new configuration version

This commit is contained in:
mamo 2024-11-18 12:59:03 +00:00
parent 2f6367888a
commit fc1475e00d
5 changed files with 143 additions and 238 deletions

View File

@ -45,7 +45,7 @@ spec:
podDisruptionBudget:
maxUnavailable: "50%"
git:
tag: "r-60b9ba22a67a26f8264776b83cc5f5017ab48294"
tag: "r-3e8d88fa89e49665fa5a0637bd4c7a9775c40543"
dir: "DEFAULT-ADN-POST-IAM-TKNXCHNG-PROJECT/DEFAULT-ADN-POST-IAM-TKNXCHNG-INV/nai"
credentials: "git-credentials"
keystores:

View File

@ -143,7 +143,7 @@
<!-- source: pattern://f03382307f2e35b70d181f0e -->
<property name="openid.support" value="true"/>
<!-- source: pattern://f03382307f2e35b70d181f0e -->
<property name="openid.issuerId" value="https://cossa.agov-w.azure.adnovum.net"/>
<property name="openid.issuerId" value="https://klp.agov-w.azure.adnovum.net"/>
<!-- source: pattern://f03382307f2e35b70d181f0e -->
<property name="scope.openid" value=""/>
<!-- source: pattern://f03382307f2e35b70d181f0e -->

View File

@ -46,7 +46,7 @@ spec:
podDisruptionBudget:
maxUnavailable: "50%"
git:
tag: "r-60b9ba22a67a26f8264776b83cc5f5017ab48294"
tag: "r-3e8d88fa89e49665fa5a0637bd4c7a9775c40543"
dir: "DEFAULT-ADN-POST-IAM-TKNXCHNG-PROJECT/DEFAULT-ADN-POST-IAM-TKNXCHNG-INV/npi"
credentials: "git-credentials"
keystores:

