diff --git a/patterns/1f0702aaabef60a615abf41f_resources/resources.zip b/patterns/1f0702aaabef60a615abf41f_resources/resources.zip index f92ad91..5b1395f 100644 Binary files a/patterns/1f0702aaabef60a615abf41f_resources/resources.zip and b/patterns/1f0702aaabef60a615abf41f_resources/resources.zip differ diff --git a/patterns/204c22beaccdfd22727af378_labels/labels.zip b/patterns/204c22beaccdfd22727af378_labels/labels.zip index eb5f1a4..9ed6da8 100644 Binary files a/patterns/204c22beaccdfd22727af378_labels/labels.zip and b/patterns/204c22beaccdfd22727af378_labels/labels.zip differ diff --git a/patterns/204c22beaccdfd22727af378_template/webdata.zip b/patterns/204c22beaccdfd22727af378_template/webdata.zip index 575100c..8cd2145 100644 Binary files a/patterns/204c22beaccdfd22727af378_template/webdata.zip and b/patterns/204c22beaccdfd22727af378_template/webdata.zip differ diff --git a/patterns/2cdd910036aa06b102863a4f_scriptFile/checkLoa.gy b/patterns/2cdd910036aa06b102863a4f_scriptFile/checkLoa.gy index 313cce5..a0e05ac 100644 --- a/patterns/2cdd910036aa06b102863a4f_scriptFile/checkLoa.gy +++ b/patterns/2cdd910036aa06b102863a4f_scriptFile/checkLoa.gy @@ -119,6 +119,7 @@ try { if (adressVerificationList && !adressVerificationList.isEmpty()) { adressVerification = adressVerificationList[0] } + def authenticationMethod = session.get('authenticatedWith') LOG.debug('CheckLoa: Requested role level '+ requestedRoleLevelNumber) LOG.debug('CheckLoa: idVerification: ' + getUserAGOVLoiIdVerification()) @@ -160,17 +161,17 @@ try { session.setAttribute('ch.nevis.idm.User.gender', '3') } - for (String role : getUserAGOVLoiRoles()) { - if (role.startsWith('level')) { - def roleLevel = role.substring(5) - int roleLevelNumber = Integer.parseInt(roleLevel) + if (role.startsWith('level')) { + def roleLevel = role.substring(5) + int roleLevelNumber = Integer.parseInt(roleLevel) - if (highestRoleLevelNumber< roleLevelNumber) { - highestRoleLevelNumber=roleLevelNumber - } - } - } + if (highestRoleLevelNumber< roleLevelNumber) { + highestRoleLevelNumber=roleLevelNumber + } + } + } + LOG.debug('CheckLoa: Highest role Level ' + highestRoleLevelNumber.toString() +' contextclassref ' + requestedRoleLevelNumber.toString()) LOG.debug('CheckLoa: Compare ' + (highestRoleLevelNumber>=requestedRoleLevelNumber)) diff --git a/patterns/306ce091fd87bad6174d9e8b_authStatesFile/eid_compare_and_update_idm_attributes.xml b/patterns/306ce091fd87bad6174d9e8b_authStatesFile/eid_compare_and_update_idm_attributes.xml new file mode 100644 index 0000000..f01f092 --- /dev/null +++ b/patterns/306ce091fd87bad6174d9e8b_authStatesFile/eid_compare_and_update_idm_attributes.xml @@ -0,0 +1,30 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/patterns/306ce091fd87bad6174d9e8b_resources/eid_compare_and_update_idm_attributes.groovy b/patterns/306ce091fd87bad6174d9e8b_resources/eid_compare_and_update_idm_attributes.groovy new file mode 100644 index 0000000..aab722c --- /dev/null +++ b/patterns/306ce091fd87bad6174d9e8b_resources/eid_compare_and_update_idm_attributes.groovy @@ -0,0 +1,158 @@ +import java.text.SimpleDateFormat +import groovy.text.SimpleTemplateEngine + +import ch.nevis.idm.client.IdmRestClient +import ch.nevis.idm.client.IdmRestClientFactory + +def getDateWithoutTimestamp(String date){ + def result = date + if(date.matches('^[0-9-]+[+]{1}.*')){ + result = date.replaceAll('[+]{1}.*', "") + } + return result +} + +// NOTE/aca/2025/06/19: We could also reload the data from idm after the update instead of updating the session variables manualy -> probably better and less error-prone +def compareAndUpdateSessionVariables(sess, keys, isProperty){ + def updatedKeys = [] + for(key in keys){ + def idmkey = isProperty ? "ch.nevis.idm.User.prop.$key" : "ch.nevis.idm.User.$key" + def eidValue = session["agov.eid.User.$key"] ?: "" + def idmValue = session[idmkey] ?: "" + if(!idmValue || eidValue != idmValue){ + sess.setAttribute(idmkey, eidValue) + updatedKeys.add(key) + } + } + return updatedKeys +} + +String user_update_dto_template = ''' +{ + "name": { + "firstName": "$firstName", + "familyName": "$familyName" + }, + "properties": { + "svnr": "$svnr", + "placeOfBirth": "$placeOfBirth", + "nationality": "$nationality", + "eIdNumber": "$eIdNumber" + }, + "gender": "$gender", + "birthDate": "$birthDate", + + "modificationComment": "updated user information with eid attributes during request $request" +} +''' + +// Accounting +def requester = session['ch.nevis.auth.saml.request.scoping.requesterId'] ?: 'unknown' +def requestId = session['ch.nevis.auth.saml.request.id'] ?: 'unknown' +def requestedAq = session['agov.requestedRoleLevel'] ?: 'unknown' +def user = session['ch.adnovum.nevisidm.user.extId'] ?: 'unknown' +def credentialType = session['authenticatedWith'] ?: 'unknown' +def sourceIp = request.getLoginContext()['connection.HttpHeader.X-Real-IP'] ?: 'unknown' +def userAgent = request.getLoginContext()['connection.HttpHeader.user-agent'] ?: request.getLoginContext()['connection.HttpHeader.User-Agent'] ?: 'unknown' + + + +def sess = request.getAuthSession(true) + +// Convert EID gender format to IDM +if(sess.get('agov.eid.User.gender') == '1'){ + sess.setAttribute('agov.eid.User.gender', 'MALE') +} +if(sess.get('agov.eid.User.gender') == '2'){ + sess.setAttribute('agov.eid.User.gender', 'FEMALE') +} +if(sess.get('agov.eid.User.gender') == '3'){ + sess.setAttribute('agov.eid.User.gender', 'OTHER') +} + +// Compare eid and idm attributes + update idm session variables if they differ +def attributesToAudit = compareAndUpdateSessionVariables(sess, ["firstName", "lastName", "gender"], false) +// NOTE/aca/2025/06/14/: Potentally Throw a DATA ERROR if the properties are different? -> should the svnr number ever change? +def propertiesToAudit = compareAndUpdateSessionVariables(sess, ["svnr", "eIdNumber", "nationality", "placeOfBirth"], true) + + +// Handle birthdate seperately, since it can contain a timestamp -> we probably don't want to update if only the timestamp is wrong +String eidBirthdate = getDateWithoutTimestamp(session["agov.eid.User.birthDate"] ?: "") +String idmBirthdate = getDateWithoutTimestamp(session["ch.nevis.idm.User.birthDate"] ?: "") +LOG.debug("eidBirthdate: $eidBirthdate idmBirthdate: $idmBirthdate") +if(eidBirthdate != idmBirthdate){ + sess.setAttribute("ch.nevis.idm.User.birthDate", eidBirthdate) + // For some reson IdmGetPropertyState uses a different date format than IdmSetPropertyState? + //def date = new SimpleDateFormat('yyyy-MM-dd').parse(eidBirthdate) + //def idmFromatedBirthDate = new SimpleDateFormat('dd.MM.yyyy').format(date) + //sess.setAttribute("ch.nevis.idm.User.birthDate.idmFormat", idmFromatedBirthDate) + attributesToAudit.add("birthDate") +} + +// Check if we need to update IDM +def auditedRequired = attributesToAudit.size() > 0 || propertiesToAudit.size() > 0 + +if(auditedRequired){ + // update attributes in idm & transition to User notification + IdmRestClient idmRestClient = IdmRestClientFactory.get(parameters) + + String baseUrl = parameters.get("baseUrl") + String clientExtId = parameters.get("clientExtId") + String endPoint = "$baseUrl/api/core/v1" + String userExtId = sess.getAttribute("ch.nevis.idm.User.extId") + + String requestUrl = "$endPoint/$clientExtId/users/$userExtId" + + + + def binding = [ + "firstName": sess.getAttribute('agov.eid.User.firstName'), + "familyName": sess.getAttribute('agov.eid.User.lastName'), + "svnr": sess.getAttribute('agov.eid.User.svnr'), + "placeOfBirth": sess.getAttribute('agov.eid.User.placeOfBirth'), + "nationality": sess.getAttribute('agov.eid.User.nationality'), + "eIdNumber": sess.getAttribute('agov.eid.User.eIdNumber'), + "gender": sess.getAttribute('agov.eid.User.gender').toLowerCase(), + "birthDate": sess.getAttribute('agov.eid.User.birthDate'), + "request": requestId + ] + + def templateEngine = new SimpleTemplateEngine() + def userUpdateDto = templateEngine.createTemplate(user_update_dto_template).make(binding).toString() + + try { + idmRestClient.patch(requestUrl, userUpdateDto) + + }catch(Exception e) { + LOG.error("Failed to update User data in IDM: ${e}") + LOG.error("Event='DATAERROR', Requester='${requester}', RequestId='${requestId}', RequestedAq=${requestedAq}, User=${user}, CredentialType='${credentialType}', SourceIp=${sourceIp}, UserAgent='${userAgent}', reason='Failed to update User data in IDM'") + response.setResult('error') + return + } + String printKeys = attributesToAudit.toListString() + LOG.debug("AuditedAttributes: $printKeys") + + // Transform gender back to number + if(sess.get('ch.nevis.idm.User.gender') == 'MALE'){ + sess.setAttribute('ch.nevis.idm.User.gender', '1') + } + if(sess.get('ch.nevis.idm.User.gender') == 'FEMALE'){ + sess.setAttribute('ch.nevis.idm.User.gender', '2') + } + if(sess.get('ch.nevis.idm.User.gender') == 'OTHER'){ + sess.setAttribute('ch.nevis.idm.User.gender', '3') + } + + response.setResult('audited') +}else{ + // Attributes match & no notification needed => continue by updating the linking credential and sending the saml assertion + // NOTE/aca/2025/06/19: We skip checking the account state, recovery code, mobile number and LoA + LOG.debug("No Audit Required: Logging user in") + response.setResult('noChange') +} + + + + + + diff --git a/patterns/306ce091fd87bad6174d9e8b_resources/eid_notify_user_idm_change.groovy b/patterns/306ce091fd87bad6174d9e8b_resources/eid_notify_user_idm_change.groovy new file mode 100644 index 0000000..9a834c3 --- /dev/null +++ b/patterns/306ce091fd87bad6174d9e8b_resources/eid_notify_user_idm_change.groovy @@ -0,0 +1,38 @@ +import ch.nevis.idm.client.IdmRestClient +import ch.nevis.idm.client.IdmRestClientFactory + + +String user_notification_dto = ''' +{ + "clientExtId": "{{clientExtId}}", + "userExtId": "{{userExtId}}", + "notificationType": "userNotification3", + "sendingMethod": [ + "Email" + ], + "async": false +} +''' + +IdmRestClient idmRestClient = IdmRestClientFactory.get(parameters) +def sess = request.getAuthSession(true) + +String baseUrl = parameters.get("baseUrl") +String clientExtId = parameters.get("clientExtId") +String endPoint = "$baseUrl/api/notification/v1/" + +String userExtId = sess.getAttribute("ch.nevis.idm.User.extId") + +String restRequest = user_notification_dto.replaceAll("\\{\\{clientExtId}}", clientExtId).replaceAll("\\{\\{userExtId}}", userExtId) + +try { + idmRestClient.post(endPoint, restRequest) + +}catch(Exception e) { + LOG.error("Failed to send User Notification: Idm Update with EId data: ${e}") + response.setResult('error') + return +} + +response.setResult('ok') +return \ No newline at end of file diff --git a/patterns/306ce091fd87bad6174d9e8b_resources/eid_update_login_info.groovy b/patterns/306ce091fd87bad6174d9e8b_resources/eid_update_login_info.groovy new file mode 100644 index 0000000..d80d99d --- /dev/null +++ b/patterns/306ce091fd87bad6174d9e8b_resources/eid_update_login_info.groovy @@ -0,0 +1,36 @@ +import ch.nevis.idm.client.IdmRestClient +import ch.nevis.idm.client.IdmRestClientFactory + + +String login_info_update_dto = ''' +{ + "success": true, + "credentialExtId": "{{credentialExtId}}" +} +''' + +IdmRestClient idmRestClient = IdmRestClientFactory.get(parameters) +def sess = request.getAuthSession(true) + +String baseUrl = parameters.get("baseUrl") +String clientExtId = parameters.get("clientExtId") +String endPoint = "$baseUrl/api/core/v1" + +String userExtId = sess.getAttribute("ch.nevis.idm.User.extId") +String linkingCredentialExtId = sess.getAttribute("agov.eid.linkingCredentialExtId") + +String requestUrl = "$endPoint/$clientExtId/users/$userExtId/login-info" + +String restRequest = login_info_update_dto.replaceAll("\\{\\{credentialExtId}}", linkingCredentialExtId) + +try { + idmRestClient.post(requestUrl, restRequest) + +}catch(Exception e) { + LOG.error("Failed to Update Linking Credential info: ${e}") + response.setResult('error') + return +} + +response.setResult('ok') +return \ No newline at end of file diff --git a/patterns/47f8f6ef24f62431fbe1b530_authStatesFile/eid_placeholder.xml b/patterns/47f8f6ef24f62431fbe1b530_authStatesFile/eid_placeholder.xml new file mode 100644 index 0000000..50c3766 --- /dev/null +++ b/patterns/47f8f6ef24f62431fbe1b530_authStatesFile/eid_placeholder.xml @@ -0,0 +1,7 @@ + + + + + + + \ No newline at end of file diff --git a/patterns/4c7ad5e93c0ed94844e6bbfe_scriptFile/fetchCountryName.groovy b/patterns/4c7ad5e93c0ed94844e6bbfe_scriptFile/fetchCountryName.groovy new file mode 100644 index 0000000..e7491e4 --- /dev/null +++ b/patterns/4c7ad5e93c0ed94844e6bbfe_scriptFile/fetchCountryName.groovy @@ -0,0 +1,39 @@ +import groovy.json.JsonSlurper +import io.opentelemetry.api.trace.Span + +def sess = request.getAuthSession(true) + +def spanCtxt = Span.current().getSpanContext() +def traceparent = "00-${spanCtxt.getTraceId()}-${spanCtxt.getSpanId()}-${spanCtxt.getTraceFlags().asHex()}" +def jsonSlurper = new JsonSlurper() + + +def lang = (session['ch.nevis.idm.User.language']?:'DE').trim() +def endppoint = "${parameters.get('baseurl')}/api/v1/countries?lang=${lang.toUpperCase()}" +def countryCode = (session['ch.nevis.idm.User.country']?:'CH').trim().toLowerCase() + +try { + LOG.debug("UTILITY: Countries: Request url: ${endppoint}") + + def httpClient = HttpClients.create(parameters) + def httpResponse = Http.get().url(endppoint).header('traceparent', traceparent).build().send(httpClient) + + LOG.debug('UTILITY: Countries: Response Message: ' + httpResponse.reasonPhrase()) + LOG.debug('UTILITY: Countries: Response Status Code: ' + httpResponse.code()) + LOG.debug('UTILITY: Countries: Response: ' + httpResponse.bodyAsString()) + + if (httpResponse.code() == 200) { + def json = jsonSlurper.parseText(httpResponse.bodyAsString()) + // {"country.af":"Afghanistan","country.al":"Albanie"... } + def countryName = json["country.${countryCode}"] + LOG.debug("UTILITY: Countries: countryName for ${countryCode}: ${countryName}") + if (countryName) { + sess.setAttribute('agov.countryName', countryName) + } + } else { + LOG.warn("UTILITY: Countries: Failed to fetch country translations. (httpResponse.code: ${httpResponse.code()})") + } +} catch (Exception e) { + LOG.warn("UTILITY: Countries: Failed to fetch country translations. (${e})") +} +response.setResult('ok') \ No newline at end of file diff --git a/patterns/4f15bae09cbda04a7a515158_authStatesFile/eid_select_agov_account.xml b/patterns/4f15bae09cbda04a7a515158_authStatesFile/eid_select_agov_account.xml new file mode 100644 index 0000000..1471a24 --- /dev/null +++ b/patterns/4f15bae09cbda04a7a515158_authStatesFile/eid_select_agov_account.xml @@ -0,0 +1,31 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/patterns/4f15bae09cbda04a7a515158_resources/eid_fetch_linked_accounts.groovy b/patterns/4f15bae09cbda04a7a515158_resources/eid_fetch_linked_accounts.groovy new file mode 100644 index 0000000..361e7a6 --- /dev/null +++ b/patterns/4f15bae09cbda04a7a515158_resources/eid_fetch_linked_accounts.groovy @@ -0,0 +1,235 @@ +import ch.nevis.esauth.auth.engine.AuthResponse +import ch.nevis.idm.client.IdmRestClient +import ch.nevis.idm.client.IdmRestClientFactory +import ch.nevis.idm.client.HTTPRequestWrapper + +import groovy.json.JsonSlurper +import groovy.json.JsonBuilder + + + +def getHeader(String name) { + def inctx = request.getLoginContext() + // case-insensitive lookup of HTTP headers + def map = new TreeMap<>(String.CASE_INSENSITIVE_ORDER) + map.putAll(inctx) + return map['connection.HttpHeader.' + name] +} + +def clearEidSession(){ + def s = request.getAuthSession(true) + s.removeAttribute('agov.eid.verification') + s.removeAttribute('agov.eid.verification.id') + s.removeAttribute('agov.eid.verification.link') + s.removeAttribute('agov.eid.linkedAccountsDto') + s.removeAttribute('agov.eid.User.birthDate') + s.removeAttribute('agov.eid.User.eIdNumber') + s.removeAttribute('agov.eid.User.firstName') + s.removeAttribute('agov.eid.User.lastName') + s.removeAttribute('agov.eid.User.gender') + s.removeAttribute('agov.eid.User.nationality') + s.removeAttribute('agov.eid.User.placeOfBirth') + s.removeAttribute('agov.eid.User.svnr') + s.removeAttribute('agov.eid.User.origin') +} + +def updateLoginHistory(idmRestClient, userExtId, credentialExtId) { + try { + def baseUrl = parameters.get("baseUrl") + def clientExtId = parameters.get("clientExtId") + def endpoint = "$baseUrl/api/core/v1/$clientExtId/users/$userExtId/login-info" + def dto = "{\"success\": true,\"credentialExtId\": \"${credentialExtId}\"}" + + def postRequest = new HTTPRequestWrapper() + postRequest.addToHeaders('Content-Type', ['application/json']) + postRequest.setPayLoad(dto.getBytes('UTF-8')) + postRequest.setPayLoad(dto.getBytes('UTF-8')) + + def result = idmRestClient.postWithResponse(endpoint, postRequest) + if (result.getStatusCode() != 200) { + // best effort, we log only + // TODO/haburger/2025-06-24: context parameters are missing here (also in getAccounts) + LOG.warn("Event='DATAERROR', Requester='${requester}', RequestId='${requestId}', RequestedAq=${requestedAq}, User=${userExtId}, CredentialType='E-ID Link', SourceIp=${sourceIp}, UserAgent='${userAgent}', reason='failed to update login history for credential ${credentialExtId} (http status: ${result.getStatusCode()})'") + } + } catch (Exception e) { + // best effort, we log only + // TODO/haburger/2025-06-24: context parameters are missing here (also in getAccounts) + LOG.warn("Event='DATAERROR', Requester='${requester}', RequestId='${requestId}', RequestedAq=${requestedAq}, User=${userExtId}, CredentialType='E-ID Link', SourceIp=${sourceIp}, UserAgent='${userAgent}', reason='failed to update login history for credential ${credentialExtId} (${e})'") + } +} + +def getAccounts(json, String svnr) { + def idm_users_dto = json["Resources"] + def accounts = [:] + def frontend_dto = [] + + for(user in idm_users_dto){ + + def credentials_dto = user["urn:nevis:idm:scim:schemas:v1:extension:User"]["credentials"] + if(!credentials_dto){ + LOG.warn("Event='DATAERROR', Requester='${requester}', RequestId='${requestId}', RequestedAq=${requestedAq}, User=${extId}, CredentialType='${credentialType}', SourceIp=${sourceIp}, UserAgent='${userAgent}', reason='AGOV account has no credentials'") + } + + for(cred in credentials_dto){ + def foundCredential = false + def extId = user["externalId"] + //TODO/aca/2025/06/11: Can we have multiple email adresses? -> if yes search for primary + String email = user["emails"][0]["value"] + if(cred["type"] == "SAMLFEDERATION" && cred["issuerNameId"] == svnr){ + // we found a second federation credential in one AGOV account -> Throw data error + if(foundCredential){ + LOG.error("Event='DATAERROR', Requester='${requester}', RequestId='${requestId}', RequestedAq=${requestedAq}, User=${extId}, CredentialType='${credentialType}', SourceIp=${sourceIp}, UserAgent='${userAgent}', reason='Multiple EId linking credentials found in one AGOV account'") + return [null,null] + } + + // extract login info + def firstLogin = true + if(cred["credentialLoginInfo"]){ + if(cred["credentialLoginInfo"]["lastLogin"] && cred["credentialLoginInfo"]["lastLogin"] != ""){ + firstLogin = false + } + } + + //NOTE/aca/2025/06/11: Assume that this is sanitized when registered. + def accountName = cred['subjectNameId'] + def credentialExtId = cred['extId'] + + accounts.put(email, [ "extId": extId, "credentialExtId": cred['extId'], "firstLogin": firstLogin ] ) + frontend_dto.add(["email": email, "description": accountName]) + + foundCredential=true + } + } + } + return [ accounts, [ "accounts": frontend_dto ] ] +} + +def sess = request.getAuthSession(true) +IdmRestClient idmRestClient = IdmRestClientFactory.get(parameters) + +// Accounting +def requester = session['ch.nevis.auth.saml.request.scoping.requesterId'] ?: 'unknown' +def requestId = session['ch.nevis.auth.saml.request.id'] ?: 'unknown' +def requestedAq = session['agov.requestedRoleLevel'] ?: 'unknown' +def user = session['ch.adnovum.nevisidm.user.extId'] ?: 'unknown' +def credentialType = session['authenticatedWith'] ?: 'unknown' +def sourceIp = request.getLoginContext()['connection.HttpHeader.X-Real-IP'] ?: 'unknown' +def userAgent = request.getLoginContext()['connection.HttpHeader.user-agent'] ?: request.getLoginContext()['connection.HttpHeader.User-Agent'] ?: 'unknown' + + +if(inargs['submit'] && inargs['login'] && inargs['login'] != ''){ + LOG.debug("Account with email: ${inargs['login']} was selceted -> Continuing") + + def accounts = new JsonSlurper().parseText(session['agov.eid.linkedAccountsDto']) + def account = accounts.get( inargs['login'].trim() ) + + sess.setAttribute('agov.eid.linkingCredentialExtId', account["credentialExtId"]) + sess.setAttribute('agov.eid.linkedAccountExtId', account["extId"]) + + // update login history + updateLoginHistory(idmRestClient, account["extId"], account["credentialExtId"]) + + if(account["firstLogin"]){ + response.setResult('firstLogin') + return + } + + response.setResult('ok') + return +} + +if(inargs['cancelEid'] && inargs['cancelEid'] == 'cancel'){ + LOG.debug("Account selection was canceled: back to initial login screen") + clearEidSession() + response.setResult('backToVerification') + return +} + + +if(getHeader('Content-Type') == 'application/json'){ + String account_selection_dto = session['agov.eid.linkedAccountsFrontendDto'] + + response.setContent(account_selection_dto.toString()) + response.setContentType('application/json') + response.setHttpStatusCode(200) + response.setIsDirectResponse(true) + response.setStatus(AuthResponse.AUTH_CONTINUE) + return +} + + +String baseUrl = parameters.get("baseUrl") +String clientExtId = parameters.get("clientExtId") +String endPoint = "$baseUrl/api/scim/v1/$clientExtId/Users" + +// Fetch account identifier +String svnr = sess.getAttribute("agov.eid.User.svnr") +LOG.debug("search for accounts with SVNR: $svnr") + +// Pepare GET request +String attributes = "externalId,emails,urn:nevis:idm:scim:schemas:v1:extension:User.credentials.type,urn:nevis:idm:scim:schemas:v1:extension:User.credentials.issuerNameId,urn:nevis:idm:scim:schemas:v1:extension:User.credentials.subjectNameId,urn:nevis:idm:scim:schemas:v1:extension:User.credentials.extId,urn:nevis:idm:scim:schemas:v1:extension:User.credentials.credentialLoginInfo.lastLogin" +String filter = "urn:nevis:idm:scim:schemas:v1:extension:User.credentials.type=='SAMLFEDERATION'%20AND%20urn:nevis:idm:scim:schemas:v1:extension:User.credentials.issuerNameId=='$svnr'" + +String requestUrl = "$endPoint?count=20&attributes=$attributes&filter=$filter" + +String scimResponse +try { + + scimResponse = idmRestClient.get(requestUrl) + + //TODO/aca/2025/06/11: Fetch more pages if more than 20 entries have been found + + LOG.debug("SCIM Response: $scimResponse") + + def json = new JsonSlurper().parseText(scimResponse) + def (accounts, frontend_dto) = getAccounts(json, svnr) + + // unrecoverable DATA ERROR happend + if(!accounts){ + response.setResult('error') + return + } + + def numAccounts = accounts.size() + + LOG.debug("Linked accounts found: " + frontend_dto.toString()) + + if(numAccounts == 0){ + //TODO/aca/2025-06-10: Implement next step + // Redirect to an error page or linking page when that's ready and decided + sess.setAttribute("eid.placeholder.text", "EId: No AGOV Account found case not implemented yet") + response.setResult('noAccount') + return + }else if(numAccounts == 1){ + // One account found -> continue with loading attributes from idm (+ notification if it is the first login) + def account = accounts.values().first() + sess.setAttribute('agov.eid.linkingCredentialExtId', account["credentialExtId"]) + sess.setAttribute('agov.eid.linkedAccountExtId', account["extId"]) + + // update login history + updateLoginHistory(idmRestClient, account["extId"], account["credentialExtId"]) + + if(account["firstLogin"]){ + response.setResult('firstLogin') + return + } + + response.setResult('ok') + return + }else{ + // Multiple accounts found -> Dispatch the account selection screen + sess.setAttribute('agov.eid.linkedAccountsDto', new JsonBuilder(accounts).toString()) + sess.setAttribute('agov.eid.linkedAccountsFrontendDto', new JsonBuilder(frontend_dto).toString()) + + LOG.debug("Show GUI") + response.setStatus(AuthResponse.AUTH_CONTINUE) + return + } + +} catch(Exception e) { + LOG.error("Fetching Agov Accounts Failed: ${e}") + sess.setAttribute("eid.placeholder.text", "EId: An exception occured while fetching the AGOV accounts\n: ${e}") + response.setResult('error') + return +} + diff --git a/patterns/4f15bae09cbda04a7a515158_resources/eid_notify_user_first_login.groovy b/patterns/4f15bae09cbda04a7a515158_resources/eid_notify_user_first_login.groovy new file mode 100644 index 0000000..e1945db --- /dev/null +++ b/patterns/4f15bae09cbda04a7a515158_resources/eid_notify_user_first_login.groovy @@ -0,0 +1,38 @@ +import ch.nevis.idm.client.IdmRestClient +import ch.nevis.idm.client.IdmRestClientFactory + + +String user_notification_dto = ''' +{ + "clientExtId": "{{clientExtId}}", + "userExtId": "{{userExtId}}", + "notificationType": "userNotification4", + "sendingMethod": [ + "Email" + ], + "async": false +} +''' + +IdmRestClient idmRestClient = IdmRestClientFactory.get(parameters) +def sess = request.getAuthSession(true) + +String baseUrl = parameters.get("baseUrl") +String clientExtId = parameters.get("clientExtId") +String endPoint = "$baseUrl/api/notification/v1/" + +String userExtId = sess.getAttribute("agov.eid.linkedAccountExtId") + +String restRequest = user_notification_dto.replaceAll("\\{\\{clientExtId}}", clientExtId).replaceAll("\\{\\{userExtId}}", userExtId) + +try { + idmRestClient.post(endPoint, restRequest) + +}catch(Exception e) { + LOG.error("Failed to send User Notification: First Login: ${e}") + response.setResult('error') + return +} + +response.setResult('ok') +return \ No newline at end of file diff --git a/patterns/4fcfadb4a5c946ead7e6e995_labels/labels.zip b/patterns/4fcfadb4a5c946ead7e6e995_labels/labels.zip index eb5f1a4..9ed6da8 100644 Binary files a/patterns/4fcfadb4a5c946ead7e6e995_labels/labels.zip and b/patterns/4fcfadb4a5c946ead7e6e995_labels/labels.zip differ diff --git a/patterns/4fcfadb4a5c946ead7e6e995_template/webdata.zip b/patterns/4fcfadb4a5c946ead7e6e995_template/webdata.zip index 575100c..8cd2145 100644 Binary files a/patterns/4fcfadb4a5c946ead7e6e995_template/webdata.zip and b/patterns/4fcfadb4a5c946ead7e6e995_template/webdata.zip differ diff --git a/patterns/584964c837512845d7940809_authStatesFile/recovery-preprocessing.xml b/patterns/584964c837512845d7940809_authStatesFile/recovery-preprocessing.xml index 857581d..68b63de 100644 --- a/patterns/584964c837512845d7940809_authStatesFile/recovery-preprocessing.xml +++ b/patterns/584964c837512845d7940809_authStatesFile/recovery-preprocessing.xml @@ -197,7 +197,7 @@ - + diff --git a/patterns/594764b3b866d7855f6990a1_authStatesFile/Fetch_Country_Name.xml b/patterns/594764b3b866d7855f6990a1_authStatesFile/Fetch_Country_Name.xml deleted file mode 100644 index 1795622..0000000 --- a/patterns/594764b3b866d7855f6990a1_authStatesFile/Fetch_Country_Name.xml +++ /dev/null @@ -1,20 +0,0 @@ - - - - - - - - - - - - - - - - - - - - diff --git a/patterns/594764b3b866d7855f6990a1_resources/countries.xml b/patterns/594764b3b866d7855f6990a1_resources/countries.xml deleted file mode 100644 index 55ea98d..0000000 --- a/patterns/594764b3b866d7855f6990a1_resources/countries.xml +++ /dev/null @@ -1,250 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/patterns/68665057549fd887ea09fb86_scriptFile/requestedRoleLevel.groovy b/patterns/68665057549fd887ea09fb86_scriptFile/requestedRoleLevel.groovy index f6e4d8a..69f33db 100644 --- a/patterns/68665057549fd887ea09fb86_scriptFile/requestedRoleLevel.groovy +++ b/patterns/68665057549fd887ea09fb86_scriptFile/requestedRoleLevel.groovy @@ -64,7 +64,7 @@ if (requestedRoleLevelNumber == 0 || session.get('ch.nevis.auth.saml.request.sco return } -def eidEnabled = parameters.get('eidPassthroughEnabled') == "true" || parameters.get('eidFullEnabled') == "true" +def eidEnabled = parameters.get('eidEnabled') == "true" // TODO/aca/2025-06-05: add a condition to check if the client actually allows eid def eidAllowed = eidEnabled // set session variable to later decide to which loginmethods we can switch @@ -81,6 +81,8 @@ if(lastLoginMethod != null || lastLoginMethod != ""){ if(lastLoginMethod == "accessApp" || lastLoginMethod == "securityKey"){ ok_transition = 'ok' } +}else{ + session.setAttribute('agov.lastLoginMethod', eidAllowed ? "accessApp" : "eid") } // NOTE: if the last login method was eid, but eid is not allowed, we will default to fido uaf @@ -103,7 +105,7 @@ try { session.setAttribute('agov.appDisplayNameFR', '' + json.displayNameFr) session.setAttribute('agov.appDisplayNameIT', '' + json.displayNameIt) session.setAttribute('agov.appDisplayNameEN', '' + json.displayNameEn) - + session.setAttribute('agov.appDisplayNameRM', '' + ((json.appDisplayNameRM) ? json.appDisplayNameRM : json.appDisplayNameDE)) // if aq500 or 600 is requested -> the only available login method is eid -> continue directly there // if eid is disabled -> show an error page @@ -160,6 +162,7 @@ try { } catch (Exception e) { LOG.error("Failed to fetch connect meta data for relying party '${session.get('ch.nevis.auth.saml.request.scoping.requesterId')}'", e) + session.setAttribute('agov.eidAllowed', 'false') if ( requestedRoleLevelNumber == 100) { session.setAttribute('agov.appAddressRequired', '' + appRequiresBestTokenWithAddress) session.setAttribute('agov.appSvnrAllowed', 'false') diff --git a/patterns/6d83506dfcc430c12d81dfa3_authStatesFile/AskMobileNumber.xml b/patterns/6d83506dfcc430c12d81dfa3_authStatesFile/AskMobileNumber.xml index 70a4c19..87de371 100644 --- a/patterns/6d83506dfcc430c12d81dfa3_authStatesFile/AskMobileNumber.xml +++ b/patterns/6d83506dfcc430c12d81dfa3_authStatesFile/AskMobileNumber.xml @@ -15,4 +15,5 @@ + diff --git a/patterns/6d83506dfcc430c12d81dfa3_resources/askMobileNumber.groovy b/patterns/6d83506dfcc430c12d81dfa3_resources/askMobileNumber.groovy index 1d61bf5..ce333ff 100644 --- a/patterns/6d83506dfcc430c12d81dfa3_resources/askMobileNumber.groovy +++ b/patterns/6d83506dfcc430c12d81dfa3_resources/askMobileNumber.groovy @@ -32,6 +32,12 @@ String baseUrl = parameters.get('baseUrl') String endPoint = "${baseUrl}/core/v1/${clientExtId}/users/${userExtId}" +if (!(parameters.get('ask_mobile_number_enabled')?.toLowerCase()?.trim() == "true")) { + LOG.debug("Feature 'ask mobile number' is disabled") + response.setResult('done') + return +} + if (mobile) { LOG.debug("User '${user}' has already registered a mobile number") response.setResult('done') diff --git a/patterns/7a913eec7f78ce674cd87854_authStatesFile/IDP_IDP_Status_Check_State.xml b/patterns/7a913eec7f78ce674cd87854_authStatesFile/IDP_IDP_Status_Check_State.xml index e625ddb..09ed3b7 100644 --- a/patterns/7a913eec7f78ce674cd87854_authStatesFile/IDP_IDP_Status_Check_State.xml +++ b/patterns/7a913eec7f78ce674cd87854_authStatesFile/IDP_IDP_Status_Check_State.xml @@ -6,7 +6,6 @@ - - + diff --git a/patterns/7a913eec7f78ce674cd87854_resources/idp_status_check.groovy b/patterns/7a913eec7f78ce674cd87854_resources/idp_status_check.groovy index 28e2b29..c9a26e4 100644 --- a/patterns/7a913eec7f78ce674cd87854_resources/idp_status_check.groovy +++ b/patterns/7a913eec7f78ce674cd87854_resources/idp_status_check.groovy @@ -87,14 +87,11 @@ if (inargs['SAMLRequest'] != null) { // process it the same way, as if frontend triggered a reload request.getInArgs().setProperty('onReload', 'now') - def eidEnabled = parameters.get('eidPassthroughEnabled') == "true" || parameters.get('eidFullEnabled') == "true" - eidEnabled - LOG.error("EID?: " + eidEnabled) - LOG.error("Full?: " + parameters.get('eidFullEnabled')) - LOG.error("Pass?: " + parameters.get('eidPassthroughEnabled')) + def eidEnabled = parameters.get('eidEnabled') == "true" def requestedLoa = s.getAttribute("agov.requestedRoleLevel") + // TODO: use a different flag to check if this is a eid request since eid can now also be used for lower aq - if( eidEnabled && ( requestedLoa == "600" || requestedLoa == "500") ){ + if( eidEnabled && ( requestedLoa == "600" || requestedLoa == "500" || s.getAttribute('agov.lastLoginMethod') == 'eid' ) ){ // EID request -> goto correct state response.setResult('continueEidAfterRepost') }else{ diff --git a/patterns/9e0cb3f3fd05315512afd46c_authStatesFile/eid_registration_page.xml b/patterns/9e0cb3f3fd05315512afd46c_authStatesFile/eid_registration_page.xml new file mode 100644 index 0000000..acefbb8 --- /dev/null +++ b/patterns/9e0cb3f3fd05315512afd46c_authStatesFile/eid_registration_page.xml @@ -0,0 +1,13 @@ + + + + + + + + + + + + + \ No newline at end of file diff --git a/patterns/9e0cb3f3fd05315512afd46c_resources/eid_registration.groovy b/patterns/9e0cb3f3fd05315512afd46c_resources/eid_registration.groovy new file mode 100644 index 