nevis
/
adn-agov-work-ob-inventory
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

new configuration version

This commit is contained in:
haburger 2024-08-23 14:04:43 +00:00
parent 6aff54278b
commit e1b1378c18
130 changed files with 34316 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-auth/etc/nevis/k8s-ob-auth-agov-work-internal-trust-store-d00b0dcbe241793d30daf91c.yaml Normal file
View File

@ -0,0 +1,14 @@
apiVersion: "operator.nevis-security.ch/v1"
kind: "NevisTrustStore"
metadata:
name: "ob-auth-agov-work-internal-trust-store"
namespace: "adn-agov-nevisidm-ob-01-uat"
labels:
deploymentTarget: "ob-auth"
annotations:
projectKey: "DEFAULT-ADN-AGOV-WORK-OB-PROJECT"
patternId: "d00b0dcbe241793d30daf91c"
spec:
keystores: []
extraCerts:
- "-----BEGIN CERTIFICATE-----\nMIIBcTCCARagAwIBAgIQWRl1eifIt8yohQYzh6yr/jAKBggqhkjOPQQDAjAYMRYw\nFAYDVQQDEw1zZWxmc2lnbmVkLWNhMB4XDTIzMDYyODE0MzI0MFoXDTQzMDYyODE0\nMzI0MFowGDEWMBQGA1UEAxMNc2VsZnNpZ25lZC1jYTBZMBMGByqGSM49AgEGCCqG\nSM49AwEHA0IABEwcjsIhSyyh0i9zP1G7ReOkFt/djzlGoUtSd5v3ZEk5QoZYjfl9\n04HdaZzrmveB2aRppbXgW7//s2Ma8wTd5uejQjBAMA4GA1UdDwEB/wQEAwICpDAP\nBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBT7YRoWIjHwkvFicwvk0Tx/yA4uUTAK\nBggqhkjOPQQDAgNJADBGAiEAgyg9t0qgb+czuscs07pNGI+12BedrD+y71psIlqx\nt2UCIQC/85UXyjYI9zg7Mg7rROTbGNCU3Jq/KIC3VzbbD+68VA==\n-----END CERTIFICATE-----\n"

59
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-auth/etc/nevis/k8s-ob-auth-d00b0dcbe241793d30daf91c.yaml Normal file
View File

@ -0,0 +1,59 @@
apiVersion: "operator.nevis-security.ch/v1"
kind: "NevisComponent"
metadata:
name: "ob-auth"
namespace: "adn-agov-nevisidm-ob-01-uat"
labels:
deploymentTarget: "ob-auth"
annotations:
projectKey: "DEFAULT-ADN-AGOV-WORK-OB-PROJECT"
patternId: "d00b0dcbe241793d30daf91c"
spec:
type: "NevisAuth"
replicas: 1
version: "8.2405.0"
gitInitVersion: "1.3.0"
runAsNonRoot: true
ports:
management: 9000
soap: 8991
resources:
limits:
cpu: "1000m"
memory: "1000Mi"
requests:
cpu: "20m"
memory: "200Mi"
livenessProbe:
soap:
tcpSocket: true
periodSeconds: 5
timeoutSeconds: 4
readinessProbe:
management:
httpGet:
path: "/nevisauth/liveness"
periodSeconds: 5
timeoutSeconds: 6
startupProbe:
management:
httpGet:
path: "/nevisauth/liveness"
periodSeconds: 5
timeoutSeconds: 6
failureThreshold: 50
podDisruptionBudget:
maxUnavailable: "50%"
git:
tag: "r-0d14bc8d1f507b55c11ab2b807d691b97d55b1dd"
dir: "DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-auth"
credentials: "git-credentials"
keystores:
- "ob-auth-default-identity"
truststores:
- "ob-auth-agov-work-internal-trust-store"
- "ob-auth-default-tls-client-trust"
podSecurity:
policy: "baseline"
automountServiceAccountToken: false
timeZone: "Europe/Zurich"

18
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-auth/etc/nevis/k8s-ob-auth-default-identity-d00b0dcbe241793d30daf91c.yaml Normal file
View File

@ -0,0 +1,18 @@
apiVersion: "operator.nevis-security.ch/v1"
kind: "NevisKeyStore"
metadata:
name: "ob-auth-default-identity"
namespace: "adn-agov-nevisidm-ob-01-uat"
labels:
deploymentTarget: "ob-auth"
annotations:
projectKey: "DEFAULT-ADN-AGOV-WORK-OB-PROJECT"
patternId: "d00b0dcbe241793d30daf91c"
spec:
cn: "ob-auth"
usage: "<reserved for future use>"
san:
dns:
- "ob-auth"
- "ob-auth.adn-agov-nevisidm-ob-01-uat"
email: []

12
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-auth/etc/nevis/k8s-ob-auth-default-tls-client-trust-d00b0dcbe241793d30daf91c.yaml Normal file
View File

@ -0,0 +1,12 @@
apiVersion: "operator.nevis-security.ch/v1"
kind: "NevisTrustStore"
metadata:
name: "ob-auth-default-tls-client-trust"
namespace: "adn-agov-nevisidm-ob-01-uat"
labels:
deploymentTarget: "ob-auth"
annotations:
projectKey: "DEFAULT-ADN-AGOV-WORK-OB-PROJECT"
patternId: "d00b0dcbe241793d30daf91c"
spec:
keystores: []

18
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-auth/etc/nevis/nevisauth_default.yml Normal file
View File

@ -0,0 +1,18 @@
schemaVersion: 1.0
instance:
type: "nevisauth"
name: "default"
directory: "/var/opt/nevisauth/default"
pid: "systemctl show nevisauth@default -p MainPID | cut -d '=' -f2"
source:
url: "/nevisadmin/#/projects/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/patterns/d00b0dcbe241793d30daf91c"
projectKey: "DEFAULT-ADN-AGOV-WORK-OB-PROJECT"
patternId: "d00b0dcbe241793d30daf91c"
patternClass: "ch.nevis.admin.v4.plugin.nevisauth.patterns.NevisAuthDeployable"
resources:
ports:
- "0.0.0.0:8991"
control:
start: "systemctl restart nevisauth@default &"
stop: "systemctl stop nevisauth@default"
status: "systemctl status nevisauth@default"

17
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-auth/var/opt/keys/own/ob-auth-signer/cert.pem Normal file
View File

@ -0,0 +1,17 @@
-----BEGIN CERTIFICATE-----
MIICwzCCAmmgAwIBAgIRAIgdSB3tN8ZLL8RUMEGevQQwCgYIKoZIzj0EAwIwGDEW
MBQGA1UEAxMNc2VsZnNpZ25lZC1jYTAeFw0yNDA3MTcwNzI5MDFaFw0yNTA3MTcw
NzI5MDFaMFYxCzAJBgNVBAYTAkNIMQwwCgYDVQQIEwNLOFMxDDAKBgNVBAcTA0s4
UzEMMAoGA1UEChMDSzhTMQwwCgYDVQQLEwNLOFMxDzANBgNVBAMTBnNpZ25lcjCC
ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOyJFpEW1XRq43YwOU/e9ufh
128Yct8Q3f6HoRaXpUmygAkUsyBwOLWmwNeS80SLyOVegco6kGOdoMvnZsLX3ujf
cASkbN+93xhc2MpJXvfWbLbFGrpuQki3V5Banw+UulBuTltFLmxaIRXs1y4Ny2uh
US98LjFY3YD+3d5WG7UpgRTJ+x+t+8nqnPVOJ5asfcirM8/lRB4drUAwCOv51XLR
fRbqCaXKpVaiw/vD5KpAOUH2N1cikfOTOY6rce0wgVDGS7eoCfkCN4gT1LG+134M
p0KT3FBikTGdkH6dQ52nTn7xm5byJvNYzq+2zKGdosYAGurdGGw+KLFsFKCpB40C
AwEAAaOBijCBhzAOBgNVHQ8BAf8EBAMCB4AwHQYDVR0lBBYwFAYIKwYBBQUHAwEG
CCsGAQUFBwMCMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAU+2EaFiIx8JLxYnML
5NE8f8gOLlEwJwYDVR0RBCAwHoIGc2lnbmVygRRub3JlcGx5QGxvY2FsLmRvbWFp
bjAKBggqhkjOPQQDAgNIADBFAiBxCyNHGWTpj8oma8cY/rUVMZu/BSDH7zzrDhh6
Q9eJegIhAIGivTcBUZvogUDfNo7IXmmxDqZHrjpoLeu6+VgTY9Qs
-----END CERTIFICATE-----

30
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-auth/var/opt/keys/own/ob-auth-signer/key.pem Normal file
View File

@ -0,0 +1,30 @@
-----BEGIN ENCRYPTED PRIVATE KEY-----
MIIFKzBVBgkqhkiG9w0BBQ0wSDAnBgkqhkiG9w0BBQwwGgQUNRg6sNHowA7ASdbh
dheymQntBakCAggAMB0GCWCGSAFlAwQBKgQQWMBaqE9clERELmyFFrvIQwSCBNC4
bz6o6yIdeKNXtdw5etS19/z3wBoiS4ZRSJq+ysmoSU4C2Ld7uCaCDcpP+dPB5euF
wvPYYmrap5v1vp54HOEMqGgDwcMqwHiGAQeS0r6ZCSixNmo8lNg743yO2fC0efaw
LJbPdgjRmyCweOsUpVNDbbkL6nc7lt16IWRNFQvodPMKiUaQtDqeWvkvthjMpwhH
78GD6bZQXpAXXTGxnnxA4vvkKETUGoclWmVmany0C8hFnrFjOItJW3x26j4h3miI
ahabYiTFrlSF6bAJxg90SlkDKbUyMi24VqdYagbuTLSF8BT28OuFwY1de9n0VVhd
aaE3YKpI6XEY4OJRDFtEMyTVvMXQtwyXzeofcXpgXKuSpbQSTrwTyG/EVN/ssy1h
x8t7tvNkkDOA3V9Ik4VYDPRCkPi7RuAoe3+ojmPkVCZjs6w6CRfqU2y+1cwkkst6
OW6QiQKUeuMckapVXgc4ZP5VFDudTWqBG69maoodlIpWIyF7g3n3cQP5wzgc/Fsv
d+r+KvjaI3mFENaoJAx0xE/DJwv5Mqh9XtvERKFCbbPUCDy2NbHsVeWBCp0n+oJR
KoY8FcXI/hNU/u2FEYZDqsgOaQe3W3lHJjFjK4biWbqPNiEGvyocQbzCpJpbE7MF
oyRVj9vaxtKhcMPduw62Yd+WX4KJkkpiX7JD+TIhCsLqzCSBBVswfGd06O0FpCup
l0oQxDpxofdOEZX7LB3kYreqHQOk/fS3CX0mdYVmEOIfSicdJeC9BEGdq+n7EfbV
iTRuMdMEnXNxXZVyumlix3htBbvASVbZHIB+7dEOg40+jbLktVPzvBGi42XBBbAG
tatQpL0UFLHFoSDnMOE5SIhuKK0JJ9+qczj8hzmtqyP82Scv0UaNlPE5mjjgI2xV
41xYAb03L31x2DBygkJZ6vj97grQ5POAXX+YEGCw2vV83+T6v6+7GGO1skHLYcRt
/BPR6g3mlNPqDGM9HsgVR+6fu9H+rGQAKU4LiCUzz7Qt3wYEculcjRDVsIRN1RsO
tFTfFu5Ecejs7rMgKY8I9TiHLZGs9MVfBF2n5sQbgrZN3nma7D/1K2/IaKu71gsg
YbdzjuNpqQ2BPTmpQ9JIiaycgO7zNwFHlZWxpt3HYQYDtwQQl6OH8eMQO5rHTL7x
rmzMDxR+ikw3oL3xBOYIH5gn34ohSk+VNtRSETfDjH+D/3cwdmibeUnvIhC1mZPO
cnJcQpdsViwySsgKPvetSBfQlgqVvjwWP1s4D88Ly7vIrZ3PHQcLq0fZpiHxxTi7
UVcLEHuSvn6w3KS16c4P0AeJh1628XxWUzv15VyFxLTSnh8MkSCcPJr6ceu8bFGW
WTr1RViVAe0QB1M+ReIHXFtfBbJiT9yvf+ilCbAVXjFaWJdLBzXoNZWW2+fRsBJV
v+eU+BTF80ycNgp2y/ZjHmxR9vrZ5pQ8cBJbxlAiZYBXNMZIFp2RAnYmBNMBGt+S
9hgAWurGoO8tnFWjNvPO6Tkpa/E2nJS0j6MPjOVOJx693jGugp+kJ3WgPF1JTM5j
/MgyTmkLAds4UgXiE1UubXbxhyJMc/UaS2nT+wwXCJs8bXWVWFuN8lz5JrzqoYfb
9huN+yGEp8L4Ss8NnTd9HEQ4J/hxnXa/wdQbGcQVBA==
-----END ENCRYPTED PRIVATE KEY-----

2
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-auth/var/opt/keys/own/ob-auth-signer/keypass Executable file
View File

@ -0,0 +1,2 @@
#!/bin/bash
echo 'yQ4X0JxsgxmmuG5j14vIdkdkqTJOEqog7Xs5UgVbo='

BIN
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-auth/var/opt/keys/own/ob-auth-signer/keystore.jks Normal file
View File

Binary file not shown.

BIN
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-auth/var/opt/keys/own/ob-auth-signer/keystore.p12 Normal file
View File

Binary file not shown.

48
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-auth/var/opt/keys/own/ob-auth-signer/keystore.pem Normal file
View File

@ -0,0 +1,48 @@
-----BEGIN ENCRYPTED PRIVATE KEY-----
MIIFKzBVBgkqhkiG9w0BBQ0wSDAnBgkqhkiG9w0BBQwwGgQUNRg6sNHowA7ASdbh
dheymQntBakCAggAMB0GCWCGSAFlAwQBKgQQWMBaqE9clERELmyFFrvIQwSCBNC4
bz6o6yIdeKNXtdw5etS19/z3wBoiS4ZRSJq+ysmoSU4C2Ld7uCaCDcpP+dPB5euF
wvPYYmrap5v1vp54HOEMqGgDwcMqwHiGAQeS0r6ZCSixNmo8lNg743yO2fC0efaw
LJbPdgjRmyCweOsUpVNDbbkL6nc7lt16IWRNFQvodPMKiUaQtDqeWvkvthjMpwhH
78GD6bZQXpAXXTGxnnxA4vvkKETUGoclWmVmany0C8hFnrFjOItJW3x26j4h3miI
ahabYiTFrlSF6bAJxg90SlkDKbUyMi24VqdYagbuTLSF8BT28OuFwY1de9n0VVhd
aaE3YKpI6XEY4OJRDFtEMyTVvMXQtwyXzeofcXpgXKuSpbQSTrwTyG/EVN/ssy1h
x8t7tvNkkDOA3V9Ik4VYDPRCkPi7RuAoe3+ojmPkVCZjs6w6CRfqU2y+1cwkkst6
OW6QiQKUeuMckapVXgc4ZP5VFDudTWqBG69maoodlIpWIyF7g3n3cQP5wzgc/Fsv
d+r+KvjaI3mFENaoJAx0xE/DJwv5Mqh9XtvERKFCbbPUCDy2NbHsVeWBCp0n+oJR
KoY8FcXI/hNU/u2FEYZDqsgOaQe3W3lHJjFjK4biWbqPNiEGvyocQbzCpJpbE7MF
oyRVj9vaxtKhcMPduw62Yd+WX4KJkkpiX7JD+TIhCsLqzCSBBVswfGd06O0FpCup
l0oQxDpxofdOEZX7LB3kYreqHQOk/fS3CX0mdYVmEOIfSicdJeC9BEGdq+n7EfbV
iTRuMdMEnXNxXZVyumlix3htBbvASVbZHIB+7dEOg40+jbLktVPzvBGi42XBBbAG
tatQpL0UFLHFoSDnMOE5SIhuKK0JJ9+qczj8hzmtqyP82Scv0UaNlPE5mjjgI2xV
41xYAb03L31x2DBygkJZ6vj97grQ5POAXX+YEGCw2vV83+T6v6+7GGO1skHLYcRt
/BPR6g3mlNPqDGM9HsgVR+6fu9H+rGQAKU4LiCUzz7Qt3wYEculcjRDVsIRN1RsO
tFTfFu5Ecejs7rMgKY8I9TiHLZGs9MVfBF2n5sQbgrZN3nma7D/1K2/IaKu71gsg
YbdzjuNpqQ2BPTmpQ9JIiaycgO7zNwFHlZWxpt3HYQYDtwQQl6OH8eMQO5rHTL7x
rmzMDxR+ikw3oL3xBOYIH5gn34ohSk+VNtRSETfDjH+D/3cwdmibeUnvIhC1mZPO
cnJcQpdsViwySsgKPvetSBfQlgqVvjwWP1s4D88Ly7vIrZ3PHQcLq0fZpiHxxTi7
UVcLEHuSvn6w3KS16c4P0AeJh1628XxWUzv15VyFxLTSnh8MkSCcPJr6ceu8bFGW
WTr1RViVAe0QB1M+ReIHXFtfBbJiT9yvf+ilCbAVXjFaWJdLBzXoNZWW2+fRsBJV
v+eU+BTF80ycNgp2y/ZjHmxR9vrZ5pQ8cBJbxlAiZYBXNMZIFp2RAnYmBNMBGt+S
9hgAWurGoO8tnFWjNvPO6Tkpa/E2nJS0j6MPjOVOJx693jGugp+kJ3WgPF1JTM5j
/MgyTmkLAds4UgXiE1UubXbxhyJMc/UaS2nT+wwXCJs8bXWVWFuN8lz5JrzqoYfb
9huN+yGEp8L4Ss8NnTd9HEQ4J/hxnXa/wdQbGcQVBA==
-----END ENCRYPTED PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
MIICwzCCAmmgAwIBAgIRAIgdSB3tN8ZLL8RUMEGevQQwCgYIKoZIzj0EAwIwGDEW
MBQGA1UEAxMNc2VsZnNpZ25lZC1jYTAeFw0yNDA3MTcwNzI5MDFaFw0yNTA3MTcw
NzI5MDFaMFYxCzAJBgNVBAYTAkNIMQwwCgYDVQQIEwNLOFMxDDAKBgNVBAcTA0s4
UzEMMAoGA1UEChMDSzhTMQwwCgYDVQQLEwNLOFMxDzANBgNVBAMTBnNpZ25lcjCC
ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOyJFpEW1XRq43YwOU/e9ufh
128Yct8Q3f6HoRaXpUmygAkUsyBwOLWmwNeS80SLyOVegco6kGOdoMvnZsLX3ujf
cASkbN+93xhc2MpJXvfWbLbFGrpuQki3V5Banw+UulBuTltFLmxaIRXs1y4Ny2uh
US98LjFY3YD+3d5WG7UpgRTJ+x+t+8nqnPVOJ5asfcirM8/lRB4drUAwCOv51XLR
fRbqCaXKpVaiw/vD5KpAOUH2N1cikfOTOY6rce0wgVDGS7eoCfkCN4gT1LG+134M
p0KT3FBikTGdkH6dQ52nTn7xm5byJvNYzq+2zKGdosYAGurdGGw+KLFsFKCpB40C
AwEAAaOBijCBhzAOBgNVHQ8BAf8EBAMCB4AwHQYDVR0lBBYwFAYIKwYBBQUHAwEG
CCsGAQUFBwMCMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAU+2EaFiIx8JLxYnML
5NE8f8gOLlEwJwYDVR0RBCAwHoIGc2lnbmVygRRub3JlcGx5QGxvY2FsLmRvbWFp
bjAKBggqhkjOPQQDAgNIADBFAiBxCyNHGWTpj8oma8cY/rUVMZu/BSDH7zzrDhh6
Q9eJegIhAIGivTcBUZvogUDfNo7IXmmxDqZHrjpoLeu6+VgTY9Qs
-----END CERTIFICATE-----

101
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-auth/var/opt/nevisauth/default/conf/LitDict.properties Normal file
View File

@ -0,0 +1,101 @@
accept.button.label=Accept
button.submit=Submit
cancel.button.label=Cancel
continue.button.label=Continue
deputy.profile.label=(Deputy Profile)
error.policy.failed=The new password does not comply with the policy.
error.saml.failed=Please close your browser and try again.
error_1=Please check your input.
error_10=Please select the correct user account.
error_100=Certificate upload not possible. Certificate already exists. Please contact your helpdesk.
error_101=The entered email address is not valid.
error_11=Please use another certficate or login with another credential type.
error_2=Please select another login name.
error_3=Your account will be locked if next authentication fails.
error_4=Your new password does not comply with the security policy. Please choose a different password.
error_5=Error in password confirmation.
error_50=The new password is too short.
error_55=The new password has to differ from old passwords.
error_6=Password change required.
error_7=Change of login ID required.
error_8=Your account has been locked due to repeated authentication failures.
error_81=No access card found, access from internet denied.
error_83=Your access card is no longer valid. Please contact your advisor to get a new access card.
error_9=Session take over failed.
error_97=You are not authorized to access this resource.
error_98=Your account has been locked.
error_99=System problems. Please try later.
info.login=Please enter your authentication information.
info.logout.confirmation=Please confirm that you want to log out.
info.logout.reminder=Your session on this application has expired. Try again with a login.
info.oauth.consent=Do you want to authorise this application to access your data?
info.signup.passwordless=Log in quickly and securely next time using this device's fingerprint, face recognition, or PIN.
info.signup.passwordless.failed=Use the same method you already use on this device for login.
info.signup.passwordless.skip=<button name="cancel-bottom" type="submit" value="true" class="btn btn-link link-primary">Skip for now</button>
info.timeout.page=Your session on this application has expired. Try again with a login.
login.button.label=Login
logout.label=Logout
logout.text=You have successfully logged out.
method.certificate.label=Certificate
method.fido.label=Mobile Authentication
method.fido2.label=FIDO 2
method.mtan.label=mTAN Code
method.oath.label=OATH Authenticator App
method.otp.label=OTP (One-Time Password)
method.recovery.label=Recovery Codes
method.safeword.label=SafeWord
method.securid.label=SecurID
method.ticket.label=Ticket
outarg.lastLogin.never=Never
policyFailure.dictionary=&#9642; must not be taken from a dictionary.
policyFailure.history.History=&#9642; must be different from previously selected passwords.
policyFailure.regex.control=&#9642; cannot contain more than {0} control characters.
policyFailure.regex.lower=&#9642; must contain at least {0} lower case characters.
policyFailure.regex.maxCharacterRepetitions=&#9642; characters must not occur more than {0} time(s) consecutively.
policyFailure.regex.maxLength=&#9642; must be at most {0} characters long.
policyFailure.regex.minLength=&#9642; must be at least {0} characters long.
policyFailure.regex.nonAlnum=&#9642; must contain at least {0} non-alphanumeric characters.
policyFailure.regex.nonAscii=&#9642; cannot contain more than {0} non-ASCII characters.
policyFailure.regex.nonGraph=&#9642; cannot contain more than {0} non-printable characters.
policyFailure.regex.nonLetter=&#9642; must contain at least {0} non-letter characters.
policyFailure.regex.numeric=&#9642; must contain at least {0} numeric characters.
policyFailure.regex.upper=&#9642; must contain at least {0} upper case characters.
policyInfo.dictionary=&#9642; must not be taken from a dictionary.
policyInfo.history.History=&#9642; must be different from previously selected passwords.
policyInfo.regex.control=&#9642; cannot contain more than {0} control characters.
policyInfo.regex.lower=&#9642; must contain at least {0} lower case characters.
policyInfo.regex.maxCharacterRepetitions=&#9642; characters must not occur more than {0} time(s) consecutively.
policyInfo.regex.maxLength=&#9642; must be at most {0} characters long.
policyInfo.regex.minLength=&#9642; must be at least {0} characters long.
policyInfo.regex.nonAlnum=&#9642; must contain at least {0} non-alphanumeric characters.
policyInfo.regex.nonAscii=&#9642; cannot contain more than {0} non-ASCII characters.
policyInfo.regex.nonGraph=&#9642; cannot contain more than {0} non-printable characters.
policyInfo.regex.nonLetter=&#9642; must contain at least {0} non-letter characters.
policyInfo.regex.numeric=&#9642; must contain at least {0} numeric characters.
policyInfo.regex.upper=&#9642; must contain at least {0} upper case characters.
policyInfo.title=The password has to comply with the following password policy:
prompt.client=Client
prompt.newpassword=New Password
prompt.newpassword.confirm=Confirm Password
prompt.password=Password
prompt.userid=User-ID
pwreset.done.info=Your password was successfully changed. Please click on continue to log in.
pwreset.email.sent=If your user ID exists, an email to reset your password has been sent to you.
pwreset.info.linktext=Password forgotten
pwreset.noticket=Your password reset link is no longer valid. Please generate a new one.
reject.button.label=Deny
submit.button.label=Submit
tan.sent=Please enter the security code which has been sent to your mobile phone.
title.login=Login
title.logout=Logout
title.logout.confirmation=Logout
title.logout.reminder=Logout
title.oauth.consent=Client Authorization
title.pwchange.label=Password Change
title.pwreset=Password Forgotten
title.saml.failed=Error
title.signup.passwordless=Go passwordless
title.signup.passwordless.failed=Failed to turn on passwordless
title.timeout.page=Logout
try_again.button.label=Try again