View File

@ -1,72 +1,11 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE web-app PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN" "/opt/nevisproxy/dtd/web-app_2_3.dtd">
<web-app>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<!-- source: pattern://b67f81a971e4c08aa79040a2 -->
<context-param>
<param-name>SectokenVerifierCert</param-name>
<param-value>/var/opt/keys/trust/npi-cossa-realm-signer-trust/truststore.pem
/var/opt/keys/trust/npi-mockrelam-signer-trust/truststore.pem</param-value>
<param-value>/var/opt/keys/trust/npi-cossa-realm-signer-trust/truststore.pem</param-value>
</context-param>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<filter>
<filter-name>AuthenticationService_MockRelam</filter-name>
<filter-class>ch::nevis::isiweb4::filter::auth::IdentityCreationFilter</filter-class>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<init-param>
<param-name>AuthenticationServlet</param-name>
<param-value>Connector_MockRelam</param-value>
</init-param>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<init-param>
<param-name>BodyReadSize</param-name>
<param-value>32768</param-value>
</init-param>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<init-param>
<param-name>EntryPointID</param-name>
<param-value>cossa.agov-w.azure.adnovum.net</param-value>
</init-param>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<init-param>
<param-name>InactiveInterval</param-name>
<param-value>7200</param-value>
</init-param>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<init-param>
<param-name>InterceptionRedirect</param-name>
<param-value>never</param-value>
</init-param>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<init-param>
<param-name>LoginRendererServlet</param-name>
<param-value>LoginRenderer_nli</param-value>
</init-param>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<init-param>
<param-name>Realm</param-name>
<param-value>MockRelam</param-value>
</init-param>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<init-param>
<param-name>RecheckAuthentication</param-name>
<param-value>On</param-value>
</init-param>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<init-param>
<param-name>RenewIdentification</param-name>
<param-value>true</param-value>
</init-param>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<init-param>
<param-name>StateKey</param-name>
<param-value>MockRelam</param-value>
</init-param>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<init-param>
<param-name>StoreInterceptedRequest</param-name>
<param-value>false</param-value>
</init-param>
</filter>
<!-- source: pattern://b67f81a971e4c08aa79040a2 -->
<filter>
<filter-name>AuthenticationService_cossa_realm</filter-name>
@ -160,33 +99,6 @@
<param-value>/var/opt/nevisproxy/default/host-cossa.agov-w.azure.adnovum.net/WEB-INF/security_cossa_realm_tokenintrospection.conf</param-value>
</init-param>
</filter>
<!-- source: pattern://f03382307f2e35b70d181f0e -->
<filter>
<filter-name>OAuth_Preflighted_CORS_New OAuth 2.0 Authorization Server / OpenID Provider</filter-name>
<filter-class>ch::nevis::isiweb4::filter::lua::LuaFilter</filter-class>
<!-- source: pattern://f03382307f2e35b70d181f0e -->
<init-param>
<param-name>Script</param-name>
<param-value>
function inputHeader(request, response)
response:setHeader("Access-Control-Allow-Origin", "*")
response:setHeader("Access-Control-Allow-Credentials", "true")
response:setHeader("Access-Control-Allow-Methods", "GET, POST, PUT, OPTIONS")
response:setHeader("Access-Control-Allow-Headers", "Authorization")
response:setHeader("Access-Control-Expose-Headers", "*")
response:setHeader("Access-Control-Max-Age", "600")
if request:getMethod() == "OPTIONS" then
response:send(204)
end
end
</param-value>
</init-param>
<!-- source: pattern://f03382307f2e35b70d181f0e -->
<init-param>
<param-name>Script.InputHeaderFunctionName</param-name>
<param-value>inputHeader</param-value>
</init-param>
</filter>
<!-- source: pattern://23dc4a9fcc79a12d82662747 -->
<filter>
<filter-name>Qos</filter-name>
@ -216,51 +128,6 @@
</param-value>
</init-param>
</filter>
<!-- source: pattern://8523f0587aa8cfa7008f8171, pattern://92e282d1dc2b69d9e4f91fc0 -->
<filter>
<filter-name>SessionHandler_MockRelam</filter-name>
<filter-class>ch::nevis::nevisproxy::filter::session::SessionManagementFilter</filter-class>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<init-param>
<param-name>Cookie.ExtraAttributes</param-name>
<param-value>SameSite=None</param-value>
</init-param>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<init-param>
<param-name>Cookie.Name</param-name>
<param-value>Session_MockRelam</param-value>
</init-param>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<init-param>
<param-name>Cookie.Secure</param-name>
<param-value>true</param-value>
</init-param>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<init-param>
<param-name>Identification</param-name>
<param-value>COOKIE</param-value>
</init-param>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<init-param>
<param-name>MaxInactiveInterval</param-name>
<param-value>600</param-value>
</init-param>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<init-param>
<param-name>MaxLifetime</param-name>
<param-value>28800</param-value>
</init-param>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<init-param>
<param-name>Servlet</param-name>
<param-value>LocalSessionStoreServlet</param-value>
