<!--
  ~ Copyright (c) 2019 Evolveum
  ~
  ~ Licensed under the Apache License, Version 2.0 (the "License");
  ~ you may not use this file except in compliance with the License.
  ~ You may obtain a copy of the License at
  ~
  ~     http://www.apache.org/licenses/LICENSE-2.0
  ~
  ~ Unless required by applicable law or agreed to in writing, software
  ~ distributed under the License is distributed on an "AS IS" BASIS,
  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  ~ See the License for the specific language governing permissions and
  ~ limitations under the License.
  -->

<securityPolicy xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3" xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3" xmlns:icfs="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3" xmlns:org="http://midpoint.evolveum.com/xml/ns/public/common/org-3" xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3" xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3" xmlns:t="http://prism.evolveum.com/xml/ns/public/types-3" oid="00000000-0000-0000-0000-0000000rt120" version="5">
    <name>Default Security Policy</name>
    <authentication>
        <modules>
            <loginForm id="1">
                <identifier>internalLoginForm</identifier>
                <description>Internal username/password authentication, default user password, login form</description>
            </loginForm>
            <httpBasic id="2">
                <identifier>internalBasic</identifier>
                <description>Internal username/password authentication, using HTTP basic auth</description>
            </httpBasic>
            <saml2 id="3">
                <identifier>mySamlSso</identifier>
                <description>My internal enterprise SAML-based SSO system.</description>
                <serviceProvider>
                    <entityId>sp_midpoint</entityId>
                    <signRequests>true</signRequests>
                    <keys>
                        <activeSimpleKey>
                            <privateKey>
                                <t:clearValue>...</t:clearValue>
                            </privateKey>
                            <passphrase>
                                <t:clearValue>...</t:clearValue>
                            </passphrase>
                            <certificate>
                                <t:clearValue>...</t:clearValue>
                            </certificate>
                        </activeSimpleKey>
                    </keys>
                    <identityProvider>
                        <entityId>https://idptestbed/idp/shibboleth</entityId>
                        <metadata>
                            <xml>[encoded data, 19356 characters]</xml>
                        </metadata>
                        <linkText>Shibboleth</linkText>
                        <authenticationRequestBinding>urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST</authenticationRequestBinding>
                        <nameOfUsernameAttribute>uid</nameOfUsernameAttribute>
                    </identityProvider>
                </serviceProvider>
            </saml2>
            <mailNonce id="4">
                <identifier>registrationMail</identifier>
                <description>Authentication based on mail message with a nonce. Used for user registration.</description>
                <credentialName>mailNonce</credentialName>
            </mailNonce>
            <smsNonce id="5">
                <identifier>passwordResetSms</identifier>
                <description>Authentication based on SMS message with a nonce. Used for password resets.</description>
                <credentialName>smsNonce</credentialName>
                <c:mobileTelephoneNumberItemPath>extension/mobile</c:mobileTelephoneNumberItemPath>
            </smsNonce>
            <securityQuestionsForm id="6">
                <identifier>SecQ</identifier>
                <description>
                    This is interactive, form-based authentication by using security questions.
                </description>
            </securityQuestionsForm>
            <httpSecQ id="7">
                <identifier>httpSecQ</identifier>
                <description>
                    Special "HTTP SecQ" authentication based on security question answers.
                    It is used for REST service.
                </description>
            </httpSecQ>
        </modules>
        <sequence id="8">
            <identifier>admin-gui-default</identifier>
            <description>
                Default GUI authentication sequence.
                We want to try company SSO, federation and internal. In that order.
                Just one of then need to be successful to let user in.
            </description>
            <channel>
                <channelId>http://midpoint.evolveum.com/xml/ns/public/common/channels-3#user</channelId>
                <default>true</default>
              <urlSuffix>default</urlSuffix>
            </channel>
            <module id="12">
                <identifier>mySamlSso</identifier>
                <order>30</order>
                <necessity>sufficient</necessity>
            </module>
            <module id="13">
                <identifier>internalLoginForm</identifier>
                <order>20</order>
                <necessity>sufficient</necessity>
            </module>
        </sequence>
        <sequence id="9">
            <identifier>admin-gui-emergency</identifier>
            <description>
                Special GUI authentication sequence that is using just the internal user password.
                It is used only in emergency. It allows to skip SAML authentication cycles, e.g. in case
                that the SAML authentication is redirecting the browser incorrectly.
            </description>
            <channel>
                <channelId>http://midpoint.evolveum.com/xml/ns/public/common/channels-3#user</channelId>
                <default>false</default>
                <urlSuffix>emergency</urlSuffix>
            </channel>
            <requireAssignmentTarget oid="00000000-0000-0000-0000-000000000004" relation="org:default" type="c:RoleType">
                <!-- Superuser -->
            </requireAssignmentTarget>
            <module id="14">
                <identifier>internalLoginForm</identifier>
                <order>30</order>
                <necessity>sufficient</necessity>
            </module>
        </sequence>
        <sequence>
            <identifier>rest</identifier>
            <description>
                Authentication sequence for REST service.
            </description>
            <channel>
                <channelId>http://midpoint.evolveum.com/xml/ns/public/common/channels-3#rest</channelId>
                <default>true</default>
                <urlSuffix>rest-default</urlSuffix>
            </channel>
            <module>
                <identifier>internalBasic</identifier>
                <order>10</order>
                <necessity>sufficient</necessity>
            </module>
        </sequence>
        <sequence>
            <identifier>actuator</identifier>
            <description>
                Authentication sequence for actuator.
            </description>
            <channel>
                <channelId>http://midpoint.evolveum.com/xml/ns/public/common/channels-3#actuator</channelId>
                <default>true</default>
                <urlSuffix>actuator-default</urlSuffix>
            </channel>
            <module>
                <identifier>internalBasic</identifier>
                <order>10</order>
                <necessity>sufficient</necessity>
            </module>
        </sequence>
      <ignoredLocalPath>/actuator</ignoredLocalPath>
      <ignoredLocalPath>/actuator/health</ignoredLocalPath>
    </authentication>
    <credentials>
        <password>
            <minOccurs>0</minOccurs>
            <lockoutMaxFailedAttempts>3</lockoutMaxFailedAttempts>
            <lockoutFailedAttemptsDuration>PT3M</lockoutFailedAttemptsDuration>
            <lockoutDuration>PT15M</lockoutDuration>
            <valuePolicyRef xmlns:tns="http://midpoint.evolveum.com/xml/ns/public/common/common-3" oid="00000000-0000-0000-0000-000000000003" relation="org:default" type="tns:ValuePolicyType">
                <!-- Default Password Policy -->
            </valuePolicyRef>
        </password>
    </credentials>
</securityPolicy>