101
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-auth/var/opt/nevisauth/default/conf/LitDict_de.properties Normal file
View File

@ -0,0 +1,101 @@
accept.button.label=Akzeptieren
button.submit=Senden
cancel.button.label=Abbrechen
continue.button.label=Weiter
deputy.profile.label=(Profil Stellvertreter)
error.policy.failed=Das neue Passwort stimmt nicht mit der Richtlinie &uuml;berein.
error.saml.failed=Bitte schliessen Sie Ihren Browser und versuchen Sie es erneut.
error_1=Bitte &uuml;berpr&uuml;fen Sie Ihre Eingabe.
error_10=Bitte w&auml;hlen Sie den gew&uuml;nschten Benutzer.
error_100=Zertifikat-Upload nicht m&ouml;glich. Zertifikat bereits vorhanden. Bitte kontaktieren Sie Ihren Helpdesk.
error_101=Die angegebene E-Mail Adresse ist ung&uuml;ltig.
error_11=Bitte verwenden Sie ein anderes Zertifikat oder ein alternatives Authentisierungsmittel.
error_2=Bitte w&auml;hlen Sie einen anderen Login-Namen.
error_3=Falls Ihr n&auml;chster Login fehlschl&auml;gt, wird Ihr Konto gesperrt.
error_4=Ihr neues Passwort wurde nicht akzeptiert. Bitte w&auml;hlen Sie eines, das den Passwortvorgaben entspricht.
error_5=Die Eingabe zur Best&auml;tigung des Passwortes ist falsch.
error_50=Das neue Passwort ist zu kurz.
error_55=Das neue Passwort muss sich von alten Passw&ouml;rtern unterscheiden.
error_6=Passwortwechsel erforderlich.
error_7=Wechsel der Login-ID erforderlich.
error_8=Ihr Konto wurde infolge wiederholt fehlgeschlagener Authentisierung gesperrt.
error_81=Keine Rasterkarte gefunden, Zugang vom Internet verweigert.
error_83=Ihre Rasterkarte ist aufgebraucht. Bitte kontaktieren Sie Ihren Berater, um eine neue zu erhalten.
error_9=Die SSO-Session konnte nicht &uuml;bernommen werden.
error_97=Sie verf&uuml;gen nicht &uuml;ber die f&uuml;r den Zugriff auf diese Ressource ben&ouml;tigte Berechtigung.
error_98=Ihr Konto ist gesperrt.
error_99=Systemfehler. Bitte versuchen Sie es sp&auml;ter.
info.login=Bitte geben Sie Ihre pers&ouml;nlichen Zugangsdaten ein.
info.logout.confirmation=Bitte best&auml;tigen Sie, dass Sie sich abmelden m&ouml;chten.
info.logout.reminder=Ihre Session ist auf dieser Applikation abgelaufen. Versuchen Sie es nochmals mit einem Login.
info.oauth.consent=Wollen Sie der Anwendung den Zugriff erlauben?
info.signup.passwordless=Melden Sie sich beim nächsten Mal schnell und sicher mit dem Fingerabdruck, der Gesichtserkennung oder der PIN dieses Geräts an.
info.signup.passwordless.failed=Verwenden Sie dieselbe Methode, die Sie bereits für die Anmeldung verwenden.
info.signup.passwordless.skip=<button name="cancel-bottom" type="submit" value="true" class="btn btn-link link-primary">Vorerst überspringen</button>
info.timeout.page=Ihre Session ist auf dieser Applikation abgelaufen. Versuchen Sie es nochmals mit einem Login.
login.button.label=Login
logout.label=Logout
logout.text=Sie haben sich erfolgreich abgemeldet.
method.certificate.label=Zertifikat
method.fido.label=Mobile Authentication
method.fido2.label=FIDO 2
method.mtan.label=mTAN-Code
method.oath.label=OATH Authenticator-App
method.otp.label=OTP (One-Time Passwort)
method.recovery.label=Wiederherstellungscodes
method.safeword.label=SafeWord
method.securid.label=SecurID
method.ticket.label=Ticket
outarg.lastLogin.never=Nie
policyFailure.dictionary=&#9642; darf nicht aus einem W&ouml;rterbuch stammen.
policyFailure.history.History=&#9642; muss sich von vorhergehenden Passw&ouml;rtern unterscheiden.
policyFailure.regex.control=&#9642; darf h&ouml;chstens {0} Kontrollzeichen enthalten.
policyFailure.regex.lower=&#9642; muss {0} Kleinbuchstaben enthalten.
policyFailure.regex.maxCharacterRepetitions=&#9642; darf nicht eine Sequenz l&auml;nger als {0} des gleichen Zeichens enthalten.
policyFailure.regex.maxLength=L&auml;nge des Passwortes darf h&ouml;chstens {0} sein.
policyFailure.regex.minLength=L&auml;nge des Passwortes muss mindestens {0} sein.
policyFailure.regex.nonAlnum=&#9642; muss {0} nicht-alphanumerische Zeichen enthalten.
policyFailure.regex.nonAscii=&#9642; darf h&ouml;chstens {0} Zeichen ausserhalb des ASCII-Zeichensatzes enthalten.
policyFailure.regex.nonGraph=&#9642; darf h&ouml;chstens {0} nicht-druckende Zeichen enthalten.
policyFailure.regex.nonLetter=&#9642; muss {0} Zeichen enthalten, die keine Buchstaben sind.
policyFailure.regex.numeric=&#9642; muss {0} numerische Zeichen enthalten.
policyFailure.regex.upper=&#9642; muss {0} Grossbuchstaben enthalten.
policyInfo.dictionary=&#9642; darf nicht aus einem W&ouml;rterbuch stammen.
policyInfo.history.History=&#9642; darf keines der zuletzt verwendeten Passw&ouml;rtern sein.
policyInfo.regex.control=&#9642; darf h&ouml;chstens {0} Kontrollzeichen enthalten.
policyInfo.regex.lower=&#9642; muss mindestens {0} Kleinbuchstaben enthalten.
policyInfo.regex.maxCharacterRepetitions=&#9642; darf nicht eine Sequenz l&auml;nger als {0} des gleichen Zeichens enthalten.
policyInfo.regex.maxLength=&#9642; darf h&ouml;chstens {0} Zeichen enthalten.
policyInfo.regex.minLength=&#9642; muss mindestens {0} Zeichen enthalten.
policyInfo.regex.nonAlnum=&#9642; muss mindestens {0} Zeichen enthalten, die nicht Alphanumerisch sind.
policyInfo.regex.nonAscii=&#9642; darf h&ouml;chstens {0} Zeichen ausserhalb des ASCII-Zeichensatzes enthalten.
policyInfo.regex.nonGraph=&#9642; darf h&ouml;chstens {0} nicht-druckende Zeichen enthalten.
policyInfo.regex.nonLetter=&#9642; muss mindestens {0} Zeichen enthalten, die keine Buchstaben sind.
policyInfo.regex.numeric=&#9642; muss mindestens {0} numerische Zeichen enthalten.
policyInfo.regex.upper=&#9642; muss mindestens {0} Grossbuchstaben enthalten.
policyInfo.title=Das Passwort muss den folgenden Passwort-Richtlinien entsprechen:
prompt.client=Mandant
prompt.newpassword=Neues Passwort
prompt.newpassword.confirm=Passwort best&auml;tigen
prompt.password=Passwort
prompt.userid=Benutzer-ID
pwreset.done.info=Ihr Passwort wurde erfolgreich ge&auml;ndert. Bitte klicken Sie auf Weiter, um sich einzuloggen.
pwreset.email.sent=Wenn Ihre Benutzer-ID existiert, haben Sie eine E-Mail erhalten, um Ihr Passwort zurückzusetzen..
pwreset.info.linktext=Passwort vergessen
pwreset.noticket=Ihr Link ist nicht mehr g&uuml;ltig. Bitte generieren Sie ein Neuen.
reject.button.label=Ablehnen
submit.button.label=Senden
tan.sent=Bitte erfassen Sie den Sicherheitscode, welcher an Ihr Mobiltelefon gesendet wurde.
title.login=Login
title.logout=Logout
title.logout.confirmation=Logout
title.logout.reminder=Logout
title.oauth.consent=Client Authorisierung
title.pwchange.label=Passwort &auml;ndern
title.pwreset=Passwort Vergesssen
title.saml.failed=Error
title.signup.passwordless=Login ohne Passwort
title.signup.passwordless.failed=Login ohne Passwort konnte nicht aktiviert werden
title.timeout.page=Logout
try_again.button.label=Erneut versuchen

101
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-auth/var/opt/nevisauth/default/conf/LitDict_en.properties Normal file
View File

@ -0,0 +1,101 @@
accept.button.label=Accept
button.submit=Submit
cancel.button.label=Cancel
continue.button.label=Continue
deputy.profile.label=(Deputy Profile)
error.policy.failed=The new password does not comply with the policy.
error.saml.failed=Please close your browser and try again.
error_1=Please check your input.
error_10=Please select the correct user account.
error_100=Certificate upload not possible. Certificate already exists. Please contact your helpdesk.
error_101=The entered email address is not valid.
error_11=Please use another certficate or login with another credential type.
error_2=Please select another login name.
error_3=Your account will be locked if next authentication fails.
error_4=Your new password does not comply with the security policy. Please choose a different password.
error_5=Error in password confirmation.
error_50=The new password is too short.
error_55=The new password has to differ from old passwords.
error_6=Password change required.
error_7=Change of login ID required.
error_8=Your account has been locked due to repeated authentication failures.
error_81=No access card found, access from internet denied.
error_83=Your access card is no longer valid. Please contact your advisor to get a new access card.
error_9=Session take over failed.
error_97=You are not authorized to access this resource.
error_98=Your account has been locked.
error_99=System problems. Please try later.
info.login=Please enter your authentication information.
info.logout.confirmation=Please confirm that you want to log out.
info.logout.reminder=Your session on this application has expired. Try again with a login.
info.oauth.consent=Do you want to authorise this application to access your data?
info.signup.passwordless=Log in quickly and securely next time using this device's fingerprint, face recognition, or PIN.
info.signup.passwordless.failed=Use the same method you already use on this device for login.
info.signup.passwordless.skip=<button name="cancel-bottom" type="submit" value="true" class="btn btn-link link-primary">Skip for now</button>
info.timeout.page=Your session on this application has expired. Try again with a login.
login.button.label=Login
logout.label=Logout
logout.text=You have successfully logged out.
method.certificate.label=Certificate
method.fido.label=Mobile Authentication
method.fido2.label=FIDO 2
method.mtan.label=mTAN Code
method.oath.label=OATH Authenticator App
method.otp.label=OTP (One-Time Password)
method.recovery.label=Recovery Codes
method.safeword.label=SafeWord
method.securid.label=SecurID
method.ticket.label=Ticket
outarg.lastLogin.never=Never
policyFailure.dictionary=&#9642; must not be taken from a dictionary.
policyFailure.history.History=&#9642; must be different from previously selected passwords.
policyFailure.regex.control=&#9642; cannot contain more than {0} control characters.
policyFailure.regex.lower=&#9642; must contain at least {0} lower case characters.
policyFailure.regex.maxCharacterRepetitions=&#9642; characters must not occur more than {0} time(s) consecutively.
policyFailure.regex.maxLength=&#9642; must be at most {0} characters long.
policyFailure.regex.minLength=&#9642; must be at least {0} characters long.
policyFailure.regex.nonAlnum=&#9642; must contain at least {0} non-alphanumeric characters.
policyFailure.regex.nonAscii=&#9642; cannot contain more than {0} non-ASCII characters.
policyFailure.regex.nonGraph=&#9642; cannot contain more than {0} non-printable characters.
policyFailure.regex.nonLetter=&#9642; must contain at least {0} non-letter characters.
policyFailure.regex.numeric=&#9642; must contain at least {0} numeric characters.
policyFailure.regex.upper=&#9642; must contain at least {0} upper case characters.
policyInfo.dictionary=&#9642; must not be taken from a dictionary.
policyInfo.history.History=&#9642; must be different from previously selected passwords.
policyInfo.regex.control=&#9642; cannot contain more than {0} control characters.
policyInfo.regex.lower=&#9642; must contain at least {0} lower case characters.
policyInfo.regex.maxCharacterRepetitions=&#9642; characters must not occur more than {0} time(s) consecutively.
policyInfo.regex.maxLength=&#9642; must be at most {0} characters long.
policyInfo.regex.minLength=&#9642; must be at least {0} characters long.
policyInfo.regex.nonAlnum=&#9642; must contain at least {0} non-alphanumeric characters.
policyInfo.regex.nonAscii=&#9642; cannot contain more than {0} non-ASCII characters.
policyInfo.regex.nonGraph=&#9642; cannot contain more than {0} non-printable characters.
policyInfo.regex.nonLetter=&#9642; must contain at least {0} non-letter characters.
policyInfo.regex.numeric=&#9642; must contain at least {0} numeric characters.
policyInfo.regex.upper=&#9642; must contain at least {0} upper case characters.
policyInfo.title=The password has to comply with the following password policy:
prompt.client=Client
prompt.newpassword=New Password
prompt.newpassword.confirm=Confirm Password
prompt.password=Password
prompt.userid=User-ID
pwreset.done.info=Your password was successfully changed. Please click on continue to log in.
pwreset.email.sent=If your user ID exists, an email to reset your password has been sent to you.
pwreset.info.linktext=Password forgotten
pwreset.noticket=Your password reset link is no longer valid. Please generate a new one.
reject.button.label=Deny
submit.button.label=Submit
tan.sent=Please enter the security code which has been sent to your mobile phone.
title.login=Login
title.logout=Logout
title.logout.confirmation=Logout
title.logout.reminder=Logout
title.oauth.consent=Client Authorization
title.pwchange.label=Password Change
title.pwreset=Password Forgotten
title.saml.failed=Error
title.signup.passwordless=Go passwordless
title.signup.passwordless.failed=Failed to turn on passwordless
title.timeout.page=Logout
try_again.button.label=Try again

101
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-auth/var/opt/nevisauth/default/conf/LitDict_fr.properties Normal file
View File

@ -0,0 +1,101 @@
accept.button.label=Accepter
button.submit=Envoyer
cancel.button.label=Abandonner
continue.button.label=Continuer
deputy.profile.label=(Profil du suppl&eacute;ant)
error.policy.failed=Votre nouveau mot de passe ne conforme pas aux mesures de s&eacute;curit&eacute;
error.saml.failed=Fermez votre navigateur et r;eacute;essayez.
error_1=Veuillez v&eacute;rifier vos donn&eacute;es, s.v.p.
error_10=Choisissez votre compte.
error_100=T&eacute;l&eacute;chargement du certificat pas possible. Certificat existe d&eacute;j&agrave;. Veuillez contacter le helpdesk s.v.p.
error_101=L&#39;adresse e-mail &eacute; n&#39;est pas valide.
error_11=Choisissez un autre certificat, s.v.p.
error_2=Choisissez un autre nom, s.v.p.
error_3=Si l&#39;authentification ne r&eacute;ussit pas au prochain essai, votre compte sera bloqu&eacute;.
error_4=Votre nouveau mot de passe ne conforme pas aux mesures de s&eacute;curit&eacute;
error_5=Votre confirmation du mot de passe ne correspond pas au mot de passe donn&eacute;.
error_50=Le nouveau mot de passe est trop court.
error_55=Le nouveau mot de passe doit diff&eacute;rer de l&#39;ancien.
error_6=Veuillez changer votre mot de passe, s.v.p.
error_7=Veuillez changer votre login ID, s.v.p.
error_8=Votre compte n&#39;est pas active.
error_81=Pas d&#39;access card trouv&eacute;, l&#39;acc&egrave;s par l&#39;internet est refus&eacute;.
error_83=Votre access card n&#39;est plus valable, veuillez contacter votre gestionnaire.
error_9=Il n&#39;est pas possible de transmettre la session.
error_97=Vous n&#39;avez pas les autorisations n&eacute;cessaires pour acc&eacute;der &agrave; cette ressource.
error_98=Votre compte a &eacute;t&eacute; bloqu&eacute;.
error_99=Probl&egrave;me technique. Veuillez essayer plus tard, s.v.p.
info.login=Veuillez entrer vos &eacute;l&eacute;ments de s&eacute;curit&eacute; ci-apr&egrave;s.
info.logout.confirmation=Veuillez confirmer que vous souhaitez vous d&eacute;connecter.
info.logout.reminder=Votre session sur cette application a expir&eacute;e. Essayez encore avec un login.
info.oauth.consent=Voulez-vous autoriser l&#39;application?
info.signup.passwordless=Connectez-vous rapidement et en toute sécurité la prochaine fois en utilisant l'empreinte digitale, la reconnaissance faciale ou le code PIN de cet appareil.
info.signup.passwordless.failed=Utilisez la même méthode que vous utilisez déjà sur cet appareil pour vous connecter.
info.signup.passwordless.skip=<button name="cancel-bottom" type="submit" value="true" class="btn btn-link link-primary">Sauter pour le moment</button>
info.timeout.page=Votre session sur cette application a expir&eacute;e. Essayez encore avec un login.
login.button.label=Login
logout.label=Logout
logout.text=Au revoir
method.certificate.label=Certificat
method.fido.label=Mobile Authentication
method.fido2.label=FIDO 2
method.mtan.label=Code mTAN
method.oath.label=Application d'authentification OATH
method.otp.label=OTP (One-Time Password)
method.recovery.label=Codes de r&eacute;cup&eacute;ration
method.safeword.label=SafeWord
method.securid.label=SecurID
method.ticket.label=Ticket
outarg.lastLogin.never=Jamais
policyFailure.dictionary=&#9642; ne peut pas &ecirc;tre pris d&#39;un dictionnaire.
policyFailure.history.History=&#9642; doit &ecirc;tre diff&eacute;rent des mots de passe pr&eacute;alablement s&eacute;lectionn&eacute;s.
policyFailure.regex.control=&#9642; ne peut contenir plus de {0} caract&egrave;res de commande.
policyFailure.regex.lower=&#9642; doit contenir au moins {0} caract&egrave;re(s) minuscule(s).
policyFailure.regex.maxCharacterRepetitions=&#9642; ne peut contenir une s&eacute;quence de plus de {0} du m&ecirc;me caract&egrave;re.
policyFailure.regex.maxLength=La longueur doit &ecirc;tre d&#39;au plus {0}.
policyFailure.regex.minLength=La longueur doit &ecirc;tre d&#39;au moins {0}.
policyFailure.regex.nonAlnum=&#9642; doit contenir au moins {0} caract&egrave;res non alphanum&eacute;riques.
policyFailure.regex.nonAscii=&#9642; ne peut contenir plus de {0} caract&egrave;res non ASCII ({1}).
policyFailure.regex.nonGraph=&#9642; ne peut contenir plus de {0} caract&egrave;res non imprimables ({1}).
policyFailure.regex.nonLetter=&#9642; doit contenir au moins {0} caract&egrave;res qui ne sont pas des lettres.
policyFailure.regex.numeric=&#9642; doit comprendre {0} caract&#232;res num&#233;riques.
policyFailure.regex.upper=&#9642; doit contenir au moins {0} caract&egrave;re(s) majuscule(s).
policyInfo.dictionary=&#9642; ne peut pas &ecirc;tre pris d&#39;un dictionnaire.
policyInfo.history.History=&#9642; ne peut pas &ecirc;tre l&#39; pr&eacute;c&eacute;demment choisis.
policyInfo.regex.control=&#9642; ne peut contenir plus de {0} caract&egrave;res de commande.
policyInfo.regex.lower=&#9642; doit contenir au moins {0} caract&egrave;re(s) minuscule(s).
policyInfo.regex.maxCharacterRepetitions=&#9642; ne peut contenir une s&eacute;quence de plus de {0} du m&ecirc;me caract&egrave;re.
policyInfo.regex.maxLength=&#9642; la longueur doit &ecirc;tre d&#39;au plus {0}.
policyInfo.regex.minLength=&#9642; la longueur doit &ecirc;tre d&#39;au moins {0}.
policyInfo.regex.nonAlnum=&#9642; doit contenir au moins {0} caract&egrave;res non alphanum&eacute;riques.
policyInfo.regex.nonAscii=&#9642; ne peut contenir plus de {0} caract&egrave;res non ASCII.
policyInfo.regex.nonGraph=&#9642; ne peut contenir plus de {0} caract&egrave;res non imprimables.
policyInfo.regex.nonLetter=&#9642; doit contenir au moins {0} caract&egrave;res qui ne sont pas des lettres.
policyInfo.regex.numeric=&#9642; doit comprendre au minimum {0} caract&#232;res num&#233;riques.
policyInfo.regex.upper=&#9642; doit contenir au moins {0} caract&egrave;re(s) majuscule(s).
policyInfo.title=Le mot de passe doit respecter les r&egrave;gles suivantes:
prompt.client=Client
prompt.newpassword=Nouveau mot de passe
prompt.newpassword.confirm=Confirmez le mot de passe
prompt.password=Mot de passe
prompt.userid=ID de l&#39;utilisateur
pwreset.done.info=Votre mot de passe a &eacute;t&eacute; chang&eacute avec succ&egrave;s. Veuillez cliquer sur continuer pour vous connecter.
pwreset.email.sent=Si votre identifiant n'existe pas, vous avez reçu un courriel pour réinitialiser votre mot de passe.
pwreset.info.linktext=Mot de passe oublié
pwreset.noticket=Votre lien n&apos;est plus valide. Veuillez en g&eacute;n&eacute;rer un nouveau.
reject.button.label=Refuser
submit.button.label=Envoyer
tan.sent=Veuillez saisir le code de s&eacute;curit&eacute; que vous avez re&ccedil;u au votre t&eacute;l&eacute;phone mobile.
title.login=Login
title.logout=Logout
title.logout.confirmation=Logout
title.logout.reminder=Logout
title.oauth.consent=Autorisation du client
title.pwchange.label=Changer mot de passe
title.pwreset=Mot de Passe Oubli&eacute;
title.saml.failed=Error
title.signup.passwordless=Aller sans mot de passe
title.signup.passwordless.failed=Impossible d'activer le sans mot de passe
title.timeout.page=Logout
try_again.button.label=Essayez à nouveau

101
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-auth/var/opt/nevisauth/default/conf/LitDict_it.properties Normal file
View File