</init-param>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<init-param>
<param-name>UpdateTimeStampMinInterval</param-name>
<param-value>120</param-value>
</init-param>
</filter>
<!-- source: pattern://b67f81a971e4c08aa79040a2 -->
<filter>
<filter-name>SessionHandler_cossa_realm</filter-name>
@ -321,26 +188,6 @@
<filter-name>SessionHandler_cossa_realm</filter-name>
<url-pattern>/token/*</url-pattern>
</filter-mapping>
<!-- source: pattern://f03382307f2e35b70d181f0e -->
<filter-mapping>
<filter-name>OAuth_Preflighted_CORS_New OAuth 2.0 Authorization Server / OpenID Provider</filter-name>
<url-pattern>/asdf/*</url-pattern>
</filter-mapping>
<!-- source: pattern://f03382307f2e35b70d181f0e -->
<filter-mapping>
<filter-name>OAuth_Preflighted_CORS_New OAuth 2.0 Authorization Server / OpenID Provider</filter-name>
<url-pattern>/qwert/*</url-pattern>
</filter-mapping>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<filter-mapping>
<filter-name>SessionHandler_MockRelam</filter-name>
<url-pattern>/asdf/*</url-pattern>
</filter-mapping>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<filter-mapping>
<filter-name>SessionHandler_MockRelam</filter-name>
<url-pattern>/qwert/*</url-pattern>
</filter-mapping>
<!-- source: pattern://cc0434226c610ad74ffbf1d1 -->
<filter-mapping>
<filter-name>ModSecurity_cossa_realm_TokenIntrospection</filter-name>
@ -351,71 +198,10 @@
<filter-name>AuthenticationService_cossa_realm</filter-name>
<url-pattern>/token/*</url-pattern>
</filter-mapping>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<filter-mapping>
<filter-name>AuthenticationService_MockRelam</filter-name>
<url-pattern>/asdf/*</url-pattern>
</filter-mapping>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<filter-mapping>
<filter-name>AuthenticationService_MockRelam</filter-name>
<url-pattern>/qwert/*</url-pattern>
</filter-mapping>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<!-- source: pattern://b67f81a971e4c08aa79040a2 -->
<listener>
<listener-class>ch::nevis::isiweb4::listener::SessionListener</listener-class>
</listener>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<servlet>
<servlet-name>Connector_MockRelam</servlet-name>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<servlet-class>ch::nevis::isiweb4::servlet::connector::soap::esauth4::Esauth4ConnectorServlet</servlet-class>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<init-param>
<param-name>Transport.DNSCache.ttl</param-name>
<param-value>60</param-value>
</init-param>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<init-param>
<param-name>Transport.InetAddress</param-name>
<param-value>nai:8991</param-value>
</init-param>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<init-param>
<param-name>Transport.KeepAlive.LifeTime</param-name>
<param-value>30</param-value>
</init-param>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<init-param>
<param-name>Transport.RequestTimeout</param-name>
<param-value>90000</param-value>
</init-param>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<init-param>
<param-name>Transport.ResourceManager.RetryTimeout</param-name>
<param-value>0</param-value>
</init-param>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<init-param>
<param-name>Transport.SSLCACertificateFile</param-name>
<param-value>/var/opt/keys/trust/npi-mockrelam-tls-trust/truststore.pem</param-value>
</init-param>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<init-param>
<param-name>Transport.SSLCheckPeerHostname</param-name>
<param-value>false</param-value>
</init-param>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<init-param>
<param-name>Transport.SSLClientCertificateFile</param-name>
<param-value>/var/opt/keys/own/npi-mockrelam-identity/cert.pem</param-value>
</init-param>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<init-param>
<param-name>Transport.SSLClientKeyFile</param-name>
<param-value>/var/opt/keys/own/npi-mockrelam-identity/key.pem</param-value>
</init-param>
</servlet>
<!-- source: pattern://b67f81a971e4c08aa79040a2 -->
<servlet>
<servlet-name>Connector_cossa_realm</servlet-name>
@ -548,10 +334,10 @@
<param-value>true</param-value>
</init-param>
</servlet>
<!-- source: pattern://f03382307f2e35b70d181f0e -->
<!-- source: pattern://4b8f4de5fefd5f33774df841 -->
<servlet>
<servlet-name>Hosting_Default</servlet-name>
<!-- source: pattern://f03382307f2e35b70d181f0e -->
<!-- source: pattern://4b8f4de5fefd5f33774df841 -->
<servlet-class>ch::nevis::isiweb4::servlet::defaults::DefaultServlet</servlet-class>
</servlet>
<!-- source: pattern://b67f81a971e4c08aa79040a2 -->
@ -617,11 +403,6 @@
<param-value>/nevislogrend</param-value>
</init-param>
</servlet>
<!-- source: pattern://f03382307f2e35b70d181f0e -->
<servlet-mapping>
<servlet-name>Hosting_Default</servlet-name>
<url-pattern>/asdf/*</url-pattern>
</servlet-mapping>
<!-- source: pattern://7dc20659babc66c4401ce0dd -->
<servlet-mapping>
<servlet-name>NevisLogrendConnector_nli</servlet-name>
@ -632,11 +413,6 @@
<servlet-name>Connector_cossa_realm_TokenIntrospection</servlet-name>
<url-pattern>/oauth/introspect2/*</url-pattern>
</servlet-mapping>
<!-- source: pattern://f03382307f2e35b70d181f0e -->
<servlet-mapping>
<servlet-name>Hosting_Default</servlet-name>
<url-pattern>/qwert/*</url-pattern>
</servlet-mapping>
<!-- source: pattern://4b8f4de5fefd5f33774df841 -->
<servlet-mapping>
<servlet-name>Hosting_Default</servlet-name>