0000000..1602a13 --- /dev/null +++ b/patterns/9e0cb3f3fd05315512afd46c_resources/eid_registration.groovy @@ -0,0 +1,17 @@ +import ch.nevis.esauth.auth.engine.AuthResponse + +if(inargs['cancel']){ + LOG.debug("Account registration canceled: Send response with error") + response.setResult('back') + return +} + +if(inargs['register'] == "agov"){ + LOG.debug("AGOV account registration was selected") + response.setResult('register') + return +} + +LOG.debug("Show GUI") +response.setStatus(AuthResponse.AUTH_CONTINUE) +return \ No newline at end of file diff --git a/patterns/Ask_Mobile_Number_6d83506dfcc430c12d81dfa3.yml b/patterns/Ask_Mobile_Number_6d83506dfcc430c12d81dfa3.yml index c99db7c..1eb2168 100644 --- a/patterns/Ask_Mobile_Number_6d83506dfcc430c12d81dfa3.yml +++ b/patterns/Ask_Mobile_Number_6d83506dfcc430c12d81dfa3.yml @@ -5,7 +5,6 @@ pattern: name: "Ask_Mobile_Number" properties: authStatesFile: "res://6d83506dfcc430c12d81dfa3#authStatesFile" - parameters: "var://ask_mobile_number-template-parameters" onSuccess: - "pattern://2cdd910036aa06b102863a4f" onFailure: diff --git a/patterns/Auth_Realm_Main_IDP_4fcfadb4a5c946ead7e6e995.yml b/patterns/Auth_Realm_Main_IDP_4fcfadb4a5c946ead7e6e995.yml index 0907cf2..f3c8d38 100644 --- a/patterns/Auth_Realm_Main_IDP_4fcfadb4a5c946ead7e6e995.yml +++ b/patterns/Auth_Realm_Main_IDP_4fcfadb4a5c946ead7e6e995.yml @@ -22,6 +22,7 @@ pattern: - "pattern://097929211988398a87bcbb0c" template: "res://4fcfadb4a5c946ead7e6e995#template" labels: "res://4fcfadb4a5c946ead7e6e995#labels" + defaultProperties: "var://nevislogrend-configuration-logrendproperties" sessionTracking: "COOKIE" cookieName: "agov" initialSessionTimeout: "var://idp-authentication-session-timeout" diff --git a/patterns/Auth_Realm_Recovery_204c22beaccdfd22727af378.yml b/patterns/Auth_Realm_Recovery_204c22beaccdfd22727af378.yml index 430d072..a8085c8 100644 --- a/patterns/Auth_Realm_Recovery_204c22beaccdfd22727af378.yml +++ b/patterns/Auth_Realm_Recovery_204c22beaccdfd22727af378.yml @@ -15,6 +15,7 @@ pattern: - "pattern://097929211988398a87bcbb0c" template: "res://204c22beaccdfd22727af378#template" labels: "res://204c22beaccdfd22727af378#labels" + defaultProperties: "var://nevislogrend-configuration-logrendproperties" cookieName: "agovRecovery" cookieSameSite: "Lax" langCookieDomain: "var://agov-language-cookie-domain" diff --git a/patterns/CheckLoa_2cdd910036aa06b102863a4f.yml b/patterns/CheckLoa_2cdd910036aa06b102863a4f.yml index 382b16d..cbe098f 100644 --- a/patterns/CheckLoa_2cdd910036aa06b102863a4f.yml +++ b/patterns/CheckLoa_2cdd910036aa06b102863a4f.yml @@ -7,7 +7,7 @@ pattern: properties: scriptFile: "res://2cdd910036aa06b102863a4f#scriptFile" onSuccess: - - "pattern://594764b3b866d7855f6990a1" + - "pattern://4c7ad5e93c0ed94844e6bbfe" onFailure: - "pattern://50b861438e79c2332862d3ca" customSteps: diff --git a/patterns/DefaulErrorPages_ecf4381f4653b0aa9a69b417.yml b/patterns/DefaulErrorPages_ecf4381f4653b0aa9a69b417.yml deleted file mode 100644 index f85a630..0000000 --- a/patterns/DefaulErrorPages_ecf4381f4653b0aa9a69b417.yml +++ /dev/null @@ -1,24 +0,0 @@ -schemaVersion: "1.0" -pattern: - id: "ecf4381f4653b0aa9a69b417" - className: "ch.nevis.admin.v4.plugin.nevisproxy.patterns.GenericHostContextSettings" - name: "DefaulErrorPages" - label: "UTILS" - properties: - filters: "\n DefaultErrorFilter\n ch::nevis::isiweb4::filter::error::ErrorFilter\n\ - \ \n StatusCode\n \n\ - \ 400:file:/resources/errorPages/404.html:reset-header:reset-status-code\n\ - \ 403:file:/resources/errorPages/403.html:reset-header:reset-status-code\n\ - \t 404:file:/resources/errorPages/404.html:reset-header:reset-status-code\n\ - \ 408:file:/resources/errorPages/timeout.html:reset-header:reset-status-code\n\ - \ 500:file:/resources/errorPages/500.html:reset-header:reset-status-code\n\ - \ 502:file:/resources/errorPages/502.html:reset-header:reset-status-code\n\ - \ \n \n \n CheckAcceptHeader\n\ - \ true\n \n \n\ - \ PlaceHolders\n \n \ - \ TransferIdHolder:TRANSFER_ID\n TimestampHolder:TIMESTAMP\n\ - \ \n \n\n\n\n\ - \ DefaultErrorFilter\n /*\n\ - \ ^/resource/utility/.*$\n\n" - filterMappings: "manual" - phase: "START" diff --git a/patterns/DefaultErrorPages_ecf4381f4653b0aa9a69b417.yml b/patterns/DefaultErrorPages_ecf4381f4653b0aa9a69b417.yml new file mode 100644 index 0000000..36a7e75 --- /dev/null +++ b/patterns/DefaultErrorPages_ecf4381f4653b0aa9a69b417.yml @@ -0,0 +1,38 @@ +schemaVersion: "1.0" +pattern: + id: "ecf4381f4653b0aa9a69b417" + className: "ch.nevis.admin.v4.plugin.nevisproxy.patterns.GenericHostContextSettings" + name: "DefaultErrorPages" + label: "UTILS" + properties: + filters: "\n DefaultErrorFilter\n ch::nevis::isiweb4::filter::error::ErrorFilter\n\ + \ \n StatusCode\n \n\ + \ 400:NevisLogrendConnector_${param.logrendInstancePatternName}:/nevislogrend/errorPages/404.vm?logrendresourcepath=/nevislogrend:keep-status-code\n\ + \ 403:NevisLogrendConnector_${param.logrendInstancePatternName}:/nevislogrend/errorPages/403.vm?logrendresourcepath=/nevislogrend:keep-status-code\n\ + \ 404:NevisLogrendConnector_${param.logrendInstancePatternName}:/nevislogrend/errorPages/404.vm?logrendresourcepath=/nevislogrend:keep-status-code\n\ + \ 408:NevisLogrendConnector_${param.logrendInstancePatternName}:/nevislogrend/errorPages/timeout.vm?logrendresourcepath=/nevislogrend:keep-status-code\n\ + \ 500:NevisLogrendConnector_${param.logrendInstancePatternName}:/nevislogrend/errorPages/500.vm?logrendresourcepath=/nevislogrend:keep-status-code\n\ + \ 502:NevisLogrendConnector_${param.logrendInstancePatternName}:/nevislogrend/errorPages/502.vm?logrendresourcepath=/nevislogrend:keep-status-code\n\ + \ \n \n \n CheckAcceptHeader\n\ + \ true\n \n \n\ + \ PlaceHolders\n \n \ + \ TransferIdHolder:TRANSFER_ID\n TimestampHolder:TIMESTAMP\n\ + \ \n \n\n\n FallbackErrorFilter\n\ + \ ch::nevis::isiweb4::filter::error::ErrorFilter\n\ + \ \n StatusCode\n \n\ + \ 500:file:/resources/errorPages/500.html:reset-header:reset-status-code\n\ + \ 502:file:/resources/errorPages/502.html:reset-header:reset-status-code\n\ + \ 503:file:/resources/errorPages/500.html:reset-header:reset-status-code\n\ + \ 504:file:/resources/errorPages/500.html:reset-header:reset-status-code\n\ + \ \n \n \n CheckAcceptHeader\n\ + \ true\n \n \n\ + \ PlaceHolders\n \n \ + \ TransferIdHolder:TRANSFER_ID\n TimestampHolder:TIMESTAMP\n\ + \ \n \n\n\n\ + \ DefaultErrorFilter\n /*\n\ + \n\n FallbackErrorFilter\n\ + \ NevisLogrendConnector_${param.logrendInstancePatternName}\n\ + " + filterMappings: "manual" + phase: "START" + parameters: "logrendInstancePatternName: nevisLogrend" diff --git a/patterns/EId_Compare_And_Update_IDM_Attributes_306ce091fd87bad6174d9e8b.yml b/patterns/EId_Compare_And_Update_IDM_Attributes_306ce091fd87bad6174d9e8b.yml new file mode 100644 index 0000000..a8bf504 --- /dev/null +++ b/patterns/EId_Compare_And_Update_IDM_Attributes_306ce091fd87bad6174d9e8b.yml @@ -0,0 +1,18 @@ +schemaVersion: "1.0" +pattern: + id: "306ce091fd87bad6174d9e8b" + className: "ch.nevis.admin.v4.plugin.nevisauth.patterns2.GenericAuthenticationStep" + name: "EId_Compare_And_Update_IDM_Attributes" + label: "EID" + notes: "We return to the regular login flow after this State" + properties: + authStatesFile: "res://306ce091fd87bad6174d9e8b#authStatesFile" + onSuccess: + - "pattern://b87d0d2b640e8e545ad70234" + onFailure: + - "pattern://4c65de021d362462324a3a5f" + nextSteps: + - "pattern://47f8f6ef24f62431fbe1b530" + resources: "res://306ce091fd87bad6174d9e8b#resources" + keyObjects: + - "pattern://947daa1313709b0f26a64432" diff --git a/patterns/EId_Fetch_IDM_Attributes_b8bdab6e4634a1d81f20e5bb.yml b/patterns/EId_Fetch_IDM_Attributes_b8bdab6e4634a1d81f20e5bb.yml new file mode 100644 index 0000000..77f05cc --- /dev/null +++ b/patterns/EId_Fetch_IDM_Attributes_b8bdab6e4634a1d81f20e5bb.yml @@ -0,0 +1,12 @@ +schemaVersion: "1.0" +pattern: + id: "b8bdab6e4634a1d81f20e5bb" + className: "ch.nevis.admin.v4.plugin.nevisauth.patterns2.GenericAuthenticationStep" + name: "EId_Fetch_IDM_Attributes" + label: "EID" + properties: + authStatesFile: "res://b8bdab6e4634a1d81f20e5bb#authStatesFile" + onSuccess: + - "pattern://306ce091fd87bad6174d9e8b" + keyObjects: + - "pattern://947daa1313709b0f26a64432" diff --git a/patterns/EId_Passthrough_Prepare_Assertion_6244fcef0dce49e7b09012de.yml b/patterns/EId_Passthrough_Prepare_Assertion_6244fcef0dce49e7b09012de.yml new file mode 100644 index 0000000..e056f9c --- /dev/null +++ b/patterns/EId_Passthrough_Prepare_Assertion_6244fcef0dce49e7b09012de.yml @@ -0,0 +1,18 @@ +schemaVersion: "1.0" +pattern: + id: "6244fcef0dce49e7b09012de" + className: "ch.nevis.admin.v4.plugin.nevisauth.patterns2.TransformVariablesStep" + name: "EId_Passthrough_Prepare_Assertion" + label: "EID" + properties: + variables: + - sess:ch.nevis.idm.User.firstName: "${sess:agov.eid.User.firstName}" + - sess:ch.nevis.idm.User.lastName: "${sess:agov.eid.User.lastName}" + - sess:ch.nevis.idm.User.birthDate: "${sess:agov.eid.User.birthDate}" + - sess:ch.nevis.idm.User.gender: "${sess:agov.eid.User.gender}" + - sess:ch.nevis.idm.User.prop.svnr: "${sess:agov.eid.User.svnr}" + - sess:ch.nevis.idm.User.prop.placeOfBirth: "${sess:agov.eid.User.placeOfBirth}" + - sess:ch.nevis.idm.User.prop.eIdNumber: "${sess:agov.eid.User.eIdNumber}" + - sess:ch.nevis.idm.User.prop.nationality: "${sess:agov.eid.User.nationality}" + onSuccess: + - "pattern://b87d0d2b640e8e545ad70234" diff --git a/patterns/EId_Passthrough_Switch_3c1d57471850dccab77fd257.yml b/patterns/EId_Passthrough_Switch_3c1d57471850dccab77fd257.yml new file mode 100644 index 0000000..31cff9b --- /dev/null +++ b/patterns/EId_Passthrough_Switch_3c1d57471850dccab77fd257.yml @@ -0,0 +1,18 @@ +schemaVersion: "1.0" +pattern: + id: "3c1d57471850dccab77fd257" + className: "ch.nevis.admin.v4.plugin.nevisauth.patterns2.Dispatcher" + name: "EId_Passthrough_Switch" + label: "EID" + properties: + conditions: + - passthrough: "${session:agov.requestedRoleLevel:600:true}" + - augmentation: "${session:agov.requestedRoleLevel:^[12345]00$:true}" + transitions: + - passthrough: "1" + - augmentation: "2" + steps: + - "pattern://6244fcef0dce49e7b09012de" + - "pattern://4f15bae09cbda04a7a515158" + defaultStep: + - "pattern://4c65de021d362462324a3a5f" diff --git a/patterns/EId_Registration_Page_9e0cb3f3fd05315512afd46c.yml b/patterns/EId_Registration_Page_9e0cb3f3fd05315512afd46c.yml new file mode 100644 index 0000000..5e40984 --- /dev/null +++ b/patterns/EId_Registration_Page_9e0cb3f3fd05315512afd46c.yml @@ -0,0 +1,13 @@ +schemaVersion: "1.0" +pattern: + id: "9e0cb3f3fd05315512afd46c" + className: "ch.nevis.admin.v4.plugin.nevisauth.patterns2.GenericAuthenticationStep" + name: "EId_Registration_Page" + label: "EID" + properties: + authStatesFile: "res://9e0cb3f3fd05315512afd46c#authStatesFile" + onSuccess: + - "pattern://d76231eaa88cb1645ce44cf3" + nextSteps: + - "pattern://e335f57d4c64dfc97223697a" + resources: "res://9e0cb3f3fd05315512afd46c#resources" diff --git