<?xml version="1.0" encoding="UTF-8"?>
<!--
  ~ Copyright (c) 2010-2024 Evolveum and contributors
  ~
 ~ Licensed under the Apache License, Version 2.0 (the "License");
  ~ you may not use this file except in compliance with the License.
  ~ You may obtain a copy of the License at
  ~
  ~     http://www.apache.org/licenses/LICENSE-2.0
  ~
  ~ Unless required by applicable law or agreed to in writing, software
  ~ distributed under the License is distributed on an "AS IS" BASIS,
  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  ~ See the License for the specific language governing permissions and
  ~ limitations under the License.
  -->

<securityPolicy oid="00000000-0000-0000-0000-000000000120">
    <name>Global Security Policy</name>
    <authentication>
        <modules>
            <loginForm>
                <identifier>loginForm</identifier>
            </loginForm>
            <httpBasic>
                <identifier>httpBasic</identifier>
            </httpBasic>
            <focusIdentification>
                <identifier>focusIdentification</identifier>
                <item>
                    <path>name</path>
                    <matchingRule>polyStringNorm</matchingRule>
                </item>
            </focusIdentification>
        </modules>
        <sequence>
            <identifier>admin-gui-default</identifier>
            <displayName>Default gui sequence</displayName>
            <channel>
                <channelId>http://midpoint.evolveum.com/xml/ns/public/common/channels-3#user</channelId>
                <default>true</default>
                <urlSuffix>gui-default</urlSuffix>
            </channel>
            <module>
                <identifier>loginForm</identifier>
                <order>2</order>
                <necessity>sufficient</necessity>
            </module>
            <module>
                <identifier>focusIdentification</identifier>
                <order>1</order>
                <necessity>requisite</necessity>
            </module>
        </sequence>
        <sequence>
            <identifier>rest-default</identifier>
            <channel>
                <channelId>http://midpoint.evolveum.com/xml/ns/public/common/channels-3#rest</channelId>
                <default>true</default>
                <urlSuffix>rest-default</urlSuffix>
            </channel>
            <module>
                <identifier>httpBasic</identifier>
                <order>1</order>
                <necessity>sufficient</necessity>
            </module>
        </sequence>
        <sequence>
            <identifier>actuator-default</identifier>
            <channel>
                <channelId>http://midpoint.evolveum.com/xml/ns/public/common/channels-3#actuator</channelId>
                <default>true</default>
                <urlSuffix>actuator-default</urlSuffix>
            </channel>
            <module>
                <identifier>httpBasic</identifier>
                <order>1</order>
                <necessity>sufficient</necessity>
            </module>
        </sequence>
        <ignoredLocalPath>/actuator/health</ignoredLocalPath>
    </authentication>
    <credentials>
        <password>
            <minOccurs>0</minOccurs>
            <lockoutMaxFailedAttempts>3</lockoutMaxFailedAttempts>
            <lockoutFailedAttemptsDuration>PT3M</lockoutFailedAttemptsDuration>
            <lockoutDuration>PT15M</lockoutDuration>
            <valuePolicyRef oid="00000000-0000-0000-0000-000000000003" relation="default" type="ValuePolicyType"/>
        </password>
    </credentials>
</securityPolicy>
