adn-agov-iam-project/patterns/92cb6d5256008a32f12ceb93_authStatesFile/agov_idp.xml

<AuthState name="${state.entry}" class="ch.nevis.esauth.auth.states.saml.IdentityProviderState" final="false" resumeState="true">
            
            <!-- Auth_Realm_Main_IDP_Concurrent_Logout -->
            <ResultCond name="IDP-initiated-ConcurrentLogout" next="${state.exit.1}"/>
            <ResultCond name="SP-initiated-ConcurrentLogout" next="${state.exit.1}"/>

            <!-- Auth_Realm_Main_IDP_Prepare_Done -->
            <ResultCond name="IDP-initiated-SingleLogout" next="${state.done}"/>
            <ResultCond name="SP-initiated-SingleLogout" next="${state.done}"/>
            <ResultCond name="ok" next="${state.done}"/>

            <!-- Auth_Realm_Main_IDP_Logout_Done -->
            <ResultCond name="LogoutCompleted" next="${state.exit.2}"/>
            <!-- Auth_Realm_Main_IDP_Logout_Fail -->
            <ResultCond name="LogoutFailed" next="${state.exit.3}"/>
            
            <!-- Auth_Realm_Main_IDP_RequestedRoleLevel -->
            <ResultCond name="authenticate:IDP-initiated-SSO" next="${state.exit.4}"/>
            <ResultCond name="authenticate:SP-initiated-SSO" next="${state.exit.4}"/>

            <ResultCond name="invalidAssertionConsumerUrl" next="${state.entry}"/>
            
             <!-- Auth_Realm_Main_IDP_Selector -->
            <ResultCond name="stepup:IDP-initiated-SSO" next="${state.failed}"/>
            <ResultCond name="stepup:SP-initiated-SSO" next="${state.failed}"/>


            <Response value="AUTH_ERROR">
                <Gui name="saml_idp" label="title.saml.failed">
                    <GuiElem name="lasterror" type="error" label="error.saml.failed"/>
                </Gui>
            </Response>

            <property name="session.participants-store.key" value="IDP_AGOV-session-participants"/>
            <property name="logoutMode" value="ConcurrentLogout-Redirect"/>
            <property name="logoutTrigger" value="#{request['currentResource'].contains('logout') || inargs.containsKey('logout') || inargs.containsKey('SAMLLogout')}"/>
            
            
            <property name="out.binding" value="http-post"/>
            <property name="out.post.relayStateEncoding" value="HTML"/>
            <property name="out.sign" value="Response Assertion"/>
            <property name="out.signatureKeyInfo" value="Certificate"/>
            <property name="out.ttl" value="30"/>
            <property name="out.subject" value="${response:userId}"/>
            <property name="out.subject.format" value="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"/>
            <property name="out.extension.Bearer" value="ch.nevis.esauth.auth.states.saml.extensions.SubjectConfirmationExtender"/>
            <!-- TODO: use var -->
            <property name="out.issuer" value="${var.idp_agov-saml-issuer}"/>
            <property name="out.keystoreref" value="Store_IDP_AGOV"/>
            <property name="out.keyobjectref" value="Signer_IDP_AGOV"/>

            <!-- TODO: use var -->
            <property name="spIssuer" value="${var.idp_sp_connector-sp-issuer}"/>
            <property name="spURL" value="${var.idp_sp_connector-sp-url---assertion-consumer-services}"/>
            <property name="acsUrlWhitelist.uris" value="${var.idp_sp_connector-sp-url---assertion-consumer-services}"/>

            <property name="in.binding" value="auto"/>
            <property name="in.max_age" value="60"/>
            <property name="in.keystoreref" value="Store_IDP_AGOV"/>


            <property name="out.authnContextClassRef" value="${sess:contextClassRefToSet}"/>
            <property name="out.audienceRestriction" value="${var.idp_agov-audience}"/>
           
            <!-- SAML Attributes -->
            <property name="out.attribute.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" value="${sess:ch.nevis.idm.User.email}"/>
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/05/identity/claims/languageOfCorrespondance" value="${sess:ch.nevis.idm.User.language}"/>
            <property name="out.attribute.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname" value="${sess:ch.nevis.idm.User.firstName}"/>
            <property name="out.attribute.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname" value="${sess:ch.nevis.idm.User.lastName}"/>
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/05/identity/claims/dateOfBirth" value="${sess:ch.nevis.idm.User.birthDate:^(\d\d\d\d-\d\d-\d\d).*$}"/>
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/05/identity/claims/sex" value="${sess:ch.nevis.idm.User.gender}"/>
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/05/identity/claims/socialSecurityNumber" value="#{ (sess['agov.appSvnrAllowed'] == 'true') ? sess['ch.nevis.idm.User.prop.svnr'] : ''}"/>
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/05/identity/claims/placeOfBirth" value="#{ (sess['agov.appSvnrAllowed'] == 'true') ? sess['ch.nevis.idm.User.prop.placeOfBirth'] : ''}"/>
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/05/identity/claims/eIdNumber" value="${sess:ch.nevis.idm.User.prop.eIdNumber}"/>
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/05/identity/claims/qa/dateOfVerification" value="${sess:ValidFrom}"/>
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/05/identity/claims/qa/validTillDate" value="${sess:ValidTo}"/>
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/05/identity/claims/qa/verificationMethod" value="#{ ''.concat(sess.get('idVerification')).replace('SelfPaid', '') }"/>
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/05/identity/claims/nationality" value="#{ sess.containsKey('ch.nevis.idm.User.prop.nationality') ? sess['ch.nevis.idm.User.prop.nationality'].toUpperCase(): '' }"/>
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/05/identity/claims/authenticatedWith" value="${sess:authenticatedWith}"/>
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/08/identity/claims/emailVerified" value="true"/>
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/08/identity/claims/address/street" value="#{ (sess['agov.appAddressRequired'] == 'true') ? sess['ch.nevis.idm.User.street'] : '' }"/>
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/08/identity/claims/address/houseNumber" value="#{ (sess['agov.appAddressRequired'] == 'true') ? sess['ch.nevis.idm.User.houseNumber'] : '' }"/>
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/08/identity/claims/address/zipCode" value="#{ (sess['agov.appAddressRequired'] == 'true') ? sess['ch.nevis.idm.User.postalCode'] : '' }"/>
            <property name="out.attribute.http://schemas.agov.ch/ws/2023/08/identity/claims/address/town" value="#{ (sess['agov.appAddressRequired'] == 'true') ? sess['ch.nevis.idm.User.city'] : '' }"/>
            <property name="out.attribute.http://schemas.agov.ch/ws/2024/02/identity/claims/address/country" value="#{ (sess['agov.appAddressRequired'] == 'true') ? sess['ch.nevis.idm.User.country'].toUpperCase() : '' }"/>
            <property name="out.attribute.http://schemas.agov.ch/ws/2024/02/identity/claims/address/qa/verificationMethod" value="#{ (sess['agov.appAddressRequired'] == 'true') ? ''.concat(sess.get('agov.adressVerification')).replace('Location', 'Domicile') : '' }"/>
            <property name="out.attribute.http://schemas.agov.ch/ws/2024/02/identity/claims/address/countryName" value="#{ (sess['agov.appAddressRequired'] == 'true') ? sess['agov.countryName'] : ''}"/>
            
        </AuthState>