@ -0,0 +1,101 @@
accept.button.label=Accettare
button.submit=Continua
cancel.button.label=Abortire
continue.button.label=Continua
deputy.profile.label=(profilo del delegato)
error.policy.failed=La nuova password non &egrave; stata accettata. Scegliere una password che sia conforme ai criteri di password.
error.saml.failed=Chiudi il browser e riprova.
error_1=Verificare i dati immessi.
error_10=Per favore selezionare il conto utente corretto.
error_100=Impossibile caricare il certificato. Questo certificato esiste gi&agrave;. La preghiamo di contattare il Suo help desk.
error_101=L&#39;indirizzo e-mail inserito non &egrave; valido.
error_11=Scegliere un altro certificato.
error_2=Per favore scegliere un altro nome.
error_3=Il conto verr&agrave; bloccato se il prossimo login non andr&agrave; a buon fine.
error_4=La nuova password non &egrave; stata accettata. Scegliere una password che sia conforme ai criteri di password.
error_5=La conferma della password &egrave; errata.
error_50=La nuova password &egrave; troppo corta.
error_55=La nuova password deve essere diversa dalla vecchia.
error_6=&Egrave; necessario modificare la password.
error_7=Set up inizale dell&#39;account per il portale necessario.
error_8=L&#39;account &egrave; stato bloccato. Rivolgersi al servizio assistenza oppure provare con un altro strumento di autenticazione.
error_81=Nessuna carta di accesso trovata, accesso da internet rifiutato.
error_83=La sua carta di accesso non &egrave; pi&ugrave; valida. Per favore contatti il suo assistente per ricevere una nuova carta di accesso.
error_9=La sessione non pu&ograve; essere ripresa.
error_97=Non si dispone delle autorizzazioni necessarie per accedere a questa risorsa.
error_98=L&#39;account &egrave; stato bloccato.
error_99=Errore di sistema. Riprovare.
info.login=Per favore inserisca i suoi dati di accesso.
info.logout.confirmation=Si prega di confermare che si desidera disconnettersi.
info.logout.reminder=La sessione su questa applicazione &#x26;egrave; scaduta. Prova ancora con un login.
info.oauth.consent=Vuoi consentire all&#39;applicazione?
info.signup.passwordless=Accedi in modo rapido e sicuro la prossima volta utilizzando l'impronta digitale, il riconoscimento facciale o il PIN di questo dispositivo.
info.signup.passwordless.failed=Utilizza lo stesso metodo che usi già su questo dispositivo per il login.
info.signup.passwordless.skip=<button name="cancel-bottom" type="submit" value="true" class="btn btn-link link-primary">Saltare per ora</button>
info.timeout.page=La sessione su questa applicazione &#x26;egrave; scaduta. Prova ancora con un login.
login.button.label=Login
logout.label=Logout
logout.text=&Egrave; uscito con successo.
method.certificate.label=Certificato
method.fido.label=Mobile Authentication
method.fido2.label=FIDO 2
method.mtan.label=Codice mTAN
method.oath.label=App di autenticazione OATH
method.otp.label=OTP (One-Time Password)
method.recovery.label=Codici di ripristino
method.safeword.label=SafeWord
method.securid.label=SecurID
method.ticket.label=Ticket
outarg.lastLogin.never=Mai
policyFailure.dictionary=&#9642; non pu&ograve; essere presa da un dizionario.
policyFailure.history.History=&#9642; deve essere diversa da password precedenti.
policyFailure.regex.control=&#9642; non pu&ograve; contenere pi&ugrave; di {0} caratteri di controllo.
policyFailure.regex.lower=&#9642; deve conenere almeno {0} caratteri minuscoli.
policyFailure.regex.maxCharacterRepetitions=&#9642; non pu&ograve; contentere una sequenza pi&ugrave; lunga di {0} caratteri uguali.
policyFailure.regex.maxLength=&#9642; deve contenere al massimo {0} caratteri.
policyFailure.regex.minLength=&#9642; deve contenere almeno {0} caratteri.
policyFailure.regex.nonAlnum=&#9642; deve conenere almeno {0} caratteri non alfanumerici.
policyFailure.regex.nonAscii=&#9642; non pu&ograve; contenere pi&ugrave; di {0} caratteri non ASCII.
policyFailure.regex.nonGraph=&#9642; non pu&ograve; contenere pi&ugrave; di {0} caratteri non stampabili.
policyFailure.regex.nonLetter=&#9642; non pu&ograve; contenere pi&ugrave; di {0} numeri o caratteri speciali.
policyFailure.regex.numeric=&#9642; deve contenere {0} caratteri numerici.
policyFailure.regex.upper=&#9642; deve conenere almeno {0} caratteri maiuscoli.
policyInfo.dictionary=&#9642; non pu&ograve; essere presa da un dizionario.
policyInfo.history.History=&#9642; deve essere diversa dalle password precedenti.
policyInfo.regex.control=&#9642; non pu&ograve; contenere pi&ugrave; di {0} carattere/i di controllo.
policyInfo.regex.lower=&#9642; deve conenere almeno {0} carattere/i minuscolo/i.
policyInfo.regex.maxCharacterRepetitions=&#9642; non pu&ograve; contentere una sequenza pi&ugrave; lunga di {0} caratteri uguali.
policyInfo.regex.maxLength=&#9642; deve contenere al massimo {0} carattere/i.
policyInfo.regex.minLength=&#9642; deve contenere almeno {0} carattere/i.
policyInfo.regex.nonAlnum=&#9642; deve conenere almeno {0} carattere/i non alfanumerico/i.
policyInfo.regex.nonAscii=&#9642; non pu&ograve; contenere pi&ugrave; di {0} carattere/i non ASCII.
policyInfo.regex.nonGraph=&#9642; non pu&ograve; contenere pi&ugrave; di {0} carattere/i non stampabile/i.
policyInfo.regex.nonLetter=&#9642; non pu&ograve; contenere pi&ugrave; di {0} numero/i o caratere/i speciale/i.
policyInfo.regex.numeric=&#9642; deve contenere un minimo di {0} carattere/i numerico/i.
policyInfo.regex.upper=&#9642; deve conenere almeno {0} carattere/i maiuscolo/i.
policyInfo.title=La password deve rispettare le seguenti direttive:
prompt.client=Mandator
prompt.newpassword=Nuova Password
prompt.newpassword.confirm=Conferma password
prompt.password=Password
prompt.userid=Nome utente
pwreset.done.info=La password &egrave; stata modificata con successo. Fare clic su continua per accedere.
pwreset.email.sent=Se il vostro ID utente esiste, vi è stata inviata un'e-mail per reimpostare la password.
pwreset.info.linktext=Password dimenticata
pwreset.noticket=Il biglietto per la reimpostazione della password non &egrave; pi&ugrave; valido. Si prega di generarne uno nuovo.
reject.button.label=Rifiuti
submit.button.label=Continua
tan.sent=Inserisci il codice di sicurezza che &egrave; stato inviato al tuo telefono cellulare.
title.login=Login
title.logout=Logout
title.logout.confirmation=Logout
title.logout.reminder=Logout
title.oauth.consent=Autorizzazione del client
title.pwchange.label=Cambiare Password
title.pwreset=Password Dimenticata
title.saml.failed=Error
title.signup.passwordless=Vai senza password
title.signup.passwordless.failed=Impossibile attivare senza password
title.timeout.page=Logout
try_again.button.label=Riprova

1
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-auth/var/opt/nevisauth/default/conf/bc.properties Normal file
View File

@ -0,0 +1 @@
bc.tracer.TraceIndentFactory=ch.nevis.bc.io.Log4jTraceIndentFactory

19
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-auth/var/opt/nevisauth/default/conf/env.conf Normal file
View File

@ -0,0 +1,19 @@
RTENV_SECURITY_CHECK=no_shell
JAVA_OPTS=(
"-XX:+UseContainerSupport"
"-Dfile.encoding=UTF-8"
"-XX:MaxRAMPercentage=80.0"
"-Djava.net.preferIPv4Stack=true"
"-Djava.net.connectionTimeout=10000"
"-Djava.net.readTimeout=15000"
"-Dch.nevis.esauth.config=/var/opt/nevisauth/default/conf/esauth4.xml"
"-Djava.awt.headless=true"
"-javaagent:/opt/agent/opentelemetry-javaagent.jar"
"-Dotel.javaagent.logging=application"
"-Dotel.javaagent.configuration-file=/var/opt/nevisauth/default/conf/otel.properties"
"-Dotel.resource.attributes=service.version=8.2405.0,service.instance.id=$HOSTNAME"
"-Djavax.net.ssl.trustStore=/var/opt/keys/trust/ob-auth-agov-work-internal-trust-store/truststore.p12"
"-Djavax.net.ssl.trustStorePassword=\${exec:/var/opt/keys/trust/ob-auth-agov-work-internal-trust-store/keypass}"
)

2
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-auth/var/opt/nevisauth/default/conf/esauth4.security Normal file
View File

@ -0,0 +1,2 @@
# this file is generated by nevisAdmin 4
security.provider.10=org.bouncycastle.jce.provider.BouncyCastleProvider

309
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-auth/var/opt/nevisauth/default/conf/esauth4.xml Normal file
View File

@ -0,0 +1,309 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE esauth-server SYSTEM "/opt/nevisauth/dtd/esauth4.dtd">
<esauth-server instance="ob-auth">
<!-- source: pattern://6e7b5a087711bd0ada9985fe, pattern://d00b0dcbe241793d30daf91c -->
<SessionCoordinator sessionInitialInactivityTimeout="600" sessionInactivityTimeout="28800" sessionMaxLifetime="28800" sessionIdPreGenerate="true">
<!-- source: pattern://d00b0dcbe241793d30daf91c -->
<LocalSessionStore maxSessions="100000"/>
<!-- source: pattern://d00b0dcbe241793d30daf91c -->
<TokenAssembler name="DefaultTokenAssembler">
<Selector default="true"/>
<!-- source: pattern://6e7b5a087711bd0ada9985fe -->
<TokenSpec ttl="28800">
<!-- source: pattern://d00b0dcbe241793d30daf91c -->
<field src="session" key="ch.nevis.session.sessid" as="sessid"/>
<!-- source: pattern://d00b0dcbe241793d30daf91c -->
<field src="session" key="ch.nevis.session.userid" as="userid"/>
<!-- source: pattern://d00b0dcbe241793d30daf91c -->
<field src="session" key="ch.nevis.session.authlevel" as="authLevel"/>
<!-- source: pattern://d00b0dcbe241793d30daf91c -->
<field src="session" key="ch.nevis.session.esauthid" as="esauthid"/>
<!-- source: pattern://d00b0dcbe241793d30daf91c -->
<field src="session" key="ch.nevis.session.entryid" as="entryid"/>
<!-- source: pattern://d00b0dcbe241793d30daf91c -->
<field src="session" key="ch.nevis.session.loginid" as="loginId"/>
<!-- source: pattern://d00b0dcbe241793d30daf91c -->
<field src="session" key="ch.nevis.session.domain" as="domain"/>
<!-- source: pattern://d00b0dcbe241793d30daf91c -->
<field src="session" key="ch.nevis.session.secroles" as="roles"/>
</TokenSpec>
<!-- source: pattern://d00b0dcbe241793d30daf91c -->
<Signer key="DefaultSigner"/>
</TokenAssembler>
<!-- source: pattern://d00b0dcbe241793d30daf91c -->
<KeyStore name="DefaultKeyStore">
<!-- source: pattern://d00b0dcbe241793d30daf91c -->
<KeyObject name="DefaultSigner" certificate="/var/opt/keys/own/ob-auth-signer/cert.pem" privateKey="/var/opt/keys/own/ob-auth-signer/keystore.jks" passPhrase="pipe:///var/opt/keys/own/ob-auth-signer/keypass"/>
</KeyStore>
</SessionCoordinator>
<!-- source: pattern://d00b0dcbe241793d30daf91c -->
<LocalOutOfContextDataStore reaperPeriod="60"/>
<!-- source: pattern://6e7b5a087711bd0ada9985fe, pattern://d00b0dcbe241793d30daf91c, pattern://e1784eecf2db74484dd1e1bb, pattern://d00b0dcbe241793d30daf91c -->
<AuthEngine useLiteralDictionary="true" literalDictionaryLanguages="en,de,fr,it" inputLanguageCookie="LANG" compatLevel="none" addAutheLevelToSecRoles="true" classPath="/opt/nevisidmcl/nevisauth/lib:/opt/nevisauth/plugin" propagateSession="false">
<!-- source: pattern://6e7b5a087711bd0ada9985fe -->
<Domain name="ob-realm" default="false" inactiveInterval="7200" reauthInterval="0" resetAuthenticationCondition="${inargs:cancel}">
<Entry method="authenticate" state="ob-realm_ob-realm-idm-pwd-login"/>
<Entry method="stepup" state="ob-realm_Selector"/>
</Domain>
<AuthState name="ob-realm_ob-realm-idm-pwd-login" class="ch.nevis.idm.authstate.IdmPasswordVerifyState" final="false">
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<ResultCond name="clientNotFound" next="ob-realm_ob-realm-idm-pwd-login"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<ResultCond name="disabled" next="ob-realm_ob-realm-idm-pwd-login"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<ResultCond name="failed" next="ob-realm_ob-realm-idm-pwd-login"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<ResultCond name="lockWarn" next="ob-realm_ob-realm-idm-pwd-login"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<ResultCond name="locked" next="ob-realm_ob-realm-idm-pwd-login"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<ResultCond name="nowLocked" next="ob-realm_ob-realm-idm-pwd-login"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<ResultCond name="ok" next="ob-realm_ob-realm-idm-pwd-login-IdmPostProcessing" authLevel="1"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<ResultCond name="pwChange" next="ob-realm_ob-realm-idm-pwd-login-IdmPasswordChange"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<ResultCond name="tmpLocked" next="ob-realm_ob-realm-idm-pwd-login"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<Response value="AUTH_CONTINUE">
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<Gui name="AuthUidPwDialog" label="title.login">
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<GuiElem name="lasterror" type="error" label="${notes:lasterrorinfo}" value="${notes:lasterror}"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<GuiElem name="info" type="info" label="info.login"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<GuiElem name="isiwebuserid" type="text" label="prompt.userid" value="${notes.loginid}"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<GuiElem name="isiwebpasswd" type="pw-text" label="prompt.password"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<GuiElem name="submit" type="button" label="continue.button.label"/>
</Gui>
</Response>
<propertyRef name="nevisIDM_Connector"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<property name="user.loginType" value="EMAIL"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<property name="client.name" value="Default"/>
</AuthState>
<AuthState name="ob-realm_ob-realm-idm-pwd-login-IdmPostProcessing" class="ch.nevis.idm.authstate.IdmGetPropertiesState" final="false">
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<ResultCond name="SOAP:showGui" next="ob-realm_ob-realm-fido2-registration"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<ResultCond name="default" next="ob-realm_ob-realm-fido2-registration"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<ResultCond name="ok" next="ob-realm_ob-realm-fido2-registration" startOver="true"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<ResultCond name="showGui" next="ob-realm_ob-realm-idm-pwd-login-IdmPostProcessing"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<Response value="AUTH_CONTINUE">
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<Gui name="AuthProfileSelectionDialog">
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<GuiElem name="lasterror" type="error" label="${notes:lasterrorinfo}" value="${notes:lasterror}"/>
</Gui>
</Response>
<propertyRef name="nevisIDM_Connector"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<property name="chooseDefaultProfile" value="true"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<property name="user.attributes" value="mobile, email, extId"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<property name="detaillevel.default" value="EXCLUDE"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<property name="detaillevel.user" value="MEDIUM"/>
</AuthState>
<AuthState name="ob-realm_ob-realm-idm-pwd-login-IdmPasswordChange" class="ch.nevis.idm.authstate.IdmChangePasswordState" final="false">
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<ResultCond name="default" next="ob-realm_ob-realm-idm-pwd-login-IdmPasswordChange"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<ResultCond name="ok" next="ob-realm_ob-realm-idm-pwd-login-IdmPostProcessing" authLevel="1"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<ResultCond name="policyFailure" next="ob-realm_ob-realm-idm-pwd-login-IdmPasswordChange"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<Response value="AUTH_CONTINUE">
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<Gui name="AuthUidPwDialog" label="title.pwchange.label">
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<GuiElem name="lasterror" type="error" label="${notes:lasterrorinfo}" value="${notes:lasterror}"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<GuiElem name="policyFailure.allowLoginIdPasswordViolated" type="error" label="${notes.policyFailure.allowLoginIdPasswordViolated}"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<GuiElem name="policyFailure.regex.minLength" type="error" label="${notes.policyFailure.regex.minLength}"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<GuiElem name="policyFailure.regex.maxLength" type="error" label="${notes.policyFailure.regex.maxLength}"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<GuiElem name="policyFailure.regex.upper" type="error" label="${notes.policyFailure.regex.upper}"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<GuiElem name="policyFailure.regex.lower" type="error" label="${notes.policyFailure.regex.lower}"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<GuiElem name="policyFailure.regex.numeric" type="error" label="${notes.policyFailure.regex.numeric}"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<GuiElem name="policyFailure.regex.nonLetter" type="error" label="${notes.policyFailure.regex.nonLetter}"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<GuiElem name="policyFailure.regex.nonAlnum" type="error" label="${notes.policyFailure.regex.nonAlnum}"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<GuiElem name="policyFailure.regex.control" type="error" label="${notes.policyFailure.regex.control}"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<GuiElem name="policyFailure.regex.nonGraph" type="error" label="${notes.policyFailure.regex.nonGraph}"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<GuiElem name="policyFailure.regex.nonAscii" type="error" label="${notes.policyFailure.regex.nonAscii}"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<GuiElem name="policyFailure.dictionary" type="error" label="${notes.policyFailure.dictionary}"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<GuiElem name="policyFailure.history.History" type="error" label="${notes.policyFailure.history.History}"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<GuiElem name="policyFailure.regex.maxCharacterRepetitions" type="error" label="${notes.policyFailure.regex.maxCharacterRepetitions}"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<GuiElem name="policyInfo.title" type="info" label="#{!notes.containsKey('lasterror') || notes.lasterror != '4' ? 'policyInfo.title' : ''}"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<GuiElem name="policyInfo.regex.minLength" type="info" label="${notes.policyInfo.regex.minLength}"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<GuiElem name="policyInfo.regex.maxLength" type="info" label="${notes.policyInfo.regex.maxLength}"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<GuiElem name="policyInfo.regex.upper" type="info" label="#{notes['policyInfo.regex.upper'].contains('upper[0]') ? '' : notes['policyInfo.regex.upper']}"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<GuiElem name="policyInfo.regex.lower" type="info" label="#{notes['policyInfo.regex.lower'].contains('lower[0]') ? '' : notes['policyInfo.regex.lower']}"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<GuiElem name="policyInfo.regex.numeric" type="info" label="#{notes['policyInfo.regex.numeric'].contains('numeric[0]') ? '' : notes['policyInfo.regex.numeric']}"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<GuiElem name="policyInfo.regex.nonLetter" type="info" label="#{notes['policyInfo.regex.nonLetter'].contains('nonLetter[0]') ? '' : notes['policyInfo.regex.nonLetter']}"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<GuiElem name="policyInfo.regex.nonAlnum" type="info" label="#{notes['policyInfo.regex.nonAlnum'].contains('nonAlnum[0]') ? '' : notes['policyInfo.regex.nonAlnum']}"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<GuiElem name="policyInfo.regex.control" type="info" label="#{notes['policyInfo.regex.control'].contains('control[0]') ? '' : notes['policyInfo.regex.control']}"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<GuiElem name="policyInfo.regex.nonGraph" type="info" label="#{notes['policyInfo.regex.nonGraph'].contains('nonGraph[0]') ? '' : notes['policyInfo.regex.nonGraph']}"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<GuiElem name="policyInfo.regex.nonAscii" type="info" label="#{notes['policyInfo.regex.nonAscii'].contains('nonAscii[0]') ? '' : notes['policyInfo.regex.nonAscii']}"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<GuiElem name="policyInfo.dictionary" type="info" label="${notes.policyInfo.dictionary}"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<GuiElem name="policyInfo.history.History" type="info" label="${notes.policyInfo.history.History}"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<GuiElem name="policyInfo.regex.maxCharacterRepetitions" type="info" label="${notes.policyInfo.regex.maxCharacterRepetitions}"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<GuiElem name="isiwebpasswd" type="pw-text" label="prompt.password"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<GuiElem name="isiwebnewpw1" type="pw-text" label="prompt.newpassword"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<GuiElem name="isiwebnewpw2" type="pw-text" label="prompt.newpassword.confirm"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<GuiElem name="submit" type="submit" label="button.submit"/>
</Gui>
</Response>
<propertyRef name="nevisIDM_Connector"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<property name="legacyLitDictMode" value="false"/>
</AuthState>
<AuthState name="nevisIDM_Connector" class="ch.nevis.esauth.auth.states.standard.AuthGeneric" final="false">
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<property name="login.service.connection.0" value="https://idm.adn-agov-nevisidm-01-uat:443/nevisidm/services/v1/LoginService"/>
<!-- source: pattern://e1784eecf2db74484dd1e1bb -->
<property name="admin.service.connection.0" value="https://idm.adn-agov-nevisidm-01-uat:443/nevisidm/services/v1/AdminService"/>
</AuthState>
<AuthState name="ob-realm_ob-realm-fido2-registration" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false">
<!-- source: pattern://3d382e0cf987535b6fa989b4 -->
<ResultCond name="cancel" next="ob-realm_ob-realm-idm-pwd-login"/>
<!-- source: pattern://3d382e0cf987535b6fa989b4 -->
<ResultCond name="failed" next="ob-realm_ob-realm-fido2-registration_Failed"/>
<!-- source: pattern://3d382e0cf987535b6fa989b4 -->
<ResultCond name="ok" next="ob-realm_Prepare_Done"/>
<!-- source: pattern://3d382e0cf987535b6fa989b4 -->
<ResultCond name="unsupported" next="ob-realm_ob-realm-idm-pwd-login"/>
<!-- source: pattern://3d382e0cf987535b6fa989b4 -->
<Response value="AUTH_CONTINUE">
<!-- source: pattern://3d382e0cf987535b6fa989b4 -->
<Gui name="fido2_onboard" label="title.signup.passwordless">
<!-- source: pattern://3d382e0cf987535b6fa989b4 -->
<GuiElem name="passwordless-icon" type="hidden" optional="true"/>
<!-- source: pattern://3d382e0cf987535b6fa989b4 -->
<GuiElem name="info-sub-icon" type="info" label="info.signup.passwordless"/>
<!-- source: pattern://3d382e0cf987535b6fa989b4 -->
<GuiElem name="logoName" type="hidden" label="${sess:ch.nevis.idc.logoName}" optional="true"/>
<!-- source: pattern://3d382e0cf987535b6fa989b4 -->
<GuiElem name="brand" type="hidden" label="${sess:ch.nevis.idc.brand}" optional="true"/>
<!-- source: pattern://3d382e0cf987535b6fa989b4 -->
<GuiElem name="primaryColor" type="hidden" label="${sess:ch.nevis.idc.config.branding.primaryColor}" optional="true"/>
<!-- source: pattern://3d382e0cf987535b6fa989b4 -->
<GuiElem name="borderRadius" type="hidden" label="${sess:ch.nevis.idc.config.branding.borderRadius}" optional="true"/>
<!-- source: pattern://3d382e0cf987535b6fa989b4 -->
<GuiElem name="fontFamily" type="hidden" label="${sess:ch.nevis.idc.config.branding.fontFamily}" optional="true"/>
<!-- source: pattern://3d382e0cf987535b6fa989b4 -->
<GuiElem name="onclick" type="button" label="continue.button.label"/>
<!-- source: pattern://3d382e0cf987535b6fa989b4 -->
<GuiElem name="cancel-bottom" type="info" label="info.signup.passwordless.skip"/>
</Gui>
</Response>
<!-- source: pattern://3d382e0cf987535b6fa989b4 -->
<property name="parameter.attestation" value="direct"/>
<!-- source: pattern://3d382e0cf987535b6fa989b4 -->
<property name="parameter.fido" value="ob-fido2:9443"/>
<!-- source: pattern://3d382e0cf987535b6fa989b4 -->
<property name="parameter.residentKey" value="required"/>
<!-- source: pattern://3d382e0cf987535b6fa989b4 -->
<property name="parameter.requireResidentKey" value="true"/>
<!-- source: pattern://3d382e0cf987535b6fa989b4 -->
<property name="parameter.userVerification" value="required"/>
<!-- source: pattern://3d382e0cf987535b6fa989b4 -->
<property name="script" value="file:///var/opt/nevisauth/default/conf/ob-realm-fido2-registration.groovy"/>
</AuthState>
<AuthState name="ob-realm_ob-realm-fido2-registration_Failed" class="ch.nevis.esauth.auth.states.standard.AuthGeneric" final="true">
<!-- source: pattern://3d382e0cf987535b6fa989b4 -->
<ResultCond name="default:${inargs:cancel-bottom:^.+$:true}" next="ob-realm_ob-realm-idm-pwd-login"/>
<!-- source: pattern://3d382e0cf987535b6fa989b4 -->
<ResultCond name="default:${inargs:o.path.v:^.+$:true}" next="ob-realm_ob-realm-fido2-registration"/>
<!-- source: pattern://3d382e0cf987535b6fa989b4 -->
<Response value="AUTH_CONTINUE">
<!-- source: pattern://3d382e0cf987535b6fa989b4 -->
<Gui name="fido2_onboard" label="title.signup.passwordless.failed">
<!-- source: pattern://3d382e0cf987535b6fa989b4 -->
<GuiElem name="info-icon" type="hidden" optional="true"/>
<!-- source: pattern://3d382e0cf987535b6fa989b4 -->
<GuiElem name="info-sub-icon" type="info" label="info.signup.passwordless.failed"/>
<!-- source: pattern://3d382e0cf987535b6fa989b4 -->
<GuiElem name="onclick" type="button" label="try_again.button.label"/>
<!-- source: pattern://3d382e0cf987535b6fa989b4 -->
<GuiElem name="logoName" type="hidden" label="${sess:ch.nevis.idc.logoName}" optional="true"/>
<!-- source: pattern://3d382e0cf987535b6fa989b4 -->
<GuiElem name="brand" type="hidden" label="${sess:ch.nevis.idc.brand}" optional="true"/>
<!-- source: pattern://3d382e0cf987535b6fa989b4 -->
<GuiElem name="primaryColor" type="hidden" label="${sess:ch.nevis.idc.config.branding.primaryColor}" optional="true"/>
<!-- source: pattern://3d382e0cf987535b6fa989b4 -->
<GuiElem name="borderRadius" type="hidden" label="${sess:ch.nevis.idc.config.branding.borderRadius}" optional="true"/>
<!-- source: pattern://3d382e0cf987535b6fa989b4 -->
<GuiElem name="fontFamily" type="hidden" label="${sess:ch.nevis.idc.config.branding.fontFamily}" optional="true"/>
<!-- source: pattern://3d382e0cf987535b6fa989b4 -->
<GuiElem name="cancel-bottom" type="info" label="info.signup.passwordless.skip"/>
</Gui>
</Response>
</AuthState>
<AuthState name="ob-realm_Prepare_Done" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false">
<!-- source: pattern://6e7b5a087711bd0ada9985fe -->
<ResultCond name="default" next="ob-realm_Auth_Done"/>
<!-- source: pattern://6e7b5a087711bd0ada9985fe -->
<Response value="AUTH_DONE">
<!-- source: pattern://6e7b5a087711bd0ada9985fe -->
<Gui name="ContinueResponse"/>
</Response>
<!-- source: pattern://6e7b5a087711bd0ada9985fe -->
<property name="script" value="file:///var/opt/nevisauth/default/conf/prepare_done.groovy"/>
</AuthState>
<AuthState name="ob-realm_Auth_Done" class="ch.nevis.esauth.auth.states.standard.AuthDone" final="false">
<!-- source: pattern://6e7b5a087711bd0ada9985fe -->
<Response value="AUTH_DONE">
<!-- source: pattern://6e7b5a087711bd0ada9985fe -->
<Gui name="ContinueResponse"/>
</Response>
</AuthState>
<AuthState name="ob-realm_Selector" class="ch.nevis.esauth.auth.states.standard.ConditionalDispatcherState" final="false">
<!-- source: pattern://6e7b5a087711bd0ada9985fe -->
<ResultCond name="nomatch" next="ob-realm_Prepare_Done"/>
<!-- source: pattern://6e7b5a087711bd0ada9985fe -->
<Response value="AUTH_ERROR">
<!-- source: pattern://6e7b5a087711bd0ada9985fe -->
<Arg name="ch.nevis.isiweb4.response.status" value="403"/>
</Response>
</AuthState>
</AuthEngine>
</esauth-server>