a/patterns/EId_Rest_Client_Trust_Store_947daa1313709b0f26a64432.yml b/patterns/EId_Rest_Client_Trust_Store_947daa1313709b0f26a64432.yml new file mode 100644 index 0000000..9983851 --- /dev/null +++ b/patterns/EId_Rest_Client_Trust_Store_947daa1313709b0f26a64432.yml @@ -0,0 +1,9 @@ +schemaVersion: "1.0" +pattern: + id: "947daa1313709b0f26a64432" + className: "ch.nevis.admin.v4.plugin.nevisauth.patterns.KeyObject" + name: "EId_Rest_Client_Trust_Store" + label: "EID" + properties: + trustStore: + - "pattern://ff188ae9f50527ef19eccd2c" diff --git a/patterns/EId_Select_AGOV_Account_4f15bae09cbda04a7a515158.yml b/patterns/EId_Select_AGOV_Account_4f15bae09cbda04a7a515158.yml new file mode 100644 index 0000000..5773a2a --- /dev/null +++ b/patterns/EId_Select_AGOV_Account_4f15bae09cbda04a7a515158.yml @@ -0,0 +1,18 @@ +schemaVersion: "1.0" +pattern: + id: "4f15bae09cbda04a7a515158" + className: "ch.nevis.admin.v4.plugin.nevisauth.patterns2.GenericAuthenticationStep" + name: "EId_Select_AGOV_Account" + label: "EID" + properties: + authStatesFile: "res://4f15bae09cbda04a7a515158#authStatesFile" + onSuccess: + - "pattern://b8bdab6e4634a1d81f20e5bb" + onFailure: + - "pattern://4c65de021d362462324a3a5f" + nextSteps: + - "pattern://47f8f6ef24f62431fbe1b530" + - "pattern://e335f57d4c64dfc97223697a" + resources: "res://4f15bae09cbda04a7a515158#resources" + keyObjects: + - "pattern://947daa1313709b0f26a64432" diff --git a/patterns/EId_Verification_Auth_e335f57d4c64dfc97223697a.yml b/patterns/EId_Verification_Auth_e335f57d4c64dfc97223697a.yml index 382857b..ac65e86 100644 --- a/patterns/EId_Verification_Auth_e335f57d4c64dfc97223697a.yml +++ b/patterns/EId_Verification_Auth_e335f57d4c64dfc97223697a.yml @@ -7,7 +7,10 @@ pattern: properties: authStatesFile: "res://e335f57d4c64dfc97223697a#authStatesFile" onSuccess: - - "pattern://b87d0d2b640e8e545ad70234" + - "pattern://3c1d57471850dccab77fd257" onFailure: - "pattern://4c65de021d362462324a3a5f" + nextSteps: + - "pattern://f63c475c35b616b7c6c1901c" + - "pattern://9e0cb3f3fd05315512afd46c" resources: "res://e335f57d4c64dfc97223697a#resources" diff --git a/patterns/Eid_Placeholder_47f8f6ef24f62431fbe1b530.yml b/patterns/Eid_Placeholder_47f8f6ef24f62431fbe1b530.yml new file mode 100644 index 0000000..826b92a --- /dev/null +++ b/patterns/Eid_Placeholder_47f8f6ef24f62431fbe1b530.yml @@ -0,0 +1,9 @@ +schemaVersion: "1.0" +pattern: + id: "47f8f6ef24f62431fbe1b530" + className: "ch.nevis.admin.v4.plugin.nevisauth.patterns2.GenericAuthenticationStep" + name: "Eid_Placeholder" + label: "EID" + notes: "Test Pattern to display messages/errors" + properties: + authStatesFile: "res://47f8f6ef24f62431fbe1b530#authStatesFile" diff --git a/patterns/FIDO_UAF_Instance_ca92034f995b39fde562293c.yml b/patterns/FIDO_UAF_Instance_ca92034f995b39fde562293c.yml index ce266b8..666332a 100644 --- a/patterns/FIDO_UAF_Instance_ca92034f995b39fde562293c.yml +++ b/patterns/FIDO_UAF_Instance_ca92034f995b39fde562293c.yml @@ -28,8 +28,10 @@ pattern: link: "Custom URI" customURILink: "var://fido_uaf_instance-custom-uri-link" nevisidm: - - "pattern://b8a36646f81c3247cdb5d90b" - client: "var://fido_uaf_instance-client-id" + - "pattern://f1e0b2a7bc849ffc63a612e6" + client: "var://idm-agov-client-extid" + backendTrustStore: + - "pattern://7076f2654dd4efa1675afc72" registrationTokenTimeout: "var://fido-uaf-generic-token-timeout" authenticationTokenTimeout: "var://fido-uaf-generic-token-timeout" deviceServiceTimeout: "var://fido-uaf-device-service-timeout" diff --git a/patterns/FIDO_UAF_extended_Frontent_Truststore_69948a66429d85d971608411.yml b/patterns/FIDO_UAF_extended_Frontent_Truststore_69948a66429d85d971608411.yml index 27a3b0f..e7f524c 100644 --- a/patterns/FIDO_UAF_extended_Frontent_Truststore_69948a66429d85d971608411.yml +++ b/patterns/FIDO_UAF_extended_Frontent_Truststore_69948a66429d85d971608411.yml @@ -4,7 +4,7 @@ pattern: className: "ch.nevis.admin.v4.plugin.nevisproxy.patterns.AutomaticTrustStoreProvider" name: "FIDO_UAF_extended_Frontent_Truststore" label: "UAF" - notes: "Used to also as trusstore for the firebase outgoing connection (i.e. trust\ + notes: "Used to also as truststore for the firebase outgoing connection (i.e. trust\ \ forward proxy CA if necessary)" properties: truststoreFile: "var://fido_uaf_extended_frontent_truststore-fw_proxy_ca_cert" diff --git a/patterns/Fetch_Country_Name_4c7ad5e93c0ed94844e6bbfe.yml b/patterns/Fetch_Country_Name_4c7ad5e93c0ed94844e6bbfe.yml new file mode 100644 index 0000000..f0a7739 --- /dev/null +++ b/patterns/Fetch_Country_Name_4c7ad5e93c0ed94844e6bbfe.yml @@ -0,0 +1,17 @@ +schemaVersion: "1.0" +pattern: + id: "4c7ad5e93c0ed94844e6bbfe" + className: "ch.nevis.admin.v4.plugin.nevisauth.patterns2.GroovyScriptStep" + name: "Fetch_Country_Name" + label: "LOA" + properties: + scriptFile: "res://4c7ad5e93c0ed94844e6bbfe#scriptFile" + parameters: + - baseurl: "${var.utility_resource_service-backend-address}" + validation: "parse-only" + onSuccess: + - "pattern://b87d0d2b640e8e545ad70234" + onFailure: + - "pattern://b87d0d2b640e8e545ad70234" + scriptTraceGroup: "AGOV-ACCT" + responseType: "AUTH_CONTINUE" diff --git a/patterns/Fetch_Country_Name_594764b3b866d7855f6990a1.yml b/patterns/Fetch_Country_Name_594764b3b866d7855f6990a1.yml deleted file mode 100644 index 878a345..0000000 --- a/patterns/Fetch_Country_Name_594764b3b866d7855f6990a1.yml +++ /dev/null @@ -1,11 +0,0 @@ -schemaVersion: "1.0" -pattern: - id: "594764b3b866d7855f6990a1" - className: "ch.nevis.admin.v4.plugin.nevisauth.patterns2.GenericAuthenticationStep" - name: "Fetch_Country_Name" - notes: "TODO/haburger/2024-12-17: replace this with a call to http://utility-application-be.adn-agov-me-01-dev:8081/utility/api/v1/countries?lang=DE" - properties: - authStatesFile: "res://594764b3b866d7855f6990a1#authStatesFile" - onSuccess: - - "pattern://b87d0d2b640e8e545ad70234" - resources: "res://594764b3b866d7855f6990a1#resources" diff --git a/patterns/IDM_DB_2951ead44a7a9362a4545094.yml b/patterns/IDM_DB_2951ead44a7a9362a4545094.yml deleted file mode 100644 index a8658ec..0000000 --- a/patterns/IDM_DB_2951ead44a7a9362a4545094.yml +++ /dev/null @@ -1,21 +0,0 @@ -schemaVersion: "1.0" -pattern: - id: "2951ead44a7a9362a4545094" - className: "ch.nevis.admin.v4.plugin.nevisidm.patterns.NevisIDMDatabase" - name: "IDM_DB" - label: "IDM" - properties: - type: "var://idm_db-database-type" - hosts: "var://idm_db-database-host" - database: "var://idm_db-database-name" - rootCredential: "var://idm_db-root-credential" - rootCredentialNamespace: "var://idm_db-root-credential-namespace" - user: "var://idm_db-database-user" - password: "var://idm_db-database-password" - encryption: "var://idm_db-tls-encryption" - trustStore: - - "pattern://326adce95ad1a0761f2259b7" - jdbcDriver: "var://idm_db-database-jdbc-driver" - oracleVolumeClaimName: "var://idm_db-database-volume-claim" - databaseManagement: "var://agov_dev_idm-db-management" - connectionUrl: "var://idm_db-database-connection-url" diff --git a/patterns/IDM_DB_TLS_TrustStore_326adce95ad1a0761f2259b7.yml b/patterns/IDM_DB_TLS_TrustStore_326adce95ad1a0761f2259b7.yml deleted file mode 100644 index 7f410d1..0000000 --- a/patterns/IDM_DB_TLS_TrustStore_326adce95ad1a0761f2259b7.yml +++ /dev/null @@ -1,8 +0,0 @@ -schemaVersion: "1.0" -pattern: - id: "326adce95ad1a0761f2259b7" - className: "ch.nevis.admin.v4.plugin.nevisproxy.patterns.PemTrustStoreProvider" - name: "IDM_DB_TLS_TrustStore" - label: "IDM" - properties: - truststoreFile: "var://idm_db_tls_truststore-trusted-certificates" diff --git a/patterns/IDM_Login_93739706b170b426534b8bd5.yml b/patterns/IDM_Login_93739706b170b426534b8bd5.yml index 311fe04..9adee67 100644 --- a/patterns/IDM_Login_93739706b170b426534b8bd5.yml +++ b/patterns/IDM_Login_93739706b170b426534b8bd5.yml @@ -6,4 +6,4 @@ pattern: label: "IDM" properties: nevisIDM: - - "pattern://b8a36646f81c3247cdb5d90b" + - "pattern://f1e0b2a7bc849ffc63a612e6" diff --git a/patterns/IDM_Settings_71411a755a625f9b850c6cf5.yml b/patterns/IDM_Settings_71411a755a625f9b850c6cf5.yml deleted file mode 100644 index 088c80d..0000000 --- a/patterns/IDM_Settings_71411a755a625f9b850c6cf5.yml +++ /dev/null @@ -1,15 +0,0 @@ -schemaVersion: "1.0" -pattern: - id: "71411a755a625f9b850c6cf5" - className: "ch.nevis.admin.v4.plugin.nevisidm.patterns.NevisIDMAdvancedSettings" - name: "IDM_Settings" - label: "IDM" - notes: "used for SAMP IDP\n---\nbatch, event, audit processing disabled on that\ - \ instance" - link: - sourceProjectKey: "DEFAULT-IAM-JAKOB" - sourcePatternId: "71411a755a625f9b850c6cf5" - author: "florip" - lastCopied: "2023-03-30T08:57:06Z" - properties: - properties: "var://idm-standard-settings" diff --git a/patterns/IDP_Extended_Truststore_7076f2654dd4efa1675afc72.yml b/patterns/IDP_Extended_Truststore_7076f2654dd4efa1675afc72.yml new file mode 100644 index 0000000..423888b --- /dev/null +++ b/patterns/IDP_Extended_Truststore_7076f2654dd4efa1675afc72.yml @@ -0,0 +1,8 @@ +schemaVersion: "1.0" +pattern: + id: "7076f2654dd4efa1675afc72" + className: "ch.nevis.admin.v4.plugin.nevisproxy.patterns.AutomaticTrustStoreProvider" + name: "IDP_Extended_Truststore" + notes: "Trusts the own CA and additionally the one needed for out-going calls.\n\ + Currently those to nevisidm running in another admin administrated namespace." + properties: {} diff --git a/patterns/IDP_OIDC4VP_Service_450d8070d6c0b395c98a013f.yml b/patterns/IDP_OIDC4VP_Service_450d8070d6c0b395c98a013f.yml new file mode 100644 index 0000000..bb92b69 --- /dev/null +++ b/patterns/IDP_OIDC4VP_Service_450d8070d6c0b395c98a013f.yml @@ -0,0 +1,10 @@ +schemaVersion: "1.0" +pattern: + id: "450d8070d6c0b395c98a013f" + className: "ch.nevis.admin.v4.plugin.nevisproxy.patterns.RESTServiceAccess" + name: "IDP_OIDC4VP_Service" + properties: + host: + - "pattern://1f0702aaabef60a615abf41f" + path: "/oidc4vp/" + backends: "var://eid-oidc4vp-service-url" diff --git a/patterns/IdP-Idm-SecToken-Signer-Trust_2d8151249e6734ccc072422b.yml b/patterns/IdP-Idm-SecToken-Signer-Trust_2d8151249e6734ccc072422b.yml deleted file mode 100644 index f7f295a..0000000 --- a/patterns/IdP-Idm-SecToken-Signer-Trust_2d8151249e6734ccc072422b.yml +++ /dev/null @@ -1,10 +0,0 @@ -schemaVersion: "1.0" -pattern: - id: "2d8151249e6734ccc072422b" - className: "ch.nevis.admin.v4.plugin.nevisproxy.patterns.AutomaticTrustStoreProvider" - name: "IdP-Idm-SecToken-Signer-Trust" - label: "STORE" - properties: - keystore: - - "pattern://aeb2fed9962dcd5f7893db51" - truststoreFile: "var://idp-idm-sectoken-signer-trust-additional-trusted-certificates" diff --git a/patterns/Log_IDM_a4c7f77128ea9a990291fe64.yml b/patterns/Log_IDM_a4c7f77128ea9a990291fe64.yml deleted file mode 100644 index 6ef5771..0000000 --- a/patterns/Log_IDM_a4c7f77128ea9a990291fe64.yml +++ /dev/null @@ -1,9 +0,0 @@ -schemaVersion: "1.0" -pattern: - id: "a4c7f77128ea9a990291fe64" - className: "ch.nevis.admin.v4.plugin.nevisidm.patterns.CustomNevisIDMLogFile" - name: "Log_IDM" - label: "LOGS" - properties: - logLevel: "var://log_idm-default-log-level" - levels: "var://log_idm-log-levels" diff --git a/patterns/Mobile_NLess_Auth_f63c475c35b616b7c6c1901c.yml b/patterns/Mobile_NLess_Auth_f63c475c35b616b7c6c1901c.yml index 15b1221..7102751 100644 --- a/patterns/Mobile_NLess_Auth_f63c475c35b616b7c6c1901c.yml +++ b/patterns/Mobile_NLess_Auth_f63c475c35b616b7c6c1901c.yml @@ -11,6 +11,7 @@ pattern: nextSteps: - "pattern://f39352769cb2a1c88e1a176d" - "pattern://d76231eaa88cb1645ce44cf3" + - "pattern://e335f57d4c64dfc97223697a" resources: "res://f63c475c35b616b7c6c1901c#resources" keyObjects: - "pattern://95220b3005deb118adeb01aa" diff --git a/patterns/NotUsed_Auth_Realm_06aeae2d799e492f5580d03b.yml b/patterns/NotUsed_Auth_Realm_06aeae2d799e492f5580d03b.yml index 633653d..31e9696 100644 --- a/patterns/NotUsed_Auth_Realm_06aeae2d799e492f5580d03b.yml +++ b/patterns/NotUsed_Auth_Realm_06aeae2d799e492f5580d03b.yml @@ -19,5 +19,6 @@ pattern: - "pattern://7022472ae407577ae604bbb8" logrend: - "pattern://097929211988398a87bcbb0c" + defaultProperties: "var://nevislogrend-configuration-logrendproperties" initialSessionTimeout: "var://idp-authentication-session-timeout" langCookieDomain: "var://agov-language-cookie-domain" diff --git a/patterns/NotUsed_Pwd_Login_e0fda9336be9c69dafc9b69e.yml b/patterns/NotUsed_Pwd_Login_e0fda9336be9c69dafc9b69e.yml index 0ff3dd7..be6da04 100644 --- a/patterns/NotUsed_Pwd_Login_e0fda9336be9c69dafc9b69e.yml +++ b/patterns/NotUsed_Pwd_Login_e0fda9336be9c69dafc9b69e.yml @@ -12,4 +12,4 @@ pattern: lastCopied: "2023-04-27T13:03:12Z" properties: nevisIDM: - - "pattern://b8a36646f81c3247cdb5d90b" + - "pattern://f1e0b2a7bc849ffc63a612e6" diff --git a/patterns/Recovery_mobile_nless_auth_4bc453bf68139ee87966b0c7.yml b/patterns/Recovery_mobile_nless_auth_4bc453bf68139ee87966b0c7.yml index ef26563..fda7255 100644 --- a/patterns/Recovery_mobile_nless_auth_4bc453bf68139ee87966b0c7.yml +++ b/patterns/Recovery_mobile_nless_auth_4bc453bf68139ee87966b0c7.yml @@ -10,6 +10,8 @@ pattern: - "pattern://6061abea33a234fad73897b7" onFailure: - "pattern://473f9d6b4ab9d61c1eb8c689" + nextSteps: + - "pattern://e335f57d4c64dfc97223697a" resources: "res://4bc453bf68139ee87966b0c7#resources" keyObjects: - "pattern://95220b3005deb118adeb01aa" diff --git a/patterns/Redirect_to_Registration_bfd395eb0dab50aff2f2c01b.yml b/patterns/Redirect_to_Registration_bfd395eb0dab50aff2f2c01b.yml index 5a93192..535d7b1 100644 --- a/patterns/Redirect_to_Registration_bfd395eb0dab50aff2f2c01b.yml +++ b/patterns/Redirect_to_Registration_bfd395eb0dab50aff2f2c01b.yml @@ -8,4 +8,6 @@ pattern: parameters: "var://service_provider_state-registration-template-parameters" onSuccess: - "pattern://f63c475c35b616b7c6c1901c" + nextSteps: + - "pattern://e335f57d4c64dfc97223697a" resources: "res://bfd395eb0dab50aff2f2c01b#resources" diff --git a/patterns/RequestedRoleLevel_68665057549fd887ea09fb86.yml b/patterns/RequestedRoleLevel_68665057549fd887ea09fb86.yml index 1c7e7cc..c475c81 100644 --- a/patterns/RequestedRoleLevel_68665057549fd887ea09fb86.yml +++ b/patterns/RequestedRoleLevel_68665057549fd887ea09fb86.yml @@ -10,8 +10,7 @@ pattern: - url: "${var.connect.metadataservice.url}" - bestTokenAddressWhitelist: "${var.bestToken.address.whitelist}" - bestTokenSvnrWhitelist: "${var.bestToken.svnr.whitelist}" - - eidPassthroughEnabled: "${var.eid.passthrough.enabled}" - - eidFullEnabled: "${var.eid.full.enabled}" + - eidEnabled: "${var.eid.enabled}" onSuccess: - "pattern://f63c475c35b616b7c6c1901c" onFailure: diff --git a/patterns/STS_to_IDM_Connection_8d94681ba6da73f92618e32d.yml b/patterns/STS_to_IDM_Connection_8d94681ba6da73f92618e32d.yml index 9dde3cb..2ff3a7d 100644 --- a/patterns/STS_to_IDM_Connection_8d94681ba6da73f92618e32d.yml +++ b/patterns/STS_to_IDM_Connection_8d94681ba6da73f92618e32d.yml @@ -6,6 +6,6 @@ pattern: label: "STS" properties: nevisIDM: - - "pattern://b8a36646f81c3247cdb5d90b" + - "pattern://f1e0b2a7bc849ffc63a612e6" genericAuthPatterns: - "pattern://5d7dc3d51416356293a239f7" diff --git a/patterns/b87d0d2b640e8e545ad70234_resources/SendSamlResponseWithAssertion.groovy b/patterns/b87d0d2b640e8e545ad70234_resources/SendSamlResponseWithAssertion.groovy index 962475d..97f51f6 100644 --- a/patterns/b87d0d2b640e8e545ad70234_resources/SendSamlResponseWithAssertion.groovy +++ b/patterns/b87d0d2b640e8e545ad70234_resources/SendSamlResponseWithAssertion.groovy @@ -47,4 +47,4 @@ def agovLoginCookie = "agovLogin=deleted; Domain=${parameters.get('cookie.domain response.setHeader('Set-Cookie', agovLoginCookie) response.setResult('ok') -return +return \ No newline at end of file diff --git a/patterns/b8bdab6e4634a1d81f20e5bb_authStatesFile/eid_fetch_idm_attributes.xml b/patterns/b8bdab6e4634a1d81f20e5bb_authStatesFile/eid_fetch_idm_attributes.xml new file mode 100644 index 0000000..215005e --- /dev/null +++ b/patterns/b8bdab6e4634a1d81f20e5bb_authStatesFile/eid_fetch_idm_attributes.xml @@ -0,0 +1,56 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/patterns/bfd395eb0dab50aff2f2c01b_authStatesFile/registrationAssertion.xml b/patterns/bfd395eb0dab50aff2f2c01b_authStatesFile/registrationAssertion.xml index 2b5c098..a3ba849 100644 --- a/patterns/bfd395eb0dab50aff2f2c01b_authStatesFile/registrationAssertion.xml +++ b/patterns/bfd395eb0dab50aff2f2c01b_authStatesFile/registrationAssertion.xml @@ -35,7 +35,8 @@ - + + diff --git a/patterns/bfd395eb0dab50aff2f2c01b_resources/handleRedirectRegistration.groovy b/patterns/bfd395eb0dab50aff2f2c01b_resources/handleRedirectRegistration.groovy index 819bb66..e1edb23 100644 --- a/patterns/bfd395eb0dab50aff2f2c01b_resources/handleRedirectRegistration.groovy +++ b/patterns/bfd395eb0dab50aff2f2c01b_resources/handleRedirectRegistration.groovy @@ -19,7 +19,15 @@ if(outargs.containsKey('saml.SAMLResponse')) { response.removeOutArg('saml.SAMLResponse') } else { - response.setResult('ok') + if (session['agov.eidAllowed'] && session['agov.eidAllowed'] == 'true') { + if (session['agov.lastLoginMethod'] && !(session['agov.lastLoginMethod'] == 'eid')) { + response.setResult('agovLogin') + } else { + response.setResult('eidLogin') + } + } else { + response.setResult('agovLogin') + } } diff --git a/patterns/e335f57d4c64dfc97223697a_authStatesFile/EId_Verification_Auth.xml b/patterns/e335f57d4c64dfc97223697a_authStatesFile/EId_Verification_Auth.xml index ca22bfd..99a305a 100644 --- a/patterns/e335f57d4c64dfc97223697a_authStatesFile/EId_Verification_Auth.xml +++ b/patterns/e335f57d4c64dfc97223697a_authStatesFile/EId_Verification_Auth.xml @@ -1,20 +1,24 @@ - + + + - - - - - + + + + + + + - + - + \ No newline at end of file diff --git a/patterns/e335f57d4c64dfc97223697a_resources/eid_verification_auth.groovy b/patterns/e335f57d4c64dfc97223697a_resources/eid_verification_auth.groovy index 02ed318..002db22 100644 --- a/patterns/e335f57d4c64dfc97223697a_resources/eid_verification_auth.groovy +++ b/patterns/e335f57d4c64dfc97223697a_resources/eid_verification_auth.groovy @@ -4,6 +4,10 @@ import ch.nevis.esauth.util.httpclient.api.HttpClient import groovy.json.JsonSlurper import io.opentelemetry.api.trace.Span +import java.time.LocalDate +import java.time.ZoneId +import java.time.ZoneOffset + import com.fasterxml.uuid.Generators def getHeader(String name) { @@ -57,6 +61,13 @@ def getNewVerification(Session sess, HttpClient httpClient, String verification_ return true } +def clearEidSession(){ + def s = request.getAuthSession(true) + s.removeAttribute('agov.eid.verification') + s.removeAttribute('agov.eid.verification.id') + s.removeAttribute('agov.eid.verification.link') +} + def verification_request_template = ''' { "presentation_definition": { "id": "{{UUID}}", @@ -211,29 +222,39 @@ if (inargs['oid4vp'] == 'SUCCEEDED') { return } -/* -// Temporary for CANCELED -if (inargs['oid4vp'] == 'CANCELED') { - LOG.debug("oid4vp canceled") - response.setResult('error') +// switch to access App +if (inargs['accessApp'] == 'accessApp') { + //TODO/aca/2025/06/19: In theory we could also land here when we send 'SUCCESS' to the frontend -> would be better to clear all session vaiables that can be set in this Authstate + //TODO/aca/2025/06/19: Should we here rather set the LOGINMETHOD cookie and send an error assertion, since otherwise we might swich states too often and Nevis will kill the session? + clearEidSession() + LOG.debug("Switch to Access App") + sess.setAttribute('agov.lastLoginMethod', 'accessApp') + response.setResult('agovLogin') + return +} + +// switch to fido2 +if (inargs['securityKey'] == 'securityKey') { + clearEidSession() + LOG.debug("Switch to Security Key") + sess.setAttribute('agov.lastLoginMethod', 'securityKey') + response.setResult('agovLogin') + return +} + +// switch to registration +if (inargs['fallback'] == 'register') { + clearEidSession() + LOG.debug("Switch to registration") + response.setResult('register') return } -*/ HttpClient httpClient = HttpClients.create(parameters) def spanCtxt = Span.current().getSpanContext() def traceparent = "00-${spanCtxt.getTraceId()}-${spanCtxt.getSpanId()}-${spanCtxt.getTraceFlags().asHex()}" -/* -if (!session['agov.eid.verification']) { - LOG.debug("Initializing verification") - if(!getNewVerification(sess, httpClient, verification_request_template, traceparent)){ - response.setResult('error') - return - } -} -*/ if (getHeader('Content-Type') == 'application/json' && inargs.containsKey('o.id.v')) { LOG.debug("Request Status Update") @@ -300,7 +321,7 @@ if (getHeader('Content-Type') == 'application/json' && inargs.containsKey('o.id. "error_code": "HTTP-ERROR", "error_message": "Faild to verify status of verification, http status: ${httpResponse.code()}" }}""" - LOG.warn("<== Response: ${responseCode}") + LOG.warn("<== Response: ${httpResponse.code()}") } else if (httpResponse.code() != 200) { LOG.debug("Result: ${httpResponse}") @@ -315,7 +336,7 @@ if (getHeader('Content-Type') == 'application/json' && inargs.containsKey('o.id. "error_code": "HTTP-ERROR", "error_message": "failed to verify status of verification ${idvalue}, http status: ${httpResponse.code()}" }}""" - LOG.warn("<== Response: ${responseCode}") + LOG.warn("<== Response: ${httpResponse.code()}") } else { @@ -324,25 +345,37 @@ if (getHeader('Content-Type') == 'application/json' && inargs.containsKey('o.id. if (json.state == 'SUCCESS') { def claims = json.wallet_response.credential_subject_data LOG.debug("Store user data in session") - // TODO/haburger/2025-03-25: format changes to align with IDM read data => No changes needed(?) - sess.setAttribute('ch.nevis.idm.User.firstName', claims.given_name) - sess.setAttribute('ch.nevis.idm.User.lastName', claims.family_name) - sess.setAttribute('ch.nevis.idm.User.birthDate', claims.birth_date) - sess.setAttribute('ch.nevis.idm.User.gender', claims.sex) - sess.setAttribute('ch.nevis.idm.User.prop.svnr', claims.personal_administrative_number.replace('.','')) - sess.setAttribute('ch.nevis.idm.User.prop.placeOfBirth', claims.birth_place) - sess.setAttribute('ch.nevis.idm.User.prop.eIdNumber', claims.document_number) - sess.setAttribute('ch.nevis.idm.User.prop.nationality', claims.nationality.toString()) - sess.setAttribute('ValidFrom', claims.issuance_date) - sess.setAttribute('ValidTo', claims.expiry_date) + + def