<?xml version="1.0" encoding="UTF-8"?>
<!--
  ~ Copyright (c) 2014-2023 Evolveum
  ~
  ~ Licensed under the Apache License, Version 2.0 (the "License");
  ~ you may not use this file except in compliance with the License.
  ~ You may obtain a copy of the License at
  ~
  ~     http://www.apache.org/licenses/LICENSE-2.0
  ~
  ~ Unless required by applicable law or agreed to in writing, software
  ~ distributed under the License is distributed on an "AS IS" BASIS,
  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  ~ See the License for the specific language governing permissions and
  ~ limitations under the License.
  -->

<securityPolicy oid="b50aff7e-3784-11e6-b97e-0b955775c407" xmlns='http://midpoint.evolveum.com/xml/ns/public/common/common-3'>
    <name>Evolveum Security Policy</name>
    <authentication>
        <modules>
            <loginForm>
                <identifier>internalLoginForm</identifier>
                <description>Internal username/password authentication, default user password, login form</description>
            </loginForm>
            <httpBasic>
                <identifier>internalBasic</identifier>
                <description>Internal username/password authentication, using HTTP basic auth</description>
            </httpBasic>
            <mailNonce>
                <identifier>MailNonce</identifier>
                <description>Authentication based on mail message with a nonce. Used for user registration.</description>
                <credentialName>mailNonce</credentialName>
            </mailNonce>
            <focusIdentification>
                <identifier>userName</identifier>
                <item>
                    <path>name</path>
                    <matchingRule>polyStringNorm</matchingRule>
                </item>
            </focusIdentification>
        </modules>
        <sequence>
            <identifier>admin-gui-default</identifier>
            <description>
                Default GUI authentication sequence.
                We want to try company SSO, federation and internal. In that order.
                Just one of then need to be successful to let user in.
            </description>
            <channel>
                <channelId>http://midpoint.evolveum.com/xml/ns/public/common/channels-3#user</channelId>
                <default>true</default>
                <urlSuffix>default</urlSuffix>
            </channel>
            <module>
                <identifier>internalLoginForm</identifier>
                <order>10</order>
                <necessity>sufficient</necessity>
            </module>
        </sequence>
        <sequence>
            <identifier>rest</identifier>
            <description>
                Authentication sequence for REST service.
            </description>
            <channel>
                <channelId>http://midpoint.evolveum.com/xml/ns/public/common/channels-3#rest</channelId>
                <default>true</default>
                <urlSuffix>rest-default</urlSuffix>
            </channel>
            <module>
                <identifier>internalBasic</identifier>
                <order>10</order>
                <necessity>sufficient</necessity>
            </module>
        </sequence>
        <sequence>
            <identifier>userPasswordResetAuth</identifier>
            <description>Just a nonce mail to validate e-mail address.</description>
            <channel>
                <channelId>http://midpoint.evolveum.com/xml/ns/public/common/channels-3#resetPassword</channelId>
                <urlSuffix>resetPassword</urlSuffix>
            </channel>
            <module>
                <identifier>userName</identifier>
                <order>10</order>
                <necessity>requisite</necessity>
            </module>
            <module>
                <identifier>MailNonce</identifier>
                <order>20</order>
                <necessity>sufficient</necessity>
            </module>
        </sequence>
    </authentication>
    <credentials>
        <password>
            <lockoutMaxFailedAttempts>3</lockoutMaxFailedAttempts>
            <lockoutFailedAttemptsDuration>PT3M</lockoutFailedAttemptsDuration>
            <lockoutDuration>PT15M</lockoutDuration>
        </password>
        <nonce>
            <maxAge>PT2M</maxAge>
            <name>mailNonce</name>
            <valuePolicyRef oid="ffa65cbc-6088-11e7-b434-db222509f488" type="ValuePolicyType"><!-- Mail Nonce Policy --></valuePolicyRef>
        </nonce>
        <securityQuestions>
            <resetMethod>
                <resetType>securityQuestions</resetType>
            </resetMethod>
            <questionNumber>2</questionNumber>
            <question>
                <identifier>http://midpoint.evolveum.com/xml/ns/public/security/question-2#q001</identifier>
                <enabled>true</enabled>
                <questionText>How much wood would a woodchuck chuck if woodchuck could chuck wood?</questionText>
            </question>
            <question>
                <identifier>http://midpoint.evolveum.com/xml/ns/public/security/question-2#q002</identifier>
                <questionText>What is your mother's best friend's uncle's grandaughter's dog's mother maiden name?</questionText>
            </question>
        </securityQuestions>
    </credentials>
    <credentialsReset>
        <identifier>global-credentials-reset</identifier>
        <description>Credential reset procedure for default user password.</description>
        <authenticationSequenceName>userPasswordResetAuth</authenticationSequenceName>
    </credentialsReset>
</securityPolicy>