27
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-auth/var/opt/nevisauth/default/conf/logging.yml Normal file
View File

@ -0,0 +1,27 @@
Configuration:
monitorInterval: 60
Appenders:
Console:
- name: "SERVER"
target: "SYSTEM_OUT"
PatternLayout:
pattern: "[esauth4sv.log] %d{ISO8601} %-15.15t %mdc{trace_id} %mdc{span_id} %-20.20c %-5.5p %m%n"
RegexFilter:
regex: ".*GET /nevisauth/liveness.*"
onMatch: "DENY"
onMismatch: "ACCEPT"
Loggers:
Logger:
- name: "EsAuthStart"
level: "INFO"
- name: "org.apache.catalina.loader.WebappClassLoader"
level: "FATAL"
- name: "org.apache.catalina.startup.HostConfig"
level: "ERROR"
- name: "ch.nevis.esauth.events"
level: "FATAL"
Root:
level: "WARN"
additivity: "false"
AppenderRef:
- ref: "SERVER"

16
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-auth/var/opt/nevisauth/default/conf/nevisauth.yml Normal file
View File

@ -0,0 +1,16 @@
server:
name: "default"
protocol: "https"
port: "8991"
host: "0.0.0.0"
tls:
keystore: "/var/opt/keys/own/ob-auth-default-identity/keystore.p12"
keystore-passphrase: "${exec:/var/opt/keys/own/ob-auth-default-identity/keypass}"
client-auth: "required"
truststore: "/var/opt/keys/trust/ob-auth-default-tls-client-trust/truststore.p12"
truststore-passphrase: "${exec:/var/opt/keys/trust/ob-auth-default-tls-client-trust/keypass}"
management:
server:
port: "9000"
healthchecks:
enabled: "true"

156
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-auth/var/opt/nevisauth/default/conf/ob-realm-fido2-registration.groovy Normal file
View File

@ -0,0 +1,156 @@
import groovy.json.JsonBuilder
import groovy.json.JsonGenerator
import groovy.json.JsonSlurper
// we cannot use the name cancel and the -bottom is required in ID Cloud for rendering
if (inargs.containsKey('cancel-bottom')) {
response.setResult('cancel')
return
}
if (inargs.containsKey('failed')) {
response.setResult('failed')
return
}
def getUserFriendlyName(String userAgent) {
if (userAgent == null) {
return null
}
def sb = new StringBuilder()
// Check for browser
def browser = null
if (userAgent.contains('Chrome')) {
browser = 'Chrome'
}
else if (userAgent.contains('Firefox')) {
browser = 'Firefox'
}
else if (userAgent.contains('Safari')) {
browser = 'Safari'
}
else {
browser = 'Unknown browser'
}
// Check for operating system
def os = null
if (userAgent.contains('Windows')) {
os = 'Windows'
}
else if (userAgent.contains('Linux')) {
os = 'Linux'
}
else if (userAgent.contains('iOS')) {
os = 'iOS'
}
// Build the string
if (browser != null) {
sb.append(browser)
}
if (os != null) {
if (sb.length() > 0) {
sb.append(' on ')
}
sb.append(os)
}
return sb.toString()
}
def getPath() {
if (inargs.containsKey('path')) { // form POST
return inargs['path']
}
if (inargs.containsKey('o.path.v')) { // AJAX POST
return inargs['o.path.v']
}
return null
}
def post(requestBuilder, json) {
def body = json.toString()
LOG.info("==> Request: ${body}")
def entity = Http.entity().content(body).build()
def fidoRequest = requestBuilder.entity(entity).build()
def httpClient = HttpClients.create()
return fidoRequest.send(httpClient)
}
def path = getPath()
if (path == null) {
// POST from JavaScript not received
return // the AuthEngine will trigger default and thus the GUI will be rendered
}
String usernameVal = session['ch.adnovum.nevisidm.user.extId'] ?: session['ch.nevis.idm.User.extId'] ?: request.getUserId() ?: notes['userid']
if (usernameVal == null) {
LOG.error("missing username. check your authentication flow.")
}
Objects.requireNonNull(usernameVal) // fatal integration error
String displayNameVal = session['ch.nevis.idm.User.email'] ?: session['ch.nevis.session.loginid'] ?: request.getLoginId()
if (displayNameVal == null) {
LOG.error("missing displayName. check your authentication flow.")
}
Objects.requireNonNull(displayNameVal) // fatal integration error
def baseUrl = "https://" + parameters.get('fido')
def requestBuilder = Http.post().url(baseUrl + path)
.header('Accept', 'application/json')
.header('Content-Type', 'application/json;charset=utf-8')
def generator = new JsonGenerator.Options().excludeNulls().build()
def json = new JsonBuilder(generator)
if (path == '/nevisfido/fido2/attestation/options') {
def name = session['ch.nevis.idm.User.email'] ?: session['ch.nevis.session.loginid'] ?: request.getLoginId()
json {
"username" usernameVal
"displayName" displayNameVal
"authenticatorSelection" {
"authenticatorAttachment" parameters.get('authenticatorAttachment')
"requireResidentKey" parameters.get('requireResidentKey')
"residentKey" parameters.get('residentKey')
"userVerification" parameters.get('userVerification')
}
"attestation" parameters.get('attestation')
}
def fidoResponse = post(requestBuilder, json)
def responseCode = fidoResponse.code()
def responseText = fidoResponse.bodyAsString()
LOG.info("<== Response: ${responseCode} : ${responseText}")
response.setContent(responseText) // return response from nevisFIDO "as-is"
response.setContentType('application/json')
response.setHttpStatusCode(200)
response.setIsDirectResponse(true)
return
}
def userAgentVal = request.getHttpHeader('User-Agent')
def userFriendlyNameVal = getUserFriendlyName(userAgentVal)
if (path == '/nevisfido/fido2/attestation/result') {
json {
"id" inargs['id']
"type" inargs['type']
response {
"clientDataJSON" inargs['response.clientDataJSON']
"attestationObject" inargs['response.attestationObject']
}
"userFriendlyName" userFriendlyNameVal
"userAgent" userAgentVal
}
def fidoResponse = post(requestBuilder, json)
def responseCode = fidoResponse.code()
def responseText = fidoResponse.bodyAsString()
LOG.info("<== Response: ${responseCode} : ${responseText}")
if (responseCode == 200 && new JsonSlurper().parseText(responseText).status == 'ok') {
response.setResult('ok')
return
}
}
response.setError(1, "FIDO2 onboarding failed")

4
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-auth/var/opt/nevisauth/default/conf/otel.properties Normal file
View File

@ -0,0 +1,4 @@
otel.service.name = ob-auth
otel.traces.exporter = none
otel.metrics.exporter = none
otel.logs.exporter = none

23
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-auth/var/opt/nevisauth/default/conf/prepare_done.groovy Normal file
View File

@ -0,0 +1,23 @@
// nevisProxy replaces the entire AUTH: scope when new outargs are returned by nevisAuth.
// Thus, we have to store tokens in the session (as a String) and restore them on subsequent step-ups.
// restore tokens
session.each { key, value ->
if (key.startsWith('outarg.token.')) {
def name = key.substring(7)
if (outargs.containsKey(name)) {
LOG.debug("not restoring token (outarg: $name) from session: outarg already set")
}
else {
LOG.debug("restoring token (outarg: $name) from session")
outargs.put(name, value)
}
}
}
// store tokens
outargs.each { name, value ->
if (name.startsWith('token.')) {
session.put('outarg.' + name, value)
}
}

0
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-auth/var/opt/nevisauth/default/log/.empty Normal file
View File

0
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-auth/var/opt/nevisauth/default/plugin/.empty Normal file
View File

0
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-auth/var/opt/nevisauth/default/run/.empty Normal file
View File

79
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-auth/var/opt/nevisauth/default/status.sh Executable file
View File

@ -0,0 +1,79 @@
#!/bin/bash
#
# NAME
# status.sh - Checks the status of the nevisAuth instance.
#
# SYNOPSIS
# status.sh
#
# DESCRIPTION
# Performs periodic checks until the instance is up or broken or timeout is reached.
# The script terminates when the process of the instance stops running.
# There are no arguments for this script.
#
# EXIT CODES
# 0 Instance is up.
# 1 Instance process is not running.
# 2 Instance is broken.
# 3 Timeout reached.
# Defines how much we should sleep between checking if the instance is up.
interval=1
# Defines how much we should wait the instance to start up until we give up and exit.
timeout=70
((end_time=${SECONDS}+$timeout))
# Checks if the process of the instance is still running.
# Arguments:
# None
# Returns:
# In case it is running, returns 0, otherwise non-zero (exit code of systemctl).
isProcessRunning() {
systemctl is-active --quiet nevisauth@default
IS_RUNNING=$?
return $IS_RUNNING
}
# Checks if the instance is up. (Attempts connecting to the instance)
# Arguments:
# None
# Returns:
# If the connection was successful and the instance up (is not broken), returns 0.
# If the connection was not successful, returns 1.
checkInstance() {
lsof -i :8991 -sTCP:LISTEN
EXIT_CODE=$?
return $EXIT_CODE
}
# This function encapsulates the logic of checking if the process is running and if the instance is up.
# In case the process is not running, exits with exit code 1.
# Arguments:
# None
# Returns:
# If the instance process is running, returns the result of the instance check function.
check() {
if isProcessRunning
then
checkInstance
CS=$?
return $CS
else
echo "Process is not running."
exit 1
fi
}
# Check the status of the instance periodically.
while ((${SECONDS} < ${end_time}))
do
sleep ${interval}
if check
then
echo "Instance is up."
exit 0
fi
done
echo "Exceeded check timeout (70s). Instance is down."
exit 3

0
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-auth/var/opt/nevisauth/default/tmp/.empty Normal file
View File

62
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido2/etc/nevis/k8s-ob-fido2-a2d03bb46b87b90160dc83d7.yaml Normal file
View File

@ -0,0 +1,62 @@
apiVersion: "operator.nevis-security.ch/v1"
kind: "NevisComponent"
metadata:
name: "ob-fido2"
namespace: "adn-agov-nevisidm-ob-01-uat"
labels:
deploymentTarget: "ob-fido2"
annotations:
projectKey: "DEFAULT-ADN-AGOV-WORK-OB-PROJECT"
patternId: "a2d03bb46b87b90160dc83d7"
spec:
type: "NevisFIDO"
replicas: 1
version: "8.2405.0"
gitInitVersion: "1.3.0"
runAsNonRoot: true
ports:
management: 9089
https: 9443
resources:
limits:
cpu: "1000m"
memory: "1000Mi"
requests:
cpu: "100m"
memory: "700Mi"
livenessProbe:
management:
httpGet:
path: "/nevisfido/liveness"
periodSeconds: 5
timeoutSeconds: 6
readinessProbe:
management:
httpGet:
path: "/nevisfido/health"
periodSeconds: 5
timeoutSeconds: 6
startupProbe:
management:
httpGet:
path: "/nevisfido/health"
periodSeconds: 5
timeoutSeconds: 6
failureThreshold: 50
podDisruptionBudget:
maxUnavailable: "50%"
git:
tag: "r-0d14bc8d1f507b55c11ab2b807d691b97d55b1dd"
dir: "DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido2"
credentials: "git-credentials"
keystores:
- "ob-fido2-default-identity"
- "ob-fido2-default-client-identity"
truststores:
- "ob-fido2-default-signer-trust"
- "ob-fido2-default-server-trust"
- "ob-fido2-default-tls-client-trust"
podSecurity:
policy: "baseline"
automountServiceAccountToken: false
timeZone: "Europe/Zurich"

18
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido2/etc/nevis/k8s-ob-fido2-default-client-identity-a2d03bb46b87b90160dc83d7.yaml Normal file
View File

@ -0,0 +1,18 @@
apiVersion: "operator.nevis-security.ch/v1"
kind: "NevisKeyStore"
metadata:
name: "ob-fido2-default-client-identity"
namespace: "adn-agov-nevisidm-ob-01-uat"
labels:
deploymentTarget: "ob-fido2"
annotations:
projectKey: "DEFAULT-ADN-AGOV-WORK-OB-PROJECT"
patternId: "a2d03bb46b87b90160dc83d7"
spec:
cn: "ob-fido2"
usage: "<reserved for future use>"
san:
dns:
- "ob-fido2"
- "ob-fido2.adn-agov-nevisidm-ob-01-uat"
email: []

18
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido2/etc/nevis/k8s-ob-fido2-default-identity-a2d03bb46b87b90160dc83d7.yaml Normal file
View File

@ -0,0 +1,18 @@
apiVersion: "operator.nevis-security.ch/v1"
kind: "NevisKeyStore"
metadata:
name: "ob-fido2-default-identity"
namespace: "adn-agov-nevisidm-ob-01-uat"
labels:
deploymentTarget: "ob-fido2"
annotations:
projectKey: "DEFAULT-ADN-AGOV-WORK-OB-PROJECT"
patternId: "a2d03bb46b87b90160dc83d7"
spec:
cn: "ob-fido2"
usage: "<reserved for future use>"
san:
dns:
- "ob-fido2"
- "ob-fido2.adn-agov-nevisidm-ob-01-uat"
email: []

12
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido2/etc/nevis/k8s-ob-fido2-default-server-trust-a2d03bb46b87b90160dc83d7.yaml Normal file
View File

@ -0,0 +1,12 @@
apiVersion: "operator.nevis-security.ch/v1"
kind: "NevisTrustStore"
metadata:
name: "ob-fido2-default-server-trust"
namespace: "adn-agov-nevisidm-ob-01-uat"
labels:
deploymentTarget: "ob-fido2"
annotations:
projectKey: "DEFAULT-ADN-AGOV-WORK-OB-PROJECT"
patternId: "a2d03bb46b87b90160dc83d7"
spec:
keystores: []

12
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido2/etc/nevis/k8s-ob-fido2-default-signer-trust-a2d03bb46b87b90160dc83d7.yaml Normal file
View File

@ -0,0 +1,12 @@
apiVersion: "operator.nevis-security.ch/v1"
kind: "NevisTrustStore"
metadata:
name: "ob-fido2-default-signer-trust"
namespace: "adn-agov-nevisidm-ob-01-uat"
labels:
deploymentTarget: "ob-fido2"
annotations:
projectKey: "DEFAULT-ADN-AGOV-WORK-OB-PROJECT"
patternId: "a2d03bb46b87b90160dc83d7"
spec:
keystores: []

12
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido2/etc/nevis/k8s-ob-fido2-default-tls-client-trust-a2d03bb46b87b90160dc83d7.yaml Normal file
View File

@ -0,0 +1,12 @@
apiVersion: "operator.nevis-security.ch/v1"
kind: "NevisTrustStore"
metadata:
name: "ob-fido2-default-tls-client-trust"
namespace: "adn-agov-nevisidm-ob-01-uat"
labels:
deploymentTarget: "ob-fido2"
annotations:
projectKey: "DEFAULT-ADN-AGOV-WORK-OB-PROJECT"
patternId: "a2d03bb46b87b90160dc83d7"
spec:
keystores: []

18
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido2/etc/nevis/nevisfido_default.yml Normal file
View File

@ -0,0 +1,18 @@
schemaVersion: 1.0
instance:
type: "nevisfido"
name: "default"
directory: "/var/opt/nevisfido/default"
pid: "systemctl show nevisfido@default -p MainPID | cut -d '=' -f2"
source:
url: "/nevisadmin/#/projects/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/patterns/a2d03bb46b87b90160dc83d7"
projectKey: "DEFAULT-ADN-AGOV-WORK-OB-PROJECT"
patternId: "a2d03bb46b87b90160dc83d7"
patternClass: "ch.nevis.admin.v4.plugin.fido2.patterns.NevisFIDODeployable"
resources:
ports:
- "0.0.0.0:9443"
control:
start: "systemctl restart nevisfido@default"
stop: "systemctl stop nevisfido@default"
status: "systemctl status nevisfido@default"

10
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido2/var/opt/nevisfido/default/conf/env.conf Normal file
View File

@ -0,0 +1,10 @@
RUN_ARGS="--config conf/nevisfido.yml --log-config conf/logging.yml"
JAVA_OPTS=(
"-XX:+UseContainerSupport"
"-XX:MaxRAMPercentage=80.0"
"-javaagent:/opt/agent/opentelemetry-javaagent.jar"
"-Dotel.javaagent.logging=application"
"-Dotel.javaagent.configuration-file=/var/opt/nevisfido/default/conf/otel.properties"
"-Dotel.resource.attributes=service.version=8.2405.0,service.instance.id=$HOSTNAME"
)

21
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido2/var/opt/nevisfido/default/conf/logging.yml Normal file
View File

@ -0,0 +1,21 @@
Configuration:
monitorInterval: 60
Appenders:
Console:
- name: "SERVER"
target: "SYSTEM_OUT"
PatternLayout:
pattern: "[nevisfido.log] %d{ISO8601} %-15.15t %mdc{trace_id} %mdc{span_id} %-40.40c %-5.5p %m%n"
RegexFilter:
regex: ".*GET /nevisfido/liveness.*"
onMatch: "DENY"
onMismatch: "ACCEPT"
Loggers:
Logger:
- name: "ch.nevis.auth.fido.application.Application"
level: "INFO"
Root:
level: "WARN"
additivity: "false"
AppenderRef:
- ref: "SERVER"

52
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido2/var/opt/nevisfido/default/conf/nevisfido.yml Normal file
View File

@ -0,0 +1,52 @@
server:
port: 9443
protocol: https
tls:
keystore: /var/opt/keys/own/ob-fido2-default-identity/keystore.p12
keystore-passphrase: ${exec:/var/opt/keys/own/ob-fido2-default-identity/keypass}
keystore-type: pkcs12
management:
server:
port: 9089
healthchecks:
enabled: true
credential-repository:
type: nevisidm
client-id: cfa9c9b9-119f-4dff-9bb8-86d7c0cf2720
rest-url: https://idm.adn-agov-nevisidm-01-uat:443/nevisidm
keystore: /var/opt/keys/own/ob-fido2-default-client-identity/keystore.p12
keystore-passphrase: ${exec:/var/opt/keys/own/ob-fido2-default-client-identity/keypass}
truststore: /var/opt/keys/trust/ob-fido2-default-server-trust/truststore.p12
truststore-passphrase: ${exec:/var/opt/keys/trust/ob-fido2-default-server-trust/keypass}
user-attribute: extId
session-repository:
type: in-memory
jdbc-url:
max-connection-lifetime:
user:
password:
schema-user:
schema-user-password:
automatic-db-schema-setup: true
fido2:
enabled: true
rp-name: AGOV-RelPartName
rp-id: adnovum.net
origins:
- https://me.agov-w.azure.adnovum.net
- https://nevisidm.agov-w.azure.adnovum.net
- https://auth.agov-w.azure.adnovum.net
- https://ob.agov-w.azure.adnovum.net
signature-algorithms:
- RS1
- RS256
- RS384
- RS512
- ES256
- ES384
- ES512
display-name-source: loginId

4
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido2/var/opt/nevisfido/default/conf/otel.properties Normal file
View File

@ -0,0 +1,4 @@
otel.service.name = ob-fido2
otel.traces.exporter = none
otel.metrics.exporter = none
otel.logs.exporter = none

47
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido2/var/opt/nevisfido/default/conf/status.py Normal file
View File

@ -0,0 +1,47 @@
import sys
import time
import urllib.request, urllib.error, urllib.parse
health_endpoint = 'http://localhost:9089/nevisfido/health'
log_file_path = '/var/opt/nevisfido/default/log/nevisfido.log'
# Calls nevisFIDO's health check endpoint repeatedly to determine whether it is up and running
# Returns True if the service is available or False otherwise
def is_nevisfido_healthy():
for timeout in [0.1, 2, 4, 8, 16, 30]:
try:
time.sleep(timeout)
response = urllib.request.urlopen(health_endpoint)
if response.getcode() == 200:
return True
except urllib.error.URLError:
continue
return False
# Parses the nevisFIDO logs for the last error registered and raises and exception about it.
def raise_last_error_in_log():
event_buffer = []
for line in reversed(open(log_file_path).readlines()):
stripped_line = line.rstrip()
event_buffer.append(stripped_line)
if '[main] ERROR' in stripped_line:
raise Exception('\n'.join(reversed(event_buffer)))
break
# Log events (by default) starts with logging the time in the following format: '2019-11-04 12:44:45,071 21512 [main]'
# but these events can be multi-lined.
# We check here whether the current line is a start of a new event - in which case we flush the buffer.
if is_year(stripped_line[:4]):
event_buffer = []
# This method returns True if the provided string can be parsed to a year (4 digit int), or False otherwise.
def is_year(str):
try:
return int(str) > 999 and int(str) < 10000
except ValueError:
return False
if is_nevisfido_healthy():
sys.exit(0)
else:
raise_last_error_in_log()
sys.exit(1)

0
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido2/var/opt/nevisfido/default/log/.empty Normal file
View File

0
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido2/var/opt/nevisfido/default/tmp/.empty Normal file
View File

53
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/etc/nevis/k8s-ob-logrend-bed300e1196a171ca12db431.yaml Normal file
View File