View File

@ -6,6 +6,66 @@
<param-name>SectokenVerifierCert</param-name>
<param-value>/var/opt/keys/trust/npi-mockrelam-signer-trust/truststore.pem</param-value>
</context-param>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<filter>
<filter-name>AuthenticationService_MockRelam</filter-name>
<filter-class>ch::nevis::isiweb4::filter::auth::IdentityCreationFilter</filter-class>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<init-param>
<param-name>AuthenticationServlet</param-name>
<param-value>Connector_MockRelam</param-value>
</init-param>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<init-param>
<param-name>BodyReadSize</param-name>
<param-value>32768</param-value>
</init-param>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<init-param>
<param-name>EntryPointID</param-name>
<param-value>klp.agov-w.azure.adnovum.net</param-value>
</init-param>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<init-param>
<param-name>InactiveInterval</param-name>
<param-value>7200</param-value>
</init-param>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<init-param>
<param-name>InterceptionRedirect</param-name>
<param-value>never</param-value>
</init-param>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<init-param>
<param-name>LoginRendererServlet</param-name>
<param-value>LoginRenderer_nli</param-value>
</init-param>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<init-param>
<param-name>Realm</param-name>
<param-value>MockRelam</param-value>
</init-param>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<init-param>
<param-name>RecheckAuthentication</param-name>
<param-value>On</param-value>
</init-param>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<init-param>
<param-name>RenewIdentification</param-name>
<param-value>true</param-value>
</init-param>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<init-param>
<param-name>StateKey</param-name>
<param-value>MockRelam</param-value>
</init-param>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<init-param>
<param-name>StoreInterceptedRequest</param-name>
<param-value>false</param-value>
</init-param>
</filter>
<!-- source: pattern://8523f0587aa8cfa7008f8171, pattern://92e282d1dc2b69d9e4f91fc0 -->
<filter>
<filter-name>Authentication_MockRelam</filter-name>
@ -79,6 +139,33 @@
</param-value>
</init-param>
</filter>
<!-- source: pattern://f03382307f2e35b70d181f0e -->
<filter>
<filter-name>OAuth_Preflighted_CORS_New OAuth 2.0 Authorization Server / OpenID Provider</filter-name>
<filter-class>ch::nevis::isiweb4::filter::lua::LuaFilter</filter-class>
<!-- source: pattern://f03382307f2e35b70d181f0e -->
<init-param>
<param-name>Script</param-name>
<param-value>
function inputHeader(request, response)
response:setHeader("Access-Control-Allow-Origin", "*")
response:setHeader("Access-Control-Allow-Credentials", "true")
response:setHeader("Access-Control-Allow-Methods", "GET, POST, PUT, OPTIONS")
response:setHeader("Access-Control-Allow-Headers", "Authorization")
response:setHeader("Access-Control-Expose-Headers", "*")
response:setHeader("Access-Control-Max-Age", "600")
if request:getMethod() == "OPTIONS" then
response:send(204)
end
end
</param-value>
</init-param>
<!-- source: pattern://f03382307f2e35b70d181f0e -->
<init-param>
<param-name>Script.InputHeaderFunctionName</param-name>
<param-value>inputHeader</param-value>
</init-param>
</filter>
<!-- source: pattern://3b41ca4ca1c4028117d16f5b -->
<filter>
<filter-name>ResponseHeader_Default</filter-name>
@ -152,13 +239,43 @@
<filter-mapping>
<filter-name>SessionHandler_MockRelam</filter-name>