validFrom = LocalDate.parse(claims.issuance_date, DateTimeFormatter.ISO_LOCAL_DATE).atStartOfDay(ZoneId.systemDefault()).format(DateTimeFormatter.ISO_OFFSET_DATE_TIME) + def validTo = LocalDate.parse(claims.expiry_date, DateTimeFormatter.ISO_LOCAL_DATE).atTime(23,59,59).atOffset(ZoneOffset.systemDefault()).format(DateTimeFormatter.ISO_OFFSET_DATE_TIME) + + sess.setAttribute('agov.eid.User.firstName', claims.given_name) + sess.setAttribute('agov.eid.User.lastName', claims.family_name) + sess.setAttribute('agov.eid.User.birthDate', claims.birth_date) + sess.setAttribute('agov.eid.User.gender', claims.sex) + sess.setAttribute('agov.eid.User.svnr', claims.personal_administrative_number.replace('.','')) + sess.setAttribute('agov.eid.User.placeOfBirth', claims.birth_place) + sess.setAttribute('agov.eid.User.eIdNumber', claims.document_number) + // Simpler for later comparison -> Is converted again to upper case in the saml assertion + sess.setAttribute('agov.eid.User.nationality', claims.nationality.toString().toLowerCase()) + + sess.setAttribute('ValidFrom', validFrom) + sess.setAttribute('ValidTo', validTo) sess.setAttribute('authenticatedWith', "urn:qa.agov.ch:names:tc:authfactor:eid") sess.setAttribute('idVerification', "Eid") - sess.setAttribute('contextClassRefToSet', "urn:qa.agov.ch:names:tc:ac:classes:600") + + // BUNDBITBK-5203 Dynamic aq levels + def requestedRoleLevel = session['agov.requestedRoleLevel'] + if(requestedRoleLevel == "600"){ + sess.setAttribute('contextClassRefToSet', "urn:qa.agov.ch:names:tc:ac:classes:600") + }else{ + sess.setAttribute('contextClassRefToSet', "urn:qa.agov.ch:names:tc:ac:classes:500") + } // subjectUUID v5 def namespace = UUID.fromString(parameters.get('eidUUIDNamespace')) def uuid = Generators.nameBasedGenerator(namespace).generate(claims.personal_administrative_number) - LOG.debug("UUID: ${uuid}") + LOG.debug("UUID derived from svnr: ${uuid}") String uuidString = uuid.toString() sess.setAttribute('agov.subjectUUID', '' + uuidString) @@ -360,9 +393,6 @@ if (getHeader('Content-Type') == 'application/json' && inargs.containsKey('o.id. }}""" } else if (json.state == 'FAILED') { - // TODO/haburger/2025-03-25: ERROR_CODE_TO_STATUS_MAPPER[json.wallet_response.error_code] == 'FAILED' we should - // initiate a new verification and return the new id, url together with the message - LOG .error("Eid verification failed: ${json.wallet_response.error_code} (${json.wallet_response.error_description})") @@ -410,14 +440,11 @@ if (getHeader('Content-Type') == 'application/json' && inargs.containsKey('o.id. }}""" } - - response.setContent(result.toString()) response.setContentType('application/json') response.setHttpStatusCode(200) response.setIsDirectResponse(true) response.setStatus(AuthResponse.AUTH_CONTINUE) - LOG.debug("Recieved json: End") return } diff --git a/patterns/f393012a278e525956a362d3_authStatesFile/ensureAccountState.xml b/patterns/f393012a278e525956a362d3_authStatesFile/ensureAccountState.xml index 313999f..3cd49cd 100644 --- a/patterns/f393012a278e525956a362d3_authStatesFile/ensureAccountState.xml +++ b/patterns/f393012a278e525956a362d3_authStatesFile/ensureAccountState.xml @@ -5,7 +5,7 @@ - + diff --git a/patterns/f63c475c35b616b7c6c1901c_authStatesFile/Mobile_NLess_Auth.xml b/patterns/f63c475c35b616b7c6c1901c_authStatesFile/Mobile_NLess_Auth.xml index 6e42040..c80e91b 100644 --- a/patterns/f63c475c35b616b7c6c1901c_authStatesFile/Mobile_NLess_Auth.xml +++ b/patterns/f63c475c35b616b7c6c1901c_authStatesFile/Mobile_NLess_Auth.xml @@ -1,6 +1,7 @@ - + + @@ -11,7 +12,7 @@ - + diff --git a/patterns/f63c475c35b616b7c6c1901c_resources/mobile_nless_auth.groovy b/patterns/f63c475c35b616b7c6c1901c_resources/mobile_nless_auth.groovy index 9eabed0..6742d6b 100644 --- a/patterns/f63c475c35b616b7c6c1901c_resources/mobile_nless_auth.groovy +++ b/patterns/f63c475c35b616b7c6c1901c_resources/mobile_nless_auth.groovy @@ -103,4 +103,11 @@ if (inargs.containsKey('onReload')) { // dispatch form post with fallback input field : go to registration with right loa if (inargs['fallback'] == 'register') { response.setResult('registration') +} + +// change to eid +// temporary for demo +if (inargs.containsKey('swiyu')) { + clearFidoUAFSession() + response.setResult('eidLogin') } \ No newline at end of file diff --git a/patterns/nevisAuth_7022472ae407577ae604bbb8.yml b/patterns/nevisAuth_7022472ae407577ae604bbb8.yml index c4c3f30..385c0c3 100644 --- a/patterns/nevisAuth_7022472ae407577ae604bbb8.yml +++ b/patterns/nevisAuth_7022472ae407577ae604bbb8.yml @@ -12,6 +12,8 @@ pattern: - "pattern://b7b59e97b3fd18bb60178573" frontendTrustStore: - "pattern://c0722fc79e7314c9cdcd20ff" + backendTrustStore: + - "pattern://7076f2654dd4efa1675afc72" signerKeyStore: - "pattern://aeb2fed9962dcd5f7893db51" signerTrustStore: diff --git a/patterns/nevisAuth_STS_4bad2fe3ccc54716cc87138f.yml b/patterns/nevisAuth_STS_4bad2fe3ccc54716cc87138f.yml index 7e0476c..96e43ee 100644 --- a/patterns/nevisAuth_STS_4bad2fe3ccc54716cc87138f.yml +++ b/patterns/nevisAuth_STS_4bad2fe3ccc54716cc87138f.yml @@ -10,6 +10,8 @@ pattern: - "pattern://aec56cb572434a42d55de30c" frontendTrustStore: - "pattern://c0722fc79e7314c9cdcd20ff" + backendTrustStore: + - "pattern://7076f2654dd4efa1675afc72" signerKeyStore: - "pattern://aeb2fed9962dcd5f7893db51" idPregenerate: "enabled" diff --git a/patterns/nevisFIDO2_087f275433f3973a1421318f.yml b/patterns/nevisFIDO2_087f275433f3973a1421318f.yml index 650be3d..0e7ccff 100644 --- a/patterns/nevisFIDO2_087f275433f3973a1421318f.yml +++ b/patterns/nevisFIDO2_087f275433f3973a1421318f.yml @@ -16,7 +16,9 @@ pattern: relyingPartyId: "var://nevisfido2-relying-party-id" relyingPartyOrigins: "var://nevisfido2-relying-party-origins" idm: - - "pattern://b8a36646f81c3247cdb5d90b" - client: "cfa9c9b9-119f-4dff-9bb8-86d7c0cf2720" + - "pattern://f1e0b2a7bc849ffc63a612e6" + client: "var://idm-agov-client-extid" + serverTrustStore: + - "pattern://7076f2654dd4efa1675afc72" addons: - "pattern://90af8358cc587f5c5aa79fec" diff --git a/patterns/nevisIDM_Connector_f1e0b2a7bc849ffc63a612e6.yml b/patterns/nevisIDM_Connector_f1e0b2a7bc849ffc63a612e6.yml new file mode 100644 index 0000000..384639e --- /dev/null +++ b/patterns/nevisIDM_Connector_f1e0b2a7bc849ffc63a612e6.yml @@ -0,0 +1,10 @@ +schemaVersion: "1.0" +pattern: + id: "f1e0b2a7bc849ffc63a612e6" + className: "ch.nevis.admin.v4.plugin.nevisidm.patterns.NevisIDMConnector" + name: "nevisIDM_Connector" + label: "UTILS" + properties: + url: "var://idm-connection-url" + kubernetes: "other_namespace" + kubernetesNamespace: "var://idm-connection-namespace" diff --git a/patterns/nevisIDM_b8a36646f81c3247cdb5d90b.yml b/patterns/nevisIDM_b8a36646f81c3247cdb5d90b.yml deleted file mode 100644 index fd223ad..0000000 --- a/patterns/nevisIDM_b8a36646f81c3247cdb5d90b.yml +++ /dev/null @@ -1,26 +0,0 @@ -schemaVersion: "1.0" -pattern: - id: "b8a36646f81c3247cdb5d90b" - className: "ch.nevis.admin.v4.plugin.nevisidm.patterns.NevisIDMDeployable" - name: "nevisIDM" - deploymentHosts: "idm" - label: "IDM" - properties: - encryptionKey: "var://nevisidm-encryption-key" - frontendTrustStore: - - "pattern://c0722fc79e7314c9cdcd20ff" - authSignerTrustStore: - - "pattern://2d8151249e6734ccc072422b" - database: - - "pattern://2951ead44a7a9362a4545094" - logging: - - "pattern://a4c7f77128ea9a990291fe64" - mailSMTPHost: "var://nevisidm-smtp-host" - mailSMTPPort: "var://nevisidm-smtp-port" - smtpTLSMode: "var://nevisidm-smtp-ssltls-mode" - mailSMTPUser: "var://nevisidm-smtp-user" - mailSMTPPass: "var://nevisidm-smtp-password" - mailSenderAddress: "var://nevisidm-mail-sender" - addons: - - "pattern://71411a755a625f9b850c6cf5" - - "pattern://90af8358cc587f5c5aa79fec" diff --git a/variables.yml b/variables.yml index 03f7f43..476a545 100644 --- a/variables.yml +++ b/variables.yml @@ -7,35 +7,6 @@ variables: maxAllowed: 1 value: ".agov-d.azure.adnovum.net" requireOverloading: true - agov_dev_idm-db-management: - className: "ch.nevis.admin.v4.plugin.base.generation.property.SelectionProperty" - parameters: - minRequired: 1 - maxAllowed: 1 - options: - - "complete" - - "schema" - - "disabled" - value: "complete" - requireOverloading: true - agov_dev_idm_db-db-management: - className: "ch.nevis.admin.v4.plugin.base.generation.property.SelectionProperty" - parameters: - minRequired: 1 - maxAllowed: 1 - options: - - "complete" - - "schema" - - "disabled" - value: "disabled" - requireOverloading: true - ask_mobile_number-template-parameters: - className: "ch.nevis.admin.v4.plugin.base.generation.property.TextProperty" - parameters: - required: false - syntax: "YAML" - value: "idm-service: idm\n" - requireOverloading: true auth-session-store-database-host: className: "ch.nevis.admin.v4.plugin.base.generation.property.HostPortProperty" parameters: @@ -181,6 +152,17 @@ variables: \ font-src 'self';" - param_report_only_csp: "none" requireOverloading: true + eid-oidc4vp-service-url: + className: "ch.nevis.admin.v4.plugin.base.generation.property.URLProperty" + parameters: + minRequired: 1 + schemeInputMode: "OPTIONAL" + allowedSchemes: "http,https" + hostNameInputMode: "REQUIRED" + portInputMode: "OPTIONAL" + pathInputMode: "OPTIONAL" + value: "http://eid-verifier-oid4vp.adn-agov-eid-01-dev:8081/api" + requireOverloading: true ensure_recovery_code-parameters: className: "ch.nevis.admin.v4.plugin.base.generation.property.TextProperty" parameters: @@ -235,10 +217,10 @@ variables: parameters: required: false syntax: "YAML" - value: "url: \"https://idm:8989/nevisidm\"\nclient.name: agov\nattributes: loginId,extId,firstName,name,email,mobile\n\ - properties: eIdNumber,gender,placeOfBirth,svnr\nidm-service: idm\nagov.unitExtId:\ - \ 1000\nagov.level100.roleExtid: aee52e9f-7084-4e55-9aea-9383ac7757f7" - requireOverloading: true + value: "client.name: agov\nattributes: loginId,extId,firstName,name,email,gender,birthDate,language,sex,addressLine1,postalCode,city,country,street,houseNumber,locality,mobile\n\ + properties: eIdNumber,placeOfBirth,svnr,nationality\nagov.unitExtId: 1000\n\ + agov.level100.roleExtid: aee52e9f-7084-4e55-9aea-9383ac7757f7\n" + requireOverloading: false fido-session-store-database-host: className: "ch.nevis.admin.v4.plugin.base.generation.property.HostPortProperty" parameters: @@ -339,13 +321,6 @@ variables: minRequired: 0 value: null requireOverloading: true - fido_uaf_instance-client-id: - className: "ch.nevis.admin.v4.plugin.base.generation.property.SimpleTextProperty" - parameters: - minRequired: 1 - maxAllowed: 1 - value: "agov" - requireOverloading: true fido_uaf_instance-custom-uri-link: className: "ch.nevis.admin.v4.plugin.base.generation.property.SimpleTextProperty" parameters: @@ -381,147 +356,39 @@ variables: pathInputMode: "NONE" value: null requireOverloading: true - idm-standard-settings: - className: "ch.nevis.admin.v4.plugin.base.generation.property.KeyValueProperty" + idm-agov-client-extid: + className: "ch.nevis.admin.v4.plugin.base.generation.property.SimpleTextProperty" parameters: - separators: - - "=" - switchedSeparators: [] - valueFormat: ".