@ -0,0 +1,53 @@
apiVersion: "operator.nevis-security.ch/v1"
kind: "NevisComponent"
metadata:
name: "ob-logrend"
namespace: "adn-agov-nevisidm-ob-01-uat"
labels:
deploymentTarget: "ob-logrend"
annotations:
projectKey: "DEFAULT-ADN-AGOV-WORK-OB-PROJECT"
patternId: "bed300e1196a171ca12db431"
spec:
type: "NevisLogrend"
replicas: 1
version: "8.2405.0"
gitInitVersion: "1.3.0"
runAsNonRoot: true
ports:
server: 8988
management: 8997
resources:
limits:
cpu: "500m"
memory: "1000Mi"
requests:
cpu: "10m"
memory: "500Mi"
livenessProbe:
management:
httpGet:
path: "/nevislogrend/liveness"
periodSeconds: 5
timeoutSeconds: 6
readinessProbe:
server:
tcpSocket: true
periodSeconds: 5
timeoutSeconds: 4
startupProbe:
server:
tcpSocket: true
periodSeconds: 5
timeoutSeconds: 4
failureThreshold: 50
podDisruptionBudget:
maxUnavailable: "50%"
git:
tag: "r-0d14bc8d1f507b55c11ab2b807d691b97d55b1dd"
dir: "DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend"
credentials: "git-credentials"
podSecurity:
policy: "baseline"
automountServiceAccountToken: false
timeZone: "Europe/Zurich"

18
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/etc/nevis/nevislogrend_default.yml Normal file
View File

@ -0,0 +1,18 @@
schemaVersion: 1.0
instance:
type: "nevislogrend"
name: "default"
directory: "/var/opt/nevislogrend/default"
pid: "systemctl show nevislogrend@default -p MainPID | cut -d '=' -f2"
source:
url: "/nevisadmin/#/projects/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/patterns/bed300e1196a171ca12db431"
projectKey: "DEFAULT-ADN-AGOV-WORK-OB-PROJECT"
patternId: "bed300e1196a171ca12db431"
patternClass: "ch.nevis.admin.v4.plugin.nevisauth.patterns.NevisLogrendDeployable"
resources:
ports:
- "0.0.0.0:8988"
control:
start: "systemctl restart nevislogrend@default"
stop: "systemctl stop nevislogrend@default"
status: "systemctl status nevislogrend@default"

14
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/conf/env.conf Normal file
View File

@ -0,0 +1,14 @@
RTENV_SECURITY_CHECK=no_shell
# only standalone deployment is supported with nevisAdmin 4
LOGREND_DEPLOY_TYPE=standalone
JAVA_OPTS=(
"-XX:+UseContainerSupport"
"-Dfile.encoding=UTF-8"
"-XX:MaxRAMPercentage=80.0"
"-javaagent:/opt/agent/opentelemetry-javaagent.jar"
"-Dotel.javaagent.logging=application"
"-Dotel.javaagent.configuration-file=/var/opt/nevislogrend/default/conf/otel.properties"
"-Dotel.resource.attributes=service.version=8.2405.0,service.instance.id=$HOSTNAME"
)

19
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/conf/logging.yml Normal file
View File

@ -0,0 +1,19 @@
Configuration:
monitorInterval: 60
Appenders:
Console:
- name: "SERVER"
target: "SYSTEM_OUT"
PatternLayout:
pattern: "[nevislogrend.log] %d{ISO8601} %-15.15t %mdc{trace_id} %mdc{span_id} %-40.40c %-5.5p %m%n"
RegexFilter:
regex: ".*GET /nevislogrend/health.*"
onMatch: "DENY"
onMismatch: "ACCEPT"
Loggers:
Logger: []
Root:
level: "WARN"
additivity: "false"
AppenderRef:
- ref: "SERVER"

26
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/conf/logrend.properties Normal file
View File

@ -0,0 +1,26 @@
application.accept.loginapplicationidfromuri=no
application.gui.litdict=yes
application.gui.substitution=yes
application.input.charset=UTF-8
application.inputs.htmlencode=yes
application.loginapp.current=
application.loginapp.default=ob-realm
application.loginapp.override=header:channel
application.package.name=nevislogrend
application.render.content.type=text/html; charset=UTF-8
application.url.obfuscate=no
application.webdata.path={0}{2}{1}
application.webdata.pathparam=logrendresourcepath
application.webdata.pathparam.default=/login/resources
cache.revalidate.delay=15
cache.source=file
keytag.end=}
keytag.start=${
management.healthchecks.enabled=true
path.config=/var/opt/nevislogrend/default/conf
path.instance=/var/opt/nevislogrend/default
server.host=0.0.0.0
server.name=default
server.port=8988
server.protocol=http

3
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/conf/mimetype.properties Normal file
View File

@ -0,0 +1,3 @@
ico=image/x-icon
woff=font/woff
woff2=font/woff2

4
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/conf/otel.properties Normal file
View File

@ -0,0 +1,4 @@
otel.service.name = ob-logrend
otel.traces.exporter = none
otel.metrics.exporter = none
otel.logs.exporter = none

26
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/data/applications/ob-realm/resources/conf/default.properties Normal file
View File

@ -0,0 +1,26 @@
# source: pattern://6e7b5a087711bd0ada9985fe
application.countries.default=CH
# source: pattern://6e7b5a087711bd0ada9985fe
cache.file.exempt=
# source: pattern://6e7b5a087711bd0ada9985fe
cache.filefolder.exempt=
# source: pattern://6e7b5a087711bd0ada9985fe
application.language.source.1=param:language
# source: pattern://6e7b5a087711bd0ada9985fe
application.language.source.2=cookie:LANG
# source: pattern://6e7b5a087711bd0ada9985fe
application.language.source.3=gui
# source: pattern://6e7b5a087711bd0ada9985fe
application.language.source.4=browser
# source: pattern://6e7b5a087711bd0ada9985fe
application.languages=en,de,fr,it
# source: pattern://6e7b5a087711bd0ada9985fe
application.languages.default=en
# source: pattern://bed300e1196a171ca12db431
application.language.cookie.en=LANG:en
# source: pattern://bed300e1196a171ca12db431
application.language.cookie.de=LANG:de
# source: pattern://bed300e1196a171ca12db431
application.language.cookie.fr=LANG:fr
# source: pattern://bed300e1196a171ca12db431
application.language.cookie.it=LANG:it

27
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/data/applications/ob-realm/resources/conf/text.properties Normal file
View File

@ -0,0 +1,27 @@
button.submit=Submit
error.policy.failed=The new password does not comply with the policy.
info.login=Please enter your authentication information.
info.signup.passwordless=Log in quickly and securely next time using this device's fingerprint, face recognition, or PIN.
info.signup.passwordless.failed=Use the same method you already use on this device for login.
info.signup.passwordless.skip=<button name="cancel-bottom" type="submit" value="true" class="btn btn-link link-primary">Skip for now</button>
language.de=Deutsch
language.en=English
language.fr=Fran&ccedil;ais
language.it=Italiano
prompt.client=Client
prompt.newpassword=New Password
prompt.newpassword.confirm=Confirm Password
prompt.password=Password
prompt.userid=User-ID
pwreset.done.info=Your password was successfully changed. Please click on continue to log in.
pwreset.email.sent=If your user ID exists, an email to reset your password has been sent to you.
pwreset.info.linktext=Password forgotten
pwreset.noticket=Your password reset link is no longer valid. Please generate a new one.
title=NEVIS SSO Portal
title.login=Login
title.pwchange.label=Password Change
title.pwreset=Password Forgotten
title.signup.passwordless=Go passwordless
title.signup.passwordless.failed=Failed to turn on passwordless
try_again.button.label=Try again

27
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/data/applications/ob-realm/resources/conf/text_de.properties Normal file
View File

@ -0,0 +1,27 @@
button.submit=Senden
error.policy.failed=Das neue Passwort stimmt nicht mit der Richtlinie &uuml;berein.
info.login=Bitte geben Sie Ihre pers&ouml;nlichen Zugangsdaten ein.
info.signup.passwordless=Melden Sie sich beim nächsten Mal schnell und sicher mit dem Fingerabdruck, der Gesichtserkennung oder der PIN dieses Geräts an.
info.signup.passwordless.failed=Verwenden Sie dieselbe Methode, die Sie bereits für die Anmeldung verwenden.
info.signup.passwordless.skip=<button name="cancel-bottom" type="submit" value="true" class="btn btn-link link-primary">Vorerst überspringen</button>
language.de=Deutsch
language.en=English
language.fr=Fran&ccedil;ais
language.it=Italiano
prompt.client=Mandant
prompt.newpassword=Neues Passwort
prompt.newpassword.confirm=Passwort best&auml;tigen
prompt.password=Passwort
prompt.userid=Benutzer-ID
pwreset.done.info=Ihr Passwort wurde erfolgreich ge&auml;ndert. Bitte klicken Sie auf Weiter, um sich einzuloggen.
pwreset.email.sent=Wenn Ihre Benutzer-ID existiert, haben Sie eine E-Mail erhalten, um Ihr Passwort zurückzusetzen..
pwreset.info.linktext=Passwort vergessen
pwreset.noticket=Ihr Link ist nicht mehr g&uuml;ltig. Bitte generieren Sie ein Neuen.
title=NEVIS SSO Portal
title.login=Login
title.pwchange.label=Passwort &auml;ndern
title.pwreset=Passwort Vergesssen
title.signup.passwordless=Login ohne Passwort
title.signup.passwordless.failed=Login ohne Passwort konnte nicht aktiviert werden
try_again.button.label=Erneut versuchen

27
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/data/applications/ob-realm/resources/conf/text_en.properties Normal file
View File

@ -0,0 +1,27 @@
button.submit=Submit
error.policy.failed=The new password does not comply with the policy.
info.login=Please enter your authentication information.
info.signup.passwordless=Log in quickly and securely next time using this device's fingerprint, face recognition, or PIN.
info.signup.passwordless.failed=Use the same method you already use on this device for login.
info.signup.passwordless.skip=<button name="cancel-bottom" type="submit" value="true" class="btn btn-link link-primary">Skip for now</button>
language.de=Deutsch
language.en=English
language.fr=Fran&ccedil;ais
language.it=Italiano
prompt.client=Client
prompt.newpassword=New Password
prompt.newpassword.confirm=Confirm Password
prompt.password=Password
prompt.userid=User-ID
pwreset.done.info=Your password was successfully changed. Please click on continue to log in.
pwreset.email.sent=If your user ID exists, an email to reset your password has been sent to you.
pwreset.info.linktext=Password forgotten
pwreset.noticket=Your password reset link is no longer valid. Please generate a new one.
title=NEVIS SSO Portal
title.login=Login
title.pwchange.label=Password Change
title.pwreset=Password Forgotten
title.signup.passwordless=Go passwordless
title.signup.passwordless.failed=Failed to turn on passwordless
try_again.button.label=Try again

27
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/data/applications/ob-realm/resources/conf/text_fr.properties Normal file
View File

@ -0,0 +1,27 @@
button.submit=Envoyer
error.policy.failed=Votre nouveau mot de passe ne conforme pas aux mesures de s&eacute;curit&eacute;
info.login=Veuillez entrer vos &eacute;l&eacute;ments de s&eacute;curit&eacute; ci-apr&egrave;s.
info.signup.passwordless=Connectez-vous rapidement et en toute sécurité la prochaine fois en utilisant l'empreinte digitale, la reconnaissance faciale ou le code PIN de cet appareil.
info.signup.passwordless.failed=Utilisez la même méthode que vous utilisez déjà sur cet appareil pour vous connecter.
info.signup.passwordless.skip=<button name="cancel-bottom" type="submit" value="true" class="btn btn-link link-primary">Sauter pour le moment</button>
language.de=Deutsch
language.en=English
language.fr=Fran&ccedil;ais
language.it=Italiano
prompt.client=Client
prompt.newpassword=Nouveau mot de passe
prompt.newpassword.confirm=Confirmez le mot de passe
prompt.password=Mot de passe
prompt.userid=ID de l&#39;utilisateur
pwreset.done.info=Votre mot de passe a &eacute;t&eacute; chang&eacute avec succ&egrave;s. Veuillez cliquer sur continuer pour vous connecter.
pwreset.email.sent=Si votre identifiant n'existe pas, vous avez reçu un courriel pour réinitialiser votre mot de passe.
pwreset.info.linktext=Mot de passe oublié
pwreset.noticket=Votre lien n&apos;est plus valide. Veuillez en g&eacute;n&eacute;rer un nouveau.
title=NEVIS SSO Portal
title.login=Login
title.pwchange.label=Changer mot de passe
title.pwreset=Mot de Passe Oubli&eacute;
title.signup.passwordless=Aller sans mot de passe
title.signup.passwordless.failed=Impossible d'activer le sans mot de passe
try_again.button.label=Essayez à nouveau

27
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/data/applications/ob-realm/resources/conf/text_it.properties Normal file
View File

@ -0,0 +1,27 @@
button.submit=Continua
error.policy.failed=La nuova password non &egrave; stata accettata. Scegliere una password che sia conforme ai criteri di password.
info.login=Per favore inserisca i suoi dati di accesso.
info.signup.passwordless=Accedi in modo rapido e sicuro la prossima volta utilizzando l'impronta digitale, il riconoscimento facciale o il PIN di questo dispositivo.
info.signup.passwordless.failed=Utilizza lo stesso metodo che usi già su questo dispositivo per il login.
info.signup.passwordless.skip=<button name="cancel-bottom" type="submit" value="true" class="btn btn-link link-primary">Saltare per ora</button>
language.de=Deutsch
language.en=English
language.fr=Fran&ccedil;ais
language.it=Italiano
prompt.client=Mandator
prompt.newpassword=Nuova Password
prompt.newpassword.confirm=Conferma password
prompt.password=Password
prompt.userid=Nome utente
pwreset.done.info=La password &egrave; stata modificata con successo. Fare clic su continua per accedere.
pwreset.email.sent=Se il vostro ID utente esiste, vi è stata inviata un'e-mail per reimpostare la password.
pwreset.info.linktext=Password dimenticata
pwreset.noticket=Il biglietto per la reimpostazione della password non &egrave; pi&ugrave; valido. Si prega di generarne uno nuovo.
title=NEVIS SSO Portal
title.login=Login
title.pwchange.label=Cambiare Password
title.pwreset=Password Dimenticata
title.signup.passwordless=Vai senza password
title.signup.passwordless.failed=Impossibile attivare senza password
try_again.button.label=Riprova

165
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/data/applications/ob-realm/webdata/resources/authcloud_login.js Normal file
View File

@ -0,0 +1,165 @@
let baseURL; // base URL
let statusToken; // used to check progress
let dispatcherElement; // to display link or QR code
let infoElement; // to display info text
let errorElement; // to display error text
function addInput(form, name, value) {
const input = document.createElement("input");
input.name = name;
input.value = value;
form.appendChild(input);
}
function submitStatus(status) {
// we have to do a form POST instead of AJAX
const form = document.createElement("form");
form.method = "POST";
form.style.display = "none";
addInput(form, "status", status);
document.body.appendChild(form);
form.submit();
}
const Status = {
_pollInterval: 2 * 1000, // Check every 2 seconds
latest: null,
startPolling: function (token, uiCallback) {
let interval = setInterval(async () => {
await this._check(token).then(function (resp) {
console.log("Polling status: %o", resp);
uiCallback && uiCallback(resp, false);
return Status.latest = resp;
})
.catch(function (err) {
console.error("Error during polling: %o", err);
return false;
});
if (Status.latest && (Status.latest.status === 'succeeded' || Status.latest.status === 'failed' || Status.latest.status === 'unknown')) {
// Done!
console.log('Latest status is: %o', this.latest);
uiCallback && uiCallback(this.latest, true);
clearInterval(interval);
}
}, this._pollInterval);
},
_check: async function (token) {
const payload = { statusToken: token };
const response = await fetch(baseURL + 'api/v1/status', {
method: 'POST',
mode: 'cors',
cache: 'no-cache',
credentials: 'omit',
headers: {
'Accept': 'application/json',
'Content-Type': 'application/json;charset=utf-8'
},
body: JSON.stringify(payload),
redirect: 'follow',
referrerPolicy: 'no-referrer'
});
return await response.json();
}
};
function setDeepLinkLabel(button) {
const text = document.getElementsByName('info.deeplink')[0].value;
button.innerHTML = text;
}
function messageScanQR() {
const text = document.getElementsByName('info.qrcode')[0].value;
infoElement.innerHTML = text;
}
function messageCheckPhone() {
const text = document.getElementsByName('info.check.phone')[0].value;
infoElement.innerHTML = text;
}
const Element = {
_elem: null, // QR code or deep link depending on device
show: function (appLink) {
const userAgent = navigator.userAgent || navigator.vendor || window.opera;
const isIphone = 'iPhone' === navigator.platform;
const isAndroid = /android/i.test(userAgent) && /mobile/i.test(userAgent);
if (isAndroid || isIphone) {
this._elem = document.createElement('a');
this._elem.setAttribute('href', appLink);
this._elem.setAttribute('class', 'btn btn-primary');
this._elem.setAttribute('target', '_blank');
dispatcherElement.appendChild(this._elem);
setDeepLinkLabel(this._elem);
}
else {
const authenticationType = document.getElementsByName('authenticationType')[0].value;
if (authenticationType == 'push') {
messageCheckPhone();
}
else {
messageScanQR();
this._elem = document.createElement('canvas');
dispatcherElement.appendChild(this._elem);
var qrcode = new QRious({
element: this._elem,
foreground: "#168CA9",
level: "M",
size: 280,
value: appLink
});
}
}
},
hide: function() {
// hide the element which was shown
if (this._elem != null) {
this._elem.style.display = "none";
}
}
};
function authenticateUser(appLink) {
Element.show(appLink);
console.log('Starting Authentication Cloud status polling...');
Status.startPolling(statusToken, (st, done) => {
if (st.status === 'succeeded') {
console.log('Authentication Cloud login done.');
submitStatus('succeeded')
}
else if (st.status === 'failed') {
// failed: The transaction failed, either by timeout or because the user did not accept.
console.warn('Authentication Cloud login failed. User abort or timeout.');
submitStatus('failed')
}
else if (st.status === 'unknown') {
console.error('Authentication Cloud login failed. Unknown status.');
submitStatus('unknown')
}
});
}
function init() {
const form = document.getElementById('authcloud_login');
baseURL = form.url.value;
statusToken = form.statusToken.value;
infoElement = document.getElementById('authcloud_info');
errorElement = document.getElementById('authcloud_error');
dispatcherElement = document.getElementById('authcloud_dispatch');
const appLink = form.appLink.value;
authenticateUser(appLink);
}
window.onload = function() {
init();
};

154
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/data/applications/ob-realm/webdata/resources/authcloud_onboard.js Normal file
View File

@ -0,0 +1,154 @@
let baseURL; // base URL
let statusToken; // used to check progress
let dispatcherElement; // to display link or QR code
let infoElement; // to display info text
let errorElement; // to display error text
function addInput(form, name, value) {
const input = document.createElement("input");
input.name = name;
input.value = value;
form.appendChild(input);
}
function submitStatus(status) {
// we have to do a form POST instead of AJAX
const form = document.createElement("form");
form.method = "POST";
form.style.display = "none";
addInput(form, "status", status);
document.body.appendChild(form);
form.submit();
}
const Status = {
_pollInterval: 2 * 1000, // Check every 2 seconds
latest: null,
startPolling: function (token, uiCallback) {
let interval = setInterval(async () => {
await this._check(token).then(function (resp) {
console.log("Polling status: %o", resp);
uiCallback && uiCallback(resp, false);
return Status.latest = resp;
})
.catch(function (err) {
console.error("Error during polling: %o", err);
return false;
});
if (Status.latest && (Status.latest.status === 'succeeded' || Status.latest.status === 'failed' || Status.latest.status === 'unknown')) {
// Done!
console.log('Latest status is: %o', this.latest);
uiCallback && uiCallback(this.latest, true);
clearInterval(interval);
}
}, this._pollInterval);
},
_check: async function (token) {
const payload = { statusToken: token };
const response = await fetch(baseURL + 'api/v1/status', {
method: 'POST',
mode: 'cors',
cache: 'no-cache',
credentials: 'omit',
headers: {
'Accept': 'application/json',
'Content-Type': 'application/json;charset=utf-8'
},
body: JSON.stringify(payload),
redirect: 'follow',
referrerPolicy: 'no-referrer'
});
return await response.json();
}
};
function setDeepLinkLabel(button) {
const text = document.getElementsByName('info.deeplink')[0].value;
button.innerHTML = text;
}
function messageScanQR() {
const text = document.getElementsByName('info.qrcode')[0].value;
infoElement.innerHTML = text;
}
const Element = {
_elem: null, // QR code or deep link depending on device
show: function (appLink) {
const userAgent = navigator.userAgent || navigator.vendor || window.opera;
const isIphone = 'iPhone' === navigator.platform;
const isAndroid = /android/i.test(userAgent) && /mobile/i.test(userAgent);
if (isAndroid || isIphone) {
this._elem = document.createElement('a');
this._elem.setAttribute('href', appLink);
this._elem.setAttribute('class', 'btn btn-primary');
this._elem.setAttribute('target', '_blank');
dispatcherElement.appendChild(this._elem);
setDeepLinkLabel(this._elem);
}
else {
messageScanQR();
this._elem = document.createElement('canvas');
dispatcherElement.appendChild(this._elem);
var qrcode = new QRious({
element: this._elem,
foreground: "#168CA9",
level: "M",
size: 280,
value: appLink
});
}
},
hide: function() {
// hide the element which was shown
if (this._elem != null) {
this._elem.style.display = "none";
}
}
};
function onboardUser(appLink) {
Element.show(appLink);
console.log('Starting Authentication Cloud status polling...');
Status.startPolling(statusToken, (st, done) => {
if (st.status === 'succeeded') {
console.log('Authentication Cloud onboarding done.');
submitStatus('succeeded')
}
else if (st.status === 'failed') {
// failed: The transaction failed, either by timeout or because the user did not accept.
console.warn('Authentication Cloud onboarding failed. User abort or timeout.');
submitStatus('failed')
}
else if (st.status === 'unknown') {
console.error('Authentication Cloud onboarding failed. Unknown status.');
submitStatus('unknown')
}
});
}
function init() {
const form = document.getElementById('authcloud_onboard');
baseURL = form.url.value;
statusToken = form.statusToken.value;
infoElement = document.getElementById('authcloud_info');
errorElement = document.getElementById('authcloud_error');
dispatcherElement = document.getElementById('authcloud_dispatch');
const appLink = form.appLink.value;
onboardUser(appLink);
}
window.onload = function() {
init();
};

87
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/data/applications/ob-realm/webdata/resources/base64.js Normal file
View File

@ -0,0 +1,87 @@
/*
* Base64URL-ArrayBuffer
* https://github.com/herrjemand/Base64URL-ArrayBuffer
*
* Copyright (c) 2017 Yuriy Ackermann <ackermann.yuriy@gmail.com>
* Copyright (c) 2012 Niklas von Hertzen
* Licensed under the MIT license.
*
*/
(function() {
"use strict";
var chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
// Use a lookup table to find the index.
var lookup = new Uint8Array(256);
for (var i = 0; i < chars.length; i++) {
lookup[chars.charCodeAt(i)] = i;
}
var encode = function(arraybuffer) {
var bytes = new Uint8Array(arraybuffer),
i, len = bytes.length, base64 = "";
for (i = 0; i < len; i+=3) {
base64 += chars[bytes[i] >> 2];
base64 += chars[((bytes[i] & 3) << 4) | (bytes[i + 1] >> 4)];
base64 += chars[((bytes[i + 1] & 15) << 2) | (bytes[i + 2] >> 6)];
base64 += chars[bytes[i + 2] & 63];
}
if ((len % 3) === 2) {
base64 = base64.substring(0, base64.length - 1);
} else if (len % 3 === 1) {
base64 = base64.substring(0, base64.length - 2);
}
return base64;
};
var decode = function(base64) {
var bufferLength = base64.length * 0.75,
len = base64.length, i, p = 0,
encoded1, encoded2, encoded3, encoded4;
var arraybuffer = new ArrayBuffer(bufferLength),
bytes = new Uint8Array(arraybuffer);
for (i = 0; i < len; i+=4) {
encoded1 = lookup[base64.charCodeAt(i)];
encoded2 = lookup[base64.charCodeAt(i+1)];
encoded3 = lookup[base64.charCodeAt(i+2)];
encoded4 = lookup[base64.charCodeAt(i+3)];
bytes[p++] = (encoded1 << 2) | (encoded2 >> 4);
bytes[p++] = ((encoded2 & 15) << 4) | (encoded3 >> 2);
bytes[p++] = ((encoded3 & 3) << 6) | (encoded4 & 63);
}
return arraybuffer;
};
/**
* Exporting and stuff
*/
if (typeof module !== 'undefined' && typeof module.exports !== 'undefined') {
module.exports = {
'encode': encode,
'decode': decode
}
} else {
if (typeof define === 'function' && define.amd) {
define([], function() {
return {
'encode': encode,
'decode': decode
}
});
} else {
window.base64url = {
'encode': encode,
'decode': decode
}
}
}
})();