<url-pattern>/*</url-pattern>
<exclude-url-regex>^/errorpages.*$|^/favicon.ico$|^/hallo.txt$|^/index.html$|^/nevislogrend/.*$|^/resources.*$</exclude-url-regex>
<exclude-url-regex>^/asdf/.*$|^/errorpages.*$|^/favicon.ico$|^/hallo.txt$|^/index.html$|^/nevislogrend/.*$|^/qwert/.*$|^/resources.*$</exclude-url-regex>
</filter-mapping>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<filter-mapping>
<filter-name>SessionHandler_MockRelam</filter-name>
<url-pattern>/asdf/*</url-pattern>
</filter-mapping>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<filter-mapping>
<filter-name>SessionHandler_MockRelam</filter-name>
<url-pattern>/qwert/*</url-pattern>
</filter-mapping>
<!-- source: pattern://f03382307f2e35b70d181f0e -->
<filter-mapping>
<filter-name>OAuth_Preflighted_CORS_New OAuth 2.0 Authorization Server / OpenID Provider</filter-name>
<url-pattern>/asdf/*</url-pattern>
</filter-mapping>
<!-- source: pattern://f03382307f2e35b70d181f0e -->
<filter-mapping>
<filter-name>OAuth_Preflighted_CORS_New OAuth 2.0 Authorization Server / OpenID Provider</filter-name>
<url-pattern>/qwert/*</url-pattern>
</filter-mapping>
<!-- source: pattern://8523f0587aa8cfa7008f8171, pattern://92e282d1dc2b69d9e4f91fc0 -->
<filter-mapping>
<filter-name>Authentication_MockRelam</filter-name>
<url-pattern>/*</url-pattern>
<exclude-url-regex>^/errorpages.*$|^/favicon.ico$|^/hallo.txt$|^/index.html$|^/nevislogrend/.*$|^/resources.*$</exclude-url-regex>
<exclude-url-regex>^/asdf/.*$|^/errorpages.*$|^/favicon.ico$|^/hallo.txt$|^/index.html$|^/nevislogrend/.*$|^/qwert/.*$|^/resources.*$</exclude-url-regex>
</filter-mapping>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<filter-mapping>
<filter-name>AuthenticationService_MockRelam</filter-name>
<url-pattern>/asdf/*</url-pattern>
</filter-mapping>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<filter-mapping>
<filter-name>AuthenticationService_MockRelam</filter-name>
<url-pattern>/qwert/*</url-pattern>
</filter-mapping>
<!-- source: pattern://8523f0587aa8cfa7008f8171 -->
<listener>
@ -215,6 +332,12 @@
<param-value>/var/opt/keys/own/npi-mockrelam-identity/key.pem</param-value>
</init-param>
</servlet>
<!-- source: pattern://f03382307f2e35b70d181f0e -->
<servlet>
<servlet-name>Hosting_Default</servlet-name>
<!-- source: pattern://f03382307f2e35b70d181f0e -->
<servlet-class>ch::nevis::isiweb4::servlet::defaults::DefaultServlet</servlet-class>
</servlet>
<!-- source: pattern://8a4997cddc02803b920c8ee9 -->
<servlet>
<servlet-name>Hosting_New_Hosting_Service</servlet-name>
@ -294,20 +417,26 @@
<param-value>/nevislogrend</param-value>
</init-param>
</servlet>
<servlet>
<servlet-name>Hosting_Default</servlet-name>
<servlet-class>ch::nevis::isiweb4::servlet::defaults::DefaultServlet</servlet-class>
</servlet>
<!-- source: pattern://8a4997cddc02803b920c8ee9 -->
<servlet-mapping>
<servlet-name>Hosting_New_Hosting_Service</servlet-name>
<url-pattern>/*</url-pattern>
</servlet-mapping>
<!-- source: pattern://f03382307f2e35b70d181f0e -->
<servlet-mapping>
<servlet-name>Hosting_Default</servlet-name>
<url-pattern>/asdf/*</url-pattern>
</servlet-mapping>
<!-- source: pattern://7dc20659babc66c4401ce0dd -->
<servlet-mapping>
<servlet-name>NevisLogrendConnector_nli</servlet-name>
<url-pattern>/nevislogrend/*</url-pattern>
</servlet-mapping>
<!-- source: pattern://f03382307f2e35b70d181f0e -->
<servlet-mapping>
<servlet-name>Hosting_Default</servlet-name>
<url-pattern>/qwert/*</url-pattern>
</servlet-mapping>
<servlet-mapping>
<servlet-name>Hosting_Default</servlet-name>
<url-pattern>/index.html</url-pattern>