*" + minRequired: 1 + maxAllowed: 1 + value: "cfa9c9b9-119f-4dff-9bb8-86d7c0cf2720" + requireOverloading: false + idm-agov-client-name: + className: "ch.nevis.admin.v4.plugin.base.generation.property.SimpleTextProperty" + parameters: + minRequired: 1 + maxAllowed: 1 value: - - application.feature.multiclientmode.enabled: "true" - - application.modules.auditing.enabled: "true" - - application.feature.email.validation.enabled: "false" - - application.generators.extid.client: "uuid" - - application.generators.extid.user: "uuid" - - application.generators.extid.profile: "uuid" - - application.generators.extid.unit: "uuid" - - application.generators.extid.credential: "uuid" - - application.generators.extid.application: "uuid" - - application.generators.extid.role: "uuid" - - application.generators.extid.policyconfig: "uuid" - - application.generators.extid.template: "uuid" - - application.generators.extid.enterpriserole: "uuid" - - application.generators.extid.authorization: "uuid" - - application.modules.event.repeat.count: "0" - - application.modules.event.autostartup.enabled: "false" - - application.modules.auditing.autostartup.enabled: "false" - - application.modules.auditing.repeat.count: "0" - - application.modules.provisioning.enabled: "false" - - database.connection.xa.enabled: "false" - - database.connection.pool.size.min: "5" - - database.connection.pool.size.max: "10" - requireOverloading: true - idm_db-database-connection-url: + - "agov" + requireOverloading: false + idm-connection-namespace: className: "ch.nevis.admin.v4.plugin.base.generation.property.SimpleTextProperty" parameters: minRequired: 0 maxAllowed: 1 - value: null - requireOverloading: true - idm_db-database-host: - className: "ch.nevis.admin.v4.plugin.base.generation.property.HostPortProperty" - parameters: - minRequired: 0 - maxAllowed: 2 - portRequired: false - value: "mariadb-agov-dev.mariadb.database.azure.com:3306" - requireOverloading: true - idm_db-database-jdbc-driver: - className: "ch.nevis.admin.v4.plugin.base.generation.property.AttachmentProperty" - parameters: - minRequired: 0 - maxAllowed: 1 - allowedFileName: ".*\\.jar" - value: null - requireOverloading: true - idm_db-database-name: - className: "ch.nevis.admin.v4.plugin.base.generation.property.SimpleTextProperty" + value: "agov-nevisidm-admin-01-prod-p" + requireOverloading: false + idm-connection-url: + className: "ch.nevis.admin.v4.plugin.base.generation.property.URLProperty" parameters: minRequired: 1 - maxAllowed: 1 - value: "nevisidm_dev" - requireOverloading: true - idm_db-database-password: - className: "ch.nevis.admin.v4.plugin.base.generation.property.SimpleTextProperty" - parameters: - minRequired: 0 - maxAllowed: 1 - secret: true - value: "sample password" - requireOverloading: true - idm_db-database-type: - className: "ch.nevis.admin.v4.plugin.base.generation.property.SelectionProperty" - parameters: - minRequired: 1 - maxAllowed: 1 - options: - - "MariaDB" - - "Oracle" - - "PostgreSQL" - value: "Oracle" - requireOverloading: true - idm_db-database-user: - className: "ch.nevis.admin.v4.plugin.base.generation.property.SimpleTextProperty" - parameters: - minRequired: 0 - maxAllowed: 1 - value: "adndbadmin" - requireOverloading: true - idm_db-database-volume-claim: - className: "ch.nevis.admin.v4.plugin.base.generation.property.SimpleTextProperty" - parameters: - minRequired: 0 - maxAllowed: 1 - value: null - requireOverloading: true - idm_db-root-credential: - className: "ch.nevis.admin.v4.plugin.base.generation.property.SimpleTextProperty" - parameters: - minRequired: 0 - maxAllowed: 1 - value: "root-adn-agov-nevisidm-01-dev-idm" - requireOverloading: true - idm_db-root-credential-namespace: - className: "ch.nevis.admin.v4.plugin.base.generation.property.SimpleTextProperty" - parameters: - minRequired: 0 - maxAllowed: 1 - value: "adn-agov-nevisidm-01-dev-idm" - requireOverloading: true - idm_db-tls-encryption: - className: "ch.nevis.admin.v4.plugin.base.generation.property.SelectionProperty" - parameters: - minRequired: 1 - maxAllowed: 1 - options: - - "disabled" - - "trust" - - "verify-ca" - - "verify-full" - value: "trust" - requireOverloading: true - idm_db_tls_truststore-trusted-certificates: - className: "ch.nevis.admin.v4.plugin.base.generation.property.AttachmentProperty" - parameters: - minRequired: 0 - secretPreserving: true - value: null - requireOverloading: true - idm_post_processing-template-parameters: - className: "ch.nevis.admin.v4.plugin.base.generation.property.TextProperty" - parameters: - required: false - syntax: "YAML" - value: "attributes: loginId,extId,firstName,name,email" - requireOverloading: true - idm_x509_state-template-parameters: - className: "ch.nevis.admin.v4.plugin.base.generation.property.TextProperty" - parameters: - required: false - syntax: "YAML" - value: "client.name: Default" - requireOverloading: true + schemeInputMode: "OPTIONAL" + allowedSchemes: "https" + hostNameInputMode: "REQUIRED" + portInputMode: "REQUIRED" + pathInputMode: "NONE" + value: "idm:8989" + requireOverloading: false idp-authentication-session-timeout: className: "ch.nevis.admin.v4.plugin.base.generation.property.DurationProperty" parameters: @@ -538,12 +405,6 @@ variables: value: "cors.allowed.fqdns: '{\"trustbroker.agov-d.azure.adnovum.net\", \"auth.agov-d.azure.adnovum.net\"\ }'" requireOverloading: true - idp-idm-sectoken-signer-trust-additional-trusted-certificates: - className: "ch.nevis.admin.v4.plugin.base.generation.property.AttachmentProperty" - parameters: - minRequired: 0 - value: null - requireOverloading: true idp-sp-connector-properties: className: "ch.nevis.admin.v4.plugin.base.generation.property.AuthStateProperty" parameters: @@ -644,16 +505,21 @@ variables: - "INFO" - "DEBUG" - "TRACE" - value: "INFO" - requireOverloading: true + value: "WARN" + requireOverloading: false log_auth-log-levels: className: "ch.nevis.admin.v4.plugin.base.generation.property.KeyValueProperty" parameters: separators: - "=" switchedSeparators: [] - value: [] - requireOverloading: true + value: + - AuthPerf: "INFO" + - AGOV-ACCT: "INFO" + - AgovCaptcha: "INFO" + - IdmAuth: "ERROR" + - OpTrace: "INFO" + requireOverloading: false log_fido2-default-log-level: className: "ch.nevis.admin.v4.plugin.base.generation.property.SelectionProperty" parameters: @@ -665,16 +531,17 @@ variables: - "INFO" - "DEBUG" - "TRACE" - value: "DEBUG" - requireOverloading: true + value: "WARN" + requireOverloading: false log_fido2-log-levels: className: "ch.nevis.admin.v4.plugin.base.generation.property.KeyValueProperty" parameters: separators: - "=" switchedSeparators: [] - value: null - requireOverloading: true + value: + - OpTrace: "INFO" + requireOverloading: false log_fido_uaf-default-log-level: className: "ch.nevis.admin.v4.plugin.base.generation.property.SelectionProperty" parameters: @@ -686,8 +553,8 @@ variables: - "INFO" - "DEBUG" - "TRACE" - value: "INFO" - requireOverloading: true + value: "WARN" + requireOverloading: false log_fido_uaf-log-levels: className: "ch.nevis.admin.v4.plugin.base.generation.property.KeyValueProperty" parameters: @@ -695,29 +562,8 @@ variables: - "=" switchedSeparators: [] value: - - OpTrace: "DEBUG" - requireOverloading: true - log_idm-default-log-level: - className: "ch.nevis.admin.v4.plugin.base.generation.property.SelectionProperty" - parameters: - minRequired: 0 - maxAllowed: 1 - options: - - "ERROR" - - "WARN" - - "INFO" - - "DEBUG" - - "TRACE" - value: "INFO" - requireOverloading: true - log_idm-log-levels: - className: "ch.nevis.admin.v4.plugin.base.generation.property.KeyValueProperty" - parameters: - separators: - - "=" - switchedSeparators: [] - value: null - requireOverloading: true + - OpTrace: "INFO" + requireOverloading: false log_proxy-default-log-level: className: "ch.nevis.admin.v4.plugin.base.generation.property.SelectionProperty" parameters: @@ -730,8 +576,8 @@ variables: - "DEBUG" - "DEBUG_HIGH" - "TRACE" - value: "DEBUG" - requireOverloading: true + value: "NOTICE" + requireOverloading: false log_proxy-log-levels: className: "ch.nevis.admin.v4.plugin.base.generation.property.KeyValueProperty" parameters: @@ -739,8 +585,10 @@ variables: - "=" - ":" switchedSeparators: [] - value: null - requireOverloading: true + value: + - IsiwebOp: "INFO" + - NavajoOp: "INFO" + requireOverloading: false nevisfido2-relying-party-id: className: "ch.nevis.admin.v4.plugin.base.generation.property.HostProperty" parameters: @@ -772,74 +620,6 @@ variables: minRequired: 0 value: null requireOverloading: true - nevisidm-custom-property-svnr-client-external-id: - className: "ch.nevis.admin.v4.plugin.base.generation.property.SimpleTextProperty" - parameters: - minRequired: 0 - maxAllowed: 1 - value: "cfa9c9b9-119f-4dff-9bb8-86d7c0cf2720" - requireOverloading: true - nevisidm-database-root-credential: - className: "ch.nevis.admin.v4.plugin.base.generation.property.SimpleTextProperty" - parameters: - minRequired: 0 - maxAllowed: 1 - value: "username: password: " - requireOverloading: true - nevisidm-encryption-key: - className: "ch.nevis.admin.v4.plugin.base.generation.property.SimpleTextProperty" - parameters: - minRequired: 1 - maxAllowed: 1 - secret: true - value: "this a sample password" - requireOverloading: true - nevisidm-mail-sender: - className: "ch.nevis.admin.v4.plugin.base.generation.property.SimpleTextProperty" - parameters: - minRequired: 0 - maxAllowed: 1 - format: "^\\S+@\\S+$" - value: "noreply-agov-dev@adnovum.ch" - requireOverloading: true - nevisidm-smtp-host: - className: "ch.nevis.admin.v4.plugin.base.generation.property.SimpleTextProperty" - parameters: - minRequired: 0 - maxAllowed: 1 - value: "greenmail.adn-agov-mail-01-dev.svc" - requireOverloading: true - nevisidm-smtp-password: - className: "ch.nevis.admin.v4.plugin.base.generation.property.SimpleTextProperty" - parameters: - minRequired: 0 - maxAllowed: 1 - value: null - requireOverloading: true - nevisidm-smtp-port: - className: "ch.nevis.admin.v4.plugin.base.generation.property.PortProperty" - parameters: - minRequired: 0 - maxAllowed: 1 - value: "3025" - requireOverloading: true - nevisidm-smtp-ssltls-mode: - className: "ch.nevis.admin.v4.plugin.base.generation.property.SelectionProperty" - parameters: - minRequired: 0 - maxAllowed: 1 - options: - - "disabled" - - "STARTTLS" - value: "disabled" - requireOverloading: true - nevisidm-smtp-user: - className: "ch.nevis.admin.v4.plugin.base.generation.property.SimpleTextProperty" - parameters: - minRequired: 0 - maxAllowed: 1 - value: null - requireOverloading: true nevislogrend-configuration-logrendproperties: className: "ch.nevis.admin.v4.plugin.base.generation.property.KeyValueProperty" parameters: {}