9
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/data/applications/ob-realm/webdata/resources/bootstrap-theme.min.css vendored Normal file
View File

File diff suppressed because one or more lines are too long

11
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/data/applications/ob-realm/webdata/resources/bootstrap.min.css vendored Normal file
View File

File diff suppressed because one or more lines are too long

12
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/data/applications/ob-realm/webdata/resources/bootstrap.min.js vendored Normal file
View File

File diff suppressed because one or more lines are too long

222
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/data/applications/ob-realm/webdata/resources/default.css Normal file
View File

@ -0,0 +1,222 @@
/********************************************************
* Layout
********************************************************/
html { /* magic to position footer */
position: relative;
min-height: 100%;
}
body {
margin-bottom: 76px; /* == footer height */
}
.container, .container-fluid {
padding-left: 36px;
padding-right: 36px;
}
nav {
min-height: 100px;
padding: 36px;
}
header {
margin-bottom: 16px; /* h1.logintitle adds 20px => 36px */
}
.container {
min-width: 260px;
max-width: 700px;
}
h1 {
margin-bottom: 50px;
}
footer {
width: 100%;
position: absolute;
bottom: 0;
padding: 0 36px;
}
img {
width: 100%;
}
/********************************************************
* Header
********************************************************/
header .logo {
/* width: 20%;*/
/*max-width: 600px;*/
max-height: 150px;
width: auto;
}
/********************************************************
* Dropdown
********************************************************/
a.dropdown-toggle {
text-decoration: none;
}
a.dropdown-toggle:hover {
color: #168CA9;
border-bottom: 3px solid #168CA9;
}
.dropdown-menu {
padding: 5px 0;
}
.dropdown-menu li > a {
padding: 6px 28px;
}
.dropdown-menu a > .prefix {
display: inline-block;
min-width: 22px;
margin-right: 28px;
text-align: right;
}
/********************************************************
* Form
********************************************************/
/* Labels should not be bold */
label {
font-weight: normal;
}
/* Make error messages bold */
.has-error .help-block {
font-weight: bold;
}
/* Change button size, by default 116px in width */
.btn {
min-width: 116px;
padding: 3px 12px;
}
/* Disable gradient in buttons, ughhhh */
.btn.btn-primary {
border-color: transparent;
background-image: none;
text-shadow: none;
box-shadow: none;
-webkit-box-shadow: none;
}
.help-block a, .help-block a:visited {
color: #168CA9;
font-weight: bold;
text-decoration: none;
}
.help-block a:hover {
color: #168CA9;
text-decoration: underline;
}
/********************************************************
* Footer
********************************************************/
footer .row {
margin: 36px 0 0 0;
height: 40px;
padding-top: 14px;
line-height: 26px; /* to center text: height - padding-top = 26px */
border-top: 1px solid #168CA9;
}
footer .row > div { /* Fix alignment between border + text on Bootstrap grid */
padding: 0;
}
footer .logo-round-container {
position: relative;
}
footer .logo-round {
position: absolute;
left: 0;
right: 0;
top: -33px; /* found visually with Chrome Dev Tools */
height: 36px;
width: 36px;
border: 1px solid #00868c;
border-radius: 18px;
background: #fff;
padding: 8px;
}
footer .logo-round > img {
display: block;
}
#dispatchTargets {
margin-top: 20px;
}
/********************************************************
* Social login
********************************************************/
.btn.line {
background-color: transparent;
display: block;
width: 100%;
padding: 0;
margin: 1.5em 0 1em;
border: 0.5px solid #ccc;
pointer-events: none;
}
.btn.socialLogin {
background-color: #fff;
border: thin solid #ccc;
color: #000;
font-weight: 600;
position: relative;
margin: 5px;
min-width: 140px;
width: 210px;
border-radius: 8px;
padding: 8px 12px;
text-align: left;
}
.socialLogin img {
width: 1.5em;
height: 108%;
margin-right: 0.5em;
}
.btn.apple img {
width: 1.2em;
}
/********************************************************
* Show password
********************************************************/
.icon-inside {
position: relative;
}
.icon-inside input {
padding-right: calc(0.75rem + 1.25rem + 0.75rem);
}
.icon-inside button {
position: absolute;
right: 0;
top: 0;
margin-top: 0.45rem;
margin-right: 0.45rem;
background: #FFFFFF;
border: #FFFFFF;
}

36
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/data/applications/ob-realm/webdata/resources/dropdown.js Normal file
View File

@ -0,0 +1,36 @@
(function() {
var closeDropdownTimeout;
function closeDropdown(event) {
var dropdowns = document.querySelectorAll('.dropdown');
for (var i = 0; i < dropdowns.length; i++) {
var dropdownMenu = dropdowns[i].querySelector('.dropdown-menu');
if (dropdownMenu.style.display !== 'none' && !dropdowns[i].contains(event.target)) {
dropdownMenu.style.display = 'none';
}
}
// remove event listener till we have a new dropdown menu open
if (document.querySelector('.dropdown-menu:not([style*="display: none"])') === null) {
document.removeEventListener('click', closeDropdown);
}
}
var dropdowns = document.querySelectorAll('.dropdown');
for (var i = 0; i < dropdowns.length; i++) {
var dropdownMenu = dropdowns[i].querySelector('.dropdown-menu');
dropdownMenu.style.display = 'none'; // ensure menu is initially hidden
dropdowns[i].addEventListener('click', function(e) {
// show dropdown menu
var dropdownMenu = this.querySelector('.dropdown-menu');
dropdownMenu.style.display = 'block';
// handle clicking away
clearTimeout(closeDropdownTimeout);
closeDropdownTimeout = setTimeout(function() {
document.addEventListener('click', closeDropdown);
}, 10);
});
}
}());

98
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/data/applications/ob-realm/webdata/resources/e2eenc.js Normal file
View File

@ -0,0 +1,98 @@
var e2eenc = function() {
this.encryptForm = function(algoString, formId) {
// TODO: in case of an error we should return false, to prevent the for to be submitted
// or replace the fields with dummy values, just to prevent the the transmission
// of unencrypted values
// create the array of input fields to encrypt (needs to be done before setting the form
// invisible
var fieldsToEncrypt = new Array();
$.each($("form input:visible"), function(index, _inputField) { fieldsToEncrypt.push($(_inputField));});
// hide the form, and display the splash screen
$('#loginform').css('display','none');
$('#e2eeSplashScreen').css('display','block');
// encryption logic
var pubKey = $("input[name='e2eenc.publicKey']").val();
var kemSessionKey = readPublicKeyAndGenerateSessionKey(pubKey)
var iv = forge.random.getBytesSync(16);
keyB64 = forge.util.encode64(kemSessionKey.key);
encapsulationB64 = forge.util.encode64(kemSessionKey.encapsulation);
ivB64 = forge.util.encode64(iv);
//console.log("Encrypting form " + formId + " (" + algoString + ")");
var fields = "";
$.each(fieldsToEncrypt, function(index, _inputField) {
var inputField = $(_inputField);
if (inputField.attr("type") == "text" || inputField.attr("type") == "password") {
//console.log("Encrypting field " + JSON.stringify(inputField));
var plainValue = inputField.val();
var encryptedValueB64 = encrypt(kemSessionKey, iv, plainValue);
//console.log("Setting encrypted value in b64: " + encryptedValueB64);
inputField.val(encryptedValueB64);
if (fields.length > 0) {
fields = fields + ","
}
fields = fields + inputField.attr("name");
}
});
$("input[name='e2eenc.iv']").val(ivB64);
$("input[name='e2eenc.encapsulation']").val(encapsulationB64);
$("input[name='e2eenc.fields']").val(fields);
}
function getRSApublicKey(pem) {
//console.log("PEM: " + pem);
var msg = forge.pem.decode(pem)[0];
//console.log("msg type: " + msg.type);
if(msg.procType && msg.procType.type === 'ENCRYPTED') {
throw new Error('Could not retrieve RSA public key from PEM; PEM is encrypted.');
}
// convert DER to ASN.1 object
var asn1obj = forge.asn1.fromDer(msg.body);
//console.log("ASN.1 obj: " + JSON.stringify(asn1obj))
var pubKey = forge.pki.publicKeyFromAsn1(asn1obj)
//console.log("PubKey: " + JSON.stringify(pubKey))
return pubKey;
}
function generateKEMSessionKey(rsaPublicKey) {
// generate key-derivation-function and initializes it with sha1
var kdf1 = new forge.kem.kdf1(forge.md.sha1.create());
// creates a KEM function based on the key-derivation-function created above
var kem = forge.kem.rsa.create(kdf1);
// generate and encapsulate a 16-byte secret key.
// The secret key is generated using the kdf defined above.
var kemSessionKey = kem.encrypt(rsaPublicKey, 16);
// kemSessionKey has 'encapsulation' (= pub key) and 'key' (= generated secret key)
return kemSessionKey;
}
function readPublicKeyAndGenerateSessionKey(pem) {
var rsaPublicKey = getRSApublicKey(pem);
//console.log("PubKey: " + JSON.stringify(rsaPublicKey))
var kemSessionKey = generateKEMSessionKey(rsaPublicKey);
//console.log("KEM session key: " + JSON.stringify(kemSessionKey))
return kemSessionKey;
}
function encrypt(kemSessionKey, iv, msg) {
var cipher = forge.cipher.createCipher('AES-CBC', kemSessionKey.key);
cipher.start({iv: iv});
cipher.update(forge.util.createBuffer(msg, 'utf-8'));
cipher.finish();
var encrypted = cipher.output.getBytes();
encryptedB64 = forge.util.encode64(encrypted);
return encryptedB64;
}
};

3
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/data/applications/ob-realm/webdata/resources/eye-off.svg Normal file
View File

@ -0,0 +1,3 @@
<svg width="22" height="20" viewBox="0 0 22 20" fill="none" xmlns="http://www.w3.org/2000/svg">
<path d="M2 1L5.58916 4.58916M20 19L16.4112 15.4112M12.8749 16.8246C12.2677 16.9398 11.6411 17 11.0005 17C6.52281 17 2.73251 14.0571 1.45825 9.99997C1.80515 8.8955 2.33851 7.87361 3.02143 6.97118M8.87868 7.87868C9.42157 7.33579 10.1716 7 11 7C12.6569 7 14 8.34315 14 10C14 10.8284 13.6642 11.5784 13.1213 12.1213M8.87868 7.87868L13.1213 12.1213M8.87868 7.87868L5.58916 4.58916M13.1213 12.1213L5.58916 4.58916M13.1213 12.1213L16.4112 15.4112M5.58916 4.58916C7.14898 3.58354 9.00656 3 11.0004 3C15.4781 3 19.2684 5.94291 20.5426 10C19.8357 12.2507 18.3545 14.1585 16.4112 15.4112" stroke="#6D7C80" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
</svg>
Side by Side

After

Width:  |  Height:  |  Size: 769 B

4
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/data/applications/ob-realm/webdata/resources/eye.svg Normal file
View File

@ -0,0 +1,4 @@
<svg width="22" height="16" viewBox="0 0 22 16" fill="none" xmlns="http://www.w3.org/2000/svg">
<path d="M14 8C14 9.65685 12.6569 11 11 11C9.34315 11 8 9.65685 8 8C8 6.34315 9.34315 5 11 5C12.6569 5 14 6.34315 14 8Z" stroke="#6D7C80" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
<path d="M1.45825 7.99997C2.73253 3.94288 6.52281 1 11.0004 1C15.4781 1 19.2684 3.94291 20.5426 8.00004C19.2684 12.0571 15.4781 15 11.0005 15C6.52281 15 2.73251 12.0571 1.45825 7.99997Z" stroke="#6D7C80" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
</svg>
Side by Side

After

Width:  |  Height:  |  Size: 585 B

61
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/data/applications/ob-realm/webdata/resources/fido2_auth.js Normal file
View File

@ -0,0 +1,61 @@
(function() {
'use strict'
async function assertion(options) {
let credential;
try {
credential = await navigator.credentials.get({ "publicKey": options });
}
// Cancel and timeout can occur besides error
catch (error) {
console.error(`Failed to get WebAuthn credential: ${error}`);
throw error;
}
// as this is the last call we have to do a top-level request instead of AJAX
const form = document.createElement("form");
form.method = "POST";
form.style.display = "none";
addInput(form, "path", "/nevisfido/fido2/assertion/result")
addInput(form, "id", credential.id);
addInput(form, "type", credential.type);
addInput(form, "response.clientDataJSON", base64url.encode(credential.response.clientDataJSON));
addInput(form, "response.authenticatorData", base64url.encode(credential.response.authenticatorData));
addInput(form, "response.signature", base64url.encode(credential.response.signature));
document.body.appendChild(form);
form.submit();
}
function authenticate() {
// WebAuthn feature detection
if (!isWebAuthnSupportedByTheBrowser()) {
cancelFido2();
return;
};
const request = {};
request.path = "/nevisfido/fido2/attestation/options";
// calling nevisFIDO through nevisAuth on current URL using AJAX
fetch("", {
method: "POST",
headers: {
'Content-Type': 'application/json'
},
body: JSON.stringify(request)
})
.then(res => res.json())
.then(options => {
options.challenge = base64url.decode(options.challenge);
options.allowCredentials = options.allowCredentials.map((c) => {
c.id = base64url.decode(c.id);
return c;
});
return assertion(options);
}).catch((error) => {
console.error(`Error during FIDO2 authentication: ${error}`);
cancelFido2();
});
}
authenticate();
})();

175
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/data/applications/ob-realm/webdata/resources/fido2_auth_std.js Normal file
View File

@ -0,0 +1,175 @@
(function() {
'use strict'
async function authenticate(username, params) {
try {
const { authenticationOptionsEndpoint, authenticationEndpoint, statusServiceEndpoint, userVerification, originalResource, nevisAuthEndpoint } = params;
const { startAuthentication } = SimpleWebAuthnBrowser;
// fetch authentication options from nevisFIDO and save the returned fido2SessionId for later use
const authOptRespJson = await getAuthenticationOptions(username, userVerification, nevisAuthEndpoint);
const fido2SessionId = authOptRespJson.fido2SessionId;
// do the client side authentication using the SimpleWebAuthn JS library
const authRespJson = await startAuthentication(authOptRespJson);
// in case the authentication response does not contain a userHandle (e.g. virtual authenticators used in system tests)
// then we have to obtain it (in our case it is the IDM extId) using the Status Service since at the moment nevisFIDO always expects it
if (!authRespJson.response.userHandle) {
const statusRespJson = await getFido2SessionStatus(fido2SessionId, statusServiceEndpoint);
if (statusRespJson && statusRespJson.userId) {
console.log("adding userHandle: " + statusRespJson.userId);
authRespJson.response.userHandle = btoa(statusRespJson.userId); // add missing userHandle
}
else {
throw new Error('userHandle is missing and could not determine it using the status service');
}
}
else {
console.log("userHandle already set: " + authRespJson.response.userHandle);
}
// send the assertion response created by the authenticator to nevisFIDO
const serverRespJson = await submitAssertion(authRespJson, authenticationEndpoint);
// checking the server response of nevisFIDO
if ((!serverRespJson) || (serverRespJson && serverRespJson.status !== 'ok')) {
let errorMessage = (serverRespJson && serverRespJson.errorMessage) ? serverRespJson.errorMessage : 'unexpected error';
throw new Error('authentication failed: ' + errorMessage);
}
// send a request to nevisAuth with the fido2SessionId in the header to trigger the synchronisation of the
// nevisFIDO and nevisAuth sessions (FIDO2 AuthState -> SyncFido2SessionStatusHandler) to reach AUTH_DONE
await updateNevisAuth(fido2SessionId, nevisAuthEndpoint);
console.log('authentication was successful');
console.log('reloading page...');
window.location.reload();
}
catch (error) {
console.error(`Error during FIDO2 authentication: ${error}`);
cancelFido2();
}
};
async function getAuthenticationOptions(username, userVerification, authenticationOptionsEndpoint) {
const authOptReqJson = {
'username': username,
'userVerification': userVerification,
};
const authOptReq = JSON.stringify(authOptReqJson);
console.log('authOptReq ==> ' + authOptReq);
const authOptResp = await fetch(authenticationOptionsEndpoint, {
method: 'POST',
headers: {
'Content-Type': 'application/json',
},
body: authOptReq,
});
if (!authOptResp.ok) {
throw new Error('authOptResp error: HTTP ' + authOptResp.status + ' ' + authOptResp.statusText);
}
const authOptRespJson = await authOptResp.json()
console.log('authOptResp <== ' + JSON.stringify(authOptRespJson));
return authOptRespJson;
};
async function getFido2SessionStatus(fido2SessionId, statusServiceEndpoint) {
const statusReqJson = {
'fido2SessionId': fido2SessionId,
};
const statusReq = JSON.stringify(statusReqJson);
console.log('statusReq ==> ' + statusReq);
const statusResp = await fetch(statusServiceEndpoint, {
method: 'POST',
headers: {
'Content-Type': 'application/json',
},
body: statusReq,
});
if (!statusResp.ok) {
throw new Error('statusResp error: HTTP ' + statusResp.status + ' ' + statusResp.statusText);
}
const statusRespJson = await statusResp.json();
console.log('statusResp <== ' + JSON.stringify(statusRespJson));
return statusRespJson;
}
async function submitAssertion(authRespJson, authenticationEndpoint) {
console.log("submitting assertion for userHandle: " + authRespJson.response.userHandle);
// TODO koenig 20230504: read btoa once nevisFIDO is adapted
let encodedAuthResp = {
"id": authRespJson.id,
"response": {
"authenticatorData": authRespJson.response.authenticatorData,
"signature": authRespJson.response.signature,
"userHandle": authRespJson.response.userHandle,
"clientDataJSON": authRespJson.response.clientDataJSON
},
"type": authRespJson.type
}
const authResp = JSON.stringify(encodedAuthResp);
console.log('authResp ==> ' + authResp);
const serverResp = await fetch(authenticationEndpoint, {
method: 'POST',
headers: {
'Content-Type': 'application/json',
},
body: authResp,
});
if (!serverResp.ok) {
throw new Error('submitAssertion error: HTTP ' + submitAssertion.status + ' ' + submitAssertion.statusText);
}
const serverRespJson = await serverResp.json();
console.log('serverResp <== ' + JSON.stringify(serverRespJson));
return serverRespJson;
};
async function updateNevisAuth(fido2SessionId, nevisAuthEndpoint) {
console.log('updateNevisAuth ==> ' + fido2SessionId);
const updateNevisAuthResponse = await fetch(nevisAuthEndpoint, {
method: 'GET',
credentials: 'same-origin',
headers: {
'nevis-fido2-session-id': fido2SessionId,
}
});
if (!updateNevisAuthResponse.ok) {
throw new Error('updateNevisAuthResponse error: HTTP ' + updateNevisAuthResponse.status + ' ' + updateNevisAuthResponse.statusText);
}
console.log('updateNevisAuth <== OK');
return;
};
// TODO koenig 20230206: we don't generate IDs into the HTML yet
let username = document.getElementsByName("username")[0].value;
params.nevisAuthEndpoint = window.location.href;
authenticate(username, params);
})();

70
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/data/applications/ob-realm/webdata/resources/fido2_onboard.js Normal file
View File

@ -0,0 +1,70 @@
function dispatch(name) {
// we have to do a top-level request instead of AJAX
const form = document.createElement("form");
form.method = "POST";
form.style.display = "none";
addInput(form, name, "true");
document.body.appendChild(form);
form.submit();
}
async function attestation(options) {
let credential;
try {
credential = await navigator.credentials.create({ "publicKey": options });
}
// cancel and timeout can occur besides error
catch (error) {
console.error(`Failed to create WebAuthn credential: ${error}`);
throw error;
}
// as this is the last call we have to do a top-level request instead of AJAX
const form = document.createElement("form");
form.method = "POST";
form.style.display = "none";
addInput(form, "path", "/nevisfido/fido2/attestation/result")
addInput(form, "id", credential.id);
addInput(form, "type", credential.type);
addInput(form, "response.clientDataJSON", base64url.encode(credential.response.clientDataJSON));
addInput(form, "response.attestationObject", base64url.encode(credential.response.attestationObject));
document.body.appendChild(form);
form.submit();
}
function start() {
if (!isWebAuthnSupportedByTheBrowser()) {
dispatch("unsupported");
return;
};
const request = {};
request.path = "/nevisfido/fido2/attestation/options";
// calling nevisFIDO through nevisAuth on current URL using AJAX
fetch("", {
method: "POST",
headers: {
'Content-Type': 'application/json'
},
body: JSON.stringify(request)
})
.then(res => res.json())
.then(options => {
options.user.id = base64url.decode(options.user.id);
options.challenge = base64url.decode(options.challenge);
if (options.excludeCredentials != null) {
options.excludeCredentials = options.excludeCredentials.map((c) => {
c.id = base64url.decode(c.id);
return c;
});
}
if (options.authenticatorSelection.authenticatorAttachment === null) {
options.authenticatorSelection.authenticatorAttachment = undefined;
}
return attestation(options);
}).catch((error) => {
console.log('Error during FIDO2 onboarding: ' + error);
dispatch("failed");
});
}

40
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/data/applications/ob-realm/webdata/resources/fido2_utils.js Normal file
View File

@ -0,0 +1,40 @@
function addInput(form, name, value) {
const input = document.createElement("input");
input.name = name;
input.value = value;
form.appendChild(input);
}
/**
* Checks whether WebAuthn is supported by the browser or not.
* @return true if supported, false if it is not supported or not in secure context
*/
function isWebAuthnSupportedByTheBrowser() {
if (window.isSecureContext) {
// This feature is available only in secure contexts in some or all supporting browsers.
if ('credentials' in navigator) {
return true;
}
console.warn('Oh no! This browser does not support WebAuthn.');
return false;
}
console.warn('WebAuthn feature is available only in secure contexts. For testing over HTTP, you can use the origin "localhost".');
return false;
}
/**
* Trigger on cancel pattern of the FIDO2 authentication step.
*
* Provides an alternative when the user decides to
* cancel the fido2 credential operation(create or fetch) or
* the operation fails and the error cannot be handled.
*/
function cancelFido2() {
// we have to do a top-level request instead of AJAX
const form = document.createElement("form");
form.method = "POST";
form.style.display = "none";
addInput(form, "cancel_fido2", "true");
document.body.appendChild(form);
form.submit();
}

28767
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/data/applications/ob-realm/webdata/resources/forge.bundle.js Normal file
View File

File diff suppressed because it is too large Load Diff

1
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/data/applications/ob-realm/webdata/resources/icons/apple/black.svg Normal file
View File

@ -0,0 +1 @@
<svg width="842" height="1e3" xmlns="http://www.w3.org/2000/svg"><path d="M702 960c-54.2 52.6-114 44.4-171 19.6-60.6-25.3-116-26.9-180 0-79.7 34.4-122 24.4-170-19.6-271-279-231-704 77-720 74.7 4 127 41.3 171 44.4 65.4-13.3 128-51.4 198-46.4 84.1 6.8 147 40 189 99.7-173 104-132 332 26.9 396-31.8 83.5-72.6 166-141 227zM423 237C414.9 113 515.4 11 631 1c15.9 143-130 250-208 236z"/></svg>
Side by Side

After

Width:  |  Height:  |  Size: 386 B

BIN
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/data/applications/ob-realm/webdata/resources/icons/facebook/white.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 2.4 KiB

9
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/data/applications/ob-realm/webdata/resources/icons/google/google.svg Normal file
View File

