start by processing that request." properties: authenticate: - - "pattern://68665057549fd887ea09fb86" + - "pattern://7a913eec7f78ce674cd87854" + logout: + - "pattern://7a913eec7f78ce674cd87854" auth: - "pattern://7022472ae407577ae604bbb8" authParams: diff --git a/patterns/Auth_Realm_Main_IDP_Custom_AGOV_IDP_92cb6d5256008a32f12ceb93.yml b/patterns/Auth_Realm_Main_IDP_Custom_AGOV_IDP_92cb6d5256008a32f12ceb93.yml new file mode 100644 index 0000000..22e1ba7 --- /dev/null +++ b/patterns/Auth_Realm_Main_IDP_Custom_AGOV_IDP_92cb6d5256008a32f12ceb93.yml @@ -0,0 +1,21 @@ +schemaVersion: "1.0" +pattern: + id: "92cb6d5256008a32f12ceb93" + className: "ch.nevis.admin.v4.plugin.nevisauth.patterns2.GenericAuthenticationStep" + name: "Auth_Realm_Main_IDP_Custom_AGOV_IDP" + label: "IDP CUSTOM" + notes: "modified script taken from what Nevis generated when using a SAM IDP Pattern" + properties: + authStatesFile: "res://92cb6d5256008a32f12ceb93#authStatesFile" + onSuccess: + - "pattern://2f81f8b878ef787fc5cc284a" + onFailure: + - "pattern://5f7e44f4fb2e3f710e4a3e91" + nextSteps: + - "pattern://db4eead0bb25b03205afd79f" + - "pattern://06515d4815de4afde6f8116a" + - "pattern://3f719a1e5c1447ee46c69cb2" + - "pattern://68665057549fd887ea09fb86" + keyObjects: + - "pattern://c0f2c118a88327acce1687fe" + - "pattern://0a15213c00dec3668fb94a65" diff --git a/patterns/Auth_Realm_Main_IDP_Custom_Auth_Done_GUI_cf0e8f8de1c8ac7345c5a6bb.yml b/patterns/Auth_Realm_Main_IDP_Custom_Auth_Done_GUI_cf0e8f8de1c8ac7345c5a6bb.yml new file mode 100644 index 0000000..9bdaa0d --- /dev/null +++ b/patterns/Auth_Realm_Main_IDP_Custom_Auth_Done_GUI_cf0e8f8de1c8ac7345c5a6bb.yml @@ -0,0 +1,8 @@ +schemaVersion: "1.0" +pattern: + id: "cf0e8f8de1c8ac7345c5a6bb" + className: "ch.nevis.admin.v4.plugin.nevisauth.patterns2.GenericAuthenticationStep" + name: "Auth_Realm_Main_IDP_Custom_Auth_Done_GUI" + label: "IDP CUSTOM" + properties: + authStatesFile: "res://cf0e8f8de1c8ac7345c5a6bb#authStatesFile" diff --git a/patterns/Auth_Realm_Main_IDP_Custom_Authorization_596e3e37c4d524690ea35897.yml b/patterns/Auth_Realm_Main_IDP_Custom_Authorization_596e3e37c4d524690ea35897.yml new file mode 100644 index 0000000..abb166b --- /dev/null +++ b/patterns/Auth_Realm_Main_IDP_Custom_Authorization_596e3e37c4d524690ea35897.yml @@ -0,0 +1,13 @@ +schemaVersion: "1.0" +pattern: + id: "596e3e37c4d524690ea35897" + className: "ch.nevis.admin.v4.plugin.nevisauth.patterns2.GenericAuthenticationStep" + name: "Auth_Realm_Main_IDP_Custom_Authorization" + label: "IDP CUSTOM" + properties: + authStatesFile: "res://596e3e37c4d524690ea35897#authStatesFile" + onSuccess: + - "pattern://cf0e8f8de1c8ac7345c5a6bb" + onFailure: + - "pattern://5f7e44f4fb2e3f710e4a3e91" + resources: "res://596e3e37c4d524690ea35897#resources" diff --git a/patterns/Auth_Realm_Main_IDP_Custom_EPD_Artifact_IDP_5a75ffc73b91b88cfab6168e.yml b/patterns/Auth_Realm_Main_IDP_Custom_EPD_Artifact_IDP_5a75ffc73b91b88cfab6168e.yml new file mode 100644 index 0000000..4eb073c --- /dev/null +++ b/patterns/Auth_Realm_Main_IDP_Custom_EPD_Artifact_IDP_5a75ffc73b91b88cfab6168e.yml @@ -0,0 +1,21 @@ +schemaVersion: "1.0" +pattern: + id: "5a75ffc73b91b88cfab6168e" + className: "ch.nevis.admin.v4.plugin.nevisauth.patterns2.GenericAuthenticationStep" + name: "Auth_Realm_Main_IDP_Custom_EPD_Artifact_IDP" + label: "EPD" + notes: "modified script taken from what Nevis generated when using a SAM IDP Pattern" + properties: + authStatesFile: "res://5a75ffc73b91b88cfab6168e#authStatesFile" + onSuccess: + - "pattern://2f81f8b878ef787fc5cc284a" + onFailure: + - "pattern://5f7e44f4fb2e3f710e4a3e91" + nextSteps: + - "pattern://db4eead0bb25b03205afd79f" + - "pattern://06515d4815de4afde6f8116a" + - "pattern://3f719a1e5c1447ee46c69cb2" + - "pattern://68665057549fd887ea09fb86" + keyObjects: + - "pattern://c0f2c118a88327acce1687fe" + - "pattern://8dbec5bb024707d73fca93ef" diff --git a/patterns/Auth_Realm_Main_IDP_Custom_EPD_IDP_1d81bd987455a8e1ee044ccf.yml b/patterns/Auth_Realm_Main_IDP_Custom_EPD_IDP_1d81bd987455a8e1ee044ccf.yml new file mode 100644 index 0000000..1bbbb3f --- /dev/null +++ b/patterns/Auth_Realm_Main_IDP_Custom_EPD_IDP_1d81bd987455a8e1ee044ccf.yml @@ -0,0 +1,21 @@ +schemaVersion: "1.0" +pattern: + id: "1d81bd987455a8e1ee044ccf" + className: "ch.nevis.admin.v4.plugin.nevisauth.patterns2.GenericAuthenticationStep" + name: "Auth_Realm_Main_IDP_Custom_EPD_IDP" + label: "EPD" + notes: "modified script taken from what Nevis generated when using a SAM IDP Pattern" + properties: + authStatesFile: "res://1d81bd987455a8e1ee044ccf#authStatesFile" + onSuccess: + - "pattern://2f81f8b878ef787fc5cc284a" + onFailure: + - "pattern://5f7e44f4fb2e3f710e4a3e91" + nextSteps: + - "pattern://db4eead0bb25b03205afd79f" + - "pattern://06515d4815de4afde6f8116a" + - "pattern://3f719a1e5c1447ee46c69cb2" + - "pattern://68665057549fd887ea09fb86" + keyObjects: + - "pattern://c0f2c118a88327acce1687fe" + - "pattern://8dbec5bb024707d73fca93ef" diff --git a/patterns/Auth_Realm_Main_IDP_Custom_IDP_Dispatcher_73efd00d67082ff1eb927922.yml b/patterns/Auth_Realm_Main_IDP_Custom_IDP_Dispatcher_73efd00d67082ff1eb927922.yml new file mode 100644 index 0000000..f4962b3 --- /dev/null +++ b/patterns/Auth_Realm_Main_IDP_Custom_IDP_Dispatcher_73efd00d67082ff1eb927922.yml @@ -0,0 +1,16 @@ +schemaVersion: "1.0" +pattern: + id: "73efd00d67082ff1eb927922" + className: "ch.nevis.admin.v4.plugin.nevisauth.patterns2.GenericAuthenticationStep" + name: "Auth_Realm_Main_IDP_Custom_IDP_Dispatcher" + label: "IDP CUSTOM" + properties: + authStatesFile: "res://73efd00d67082ff1eb927922#authStatesFile" + parameters: "var://auth_realm_main_idp_custom_idp_dispatcher-template-parameters" + onSuccess: + - "pattern://9196b809b539716b03ad8565" + nextSteps: + - "pattern://92cb6d5256008a32f12ceb93" + - "pattern://1d81bd987455a8e1ee044ccf" + - "pattern://5a75ffc73b91b88cfab6168e" + resources: "res://73efd00d67082ff1eb927922#resources" diff --git a/patterns/Auth_Realm_Main_IDP_Custom_Logout_Confirm_9196b809b539716b03ad8565.yml b/patterns/Auth_Realm_Main_IDP_Custom_Logout_Confirm_9196b809b539716b03ad8565.yml new file mode 100644 index 0000000..e320859 --- /dev/null +++ b/patterns/Auth_Realm_Main_IDP_Custom_Logout_Confirm_9196b809b539716b03ad8565.yml @@ -0,0 +1,9 @@ +schemaVersion: "1.0" +pattern: + id: "9196b809b539716b03ad8565" + className: "ch.nevis.admin.v4.plugin.nevisauth.patterns2.GenericAuthenticationStep" + name: "Auth_Realm_Main_IDP_Custom_Logout_Confirm" + label: "IDP CUSTOM" + properties: + authStatesFile: "res://9196b809b539716b03ad8565#authStatesFile" + resources: "res://9196b809b539716b03ad8565#resources" diff --git a/patterns/Auth_Realm_Main_IDP_Custom_Logout_Done_06515d4815de4afde6f8116a.yml b/patterns/Auth_Realm_Main_IDP_Custom_Logout_Done_06515d4815de4afde6f8116a.yml new file mode 100644 index 0000000..1e8cd35 --- /dev/null +++ b/patterns/Auth_Realm_Main_IDP_Custom_Logout_Done_06515d4815de4afde6f8116a.yml @@ -0,0 +1,8 @@ +schemaVersion: "1.0" +pattern: + id: "06515d4815de4afde6f8116a" + className: "ch.nevis.admin.v4.plugin.nevisauth.patterns2.GenericAuthenticationStep" + name: "Auth_Realm_Main_IDP_Custom_Logout_Done" + label: "IDP CUSTOM" + properties: + authStatesFile: "res://06515d4815de4afde6f8116a#authStatesFile" diff --git a/patterns/Auth_Realm_Main_IDP_Custom_Logout_Fail_3f719a1e5c1447ee46c69cb2.yml b/patterns/Auth_Realm_Main_IDP_Custom_Logout_Fail_3f719a1e5c1447ee46c69cb2.yml new file mode 100644 index 0000000..d8b6911 --- /dev/null +++ b/patterns/Auth_Realm_Main_IDP_Custom_Logout_Fail_3f719a1e5c1447ee46c69cb2.yml @@ -0,0 +1,8 @@ +schemaVersion: "1.0" +pattern: + id: "3f719a1e5c1447ee46c69cb2" + className: "ch.nevis.admin.v4.plugin.nevisauth.patterns2.GenericAuthenticationStep" + name: "Auth_Realm_Main_IDP_Custom_Logout_Fail" + label: "IDP CUSTOM" + properties: + authStatesFile: "res://3f719a1e5c1447ee46c69cb2#authStatesFile" diff --git a/patterns/Auth_Realm_Main_IDP_Custom_Prepare_Done_2f81f8b878ef787fc5cc284a.yml b/patterns/Auth_Realm_Main_IDP_Custom_Prepare_Done_2f81f8b878ef787fc5cc284a.yml new file mode 100644 index 0000000..f5986d1 --- /dev/null +++ b/patterns/Auth_Realm_Main_IDP_Custom_Prepare_Done_2f81f8b878ef787fc5cc284a.yml @@ -0,0 +1,11 @@ +schemaVersion: "1.0" +pattern: + id: "2f81f8b878ef787fc5cc284a" + className: "ch.nevis.admin.v4.plugin.nevisauth.patterns2.GenericAuthenticationStep" + name: "Auth_Realm_Main_IDP_Custom_Prepare_Done" + label: "IDP CUSTOM" + properties: + authStatesFile: "res://2f81f8b878ef787fc5cc284a#authStatesFile" + onSuccess: + - "pattern://596e3e37c4d524690ea35897" + resources: "res://2f81f8b878ef787fc5cc284a#resources" diff --git a/patterns/Auth_Realm_Main_IDP_Custom_Preprocess_Done_03326b180687860ffe06a58c.yml b/patterns/Auth_Realm_Main_IDP_Custom_Preprocess_Done_03326b180687860ffe06a58c.yml new file mode 100644 index 0000000..b3381cd --- /dev/null +++ b/patterns/Auth_Realm_Main_IDP_Custom_Preprocess_Done_03326b180687860ffe06a58c.yml @@ -0,0 +1,15 @@ +schemaVersion: "1.0" +pattern: + id: "03326b180687860ffe06a58c" + className: "ch.nevis.admin.v4.plugin.nevisauth.patterns2.Dispatcher" + name: "Auth_Realm_Main_IDP_Custom_Preprocess_Done" + label: "IDP CUSTOM" + properties: + conditions: + - ok: "${request:currentResource:^http[s]?\\u003A//[^/]+/SAML2/SSO/.*$:true}" + transitions: + - ok: "1" + steps: + - "pattern://73efd00d67082ff1eb927922" + defaultStep: + - "pattern://473f9d6b4ab9d61c1eb8c689" diff --git a/patterns/Auth_Realm_Main_IDP_Custom_Selector_5f7e44f4fb2e3f710e4a3e91.yml b/patterns/Auth_Realm_Main_IDP_Custom_Selector_5f7e44f4fb2e3f710e4a3e91.yml new file mode 100644 index 0000000..6cbadc5 --- /dev/null +++ b/patterns/Auth_Realm_Main_IDP_Custom_Selector_5f7e44f4fb2e3f710e4a3e91.yml @@ -0,0 +1,10 @@ +schemaVersion: "1.0" +pattern: + id: "5f7e44f4fb2e3f710e4a3e91" + className: "ch.nevis.admin.v4.plugin.nevisauth.patterns2.GenericAuthenticationStep" + name: "Auth_Realm_Main_IDP_Custom_Selector" + label: "IDP CUSTOM" + properties: + authStatesFile: "res://5f7e44f4fb2e3f710e4a3e91#authStatesFile" + onSuccess: + - "pattern://2f81f8b878ef787fc5cc284a" diff --git a/patterns/Auth_Realm_Recovery_204c22beaccdfd22727af378.yml b/patterns/Auth_Realm_Recovery_204c22beaccdfd22727af378.yml index 2cc9e23..430d072 100644 --- a/patterns/Auth_Realm_Recovery_204c22beaccdfd22727af378.yml +++ b/patterns/Auth_Realm_Recovery_204c22beaccdfd22727af378.yml @@ -3,6 +3,7 @@ pattern: id: "204c22beaccdfd22727af378" className: "ch.nevis.admin.v4.plugin.nevisauth.patterns2.NevisAuthRealm" name: "Auth_Realm_Recovery" + label: "RECOVERY" properties: authenticate: - "pattern://584964c837512845d7940809" diff --git a/patterns/CSP_Security_Response_Headers_162d4ee18e469c146df153cc.yml b/patterns/CSP_Security_Response_Headers_162d4ee18e469c146df153cc.yml index 541bbfa..0dbffb0 100644 --- a/patterns/CSP_Security_Response_Headers_162d4ee18e469c146df153cc.yml +++ b/patterns/CSP_Security_Response_Headers_162d4ee18e469c146df153cc.yml @@ -3,6 +3,7 @@ pattern: id: "162d4ee18e469c146df153cc" className: "ch.nevis.admin.v4.plugin.nevisproxy.patterns.LuaPattern" name: "CSP Security Response Headers" + label: "SECURITY" properties: script: "res://162d4ee18e469c146df153cc#script" phase: "BEFORE_SANITATION" diff --git a/patterns/ClusterInternalTlsTrustObject_bcfe78c02cbe0588528bc3cb.yml b/patterns/ClusterInternalTlsTrustObject_bcfe78c02cbe0588528bc3cb.yml index 331b0bb..a7380df 100644 --- a/patterns/ClusterInternalTlsTrustObject_bcfe78c02cbe0588528bc3cb.yml +++ b/patterns/ClusterInternalTlsTrustObject_bcfe78c02cbe0588528bc3cb.yml @@ -3,6 +3,7 @@ pattern: id: "bcfe78c02cbe0588528bc3cb" className: "ch.nevis.admin.v4.plugin.nevisauth.patterns.KeyObject" name: "ClusterInternalTlsTrustObject" + label: "STORE" properties: keyObjectId: "TlsTrustStore" type: "truststore" diff --git a/patterns/EId_Verification_Auth_7441fca76f479e4beb5ca796.yml b/patterns/EId_Verification_Auth_e335f57d4c64dfc97223697a.yml similarity index 62% rename from patterns/EId_Verification_Auth_7441fca76f479e4beb5ca796.yml rename to patterns/EId_Verification_Auth_e335f57d4c64dfc97223697a.yml index 37ffc22..382857b 100644 --- a/patterns/EId_Verification_Auth_7441fca76f479e4beb5ca796.yml +++ b/patterns/EId_Verification_Auth_e335f57d4c64dfc97223697a.yml @@ -1,12 +1,13 @@ schemaVersion: "1.0" pattern: - id: "7441fca76f479e4beb5ca796" + id: "e335f57d4c64dfc97223697a" className: "ch.nevis.admin.v4.plugin.nevisauth.patterns2.GenericAuthenticationStep" name: "EId_Verification_Auth" + label: "EID" properties: - authStatesFile: "res://7441fca76f479e4beb5ca796#authStatesFile" + authStatesFile: "res://e335f57d4c64dfc97223697a#authStatesFile" onSuccess: - "pattern://b87d0d2b640e8e545ad70234" onFailure: - "pattern://4c65de021d362462324a3a5f" - resources: "res://7441fca76f479e4beb5ca796#resources" + resources: "res://e335f57d4c64dfc97223697a#resources" diff --git a/patterns/EPD_Artifact_Resolution_Service_ab5a82719993921822e95751.yml b/patterns/EPD_Artifact_Resolution_Service_ab5a82719993921822e95751.yml new file mode 100644 index 0000000..35f3094 --- /dev/null +++ b/patterns/EPD_Artifact_Resolution_Service_ab5a82719993921822e95751.yml @@ -0,0 +1,11 @@ +schemaVersion: "1.0" +pattern: + id: "ab5a82719993921822e95751" + className: "ch.nevis.admin.v4.plugin.nevisauth.patterns.GenericAuthWebService" + name: "EPD_Artifact_Resolution_Service" + label: "EPD" + properties: + auth: + - "pattern://7022472ae407577ae604bbb8" + configFile: "res://ab5a82719993921822e95751#configFile" + parameters: "var://epd_artifact_resolution_service-template-parameters" diff --git a/patterns/IDP_EPD_Truststore_8dbec5bb024707d73fca93ef.yml b/patterns/IDP_EPD_Truststore_8dbec5bb024707d73fca93ef.yml new file mode 100644 index 0000000..68a1069 --- /dev/null +++ b/patterns/IDP_EPD_Truststore_8dbec5bb024707d73fca93ef.yml @@ -0,0 +1,11 @@ +schemaVersion: "1.0" +pattern: + id: "8dbec5bb024707d73fca93ef" + className: "ch.nevis.admin.v4.plugin.nevisauth.patterns.KeyObject" + name: "IDP_EPD_Truststore" + label: "EPD" + properties: + keyObjectId: "var://idp_sp_epd_connector-sp-issuer" + keyStoreName: "Store_IDP_AGOV" + trustStore: + - "pattern://8052fd68f4a663629d651f7b" diff --git a/patterns/IDP_Keystore_c0f2c118a88327acce1687fe.yml b/patterns/IDP_Keystore_c0f2c118a88327acce1687fe.yml new file mode 100644 index 0000000..9243cdd --- /dev/null +++ b/patterns/IDP_Keystore_c0f2c118a88327acce1687fe.yml @@ -0,0 +1,12 @@ +schemaVersion: "1.0" +pattern: + id: "c0f2c118a88327acce1687fe" + className: "ch.nevis.admin.v4.plugin.nevisauth.patterns.KeyObject" + name: "IDP_Keystore" + label: "STORE" + properties: + keyObjectId: "Signer_IDP_AGOV" + keyStoreName: "Store_IDP_AGOV" + type: "keystore" + keyStore: + - "pattern://56d6268c95f766c86c6aaae9" diff --git a/patterns/IDP_SP_EPD_Connector_b8139a4b73abce1ce1a22170.yml b/patterns/IDP_SP_EPD_Connector_b8139a4b73abce1ce1a22170.yml index 4ac6887..c3138ac 100644 --- a/patterns/IDP_SP_EPD_Connector_b8139a4b73abce1ce1a22170.yml +++ b/patterns/IDP_SP_EPD_Connector_b8139a4b73abce1ce1a22170.yml @@ -8,55 +8,29 @@ pattern: - dateOfBirth: to have a date suitable for SAML and OIDC, we remove the TimeZone\ \ charachter ('1993-03-03Z' --> '1993-03-03')\n- verificationMethod: BUNDBITBK-2892\ \ SelfPaid is only for internal use, we remove this from the public assertion\n\ - - address.verificationMethod: BUNDBITBK-2921 avoid interface change for hotfix" + - address.verificationMethod: BUNDBITBK-2921 avoid interface change for hotfix\n\ + \n- todo: GLN" properties: issuer: "var://idp_sp_epd_connector-sp-issuer" url: "var://idp_sp_epd_connector-sp-url---assertion-consumer-services" signerTrust: - "pattern://8052fd68f4a663629d651f7b" + binding: "http-post" subjectFormat: "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" subjectConfirmation: "bearer" attributes: - - http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress: "${sess:ch.nevis.idm.User.email}" - - http://schemas.agov.ch/ws/2023/05/identity/claims/languageOfCorrespondance: "${sess:ch.nevis.idm.User.language}" - http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname: "${sess:ch.nevis.idm.User.firstName}" - http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname: "${sess:ch.nevis.idm.User.lastName}" - - http://schemas.agov.ch/ws/2023/05/identity/claims/dateOfBirth: "${sess:ch.nevis.idm.User.birthDate:^(\\\ - d\\d\\d\\d-\\d\\d-\\d\\d).