@ -0,0 +1,9 @@
<?xml version="1.0" encoding="utf-8"?>
<svg viewBox="0 0 24 24" width="24" height="24" xmlns="http://www.w3.org/2000/svg">
<g transform="matrix(1, 0, 0, 1, 27.009001, -39.238998)">
<path fill="#4285F4" d="M -3.264 51.509 C -3.264 50.719 -3.334 49.969 -3.454 49.239 L -14.754 49.239 L -14.754 53.749 L -8.284 53.749 C -8.574 55.229 -9.424 56.479 -10.684 57.329 L -10.684 60.329 L -6.824 60.329 C -4.564 58.239 -3.264 55.159 -3.264 51.509 Z"/>
<path fill="#34A853" d="M -14.754 63.239 C -11.514 63.239 -8.804 62.159 -6.824 60.329 L -10.684 57.329 C -11.764 58.049 -13.134 58.489 -14.754 58.489 C -17.884 58.489 -20.534 56.379 -21.484 53.529 L -25.464 53.529 L -25.464 56.619 C -23.494 60.539 -19.444 63.239 -14.754 63.239 Z"/>
<path fill="#FBBC05" d="M -21.484 53.529 C -21.734 52.809 -21.864 52.039 -21.864 51.239 C -21.864 50.439 -21.724 49.669 -21.484 48.949 L -21.484 45.859 L -25.464 45.859 C -26.284 47.479 -26.754 49.299 -26.754 51.239 C -26.754 53.179 -26.284 54.999 -25.464 56.619 L -21.484 53.529 Z"/>
<path fill="#EA4335" d="M -14.754 43.989 C -12.984 43.989 -11.404 44.599 -10.154 45.789 L -6.734 42.369 C -8.804 40.429 -11.514 39.239 -14.754 39.239 C -19.444 39.239 -23.494 41.939 -25.464 45.859 L -21.484 48.949 C -20.534 46.099 -17.884 43.989 -14.754 43.989 Z"/>
</g>
</svg>
Side by Side

After

Width:  |  Height:  |  Size: 1.3 KiB

1
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/data/applications/ob-realm/webdata/resources/icons/microsoft/microsoft.svg Normal file
View File

@ -0,0 +1 @@
<svg xmlns="http://www.w3.org/2000/svg" aria-label="Microsoft" role="img" viewBox="0 0 512 512"><rect width="512" height="512" rx="15%" fill="#fff"/><path d="M75 75v171h171v-171z" fill="#f25022"/><path d="M266 75v171h171v-171z" fill="#7fba00"/><path d="M75 266v171h171v-171z" fill="#00a4ef"/><path d="M266 266v171h171v-171z" fill="#ffb900"/></svg>
Side by Side

After

Width:  |  Height:  |  Size: 347 B

2
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/data/applications/ob-realm/webdata/resources/jquery-3.6.0.min.js vendored Normal file
View File

File diff suppressed because one or more lines are too long

31
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/data/applications/ob-realm/webdata/resources/loading.svg Normal file
View File

@ -0,0 +1,31 @@
<svg width="38" height="38" viewBox="0 0 38 38" xmlns="http://www.w3.org/2000/svg">
<defs>
<linearGradient x1="8.042%" y1="0%" x2="65.682%" y2="23.865%" id="a">
<stop stop-color="#168CA9" stop-opacity="0" offset="0%"/>
<stop stop-color="#168CA9" stop-opacity=".631" offset="63.146%"/>
<stop stop-color="#168CA9" offset="100%"/>
</linearGradient>
</defs>
<g fill="none" fill-rule="evenodd">
<g transform="translate(1 1)">
<path d="M36 18c0-9.94-8.06-18-18-18" id="Oval-2" stroke="url(#a)" stroke-width="2">
<animateTransform
attributeName="transform"
type="rotate"
from="0 18 18"
to="360 18 18"
dur="0.9s"
repeatCount="indefinite" />
</path>
<circle fill="#fff" cx="36" cy="18" r="1">
<animateTransform
attributeName="transform"
type="rotate"
from="0 18 18"
to="360 18 18"
dur="0.9s"
repeatCount="indefinite" />
</circle>
</g>
</g>
</svg>
Side by Side

After

Width:  |  Height:  |  Size: 1.2 KiB

BIN
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/data/applications/ob-realm/webdata/resources/logo.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 9.5 KiB

BIN
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/data/applications/ob-realm/webdata/resources/logo_animated.gif Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 68 KiB

119
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/data/applications/ob-realm/webdata/resources/mauth_link_qr.js Normal file
View File

@ -0,0 +1,119 @@
(function () {
function createForm() {
const form = document.createElement("form");
form.method = "POST";
form.style.display = "none";
return form;
}
function addInput(form, name, value) {
const input = document.createElement("input");
input.name = name;
input.value = value;
form.appendChild(input);
}
let statusPolling;
function dispatchLink() {
document.getElementById("mauth_started").style.display = "block"; // show
const request = {};
// calling nevisFIDO through nevisAuth on current URL using AJAX
fetch("", {
method: "POST",
headers: {
'Content-Type': 'application/json'
},
body: JSON.stringify(request)
}).then(res => {
res.json().then(o => {
// example response: {"dispatchResult":"..."}
if (o.dispatchResult == 'dispatched') {
// example response: {..., "dispatcherInformation":{..., "response":"admin4testing://authenticate?dispatchTokenResponse=ey..."}}
var link = o.dispatcherInformation.response;
console.log("received link: " + link);
var linkElem = document.getElementById("mauth_link");
linkElem.href = link; // custom scheme link does not work in Android 13
const isMobile = !!/(iPhone|iPad|Android)/.test(window.navigator.userAgent);
if (isMobile) {
document.getElementById("mauth_link_parent").style.display = "inline"; // show
}
var url = new URL(link);
var dispatchTokenResponse = url.searchParams.get("dispatchTokenResponse");
// render QR code
var qrCodeElem = document.getElementById("mauth_qrcode");
var qrcode = new QRious({
element: qrCodeElem,
foreground: "#168CA9",
level: "M",
size: 256,
value: link
});
var sessionId = o.sessionId;
console.log("started polling for session ID: " + sessionId);
statusPolling = window.setInterval(function () {
poll(sessionId);
}, 2000);
}
else {
console.log("authentication failed: " + o.dispatchResult);
const form = createForm();
document.body.appendChild(form);
form.submit();
}
});
}).catch((err) => console.error("error: ", err));
}
function poll(sessionId) {
const request = {};
request.fidoUafSessionId = sessionId;
// calling nevisFIDO through nevisAuth on current URL using AJAX
fetch("", {
method: "POST",
headers: {
'Content-Type': 'application/json'
},
body: JSON.stringify(request)
}).then(res => {
res.json().then(o => {
var status = o.status;
console.log("status: " + status);
if (status == 'clientAuthenticating') {
// show process icon
document.getElementById("mauth_loading").style.display = 'block';
// hide QR-code and information
document.getElementById("mauth_qrcode").style.display = 'none';
document.getElementById("mauth_qrcode_info").style.display = 'none';
}
if (status == 'succeeded') {
clearInterval(statusPolling);
// as this is the last call we have to do a top-level request instead of AJAX
const form = createForm();
addInput(form, "continue", "true"); // required for custom dispatching in usernameless
document.body.appendChild(form);
form.submit();
}
else if (status == 'failed' || status == 'unknown') {
clearInterval(statusPolling);
console.error("authentication failed with status: " + status);
// as this is the last call we have to do a top-level request instead of AJAX
const form = createForm();
addInput(form, "fidoUafSessionId", sessionId);
document.body.appendChild(form);
form.submit();
}
});
}).catch((err) => console.error("error: ", err));
}
dispatchLink();
})();

106
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/data/applications/ob-realm/webdata/resources/mauth_onboard.js Normal file
View File

@ -0,0 +1,106 @@
(function () {
function createForm() {
const form = document.createElement("form");
form.method = "POST";
form.style.display = "none";
return form;
}
function addInput(form, name, value) {
const input = document.createElement("input");
input.name = name;
input.value = value;
form.appendChild(input);
}
let statusPolling;
function renderEnrollment() {
// link is provided by a hidden GuiElem
var link = document.getElementsByName("mauth_dispatcher_link")[0].value;
console.log("received dispatcher link: " + link);
const isMobile = !!/(iPhone|iPad|Android)/.test(window.navigator.userAgent);
if (isMobile) {
var linkElem = document.getElementById("mauth_link");
linkElem.href = link;
document.getElementById("mauth_link_parent").style.display = "inline"; // show
}
var url = new URL(link);
var dispatchTokenResponse = url.searchParams.get("dispatchTokenResponse");
// render QR code into mauth_qrcode element
var qrCodeElem = document.getElementById("mauth_qrcode");
var qrcode = new QRious({
element: qrCodeElem,
foreground: "#168CA9",
level: "M",
size: 256,
value: link
});
// show entire element
document.getElementById("mauth_started").style.display = "block";
console.log("scheduling status polling (2s interval)");
statusPolling = window.setInterval(function () {
poll();
}, 2000);
}
function poll() {
// state is held on backend side
const request = {};
// calling nevisFIDO through nevisAuth on current URL using AJAX
fetch("", {
method: "POST",
headers: {
'Content-Type': 'application/json'
},
body: JSON.stringify(request)
}).then(res => {
res.json().then(o => {
var status = o.status;
console.log("status: " + status);
if (status == 'clientRegistering') {
// show process icon
document.getElementById("mauth_loading").style.display = 'block';
// hide QR-code and information
document.getElementById("mauth_qrcode").style.display = 'none';
document.getElementById("mauth_qrcode_info").style.display = 'none';
}
else if (status == 'succeeded') {
clearInterval(statusPolling);
console.error("onboarding successful");
// as this is the last call we have to do a top-level request instead of AJAX
const form = createForm();
document.body.appendChild(form);
form.submit();
}
else if (status == 'failed' || status == 'unknown') {
clearInterval(statusPolling);
console.error("onboarding failed with status: " + status);
// as this is the last call we have to do a top-level request instead of AJAX
const form = createForm();
document.body.appendChild(form);
form.submit();
}
});
}).catch((err) => console.error("error: ", err));
}
renderEnrollment();
})();

172
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/data/applications/ob-realm/webdata/resources/mauth_push_qr.js Normal file
View File

@ -0,0 +1,172 @@
(function () {
function createForm() {
const form = document.createElement("form");
form.method = "POST";
form.style.display = "none";
return form;
}
function addInput(form, name, value) {
const input = document.createElement("input");
input.name = name;
input.value = value;
form.appendChild(input);
}
let statusPolling;
function dispatch(id) {
document.getElementById("mauth_devices").style.display = "none"; // hide selection menu
document.getElementById("mauth_started").style.display = "block"; // show
const request = {};
request.dispatchTargetId = id;
request.dispatcher = "firebase-cloud-messaging";
// calling nevisFIDO through nevisAuth on current URL using AJAX
fetch("", {
method: "POST",
headers: {
'Content-Type': 'application/json'
},
body: JSON.stringify(request)
}).then(res => {
res.json().then(o => {
console.log("dispatch response: " + JSON.stringify(o));
// example response: {"dispatchResult":"..."}
if (o.dispatchResult == 'dispatched') {
// example response: {"token":"...","sessionId":"...","dispatchResult":"dispatched","dispatcherInformation":{"name":"firebase-cloud-messaging","response":"..."}}
console.log("push dispatching successful");
// set numbers for number matching
if (o.channelLinking) {
document.getElementById('mauth_match_numbers').innerHTML = o.channelLinking.content;
}
// preparing content for QR-code
var token = o.token;
console.log("found token: " + token);
// hidden GuiElem
var redeemUrl = document.querySelector('input[name=redeem_url]').value;
console.log("found redeem URL: " + redeemUrl);
let qrCodeContents = {
nma_data_version: "1",
nma_data_content_type: "application/json",
nma_data: {
token: token,
redeem_url: redeemUrl
}
};
var qrCodeValue = window.btoa(JSON.stringify(qrCodeContents));
// render QR code
var qrCodeElem = document.getElementById("mauth_qrcode");
console.log("rendering QR code");
var qrcode = new QRious({
element: qrCodeElem,
foreground: "#168CA9",
level: "M",
size: 256,
value: qrCodeValue
});
var sessionId = o.sessionId;
console.log("started polling for session ID: " + sessionId);
statusPolling = window.setInterval(function () {
poll(sessionId);
}, 2000);
}
else {
console.log("authentication failed: " + o.dispatchResult);
const form = createForm();
document.body.appendChild(form);
form.submit();
}
});
}).catch((err) => console.error("error: ", err));
}
function renderDeviceList() {
const request = {};
// calling nevisFIDO through nevisAuth on current URL using AJAX
fetch("", {
method: "POST",
headers: {
'Content-Type': 'application/json'
},
body: JSON.stringify(request)
}).then(res => {
res.json().then(o => {
// example response: {"dispatchTargets":[{"id":"40a41ac7-0189-4c0b-8db9-cafcaa3e3f11","name":"Android Google Pixel 4 23.11.2022 07:26:25"}]}
var devices = o.dispatchTargets;
if (devices.length > 1) {
console.log("multiple devices found, selection menu required.");
let list = document.getElementById("mauth_devices");
for (let i = 0; i < devices.length; i++) {
let device = devices[i];
var item = document.createElement("li");
item.class = "list-group-item list-group-item-action";
item.onclick = function() { dispatch(device.id) };
item.innerHTML += device.name;
list.appendChild(item);
}
list.style.display = "block"; // show selection menu
}
else if (devices.length == 1) {
console.log("user has only 1 device, no selection required.");
dispatch(devices[0].id);
}
else {
console.error("user has no device.");
// TODO koenig 20221124: design this case
}
});
}).catch((err) => console.error("error: ", err));
}
function poll(sessionId) {
const request = {};
request.fidoUafSessionId = sessionId;
// calling nevisFIDO through nevisAuth on current URL using AJAX
fetch("", {
method: "POST",
headers: {
'Content-Type': 'application/json'
},
body: JSON.stringify(request)
}).then(res => {
res.json().then(o => {
var status = o.status;
console.log("status: " + status);
if (status == 'clientAuthenticating') {
document.getElementById("mauth_qrcode").style.display = 'none';
document.getElementById("mauth_qrcode_info").style.display = 'none';
document.getElementById("mauth_match_numbers").style.display = 'block';
document.getElementById("mauth_loading").style.display = 'block';
}
if (status == 'succeeded') {
clearInterval(statusPolling);
// as this is the last call we have to do a top-level request instead of AJAX
const form = createForm();
document.body.appendChild(form);
form.submit();
}
else if (status == 'failed' || status == 'unknown') {
clearInterval(statusPolling);
console.error("authentication failed with status: " + status);
// as this is the last call we have to do a top-level request instead of AJAX
const form = createForm();
addInput(form, "fidoUafSessionId", sessionId);
document.body.appendChild(form);
form.submit();
}
});
}).catch((err) => console.error("error: ", err));
}
renderDeviceList();
})();

119
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/data/applications/ob-realm/webdata/resources/mauth_usernameless.js Normal file
View File

@ -0,0 +1,119 @@
(function () {
function createForm() {
const form = document.createElement("form");
form.method = "POST";
form.style.display = "none";
return form;
}
function addInput(form, name, value) {
const input = document.createElement("input");
input.name = name;
input.value = value;
form.appendChild(input);
}
let statusPolling;
function dispatch() {
console.log("initiating usernameless mobile authentication...");
document.getElementById("mauth_started").style.display = "block"; // show
const request = {};
// calling nevisFIDO through nevisAuth on current URL using AJAX
fetch("", {
method: "POST",
headers: {
'Content-Type': 'application/json'
},
body: JSON.stringify(request)
}).then(res => {
res.json().then(o => {
console.log(o);
// example response: {"dispatchResult":"..."}
if (o.dispatchResult == 'dispatched') {
// example response: {..., "dispatcherInformation":{..., "response":"admin4testing://authenticate?dispatchTokenResponse=ey..."}}
var link = o.dispatcherInformation.response;
console.log("received link: " + link);
var linkElem = document.getElementById("mauth_link");
linkElem.href = link; // custom scheme link does not work in Android 13
const isMobile = !!/(iPhone|iPad|Android)/.test(window.navigator.userAgent);
if (isMobile) {
document.getElementById("mauth_link_parent").style.display = "inline"; // show
}
var url = new URL(link);
var dispatchTokenResponse = url.searchParams.get("dispatchTokenResponse");
// render QR code
var qrCodeElem = document.getElementById("mauth_qrcode");
var qrcode = new QRious({
element: qrCodeElem,
foreground: "#168CA9",
level: "M",
size: 256,
value: link
});
var sessionId = o.sessionId;
console.log("started polling for session ID: " + sessionId);
statusPolling = window.setInterval(function () {
poll(sessionId);
}, 2000);
}
else {
console.log("authentication failed: " + o.dispatchResult);
const form = createForm();
document.body.appendChild(form);
form.submit();
}
});
}).catch((err) => console.error("error: ", err));
}
function poll(sessionId) {
const request = {};
request.fidoUafSessionId = sessionId;
// calling nevisFIDO through nevisAuth on current URL using AJAX
fetch("", {
method: "POST",
headers: {
'Content-Type': 'application/json'
},
body: JSON.stringify(request)
}).then(res => {
res.json().then(o => {
var status = o.status;
console.log("status: " + status);
if (status == 'clientAuthenticating') {
document.getElementById("mauth_qrcode").style.display = 'none';
document.getElementById("mauth_loading").style.display = 'block';
}
if (status == 'succeeded') {
clearInterval(statusPolling);
// as this is the last call we have to do a top-level request instead of AJAX
const form = createForm();
addInput(form, "fidoUafDone", "true"); // checked by Groovy script
document.body.appendChild(form);
form.submit();
}
else if (status == 'failed' || status == 'unknown') {
clearInterval(statusPolling);
console.error("authentication failed with status: " + status);
// as this is the last call we have to do a top-level request instead of AJAX
const form = createForm();
addInput(form, "fidoUafSessionId", sessionId); // checked by Groovy script
document.body.appendChild(form);
form.submit();
}
});
}).catch((err) => console.error("error: ", err));
}
dispatch();
})();

43
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/data/applications/ob-realm/webdata/resources/oauth_consent.js Normal file
View File

@ -0,0 +1,43 @@
// display oauth scopes listed in input field 'consentInformation'
// change 'consentInformation' and 'scope_name' to the values used in your configuration.
$(function() {
var consentInformationFieldName = "consentInformation"; // name of the input field from which to parse the value as the consent information JSON
var scopeDescriptionSource = "scope_name"; // key of the field in the consent information JSON of which to get the value as the scope description
function displayOAuthScopesConsent() {
var jsonData = parseJson();
if (jsonData !== undefined) {
mapJsonToHtml(jsonData)
}
}
function mapJsonToHtml(jsonData) {
mapJsonToHtmlScopeList("listOfRequestedScopesWithExistingConsent", jsonData.requestedScopesWithExistingConsent, "Already accepted scopes:");
mapJsonToHtmlScopeList("listOfRequestedScopes", jsonData.requestedScopesRequiringConsent, "Requested scopes that require a consent:");
}
function mapJsonToHtmlScopeList(elementId, scopeInformation, title) {
if (scopeInformation !== undefined && Object.keys(scopeInformation).length > 0) {
$("input[name=" + consentInformationFieldName +"]").after("<p style='margin-top: 0.5em'>" + title + "</p><div class='scopeinfobox'><ul id='" + elementId + "' /> </div>");
jQuery.each(scopeInformation, function(key,value) {
var scopeDescription = value[scopeDescriptionSource];
if (scopeDescription) {
$("#" + elementId).append('<li>' + scopeDescription + '</li>');
} else {
$("#" + elementId).append('<li>' + key + '</li>');
}
});
}
}
function parseJson() {
var consentInformationField = $("input[name=" +consentInformationFieldName +"]");
if (consentInformationField.length > 0) {
return JSON.parse(consentInformationField.val());
}
}
displayOAuthScopesConsent();
});

6
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/data/applications/ob-realm/webdata/resources/qrious.min.js vendored Normal file
View File

File diff suppressed because one or more lines are too long

11
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/data/applications/ob-realm/webdata/resources/show-password.js Normal file
View File

@ -0,0 +1,11 @@
function toggleInputType(passwordInputId, eyeIconId, resourcePath) {
const passwordInput = document.getElementById(passwordInputId);
const eyeIcon = document.getElementById(eyeIconId);
if (passwordInput.type === 'text') {
passwordInput.type = 'password';
eyeIcon.src = resourcePath + '/resources/eye.svg';
return;
}
passwordInput.type = 'text';
eyeIcon.src = resourcePath + '/resources/eye-off.svg';
}

2
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/data/applications/ob-realm/webdata/resources/simplewebauthn-browser@7.1.0.min.js vendored Normal file
View File

File diff suppressed because one or more lines are too long

65
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/data/applications/ob-realm/webdata/template/default.vm Normal file
View File

@ -0,0 +1,65 @@
#set($jsValidation = 1) ## enable JS validation, client-side
#set($useFormEncryption = $gui.encryption && ($gui.encryption.length() > 0))
#set($encryptionParamsOk = true)
#if ($useFormEncryption)
#* check the mandatory e2eenc.publicKey GuiElem *#
#set($encryptionParamsOk = $gui.getGuiElem("e2eenc.publicKey") && ($gui.getGuiElem("e2eenc.publicKey") != "" ))
#end
#if (!$encryptionParamsOk)
$response.setStatus(502)
#else
#set($isAjaxRequest = "XMLHttpRequest" == $login.requestHeaders.get("X-Requested-With"))
#set($acceptHeader = $login.requestHeaders.accept)
#if (!$acceptHeader)
#set($acceptHeader = $login.requestHeaders.Accept)
#end
#if ($acceptHeader)
#set($isHtmlRequest = $acceptHeader.contains("text/html") || $acceptHeader.contains("*/*"))
#set($isJsonRequest = $acceptHeader.contains("application/json"))
#set($isSoapRequest = $acceptHeader.contains("application/soap+xml"))
#set($isXmlRequest = $acceptHeader.contains("application/xml")||$acceptHeader.contains("text/xml"))
#set($isCssRequest = $acceptHeader.contains("text/css"))
#else
#set($isHtmlRequest = true)
#set($isSoapRequest = false)
#set($isXmlRequest = false)
#set($isCssRequest = false)
#end
## sending the query parameter render=form will render only the inner form
#set($isFormRequest = "form" == $login.requestParameters.render && $isHtmlRequest)
#parse("${templatePath}/macros.vm")
#if ($isHtmlRequest)
#if ($isFormRequest)
#parse("${templatePath}/form.vm")
#else
## html.vm is generated from html provided via pattern
#parse("${templatePath}/html.vm")
#end
#end
## AJAX requests: signal to JS-Client that login is required
#if ($isAjaxRequest)
$response.setStatus(401)
$response.setHeader("WWW-Authenticate","$gui.domain")
#end
#if (!$isHtmlRequest && $isXmlRequest)
$response.setHeader("Content-Type","text/xml")
## emit custom XML here, use $utils.escapeXml to sanitize values coming from clients
#end
#if (!$isHtmlRequest && $isJsonRequest)
$response.setHeader("Content-Type","application/json")
#parse("${templatePath}/json.vm")
## emit custom JSON here, use $utils.escapeJs to sanitize values coming from clients
#end
#end

11
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/data/applications/ob-realm/webdata/template/footer.vm Normal file
View File

@ -0,0 +1,11 @@
<footer id="footer" class="text-primary">
<div class="row small">
<div class="col-md-4 hidden-xs hidden-sm">Copyright &#169; 2023 NEVIS Security AG</div>
<div class="col-xs-12 col-md-4 text-center text-uppercase logo-round-container">
<div class="logo-round center-block">
<img src="${login.appDataPath}/resources/logo.png" alt="NEVIS Security Suite">
</div>
<strong>NEVIS Security Suite</strong>
</div>
</div>
</footer>

127
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/data/applications/ob-realm/webdata/template/form.vm Normal file
View File

@ -0,0 +1,127 @@
## if only form, then we include javascript here (start of body)
#if ($isFormRequest)
#parse("${templatePath}/js_start.vm")
#end
#set ($formTarget = $utils.escapeHtmlAttribute($gui.target.replaceAll('&?language=[^&]*','')))
#if ($useFormEncryption)
<div id="e2eeSplashScreen" style="display:none;">
<h2 class="logintitle text-center">$gui.label</h2>
<div class="field info" id="info">$text.get("e2ee.splashscreen.msg")</div>
</div>
#end
<div id="loginform">
<form id="$gui.name" name="$gui.name"
#if ($useFormEncryption) onsubmit="new e2eenc().encryptForm('$gui.encryption','$gui.name')" #end
method="POST" target="_self" action="$formTarget" autocomplete="off" accept-charset="UTF-8" class="form-horizontal">
<h1 class="logintitle text-center">$gui.label</h1>
#set ($tabindex = 0)
#set ($policyFailureOpen = false)
#set ($policyInfoOpen = false)
#foreach ($guiElem in $gui.getGuiElems())
#set ($tabindex = $tabindex+1)
#if ($guiElem.name.startsWith("policyInfo") && $guiElem.label && $guiElem.label.length() > 0)
#if (!$policyInfoOpen)
<div class="form-group">
<div class="col-sm-offset-3 col-sm-6">
#set ($policyInfoOpen = true)
#end
<span class="help-block small" id="$guiElem.name">$guiElem.label</span>
#elseif ($guiElem.name.startsWith("policyFailure") && $guiElem.label && $guiElem.label.length() > 0)
#if (!$policyFailureOpen)
<div class="form-group has-error">
<div class="col-sm-offset-3 col-sm-6">
#set ($policyFailureOpen = true)
#end
<span class="help-block small" id="$guiElem.name">$guiElem.label</span>
#else
#if (!$guiElem.name.startsWith("policyInfo") && $policyInfoOpen) ## close
</div>
</div>
#set ($policyInfoOpen = false)
#end
#if (!$guiElem.name.startsWith("policyFailure") && $policyFailureOpen) ## close
</div>
</div>
#set ($policyFailureOpen = false)
#end
#renderFormField($guiElem, $gui, $tabindex)
#end
#end
## this block applies when Channel is set to Push / Link
#if ($gui.name == "mauth_link_qr" || $gui.name == "mauth_onboard")
<!-- shown after dispatching -->
<center id="mauth_started">
<img id="mauth_loading" style="width: 60px; height: 60px; display: none;" src="${login.appDataPath}/resources/loading.svg"/>
<br><br>
<p id="mauth_qrcode_info">$text.get("mobile_auth.scan")</p>
<canvas id="mauth_qrcode" style="width: 256px; height: 256px;">
</canvas>
<div id="mauth_link_parent" class="form-group" style="display: none">
$text.get("mobile_auth.link")
</div>
</center>
#end
## this block applies when Channel is set to Push / QR-code (in-app)
#if ($gui.name == "mauth_push_qr")
<!-- shown if the user has multiple devices -->
<ul id="mauth_devices" style="display: none">
</ul>
<!-- shown after selecting the device -->
<center id="mauth_started" style="display: none">
<img id="mauth_loading" style="width: 60px; height: 60px; display: none;" src="${login.appDataPath}/resources/loading.svg"/>
<p id="mauth_match_numbers" style="font-size: 64px; display: none;"></p>
<p id="mauth_qrcode_info">$text.get("mobile_auth.push-or-scan")</p>
<canvas id="mauth_qrcode" style="width: 256px; height: 256px;">
</canvas>
</center>
#end
## this block applies for usernameless mobile authentication
#if ($gui.name == "mauth_usernameless")
<center id="mauth_started" style="display: none">
<img id="mauth_loading" style="width: 60px; height: 60px; display: none;" src="${login.appDataPath}/resources/loading.svg"/>
<br><br>
<p id="mauth_qrcode_info">$text.get("mobile_auth.scan")</p>
<canvas id="mauth_qrcode" style="width: 256px; height: 256px;">
</canvas>
<div id="mauth_link_parent" class="form-group" style="display: none">
<a href="" id="mauth_link">$text.get("mobile_auth.link")</a>
</div>
</center>
#end
#if ($useFormEncryption)
<input type="hidden" name="e2eenc.fields" value="not-set">
<input type="hidden" name="e2eenc.iv" value="not-set">
<input type="hidden" name="e2eenc.encapsulation" value="not-set">
#end
#renderFormControls($gui)
#renderFormLinks($gui)
</form>
<!-- position input focus into first element of form -->
<script type="text/javascript">
const form = document.forms['$gui.name'];
if (form) {
const input = form.elements[0];
if (input) {
input.focus();
}
}
</script>
## if only form, then we include javascript here (end of body)
#if ($isFormRequest)
#parse("${templatePath}/js_end.vm")
#end
</div>

3
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/data/applications/ob-realm/webdata/template/header.vm Normal file
View File

@ -0,0 +1,3 @@
<header id="header" class="container-fluid">
<img class="logo center-block" src="${login.appDataPath}/resources/logo_animated.gif" alt="NEVIS Security Suite">
</header>

32
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/data/applications/ob-realm/webdata/template/html.vm Normal file
View File

@ -0,0 +1,32 @@
<!DOCTYPE html>
<html lang="${utils.escapeHtml($login.localeCode)}">
<head>
<title>$text.get('title')</title>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
<link href="${login.appDataPath}/resources/bootstrap.min.css" rel="stylesheet" type="text/css">
<link href="${login.appDataPath}/resources/bootstrap-theme.min.css" rel="stylesheet" type="text/css" media="all">
<link href="${login.appDataPath}/resources/default.css" rel="stylesheet" type="text/css" media="all">
<link rel="shortcut icon" type="image/x-icon" href="/favicon.ico">
#parse("${templatePath}/js_start.vm")
</head>
<body>
#parse("${templatePath}/lang.vm")
#parse("${templatePath}/header.vm")
<main id="content" class="container">
#parse("${templatePath}/form.vm")
</main>
#parse("${templatePath}/footer.vm")
#parse("${templatePath}/js_end.vm")
</body>
</html>

76
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/data/applications/ob-realm/webdata/template/js_end.vm Normal file
View File

@ -0,0 +1,76 @@
<script src="${login.appDataPath}/resources/dropdown.js"></script>
<script src="${login.appDataPath}/resources/show-password.js"></script>
#if ($gui.name == "oauth_consent")
<script src="${login.appDataPath}/resources/oauth_consent.js"></script>
#end
#if ($gui.name == "authcloud")
<script src="${login.appDataPath}/resources/qrious.min.js"></script>
<script src="${login.appDataPath}/resources/authcloud.js"></script>
#end
#if ($gui.name == "authcloud_onboard")
<script src="${login.appDataPath}/resources/qrious.min.js"></script>
<script src="${login.appDataPath}/resources/authcloud_onboard.js"></script>
#end
#if ($gui.name == "authcloud_login")
<script src="${login.appDataPath}/resources/qrious.min.js"></script>
<script src="${login.appDataPath}/resources/authcloud_login.js"></script>
#end
#if ($gui.name == "mauth_onboard")
<script src="${login.appDataPath}/resources/qrious.min.js"></script>
<script src="${login.appDataPath}/resources/mauth_onboard.js"></script>
#end
#if ($gui.name == "mauth_link_qr")
<script src="${login.appDataPath}/resources/qrious.min.js"></script>
<script src="${login.appDataPath}/resources/mauth_link_qr.js"></script>
#end
#if ($gui.name == "mauth_push_qr")
<script src="${login.appDataPath}/resources/qrious.min.js"></script>
<script src="${login.appDataPath}/resources/mauth_push_qr.js"></script>
#end
#if ($gui.name == "mauth_usernameless")
<script src="${login.appDataPath}/resources/qrious.min.js"></script>
<script src="${login.appDataPath}/resources/mauth_usernameless.js"></script>
#end
#if ($gui.name == "fido2_auth")
<script src="${login.appDataPath}/resources/base64.js"></script>
<script src="${login.appDataPath}/resources/fido2_utils.js"></script>
<script src="${login.appDataPath}/resources/fido2_auth.js"></script>
#end
#if ($gui.name == "fido2_auth_std")
#set ($authenticationOptionsPath = $login.requestHeaders["fido2AuthenticationOptionsPath"])
#set ($authenticationPath = $login.requestHeaders["fido2AuthenticationPath"])
#set ($statusServicePath = $login.requestHeaders["fido2StatusServicePath"])
#set ($userVerification = $login.requestHeaders["fido2UserVerification"])
<script>
let params = {
authenticationOptionsEndpoint: "$authenticationOptionsPath",
authenticationEndpoint: "$authenticationPath",
statusServiceEndpoint: "$statusServicePath",
userVerification: "$userVerification",
};
</script>
<script src="${login.appDataPath}/resources/simplewebauthn-browser@7.1.0.min.js"></script>
<script src="${login.appDataPath}/resources/fido2_utils.js"></script>
<script src="${login.appDataPath}/resources/fido2_auth_std.js"></script>
#end
#if ($gui.name == "fido2_onboard")
<script src="${login.appDataPath}/resources/base64.js"></script>
<script src="${login.appDataPath}/resources/fido2_utils.js"></script>
<script src="${login.appDataPath}/resources/fido2_onboard.js"></script>
#end
#if ($useFormEncryption)
<script src="${login.appDataPath}/resources/forge.bundle.js"></script>
<script src="${login.appDataPath}/resources/e2eenc.js"></script>
#end

1
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/data/applications/ob-realm/webdata/template/js_start.vm Normal file
View File

@ -0,0 +1 @@
<script src="${login.appDataPath}/resources/jquery-3.6.0.min.js"></script>

88
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/data/applications/ob-realm/webdata/template/json.vm Normal file
View File

@ -0,0 +1,88 @@
## This template is used to respond with a JSON format
## In this case, the client is supposed to parse and show the data
## The JSON data is close to the XML format of the GuiDesc
#set ($target = $utils.escapeHtmlAttribute($gui.target.replaceAll('&?language=[^&]*','')))
{
"name" : "$gui.name" ,
"target" : "$target" #if ($gui.label || $gui.language || $gui.domain || $gui.getGuiElems().size() > 0 || $gui.getGuiGroup().size() > 0), #end ## if
#if ($gui.label) "label" : "$gui.label" #if ($gui.language || $gui.domain || $gui.getGuiElems().size() > 0 || $gui.getGuiGroup().size() > 0), #end ## if
#end ## if
#if ($gui.language) "language" : "$gui.language" #if ($gui.domain || $gui.getGuiElems().size() > 0 || $gui.getGuiGroup().size() > 0), #end ## if
#end ## if ($gui.language)
#if ($gui.domain) "domain" : "$gui.domain" #if ($gui.getGuiElems().size() > 0 || $gui.getGuiGroup().size() > 0), #end ## if
#end ## if ($gui.domain)
#if ($gui.getGuiElems().size() > 0)
"elements" : [
#set ($i = 0)
#foreach ($guiElem in $gui.getGuiElems())
{
"name" : "$guiElem.name",
"type" : "$guiElem.type",
"optional" : "$guiElem.optional",
"label" : "$guiElem.label" #if ($guiElem['validation-failed'] || $guiElem.value || $guiElem.length || $guiElem.format), #end
#if ($guiElem['validation-failed']) "validation-failed" : "$guiGroup.validationFailed" #if ($guiElem.value || $guiElem.length || $guiElem.format), #end
#end ## if ($guiElem['validation-failed'])
#if ($guiElem.value) "value" : "$guiElem.value.replaceAll('\\\\','_ESCAPED_BACKSLASH_').replaceAll('\\"','_ESCAPED_QUOTE_').replaceAll('\\','\\\\').replaceAll('"','\\"').replaceAll('_ESCAPED_BACKSLASH_','\\\\').replaceAll('_ESCAPED_QUOTE_','\\"')" #if ($guiElem.length || $guiElem.format), #end
#end ## if ($guiElem.value)
#if ($guiElem.length) "max-length" : "$guiElem.length" #if ($guiElem.format), #end
#end ## if ($guiElem.length)
#if ($guiElem.format) "format" : "$guiElem.format"
#end
}
#set ($i = $i + 1)
#if ($i < ($gui.getGuiElems().size())), #end
#end ## loop
] #if ($gui.getGuiGroup() && $gui.getGuiGroup().size() > 0), #end
#end ## if ($gui.getGuiGroup() && $gui.getGuiElem().size() > 0)
#if ($gui.getGuiGroup() && $gui.getGuiGroup().size() > 0)
"groups" : [
#set ($j = 0)
#foreach ($guiGroup in $gui.getGuiGroup())
"name" : "$guiGroup.name",
"type" : "$guiGroup.type",
"label" : "$guiGroup.label",
"multiple" : "$guiGroup.multiple",
"format" : "$guiGroup.format",
"optional" : "$guiGroup.optional",
"validation-failed" : "$guiGroup.validationFailed" #if ($gui.getGuiElems().length() > 0), #end
#if ($gui.getGuiElems() && $gui.getGuiElems().length() > 0)
"elements" : [
#set ($i = 0)
#foreach ($guiElem in $gui.getGuiElems())
{
"name" : "$guiElem.name",
"type" : "$guiElem.type",
"optional" : "$guiElem.optional",
"validation-failed" : "$guiGroup.validationFailed",
"label" : "$guiElem.label" #if ($guiElem.value || $guiElem.length || $guiElem.format), #end
#if ($guiElem.value)
"value" : "$guiElem.value.replaceAll('\\\\','_ESCAPED_BACKSLASH_').replaceAll('\\"','_ESCAPED_QUOTE_').replaceAll('\\','\\\\').replaceAll('"','\\"').replaceAll('_ESCAPED_BACKSLASH_','\\\\').replaceAll('_ESCAPED_QUOTE_','\\"')" #if ($guiElem.length || $guiElem.format), #end
#end ## if ($guiElem.value)
#if ($guiElem.length)
"max-length" : "$guiElem.length" #if ($guiElem.format), #end
#end ## if ($guiElem.length)
#if ($guiElem.format)
"format" : "$guiElem.format"
#end ## if ($guiElem.format)
}
#set ($i = $i + 1)
#if ($i < ($gui.getGuiElems().size())), #end
#end ## loop
] #if ($foreach.hasNext), #end
#set ($j = $j + 1)
#if ($j < ($gui.getGuiGroup().size())), #end
#end ## foreach ($guiGroup in $gui.getGuiGroup())
#end ## if ($gui.getGuiElem() && $gui.getGuiElem().size() > 0)
]
#end ## if ($gui.getGuiGroup() && $gui.getGuiGroup().length() > 0)
}

32
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/data/applications/ob-realm/webdata/template/lang.vm Normal file
View File

@ -0,0 +1,32 @@
## Nav =================================================================
<nav id="language-switch" class="container-fluid">
<div class="dropdown pull-right">
<a id="language-switch-btn" class="dropdown-toggle text-uppercase small" role="button" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
<strong id="language">$login.localeCode</strong>
<span class="caret"></span>
</a>
<ul class="dropdown-menu" aria-labelledby="language-switch-btn">
## loop over all defined languages/locales....
#foreach ($locale in $login.locales)
## find translated label of current locale
#if ($text.contains("language.$locale"))
#set ($langLabel = $text.get("language.$locale"))
#elseif ($locale.length() > 2)
#set ($langLabel = $text.get("language.${locale.substring(0,2).toLowercase()}"))
#else
#set ($langLabel = $locale)
#end
## emit link or text for each language
#if ($login.localeCode != $locale && $login.language != $locale)
#set ($langTarget = $utils.escapeHtmlAttribute($gui.target('language', $locale)))
<li>
<a class="lang" href="$langTarget">
<strong class="prefix text-primary text-uppercase">$locale</strong>
<span>$langLabel</span>
</a>
</li>
#end
#end ## end foreach
</ul>
</div>
</nav>

295
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/data/applications/ob-realm/webdata/template/macros.vm Normal file
View File

@ -0,0 +1,295 @@
#macro(renderFormField $guiElem, $gui, $tabindex)
#if ($guiElem.type == "submit" || $guiElem.type == "button" || $guiElem.type == "reset" || $guiElem.type == "link")
## do nothing, will be rendered in renderFormControls nd renderFormLinks
#elseif ($guiElem.type == "info" || $guiElem.type == "error")
#if ($guiElem.label && $guiElem.label.length() > 0)
## special fields: display some text only
#set ($class = "form-group")
#if ($guiElem.type == "error")
#set ($class = "$class has-error")
#end
<div class="$class">
<div class="col-sm-offset-3 col-sm-6">
<span class="help-block small" id="$guiElem.name">
$guiElem.label
</span>
</div>
</div>
#end
#elseif ($guiElem.type == "hidden" && $guiElem.name == "saml.logoutURLs")
<script>
var sp_urls = '$guiElem.value'.split(',');
var final_url = '$gui.getGuiElem("saml.logoutURL").value';
function kill_session() {
var current_url = window.location.href;
if (current_url.indexOf('?logout') == -1 && current_url.indexOf('&logout') == -1) {
console.log("current URL does not terminate the IDP session");
var logout_url = '';
if (current_url.indexOf('?') > 0) {
logout_url = current_url + "&logout";
}
else {
logout_url = current_url + "?logout";
}
$.ajax({
type: "GET",
url: logout_url,
async: false,
xhrFields: {
withCredentials: true
},
dataType: "text",
success: function() {},
error: function() {}
});
}
}
var request_urls = sp_urls.filter(function(current_url) {
return current_url.indexOf('SAMLRequest') > 0;
});
var response_urls = sp_urls.filter(function(current_url) {
return current_url.indexOf('SAMLResponse') > 0;
});
function end_logout() {
if (response_urls.length == 0) {
console.log('IDP-initiated SAML logout detected');
kill_session(); // required to terminate IDP session
window.location.href = final_url;
}
else {
console.log('SP-initiated SAML logout detected');
kill_session(); // required to terminate IDP session
window.location.href = response_urls[0]; // only 1 such URL allowed. process ends on SP
}
}
var requests = [];
for (var i = 0; i < request_urls.length; i++) {
var current_url = request_urls[i];
requests.push($.ajax({
type: "GET",
url: current_url,
xhrFields: {
withCredentials: true
},
crossDomain: true,
dataType: 'jsonp',
error: function() {}
})
);
}
// send out the requests in parallel and afterwards terminate the logout process
// we have to terminate the logout no mather if the requests were successful or if there were failed requests
$.when.apply($, requests).then(function() { end_logout(); }, function() { end_logout(); });
</script>
#elseif ($guiElem.type == "hidden")
<input type="hidden" name="$guiElem.name" value="$utils.escapeHtml($guiElem.value)">
#else ## not info, error, button, submit, reset or hidden -> normal visual element
## define CSS class of representation in form
#set ($class = "form-group")
#if ($guiElem.optional)
#set ($class = "$class optional")
#else
#set ($class = "$class required")
#end
## highlight failed input validation, if flagged
#if ($guiElem.validationFailed && $guiElem.value && $guiElem.value.length() > 0)
#set ($class = "$class has-error")
#end
#if ($guiElem.validationFailed && (!$guiElem.value || $guiElem.value.length() == 0))
#set ($class = "$class has-error")
#end
## the form field's container, a label, and optionally a validation-related message
<div class="$class">
## Special handling required for radios + checkboxes
#if ($guiElem.type != "radio" && $guiElem.type != "checkbox")
<label class="col-sm-3 control-label" for="$guiElem.name">
#if ($guiElem.name.startsWith("inputField") && !$guiElem.optional)
$guiElem.label<span style="color: red">*</span>
#else
$guiElem.label
#end
</label>
<div class="col-sm-6">
#if ($guiElem.type == "text")
<input class="form-control" type="text" name="$guiElem.name" id="$guiElem.name"
maxlength="$guiElem.length"
value="$utils.escapeHtml($guiElem.value)" tabindex="$tabindex">
#elseif ($guiElem.type == "pw-text")
<div class="icon-inside">
<input name="${guiElem.name}" type="password" class="form-control" id="${guiElem.name}" value="$utils.escapeHtml($guiElem.value)" tabindex="$tabindex">
<button class="icon-button" type="button" onclick="toggleInputType('${guiElem.name}', '${guiElem.name}eye-icon', '${login.appDataPath}')">
<img id="${guiElem.name}eye-icon" src="${login.appDataPath}/resources/eye.svg">
</button>
</div>
#elseif ($guiElem.type == "select")
#set ($scrollSize = $guiElem.getGuiElems().size())
#set ($scrollSize = $math.min($scrollSize,4))
#if ($guiElem.multiple)
<select name="$guiElem.name" class="form-control" size="$scrollSize" multiple>
#else
<select name="$guiElem.name" class="form-control">
#end
#foreach ($option in $guiElem.getGuiElems())
#if ($option.selected)
<option value="$utils.escapeHtml($option.value)" selected>$option.label</option>
#else
<option value="$utils.escapeHtml($option.value)">$option.label</option>
#end
#end ## foreach option
</select>
#elseif ($guiElem.type == "image" )
<img src="$utils.escapeHtml($guiElem.value)" alt="$guiElem.label" />
#end
#if ($guiElem.validationMessage && $guiElem.validationMessage.length() > 0)
<span class="help-block small">$guiElem.validationMessage</span>
#end
#if ($jsValidation)
#renderElementValidation($guiElem, $gui)
#end
</div>
#else
## Special handling for checkboxes and radios
<div class="col-sm-offset-3 col-sm-6">
<label>
<input type="$guiElem.type" name="$guiElem.name"
value="$utils.escapeHtml($guiElem.value)"
#if ($guiElem.checked || $guiElem.value == 'true')
checked
#end
tabindex="$tabindex">
$guiElem.label
</label>
#if ($guiElem.validationMessage && $guiElem.validationMessage.length() > 0)
<span class="help-block small">$guiElem.validationMessage</span>
#end
#if ($jsValidation)
#renderElementValidation($guiElem, $gui)
#end
</div>
#end
</div>
#end
#end ## end macro
#macro(renderElementValidation $guiElem, $gui)
#if (($guiElem.validation && $guiElem.validation.length() > 0)||($guiElem.format && $guiElem.format.length() > 0))
<script type="text/javascript">
#if ($guiElem.validation && $guiElem.validation.length() > 0)
#if ($guiElem.validation.indexof('return ') > 0)
#set ($validationFunc="function () { $guiElem.validation }")
#else
#set ($validationFunc="function () { return $guiElem.validation ; }")
#end
#else
#set ($validationFunc="function () { return true; }")
#end
var form = document.getElementById('${gui.name}');
var formInput = form.elements["${guiElem.name}"];
formInput.onchange = function () {
var valid = ${validationFunc}.call(this);
#if ($guiElem.format && $guiElem.format.length() > 0)
valid = valid && (/${guiElem.format}/).test(this.value);
#end
var parent = this.parentNode;
if (!valid) {
parent.className += " has-error";
} else {
parent.className = parent.className.replace(/ has-error/g, '');
}
#if (!$guiElem.optional)
if (!this.value) {
parent.className += " has-warning";
} else {
parent.className = parent.className.replace(/ has-warning/g,'');
}
#end
};
</script>
#end
#end ## macro
#macro(renderFormLinks $gui)
#set ($noLinks = true)
#foreach ($guiElem in $gui.getGuiElems())
#if ($guiElem.type == "link")
#if ($noLinks)
<div class="form-group text-center">
#set ($noLinks = false)
#end
<a class="link" title="${utils.escapeHtml($guiElem.label)}" href="$utils.escapeHtml($guiElem.value)">${utils.escapeHtml($guiElem.label)}</a>
#end
#end
#if (!$noLinks)
</div>
#end
#end
#macro(renderFormControls $gui)
<div class="form-group text-center">
#set ($buttonClass = "btn")
#if ($isFormRequest)
#set ($buttonClass = "$buttonClass btn-default")
#else
#set ($buttonClass = "$buttonClass btn-primary")
#end
#foreach ($guiElem in $gui.getGuiElems())
#if ($guiElem.type == "submit" || $guiElem.type == "button" || $guiElem.type == "reset")
<button class="$buttonClass $guiElem.cssClass"
## special handling for button which execute a JS
#if ($guiElem.name == 'onclick')
type="button"
onClick="start()"
#else
name="$guiElem.name"
value="$utils.escapeHtml($guiElem.value)"
#end
>
#if ($guiElem.icon != "")
#if ($guiElem.icon.contains("http"))
<img src="$guiElem.icon" class="$guiElem.iconCssClass" />
#else
<img src="${login.appDataPath}/resources/$guiElem.icon" class="$guiElem.iconCssClass" />
#end
#end
$utils.escapeHtml($guiElem.label)
</button>
#end
#end ## foreach
</div>
#end ## end macro

0
DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-logrend/var/opt/nevislogrend/default/log/.empty Normal file
View File

Some files were not shown because too many files have changed in this diff Show More