*$}" - http://schemas.agov.ch/ws/2023/05/identity/claims/sex: "${sess:ch.nevis.idm.User.gender}" - http://schemas.agov.ch/ws/2023/05/identity/claims/socialSecurityNumber: "#{\ \ (sess['agov.appSvnrAllowed'] == 'true') ? sess['ch.nevis.idm.User.prop.svnr']\ \ : ''}" - - http://schemas.agov.ch/ws/2023/05/identity/claims/placeOfBirth: "#{ (sess['agov.appSvnrAllowed']\ - \ == 'true') ? sess['ch.nevis.idm.User.prop.placeOfBirth'] : ''}" - - http://schemas.agov.ch/ws/2023/05/identity/claims/eIdNumber: "${sess:ch.nevis.idm.User.prop.eIdNumber}" - - http://schemas.agov.ch/ws/2023/05/identity/claims/qa/dateOfVerification: "${sess:ValidFrom}" - - http://schemas.agov.ch/ws/2023/05/identity/claims/qa/validTillDate: "${sess:ValidTo}" - - http://schemas.agov.ch/ws/2023/05/identity/claims/qa/verificationMethod: "#{\ - \ ''.concat(sess.get('idVerification')).replace('SelfPaid', '') }" - - http://schemas.agov.ch/ws/2023/05/identity/claims/nationality: "#{ sess.containsKey('ch.nevis.idm.User.prop.nationality')\ - \ ? sess['ch.nevis.idm.User.prop.nationality'].toUpperCase(): '' }" - - http://schemas.agov.ch/ws/2023/05/identity/claims/authenticatedWith: "${sess:authenticatedWith}" - - http://schemas.agov.ch/ws/2023/08/identity/claims/emailVerified: "true" - - http://schemas.agov.ch/ws/2023/08/identity/claims/address/street: "#{ (sess['agov.appAddressRequired']\ - \ == 'true') ? sess['ch.nevis.idm.User.street'] : '' }" - - http://schemas.agov.ch/ws/2023/08/identity/claims/address/houseNumber: "#{ (sess['agov.appAddressRequired']\ - \ == 'true') ? sess['ch.nevis.idm.User.houseNumber'] : '' }" - - http://schemas.agov.ch/ws/2023/08/identity/claims/address/zipCode: "#{ (sess['agov.appAddressRequired']\ - \ == 'true') ? sess['ch.nevis.idm.User.postalCode'] : '' }" - - http://schemas.agov.ch/ws/2023/08/identity/claims/address/town: "#{ (sess['agov.appAddressRequired']\ - \ == 'true') ? sess['ch.nevis.idm.User.city'] : '' }" - - http://schemas.agov.ch/ws/2024/02/identity/claims/address/country: "#{ (sess['agov.appAddressRequired']\ - \ == 'true') ? sess['ch.nevis.idm.User.country'].toUpperCase() : '' }" - - http://schemas.agov.ch/ws/2024/02/identity/claims/address/qa/verificationMethod: "#{\ - \ (sess['agov.appAddressRequired'] == 'true') ? ''.concat(sess.get('agov.adressVerification')).replace('Location',\ - \ 'Domicile') : '' }" - - http://schemas.agov.ch/ws/2024/02/identity/claims/address/countryName: "#{ (sess['agov.appAddressRequired']\ - \ == 'true') ? sess['agov.countryName'] : ''}" + - http://schemas.agov.ch/ws/2023/05/identity/claims/dateOfBirth: "${sess:ch.nevis.idm.User.birthDate:^(\\\ + d\\d\\d\\d-\\d\\d-\\d\\d).*$}" context: "PasswordProtectedTransport" assertionLifetime: "30s" sign: - "Response" - "Assertion" keyInfo: "Certificate" - properties: "var://idp-sp-connector-properties" + properties: "var://epd_idp-parameters" diff --git a/patterns/IDP_Status_Check_7a913eec7f78ce674cd87854.yml b/patterns/IDP_Status_Check_7a913eec7f78ce674cd87854.yml index b11cbd8..1797a7a 100644 --- a/patterns/IDP_Status_Check_7a913eec7f78ce674cd87854.yml +++ b/patterns/IDP_Status_Check_7a913eec7f78ce674cd87854.yml @@ -6,6 +6,8 @@ pattern: label: "IDP" properties: authStatesFile: "res://7a913eec7f78ce674cd87854#authStatesFile" + onSuccess: + - "pattern://03326b180687860ffe06a58c" nextSteps: - "pattern://f63c475c35b616b7c6c1901c" resources: "res://7a913eec7f78ce674cd87854#resources" diff --git a/patterns/IDP_Truststore_0a15213c00dec3668fb94a65.yml b/patterns/IDP_Truststore_0a15213c00dec3668fb94a65.yml new file mode 100644 index 0000000..a52a48f --- /dev/null +++ b/patterns/IDP_Truststore_0a15213c00dec3668fb94a65.yml @@ -0,0 +1,11 @@ +schemaVersion: "1.0" +pattern: + id: "0a15213c00dec3668fb94a65" + className: "ch.nevis.admin.v4.plugin.nevisauth.patterns.KeyObject" + name: "IDP_Truststore" + label: "STORE" + properties: + keyObjectId: "var://idp_sp_connector-sp-issuer" + keyStoreName: "Store_IDP_AGOV" + trustStore: + - "pattern://8052fd68f4a663629d651f7b" diff --git a/patterns/IdP-Cors-Filter_8b8167e5de0e69dedb81cacb.yml b/patterns/IdP-Cors-Filter_8b8167e5de0e69dedb81cacb.yml index acdeb82..bfb11f8 100644 --- a/patterns/IdP-Cors-Filter_8b8167e5de0e69dedb81cacb.yml +++ b/patterns/IdP-Cors-Filter_8b8167e5de0e69dedb81cacb.yml @@ -3,6 +3,7 @@ pattern: id: "8b8167e5de0e69dedb81cacb" className: "ch.nevis.admin.v4.plugin.nevisproxy.patterns.GenericHostContextSettings" name: "IdP-Cors-Filter" + label: "SECURITY" properties: filters: "\n Lua_${name}\n ch::nevis::isiweb4::filter::lua::LuaFilter\n\ \ \n Script.OutputHeaderFunctionName\n\ diff --git a/patterns/IdP-Idm-SecToken-Signer-Trust_2d8151249e6734ccc072422b.yml b/patterns/IdP-Idm-SecToken-Signer-Trust_2d8151249e6734ccc072422b.yml index c40a349..f7f295a 100644 --- a/patterns/IdP-Idm-SecToken-Signer-Trust_2d8151249e6734ccc072422b.yml +++ b/patterns/IdP-Idm-SecToken-Signer-Trust_2d8151249e6734ccc072422b.yml @@ -3,6 +3,7 @@ pattern: id: "2d8151249e6734ccc072422b" className: "ch.nevis.admin.v4.plugin.nevisproxy.patterns.AutomaticTrustStoreProvider" name: "IdP-Idm-SecToken-Signer-Trust" + label: "STORE" properties: keystore: - "pattern://aeb2fed9962dcd5f7893db51" diff --git a/patterns/Internal-IdP-Auth-Signer-Trust_55bf63a1b1716e9631f7080d.yml b/patterns/Internal-IdP-Auth-Signer-Trust_55bf63a1b1716e9631f7080d.yml index 53f1a3e..98e8397 100644 --- a/patterns/Internal-IdP-Auth-Signer-Trust_55bf63a1b1716e9631f7080d.yml +++ b/patterns/Internal-IdP-Auth-Signer-Trust_55bf63a1b1716e9631f7080d.yml @@ -3,6 +3,8 @@ pattern: id: "55bf63a1b1716e9631f7080d" className: "ch.nevis.admin.v4.plugin.nevisproxy.patterns.AutomaticTrustStoreProvider" name: "Internal-IdP-Auth-Signer-Trust" + label: "STORE" properties: keystore: - "pattern://aeb2fed9962dcd5f7893db51" + truststoreFile: "var://internal-idp-auth-signer-trust-additional-trusted-certificates" diff --git a/patterns/Internal-IdP-Auth-Signer_aeb2fed9962dcd5f7893db51.yml b/patterns/Internal-IdP-Auth-Signer_aeb2fed9962dcd5f7893db51.yml index 7482431..0026d20 100644 --- a/patterns/Internal-IdP-Auth-Signer_aeb2fed9962dcd5f7893db51.yml +++ b/patterns/Internal-IdP-Auth-Signer_aeb2fed9962dcd5f7893db51.yml @@ -3,6 +3,7 @@ pattern: id: "aeb2fed9962dcd5f7893db51" className: "ch.nevis.admin.v4.plugin.nevisproxy.patterns.AutomaticKeyStoreProvider" name: "Internal-IdP-Auth-Signer" + label: "STORE" properties: owner: - "pattern://7022472ae407577ae604bbb8" diff --git a/patterns/Main_IDP_Authentication_Flow_a6f6dc6affdc7c692ff857b9.yml b/patterns/Main_IDP_Authentication_Flow_a6f6dc6affdc7c692ff857b9.yml new file mode 100644 index 0000000..5848dd9 --- /dev/null +++ b/patterns/Main_IDP_Authentication_Flow_a6f6dc6affdc7c692ff857b9.yml @@ -0,0 +1,12 @@ +schemaVersion: "1.0" +pattern: + id: "a6f6dc6affdc7c692ff857b9" + className: "ch.nevis.admin.v4.plugin.nevisauth.patterns.AuthenticationFlow" + name: "Main IDP Authentication Flow" + label: "IDP CUSTOM" + properties: + host: + - "pattern://1f0702aaabef60a615abf41f" + path: "/SAML2/SSO/" + realm: + - "pattern://4fcfadb4a5c946ead7e6e995" diff --git a/patterns/Recovery_Auth_584964c837512845d7940809.yml b/patterns/Recovery_Auth_584964c837512845d7940809.yml index db23858..1978139 100644 --- a/patterns/Recovery_Auth_584964c837512845d7940809.yml +++ b/patterns/Recovery_Auth_584964c837512845d7940809.yml @@ -3,6 +3,7 @@ pattern: id: "584964c837512845d7940809" className: "ch.nevis.admin.v4.plugin.nevisauth.patterns2.GenericAuthenticationStep" name: "Recovery_Auth" + label: "RECOVERY" notes: "TODO/haburger/2025-01-23: the transition exit.3 (alreadyInRecovery) is never\ \ used. We should clean this up here" properties: diff --git a/patterns/Recovery_Authentication_Flow_decb9b3f88d430fb5c95f466.yml b/patterns/Recovery_Authentication_Flow_decb9b3f88d430fb5c95f466.yml index 77c3702..7bc42c1 100644 --- a/patterns/Recovery_Authentication_Flow_decb9b3f88d430fb5c95f466.yml +++ b/patterns/Recovery_Authentication_Flow_decb9b3f88d430fb5c95f466.yml @@ -3,6 +3,7 @@ pattern: id: "decb9b3f88d430fb5c95f466" className: "ch.nevis.admin.v4.plugin.nevisauth.patterns.AuthenticationFlow" name: "Recovery Authentication Flow" + label: "RECOVERY" properties: host: - "pattern://1f0702aaabef60a615abf41f" diff --git a/patterns/Recovery_Correct_Path_to_static_Ressources_3d45f250b698005a29eb58b6.yml b/patterns/Recovery_Correct_Path_to_static_Ressources_3d45f250b698005a29eb58b6.yml index 85f5d02..b5ca2c4 100644 --- a/patterns/Recovery_Correct_Path_to_static_Ressources_3d45f250b698005a29eb58b6.yml +++ b/patterns/Recovery_Correct_Path_to_static_Ressources_3d45f250b698005a29eb58b6.yml @@ -3,6 +3,7 @@ pattern: id: "3d45f250b698005a29eb58b6" className: "ch.nevis.admin.v4.plugin.nevisproxy.patterns.URLHandler" name: "Recovery_Correct_Path_to_static_Ressources" + label: "RECOVERY" properties: redirects: - /AUTH/RECOVERY/undefined/(.*): "/nevislogrend/nevislogrend/applications/Auth_Realm_Recovery/webdata/$1" diff --git a/patterns/Recovery_Pdf_Generation_cadefc0abd2323fdccdb7a18.yml b/patterns/Recovery_Pdf_Generation_cadefc0abd2323fdccdb7a18.yml index 6e189cd..1fef6c4 100644 --- a/patterns/Recovery_Pdf_Generation_cadefc0abd2323fdccdb7a18.yml +++ b/patterns/Recovery_Pdf_Generation_cadefc0abd2323fdccdb7a18.yml @@ -3,6 +3,7 @@ pattern: id: "cadefc0abd2323fdccdb7a18" className: "ch.nevis.admin.v4.plugin.nevisproxy.patterns.RESTServiceAccess" name: "Recovery_Pdf_Generation" + label: "RECOVERY" properties: host: - "pattern://1f0702aaabef60a615abf41f" diff --git a/patterns/Recovery_authWithNewCredentials_c1c0941f54cc36340578ff5f.yml b/patterns/Recovery_authWithNewCredentials_c1c0941f54cc36340578ff5f.yml index be931eb..310fd11 100644 --- a/patterns/Recovery_authWithNewCredentials_c1c0941f54cc36340578ff5f.yml +++ b/patterns/Recovery_authWithNewCredentials_c1c0941f54cc36340578ff5f.yml @@ -3,6 +3,7 @@ pattern: id: "c1c0941f54cc36340578ff5f" className: "ch.nevis.admin.v4.plugin.nevisauth.patterns2.GenericAuthenticationStep" name: "Recovery_authWithNewCredentials" + label: "RECOVERY" properties: authStatesFile: "res://c1c0941f54cc36340578ff5f#authStatesFile" onSuccess: diff --git a/patterns/Recovery_checkAccountState_249d97a8932fe97d36112ff3.yml b/patterns/Recovery_checkAccountState_249d97a8932fe97d36112ff3.yml index 0966209..9c1908e 100644 --- a/patterns/Recovery_checkAccountState_249d97a8932fe97d36112ff3.yml +++ b/patterns/Recovery_checkAccountState_249d97a8932fe97d36112ff3.yml @@ -3,6 +3,7 @@ pattern: id: "249d97a8932fe97d36112ff3" className: "ch.nevis.admin.v4.plugin.nevisauth.patterns2.GenericAuthenticationStep" name: "Recovery_checkAccountState" + label: "RECOVERY" properties: authStatesFile: "res://249d97a8932fe97d36112ff3#authStatesFile" onSuccess: diff --git a/patterns/Recovery_createURLTicket_9a1d3c6052019748d3510261.yml b/patterns/Recovery_createURLTicket_9a1d3c6052019748d3510261.yml index a8953f4..b25da4b 100644 --- a/patterns/Recovery_createURLTicket_9a1d3c6052019748d3510261.yml +++ b/patterns/Recovery_createURLTicket_9a1d3c6052019748d3510261.yml @@ -3,6 +3,7 @@ pattern: id: "9a1d3c6052019748d3510261" className: "ch.nevis.admin.v4.plugin.nevisauth.patterns2.GenericAuthenticationStep" name: "Recovery_createURLTicket" + label: "RECOVERY" properties: authStatesFile: "res://9a1d3c6052019748d3510261#authStatesFile" onSuccess: diff --git a/patterns/Recovery_emailSent_screen_6364d27d1ca954be8ef7cb46.yml b/patterns/Recovery_emailSent_screen_6364d27d1ca954be8ef7cb46.yml index fac5c08..12a8438 100644 --- a/patterns/Recovery_emailSent_screen_6364d27d1ca954be8ef7cb46.yml +++ b/patterns/Recovery_emailSent_screen_6364d27d1ca954be8ef7cb46.yml @@ -3,6 +3,7 @@ pattern: id: "6364d27d1ca954be8ef7cb46" className: "ch.nevis.admin.v4.plugin.nevisauth.patterns2.GenericAuthenticationStep" name: "Recovery_emailSent_screen" + label: "RECOVERY" properties: authStatesFile: "res://6364d27d1ca954be8ef7cb46#authStatesFile" onSuccess: diff --git a/patterns/Recovery_fetchCaptchaInfos_bea3ca0c85381d07d632be52.yml b/patterns/Recovery_fetchCaptchaInfos_bea3ca0c85381d07d632be52.yml index 654fdf7..8936e92 100644 --- a/patterns/Recovery_fetchCaptchaInfos_bea3ca0c85381d07d632be52.yml +++ b/patterns/Recovery_fetchCaptchaInfos_bea3ca0c85381d07d632be52.yml @@ -3,6 +3,7 @@ pattern: id: "bea3ca0c85381d07d632be52" className: "ch.nevis.admin.v4.plugin.nevisauth.patterns2.GroovyScriptStep" name: "Recovery_fetchCaptchaInfos" + label: "RECOVERY" properties: scriptFile: "res://bea3ca0c85381d07d632be52#scriptFile" parameters: diff --git a/patterns/Recovery_fetchCaptchaResult_717094cbd4ddbadeab4b2cc1.yml b/patterns/Recovery_fetchCaptchaResult_717094cbd4ddbadeab4b2cc1.yml index 4919a76..c3a5cda 100644 --- a/patterns/Recovery_fetchCaptchaResult_717094cbd4ddbadeab4b2cc1.yml +++ b/patterns/Recovery_fetchCaptchaResult_717094cbd4ddbadeab4b2cc1.yml @@ -3,6 +3,7 @@ pattern: id: "717094cbd4ddbadeab4b2cc1" className: "ch.nevis.admin.v4.plugin.nevisauth.patterns2.GroovyScriptStep" name: "Recovery_fetchCaptchaResult" + label: "RECOVERY" properties: scriptFile: "res://717094cbd4ddbadeab4b2cc1#scriptFile" parameters: diff --git a/patterns/Recovery_fido2Login_54c1b68431bc2e03b61edcaa.yml b/patterns/Recovery_fido2Login_54c1b68431bc2e03b61edcaa.yml index d167339..9d3246c 100644 --- a/patterns/Recovery_fido2Login_54c1b68431bc2e03b61edcaa.yml +++ b/patterns/Recovery_fido2Login_54c1b68431bc2e03b61edcaa.yml @@ -3,6 +3,7 @@ pattern: id: "54c1b68431bc2e03b61edcaa" className: "ch.nevis.admin.v4.plugin.nevisauth.patterns2.GenericAuthenticationStep" name: "Recovery_fido2Login" + label: "RECOVERY" properties: authStatesFile: "res://54c1b68431bc2e03b61edcaa#authStatesFile" onSuccess: diff --git a/patterns/Recovery_handleCode_db4acd487dc7e8b82de8abb4.yml b/patterns/Recovery_handleCode_db4acd487dc7e8b82de8abb4.yml index 2dd9cb7..bb6406a 100644 --- a/patterns/Recovery_handleCode_db4acd487dc7e8b82de8abb4.yml +++ b/patterns/Recovery_handleCode_db4acd487dc7e8b82de8abb4.yml @@ -3,6 +3,7 @@ pattern: id: "db4acd487dc7e8b82de8abb4" className: "ch.nevis.admin.v4.plugin.nevisauth.patterns2.GroovyScriptStep" name: "Recovery_handleCode" + label: "RECOVERY" properties: scriptFile: "res://db4acd487dc7e8b82de8abb4#scriptFile" onSuccess: diff --git a/patterns/Recovery_loadUser_81ae3547acc02160f787a546.yml b/patterns/Recovery_loadUser_81ae3547acc02160f787a546.yml index f499bf9..145d3ef 100644 --- a/patterns/Recovery_loadUser_81ae3547acc02160f787a546.yml +++ b/patterns/Recovery_loadUser_81ae3547acc02160f787a546.yml @@ -3,6 +3,7 @@ pattern: id: "81ae3547acc02160f787a546" className: "ch.nevis.admin.v4.plugin.nevisauth.patterns2.GenericAuthenticationStep" name: "Recovery_loadUser" + label: "RECOVERY" properties: authStatesFile: "res://81ae3547acc02160f787a546#authStatesFile" parameters: "var://extid_user_verify-template-parameters" diff --git a/patterns/Recovery_mobile_nless_auth_4bc453bf68139ee87966b0c7.yml b/patterns/Recovery_mobile_nless_auth_4bc453bf68139ee87966b0c7.yml index c4a1f52..ef26563 100644 --- a/patterns/Recovery_mobile_nless_auth_4bc453bf68139ee87966b0c7.yml +++ b/patterns/Recovery_mobile_nless_auth_4bc453bf68139ee87966b0c7.yml @@ -3,6 +3,7 @@ pattern: id: "4bc453bf68139ee87966b0c7" className: "ch.nevis.admin.v4.plugin.nevisauth.patterns2.GenericAuthenticationStep" name: "Recovery_mobile_nless_auth" + label: "RECOVERY" properties: authStatesFile: "res://4bc453bf68139ee87966b0c7#authStatesFile" onSuccess: diff --git a/patterns/Recovery_ongoing_1d38203c48e017b5b3812385.yml b/patterns/Recovery_ongoing_1d38203c48e017b5b3812385.yml index 8862baf..7cfdbda 100644 --- a/patterns/Recovery_ongoing_1d38203c48e017b5b3812385.yml +++ b/patterns/Recovery_ongoing_1d38203c48e017b5b3812385.yml @@ -3,6 +3,7 @@ pattern: id: "1d38203c48e017b5b3812385" className: "ch.nevis.admin.v4.plugin.nevisauth.patterns2.GenericAuthenticationStep" name: "Recovery_ongoing" + label: "RECOVERY" properties: authStatesFile: "res://1d38203c48e017b5b3812385#authStatesFile" onSuccess: diff --git a/patterns/Recovery_redirectAgovMe_6061abea33a234fad73897b7.yml b/patterns/Recovery_redirectAgovMe_6061abea33a234fad73897b7.yml index f9bc357..df49bc9 100644 --- a/patterns/Recovery_redirectAgovMe_6061abea33a234fad73897b7.yml +++ b/patterns/Recovery_redirectAgovMe_6061abea33a234fad73897b7.yml @@ -3,6 +3,7 @@ pattern: id: "6061abea33a234fad73897b7" className: "ch.nevis.admin.v4.plugin.nevisauth.patterns2.GenericAuthenticationStep" name: "Recovery_redirectAgovMe" + label: "RECOVERY" properties: authStatesFile: "res://6061abea33a234fad73897b7#authStatesFile" parameters: "var://service_provider_state-template-parameters" diff --git a/patterns/Recovery_sendEmail031_9f443ce76f9522dfae4c3aa0.yml b/patterns/Recovery_sendEmail031_9f443ce76f9522dfae4c3aa0.yml index 8676570..ecc465b 100644 --- a/patterns/Recovery_sendEmail031_9f443ce76f9522dfae4c3aa0.yml +++ b/patterns/Recovery_sendEmail031_9f443ce76f9522dfae4c3aa0.yml @@ -3,6 +3,7 @@ pattern: id: "9f443ce76f9522dfae4c3aa0" className: "ch.nevis.admin.v4.plugin.nevisauth.patterns2.GroovyScriptStep" name: "Recovery_sendEmail031" + label: "RECOVERY" properties: scriptFile: "res://9f443ce76f9522dfae4c3aa0#scriptFile" parameters: diff --git a/patterns/Recovery_sendEmail031b_ae023be7e097522c74e31d17.yml b/patterns/Recovery_sendEmail031b_ae023be7e097522c74e31d17.yml index fceee0d..a6eae19 100644 --- a/patterns/Recovery_sendEmail031b_ae023be7e097522c74e31d17.yml +++ b/patterns/Recovery_sendEmail031b_ae023be7e097522c74e31d17.yml @@ -3,6 +3,7 @@ pattern: id: "ae023be7e097522c74e31d17" className: "ch.nevis.admin.v4.plugin.nevisauth.patterns2.GenericAuthenticationStep" name: "Recovery_sendEmail031b" + label: "RECOVERY" properties: authStatesFile: "res://ae023be7e097522c74e31d17#authStatesFile" onSuccess: diff --git a/patterns/Recovery_verifyEmail_0327ca909dfcaf2d332da104.yml b/patterns/Recovery_verifyEmail_0327ca909dfcaf2d332da104.yml index 60ad52a..3035436 100644 --- a/patterns/Recovery_verifyEmail_0327ca909dfcaf2d332da104.yml +++ b/patterns/Recovery_verifyEmail_0327ca909dfcaf2d332da104.yml @@ -3,6 +3,7 @@ pattern: id: "0327ca909dfcaf2d332da104" className: "ch.nevis.admin.v4.plugin.nevisauth.patterns2.GenericAuthenticationStep" name: "Recovery_verifyEmail" + label: "RECOVERY" properties: authStatesFile: "res://0327ca909dfcaf2d332da104#authStatesFile" parameters: "var://extid_user_verify-template-parameters" diff --git a/patterns/Request_Validation_Settings_(ModSecurity)_0573c2491a56e59daca47e95.yml b/patterns/Request_Validation_Settings_(ModSecurity)_0573c2491a56e59daca47e95.yml index d11a67d..8f12e28 100644 --- a/patterns/Request_Validation_Settings_(ModSecurity)_0573c2491a56e59daca47e95.yml +++ b/patterns/Request_Validation_Settings_(ModSecurity)_0573c2491a56e59daca47e95.yml @@ -3,6 +3,7 @@ pattern: id: "0573c2491a56e59daca47e95" className: "ch.nevis.admin.v4.plugin.nevisproxy.patterns.RequestValidationSettings" name: "Request Validation Settings (ModSecurity)" + label: "SECURITY" properties: logOnlyMode: "enabled" level: "var://request-validation-settings-modsecurity-paranoia-level" diff --git a/patterns/RequestedRoleLevel_68665057549fd887ea09fb86.yml b/patterns/RequestedRoleLevel_68665057549fd887ea09fb86.yml index e757d6f..7476fe6 100644 --- a/patterns/RequestedRoleLevel_68665057549fd887ea09fb86.yml +++ b/patterns/RequestedRoleLevel_68665057549fd887ea09fb86.yml @@ -15,5 +15,5 @@ pattern: onFailure: - "pattern://4c65de021d362462324a3a5f" customSteps: - - "pattern://7441fca76f479e4beb5ca796" + - "pattern://e335f57d4c64dfc97223697a" scriptTraceGroup: "AGOV-ACCT" diff --git a/patterns/_Auth_Realm_Main_IDP_Custom_Concurrent_Logout_db4eead0bb25b03205afd79f.yml b/patterns/_Auth_Realm_Main_IDP_Custom_Concurrent_Logout_db4eead0bb25b03205afd79f.yml new file mode 100644 index 0000000..e610702 --- /dev/null +++ b/patterns/_Auth_Realm_Main_IDP_Custom_Concurrent_Logout_db4eead0bb25b03205afd79f.yml @@ -0,0 +1,8 @@ +schemaVersion: "1.0" +pattern: + id: "db4eead0bb25b03205afd79f" + className: "ch.nevis.admin.v4.plugin.nevisauth.patterns2.GenericAuthenticationStep" + name: " Auth_Realm_Main_IDP_Custom_Concurrent_Logout" + label: "IDP CUSTOM" + properties: + authStatesFile: "res://db4eead0bb25b03205afd79f#authStatesFile" diff --git a/patterns/ab5a82719993921822e95751_configFile/epd_artifact_resolution_endpoint.xml b/patterns/ab5a82719993921822e95751_configFile/epd_artifact_resolution_endpoint.xml new file mode 100644 index 0000000..1440747 --- /dev/null +++ b/patterns/ab5a82719993921822e95751_configFile/epd_artifact_resolution_endpoint.xml @@ -0,0 +1,5 @@ + + + + + \ No newline at end of file diff --git a/patterns/bfd395eb0dab50aff2f2c01b_authStatesFile/registrationAssertion.xml b/patterns/bfd395eb0dab50aff2f2c01b_authStatesFile/registrationAssertion.xml index c486c6d..2b5c098 100644 --- a/patterns/bfd395eb0dab50aff2f2c01b_authStatesFile/registrationAssertion.xml +++ b/patterns/bfd395eb0dab50aff2f2c01b_authStatesFile/registrationAssertion.xml @@ -6,6 +6,9 @@ + + + diff --git a/patterns/cf0e8f8de1c8ac7345c5a6bb_authStatesFile/auth_done_gui.xml b/patterns/cf0e8f8de1c8ac7345c5a6bb_authStatesFile/auth_done_gui.xml new file mode 100644 index 0000000..472f489 --- /dev/null +++ b/patterns/cf0e8f8de1c8ac7345c5a6bb_authStatesFile/auth_done_gui.xml @@ -0,0 +1,5 @@ + + + + + \ No newline at end of file diff --git a/patterns/db4eead0bb25b03205afd79f_authStatesFile/concurrent_logout.xml b/patterns/db4eead0bb25b03205afd79f_authStatesFile/concurrent_logout.xml new file mode 100644 index 0000000..81cbb58 --- /dev/null +++ b/patterns/db4eead0bb25b03205afd79f_authStatesFile/concurrent_logout.xml @@ -0,0 +1,8 @@ + + + + + + + + \ No newline at end of file diff --git a/patterns/7441fca76f479e4beb5ca796_authStatesFile/EId_Verification_Auth.xml b/patterns/e335f57d4c64dfc97223697a_authStatesFile/EId_Verification_Auth.xml similarity index 100% rename from patterns/7441fca76f479e4beb5ca796_authStatesFile/EId_Verification_Auth.xml rename to patterns/e335f57d4c64dfc97223697a_authStatesFile/EId_Verification_Auth.xml diff --git a/patterns/7441fca76f479e4beb5ca796_resources/eid_verification_auth.groovy b/patterns/e335f57d4c64dfc97223697a_resources/eid_verification_auth.groovy similarity index 100% rename from patterns/7441fca76f479e4beb5ca796_resources/eid_verification_auth.groovy rename to patterns/e335f57d4c64dfc97223697a_resources/eid_verification_auth.groovy diff --git a/patterns/nevisAuth_7022472ae407577ae604bbb8.yml b/patterns/nevisAuth_7022472ae407577ae604bbb8.yml index 786a54c..6f22ae0 100644 --- a/patterns/nevisAuth_7022472ae407577ae604bbb8.yml +++ b/patterns/nevisAuth_7022472ae407577ae604bbb8.yml @@ -14,5 +14,7 @@ pattern: - "pattern://c0722fc79e7314c9cdcd20ff" signerKeyStore: - "pattern://aeb2fed9962dcd5f7893db51" + signerTrustStore: + - "pattern://55bf63a1b1716e9631f7080d" addons: - "pattern://90af8358cc587f5c5aa79fec" diff --git a/variables.yml b/variables.yml index 341eeb1..6fa8f42 100644 --- a/variables.yml +++ b/variables.yml @@ -99,6 +99,14 @@ variables: maxAllowed: 1 value: "nevisauth" requireOverloading: true + auth_realm_main_idp_custom_idp_dispatcher-template-parameters: + className: "ch.nevis.admin.v4.plugin.base.generation.property.TextProperty" + parameters: + required: false + syntax: "YAML" + value: "epd_idp_binding_mode: post\natb: https://trustbroker.agov-epr-lab.azure.adnovum.net\n\ + epd_atb: https://trustbroker-idp.agov-epr-lab.azure.adnovum.net\n \n" + requireOverloading: true auth_realm_main_sts_parameters: className: "ch.nevis.admin.v4.plugin.base.generation.property.TextProperty" parameters: @@ -172,6 +180,24 @@ variables: secretPreserving: true value: null requireOverloading: true + epd_artifact_resolution_service-template-parameters: + className: "ch.nevis.admin.v4.plugin.base.generation.property.TextProperty" + parameters: + required: false + syntax: "YAML" + value: "endpoint: auth.agov-epr-lab.azure.adnovum.net" + requireOverloading: true + epd_idp-parameters: + className: "ch.nevis.admin.v4.plugin.base.generation.property.AuthStateProperty" + parameters: + separators: + - "->" + - "=" + switchedSeparators: [] + problematicSeparator: "->" + value: + - out.authnContextClassRef: "${sess:contextClassRefToSet}" + requireOverloading: true externalingresssettings-annotations: className: "ch.nevis.admin.v4.plugin.base.generation.property.KeyValueProperty" parameters: @@ -554,6 +580,16 @@ variables: queryInputMode: "OPTIONAL" value: "https://trustbroker.agov-d.azure.adnovum.net/adfs/ls" requireOverloading: true + idp_sp_epd_connector-outbound-binding: + className: "ch.nevis.admin.v4.plugin.base.generation.property.SelectionProperty" + parameters: + minRequired: 1 + maxAllowed: 1 + options: + - "http-post" + - "http-redirect" + value: "http-post" + requireOverloading: true idp_sp_epd_connector-sp-issuer: className: "ch.nevis.admin.v4.plugin.base.generation.property.SimpleTextProperty" parameters: @@ -574,6 +610,12 @@ variables: queryInputMode: "OPTIONAL" value: "https://trustbroker-idp.agov-d.azure.adnovum.net/adfs/ls" requireOverloading: true + internal-idp-auth-signer-trust-additional-trusted-certificates: + className: "ch.nevis.admin.v4.plugin.base.generation.property.AttachmentProperty" + parameters: + minRequired: 0 + value: null + requireOverloading: true log_auth-default-log-level: className: "ch.nevis.admin.v4.plugin.base.generation.property.SelectionProperty" parameters: