trustbroker.swiss (XTB)

sudo bash
curl -SL https://github.com/docker/compose/releases/download/v2.27.0/docker-compose-linux-x86_64 -o
/usr/local/bin/docker-compose
chmod 555 /usr/local/bin/docker-compose

bash run.sh

# Variant 0: Run directly with the read-only public repository from GitHub
GIT_URL=https://github.com/trustbroker-swiss/xtb-gitops-demo.git
#GIT_TOKEN=not-required-on-public-repo

# Variant 1: Access token used to access GitOps repository using http bearer token (must be created on Git server)
# Gitea >> User Avater >> Settings >> Applications >> Manage Access Tokens >> Generate Token
# Pass by value or by reference ie.e $TRUSTBROKER_HOME/keys/git_token
#GIT_URL=http://git@gitea:3000/trustbroker-swiss/xtb-gitops-demo.git
#GIT_TOKEN=./keys/git_token

# Variant 2: SSH key used to access GitOps repository using ssh protocol (see setup-ssh.sh on how to get it)
# We instead mount the SSH key(s) into /etc/trustbroker/keys.
#GIT_URL=ssh://git@gitea:22/trustbroker-swiss/xtb-gitops-demo.git
#SSH_KEY=./keys/id_rsa

# data selection from git repo selecting trustbroker-inventories/DEMO
CONFIG_BRANCH=main
SPRING_PROFILES_ACTIVE=DEMO

# Passphrase to decrypt keystores stored in git (RSA private in openssl PEM or PKCS12 keystores)
PKI_PASSPHRASE=changeit

# Access to the mariadb session store. We use the same passphrase for DB owner 'root' and XTB user 'trustbroker'.
STATECACHE_PASS=secret

# Development environment population
export GIT_URL GIT_TOKEN SSH_KEY CONFIG_BRANCH TRUSTBROKER_HOME SPRING_PROFILES_ACTIVE
export PKI_PASSPHRASE STATECACHE_PASS

# Rootless docker-compose requires switching the run user of the container.
[ -z "$UID" ] && export UID=$(id -u)
[ -z "$GID" ] && export GID=$(id -g)
export UID GID

# vim: syntax=yaml textwidth=120 expandtab tabstop=2 softtabstop=2 shiftwidth=2 autoindent
# Docker compose setting up a standalone XTB service on a local docker host.configs:
# NOTE: Source the ENV defining the secret first or define them inline (SSH_KEY, PKI_PASSPHRASE, STATECACHE_PASS)

networks:
  trustbroker-network:
    external: false

services:
  mariadb:
    container_name: mariadb
    restart: on-failure
    image: docker.io/library/mariadb:10.7.6
    volumes:
      - ./mariadb:/var/lib/mysql
      - /etc/localtime:/etc/localtime:ro
    ports:
      - "3306:3306"
    environment:
      - MYSQL_DATABASE=TBSS16
      - MYSQL_ROOT_PASSWORD=${STATECACHE_PASS}
      - MYSQL_PASSWORD=${STATECACHE_PASS}
      - MYSQL_USER=trustbroker
    networks:
      - trustbroker-network

  gitea:
    container_name: gitea
    restart: on-failure
    image: docker.io/gitea/gitea:1.21.5
    environment:
      - USER_UID=1000
      - USER_GID=1000
    volumes:
      - ./gitea:/data
      - /etc/localtime:/etc/localtime:ro
    ports:
      - "3000:3000"
      - "222:22"
    networks:
      - trustbroker-network

  ldap:
    container_name: ldap
    image: bitnami/openldap
    ports:
      - '1389:1389'
      - '1636:1636'
    environment:
      #- BITNAMI_DEBUG=true
      - LDAP_ROOT=dc=trustbroker,dc=swiss
      - LDAP_ADMIN_USERNAME=admin
      - LDAP_ADMIN_PASSWORD=secret
      - LDAP_CUSTOM_SCHEMA_DIR=/schema_init
      - LDAP_CUSTOM_LDIF_DIR=/ldif_init
    volumes:
      - ./ldap_init/schema:/schema_init:ro
      - ./ldap_init/ldif:/ldif_init:ro
      #- openldap_data:/bitnami/openldap

  trustbroker:
    container_name: trustbroker
    image: ghcr.io/trustbroker-swiss/trustbroker-application:latest
    user: "${UID}:${GID}"
    depends_on:
      - gitea
      - mariadb
      - ldap
    volumes:
      - ./ssh:/etc/trustbroker/keys:ro
      - /etc/localtime:/etc/localtime:ro
    ports:
      - "8090:8090"
      - "8091:8091"
    environment:
      - GIT_URL=${GIT_URL}
      - GIT_TOKEN=${GIT_TOKEN}
      - SSH_KEY=${SSH_KEY}
      - CONFIG_BRANCH=main
      - SPRING_PROFILES_ACTIVE=DEMO
      - PKI_PASSPHRASE=${PKI_PASSPHRASE}
      - SPRING_FLYWAY_URL=jdbc:mariadb://mariadb:3306
      - SPRING_FLYWAY_USER=root
      - SPRING_FLYWAY_PASSWORD=${STATECACHE_PASS}
      - SPRING_DATASOURCE_USERNAME=trustbroker
      - SPRING_DATASOURCE_PASSWORD=${STATECACHE_PASS}
      # Debug SSH startup in case of connectivity problem with external git repo
      #- LOGGING_LEVEL_ROOT=DEBUG
      # When running behind an enterprise proxy inject a HTTPS or SSH proxy (HTTP not supported)
      #- HTTPS_PROXY=http://proxy.company.com:1234
      #- SSH_PROXY_HOST=proxy.company.com
      #- SSH_PROXY_PORT=1234
      # When running on HTTP relax cookie polices
      - TRUSTBROKER_CONFIG_SECUREBROWSERHEADERS=false
    networks:
      - trustbroker-network

  samlmock:
    container_name: samlmock
    image: ghcr.io/trustbroker-swiss/trustbroker-samlmock:latest
    depends_on:
      - gitea
    volumes:
      - ./ssh:/etc/trustbroker/keys:ro
      - /etc/localtime:/etc/localtime:ro
    ports:
      - "7070:7070"
      - "7071:7071"
    environment:
      - GIT_URL=${GIT_URL}
      - GIT_TOKEN=${GIT_TOKEN}
      - SSH_KEY=${SSH_KEY}
      - CONFIG_BRANCH=main
      - SPRING_PROFILES_ACTIVE=DEMO
      - PKI_PASSPHRASE=${PKI_PASSPHRASE}
    networks:
      - trustbroker-network

#!/bin/bash

# Site config (you can also use shorter ecdsa keys, but git server need sto support it)
SSH_KEY_FILE=${SSH_KEY_FILE:-ssh/id_rsa}
SSH_KEY_OWNER=${SSH_KEY_OWNER:-xtb-owner@your.site}
SSH_CFG_FILE=${SSH_CFG_FILE:-ssh/config}

# SSH key is stored un-encrypted in vault (no apssword necessary)
SSH_KEY_PASS=

# Trusted server keys need to be engineered when StrictHostKeyChecking=yes is used
SSH_HST_FILE=${SSH_HST_FILE:-ssh/known_hosts}

# Generate client key
ssh-keygen -m pem -t rsa -b 4096 -P "$SSH_KEY_PASS" -f $SSH_KEY_FILE -C $SSH_KEY_OWNER

# Provide server trust: Done automatically when connecting to the Git server for the first time.
# To explicitly establish server trust setup keys/config and keys/known_hosts using OpenSSH conventions.
# The following default config allows bootstrapping any ssh server automatically, so take care what git url you are using.
touch $SSH_HST_FILE
cat >$SSH_CFG_FILE <<EOT
Host *
  StrictHostKeyChecking no
EOT

# Optional: Inject private key via ENV for bootstrap (done instead via volume mount from docker-compose or K8S secret)
SSH_KEY=$(cat $SSH_KEY_FILE | base64 -w 0)
[ -f env-vault.conf ] && sed -i.old -e "s|SSH_KEY=.*|SSH_KEY=$SSH_KEY|" env-vault.conf

# Put public key into Git server user or repository settings
echo "##### Public SSH key to be added to Git server user/repository #####"
cat ${SSH_KEY_FILE}.pub

sudo docker-compose up gitea

git clone -b main git@github.com/trustbroker-swiss/xtb-gitops-demo
cd xtb-gitops-demo

cd trustbroker-inventories/DEMO/keystore/token-signer
./setup-signer.sh # my-subject my-passphrase
git commit -m "Created XTB signer" ./

git remote set-url origin ssh://git@localhost:222/trustbroker-swiss/xtb-gitops-demo.git
git push -u origin main

git remote set-url origin http://git@localhost:3000/trustbroker-swiss/xtb-gitops-demo.git
git push

#!/bin/bash
# Fast lane: Wire secrets into your docker-compose.yml and run it with 'docker-compose up' attached to console.
# Below we run it the correct way.

# get secrets
source env-vault.conf

# validate
[ ! -n "$STATECACHE_PASS" ] && echo "ERROR: STATECACHE_PASS undefined" && exit 1
[ ! -n "$PKI_PASSPHRASE" ] && echo "ERROR: PKI_PASSPHRASE undefined" && exit 1
if [ -z "$SSH_KEY" -a -z "$GIT_TOKEN" -a ! -r ssh/id_rsa -a ! -r ssh/git_token ]; then
	echo "INFO: Assuming public access to $GIT_URL"
	echo "HINT: GIT_TOKEN should be defined for private access via ENV or mapped to /etc/trustbroker/keys/git_token"
	echo "HINT: SSH_KEY should be defined for private access via ENV or mapped to /etc/trustbroker/keys/id_rsa"
fi

# run service mesh in foreground
docker compose up

# run service mesh in background and follow trustbroker log
#docker compose up -d
#docker logs -f trustbroker

---
server:
  tomcat:
    threads: # scaling
      max: 100
      min-spare: 50
  servlet:
    session:
      cookie:
        name: BSESSION
  ssl:
    enabled: false

spring:
  datasource:
    url: ${spring.flyway.url}/${spring.flyway.schemas}
    username: trustbroker
    password: ${STATECACHE_PASS}
    driverClassName: ${spring.flyway.driver-class-name}
    hikari:
      maximum-pool-size: 30 # we run 3 pods in PROD => 90 connections max on mariadb (max acceptable is 150 per default)
      connection-timeout: 15000 # DB connection establish timeout in case of network problems (default: 30000ms = 10min)
      minimum-idle: 3 # close connections being idle for idle-timeout except if we have too few afterwards
      idle-timeout: 300000 # maximum connection idle time (default: 600000ms = 10min)
      max-lifetime: 1800000 # maximum connection lifetime in the pool after close (default: 1800000ms = 30min, mariadb has 60min)
      keepalive-time: 600000 # less than max-lifetime using connection-test-query to probe the DB (default: 0ms == disabled)
      connection-test-query: select 1 from dual # probe DB according to keepalive-time
  flyway:
    enabled: true
    url: jdbc:mariadb://mariadb:3306
    user: root
    password: ${STATECACHE_PASS}
    schemas: TBSS16
    driver-class-name: org.mariadb.jdbc.Driver
    locations: [ classpath:db/migration/mariadb ]
    baselineOnMigrate: true # force upgrading XTB schema even though the database is not empty

trustbroker:
  config:
    issuer: http://localhost:8090 # Issuer ID used to identify assertion/token issuer
    perimeterUrl: ${trustbroker.config.issuer} # Override if network endpoint cannot be derived from issuer ID
    adminSecret: 'trustbroker.config.adminSecret'
    traceIdHeader: X-Request-Id # use edge infrastructure injected HTTP header to correlate all logs belonging to a request
    sessionLifetimeSec: 1800 # 30min user login latency on CP/IDP
    ssoSessionLifetimeSec: 43200 # 12h without re-auth when SSO enabled=true and not SAML forceAuthn=true or OIDC prompt=login
    ssoMinQoaLevel: -2 # we allow SSO for any QOA level sent by CP i.e. unspecified having order# -1 is good enough
    handleResponderErrors: false # Pass through CP/IDP SAML responder messages to CP/SP
    # Allow access to some halfway public APIs usually not exposed on internet (header injected by network perimeter)
    network:
      networkHeader: 'X-ClientNetwork'
      internetNetworkName: INTERNET
      intranetNetworkName: INTRANET
    # Support a global signer and the option to read multiple certs from a single keystore (including p12) by picking by name
    signer:
      signerCert: ${TRUSTBROKER_HOME}/configuration/latest/keystore/token-signer/keystore.pem
      password: "${PKI_PASSPHRASE}"
    rolloverSigner:
      signerCert: ${TRUSTBROKER_HOME}/configuration/latest/keystore/token-signer/rollover-keystore.pem
      password: "${PKI_PASSPHRASE}"
    claimsMapping:
      syncSchedule: '0 */1 * * * *' # check for git changes every 1min
    stateCache:
      reapSchedule: '30 * * * * *' # check every minute for collectable sessions (see spring CronExpression)
      reapMaxDelaySec: 25 # randomize actual execution start in multiple instance deployments (K8S replicas)
      targetMaxEntries: 104857 # may number of sessions before garbage collecting the oldest valid ones
      minSessionLifetimeSec: ${trustbroker.config.sessionLifetimeSec}
    secureBrowserHeaders: true # false required for OIDC when XTB runs on http instead of https
    security: # some of the following checks can be configured in RelyingPartySecurityPolicies or ClaimsParty.SecurityPolicies
      tokenLifetimeSec: 3600 # Assertion/Condition/Subject timestamp create/check, override on RP SecurityPolicies.notOnOrAfter
      messageLifetimeSec: 28800 # AuthnRequest/Response/LogoutRequest IssueInstant timestamp check (accepted max)
      notBeforeToleranceSec: -5 # NTP time drift accepted from peer for notBefore timestamps
      notOnOrAfterToleranceSec: 5 # NTP time drift accepted from peer for notOnOrAfter timestamps
      requireSignedAuthnRequest: true # CP/IDP per default expect signed request
      requireSignedResponse: true # CP/IDP per default must sign response
      requireSignedAssertion: true # CP/IDP per default must sign assertion within response
      validateAuthnRequest: true # RP/SP per default must sign request
      validateXmlSchema: true # Peers must comply to SAML protocol schemas pre default
      validateAcs: false # Incoming AssertionConsumerURL is validated against ACWhitelist
      validateRelayState: true # SAML RelayState is required and must match session
      validateAudience: true # SAML audience is matched against XTB issuer if found
      requireAudienceRestriction: false # Non-matching SAML audience results in an error
      validateResponseIssuer: false # SAML response issuer must match ClaimsParty.id (recommended)
      requireSubjectConfirmation: true # SAML responses must contain a SubjectConfirmation element
      validateSubjectConfirmationTimestamp: true # Timestamps must be in range
      validateSubjectConfirmationInResponseTo: true # SAML InResponseTo response attribute must match request ID
      validateRequestIssueInstant: true # Check request IssueInstant timestamp against messageLifeTimeSec
      validateRequestCondition: true # Check Condition before/after timestamps against tokenLifetimeSec and tolerances
      validateResponseIssueInstant: true # Check IssueInstant timestamp against messageLifeTimeSec
      validateAssertionIssueInstant: true # Check IssueInstant timestamp against messageLifeTimeSec
      validateAuthnStatementIssueInstant: true # Check IssueInstant timestamp against messageLifeTimeSec
      doSignAssertions: true # RP/SP responses must contain assertion signed by XTB
      doSignSuccessResponse: true # RP/SP responses must be signed by XTB
      doSignFailureResponse: true # RP/SP responders messages must be signed too
    # global Qoa model defining the order, order then optional in SetupRP/SetupCP
    qoa:
      defaultQoa: 'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport'
      strongestPossible: 'urn:oasis:names:tc:SAML:2.0:ac:classes:SmartcardPKI'
      mapping:
        '[urn:oasis:names:tc:SAML:2.0:ac:classes:MobileOneFactorUnregistered]': 100
        '[urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport]': 200
        '[urn:oasis:names:tc:SAML:2.0:ac:classes:NomadTelephony]': 300
        '[urn:oasis:names:tc:SAML:2.0:ac:classes:SoftwareTimeSyncToken]': 300
        '[urn:oasis:names:tc:SAML:2.0:ac:classes:Kerberos]': 400
        '[urn:oasis:names:tc:SAML:2.0:ac:classes:SoftwarePKI]': 500
        '[urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorContract]': 500
        '[urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken]': 500
        '[urn:oasis:names:tc:SAML:2.0:ac:classes:SmartcardPKI]': 600
    saml:
      consumerUrl: ${trustbroker.config.perimeterUrl}/api/v1/saml # SAML post protocol endpoint
      artifactResolution:
        serviceUrl: ${trustbroker.config.perimeterUrl}/api/v1/saml/arp # SAML artifact resolution protocol endpoint
        index: 0
        artifactLifetimeSecs: 60
        artifactReapIntervalSecs: 300
        persistentCache: true # store artifacts in sessiondb
        truststore:
          signerCert: ${TRUSTBROKER_HOME}/configuration/latest/keystore/outgoing-tls-trust/truststore.p12
          password: "${PKI_PASSPHRASE}"
    oidc:
      issuer: "${trustbroker.config.issuer}" # iss claim setup
      perimeterUrl: "${trustbroker.config.perimeterUrl}/login/saml2/sso" # XTB OIDC federation forward
      sessionMode: IN_DB # use mariadb for state sharing
      endSessionEndpoint: "${trustbroker.config.oidc.issuer}/logout"
      sessionLifetimeSec: ${trustbroker.config.sessionLifetimeSec}
      sessionCookie: true # set additional tracking cookie for clients to detect session termination
      identityProvider:
        assertionConsumerService: "${trustbroker.config.saml.consumerUrl}"
        responseIssuerId: ${trustbroker.config.issuer}
        signer:
          signerCert: ${trustbroker.config.signer.signerCert}
          password: ${trustbroker.config.signer.password}
          keyEntryId: ${trustbroker.config.signer.keyEntryId}
      samlEncrypt: false # encrypt SAML messages sent from XTB/SAML to XTB/OIDC (more SAMl attributes than OIDC claims
      keySchedule: "0 0 1 * * *" # key rotation daily at 1 am (see spring CronExpression)
      keyExpirationMinutes: 2880 # keys valid for 48 hours (requires clients to fetch keys at least once a day)
      keyDeletionMinutes: 3000 # keys kept 2h longer in the database for debugging
      defaultQoa: "urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified" # fallback for acr_values claims
      # Globally customize /token and /userinfo output dropping technical claims (typ=JWT and iss=issuer we keep for now)
      addTokenClaims: # used on /token endpoint to whitelist OIDC technical claims
        - acr # auth context class refs
        - aud # audience => client_id and other audiences
        - auth_time # authorize time
        - azp # authorized party => client_id
        - exp # token expiration
        - iat # token issued at
        - iss # OIDC issuer ID
        - jti # JSON token ID
        - nbf # token valid not before
        - nonce # message only once ID
        - scope # claims selection
        - session_state # OIDC session spec (future)
        - sid # front channel logout session ID
        - typ # keycloak specific token typing
      removeUserInfoClaims: # used in /userinfo endpoint to blacklist OIDC technical claims (i.e. remove them from response)
        - aud
        - auth_time
        - azp
        - exp
        - iat
        - jti
        - nbf
        - nonce
        - scope
        - session_state
        - sid
    gui:
      defaultLanguage: de # XTB supports de,fre,it,en per default
      features:
        - HEADER
        - FOOTER
      buttons:
        - HELP_PANEL # or HELP_LINK
        - LANGUAGE_SHORT # or LANGUAGE_LONG
      themeCookie:
        name: THEME
        defaultValue: default
        values:
          - default
      languageCookie:
        name: LANG
    skinnyHrdTriggers: # MSIE workaround using a hard-coded HRD handling instead of the standard application
      - name: 'User-Agent'
        regex: '.*Trident/7.*'
        value: '/skinnyColHRD.html'

logging:
  level:
    root: INFO
    swiss.trustbroker.script: DEBUG

<?xml version="1.0" encoding="utf-8"?>
<!-- Define the HRD tiles for the claims parties defined in SetupCP_*.xml -->
<ClaimsProviderDefinitions>
	<ClaimsProvider name="SamlMock-1"
					id="urn:trustbroker.swiss:idp:SAML-MOCK-1"
					img="Tile_SAML-Mock.svg"
					description="saml-mock-1"
					shortcut="SM" color="#11AABB"
	/>
	<ClaimsProvider name="SamlMock-2"
					id="urn:trustbroker.swiss:idp:SAML-MOCK-2"
					img="Tile_SAML-Mock.svg"
					description="saml-mock-2"
					shortcut="SM2" color="#FFAA33"
	/>
	<ClaimsProvider name="SamlMock-2"
					id="urn:trustbroker.swiss:idp:SAML-MOCK-3"
					img="Tile_SAML-Mock-3.svg"
					description="saml-mock-3"
					shortcut="SM2" color="#FFAA33"
	/>
</ClaimsProviderDefinitions>

<?xml version="1.0" encoding="utf-8"?>
<!--
Define SSO groups and their lifecycle to join multiple relying parties into a single per CP login session:
- name: SSO group name used in RelyingParty.SSO element
- maxIdleTimeMinutes: Time until the SSO session expires without any interaction from any SSO participants
- maxSessionTimeMinutes: Time until the SSO session expires unconditionally
- maxCachingTimeMinutes: Set this one to the same value as maxSessionTimeMinutes (future feature may be)
-->
<SSOGroupSetup>
	<SSOGroup name="SSO-GROUP-1"
			  maxIdleTimeMinutes="120"
			  maxSessionTimeMinutes="600"
			  maxCachingTimeMinutes="600"
	/>
</SSOGroupSetup>

<?xml version="1.0" encoding="utf-8"?>
<ClaimsProviderSetup>
	<ClaimsParty id="urn:trustbroker.swiss:idp:SAML-MOCK-1">
		<SSOUrl>http://localhost:7070/auth/saml2/idp/samples</SSOUrl>
		<Certificates>
			<SignerTruststore>
				<CertPath>token-signer/keystore.pem</CertPath>
				<Password>$PKI_PASSPHRASE</Password>
			</SignerTruststore>
		</Certificates>
		<Saml>
			<ArtifactBinding inboundMode="SUPPORTED" outboundMode="SUPPORTED"/>
		</Saml>
		<!-- CP attributes to be propagated -->
		<AttributesSelection>
			<Definition name="EMail" namespaceUri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"/>
			<Definition name="FirstName" namespaceUri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname"/>
			<Definition name="FamilyName" namespaceUri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname"/>
		</AttributesSelection>
	</ClaimsParty>
</ClaimsProviderSetup>

<?xml version="1.0" encoding="utf-8"?>
<!-- A base profile defines defaults used by all RelyingParty setups referring to it -->
<RelyingParty>
	<Certificates>
		<!-- Signer towards all RPs -->
		<SignerKeystore>
			<CertPath>token-signer/keystore.pem</CertPath>
			<Password>$PKI_PASSPHRASE</Password>
		</SignerKeystore>
		<!-- Fallback: We only trust ourselves -->
		<SignerTruststore>
			<CertPath>token-signer/keystore.pem</CertPath>
			<Password>$PKI_PASSPHRASE</Password>
		</SignerTruststore>
	</Certificates>
	<SecurityPolicies
			notOnOrAfterSeconds="3600"
			requireSignedAuthnRequest="true"
			requireSignedLogoutRequest="true"
			validateXmlSchema="true"
	/>
	<Oidc>
		<Client id="template">
			<!-- Access restrictions (development only) -->
			<RedirectUris>
				<ACUrl>https://oidcdebugger.com/debug</ACUrl>
				<ACUrl>http://localhost:0/.*</ACUrl>
			</RedirectUris>
			<!-- PKCE code flow with requireProofKey=true and client authentication none -->
			<OidcSecurityPolicies
					requireProofKey="true"
					tokenTimeToLiveMin="60"
					refreshTokenTimeToLiveMin="60"
			/>
			<!-- Supported subset of https://openid.net/specs/openid-connect-core-1_0.html#TokenRequest -->
			<AuthorizationGrantTypes>
				<GrantType>authorization_code</GrantType>
				<GrantType>refresh_token</GrantType>
			</AuthorizationGrantTypes>
			<!-- Supported subset of https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication -->
			<ClientAuthenticationMethods>
				<Method>none</Method>
				<Method>client_secret_basic</Method>
				<Method>client_secret_post</Method>
			</ClientAuthenticationMethods>
			<!-- Scopes see https://openid.net/specs/openid-connect-core-1_0.html#ScopeClaims -->
			<Scopes>
				<Scope>openid</Scope>
				<Scope>profile</Scope>
				<Scope>email</Scope>
			</Scopes>
			<!-- Claims see at https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims -->
			<ClaimsSelection>
				<Definition name="EMail" namespaceUri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"
							oidcNames="email" multiValued="STRING"/>
				<Definition name="FirstName" namespaceUri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname"
							oidcNames="given_name"/>
				<Definition name="Name" namespaceUri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname"
							oidcNames="family_name"/>
				<Definition name="dateOfBirth" namespaceUri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dateofbirth"
							oidcNames="birthdate" multiValued="STRING" oidcMapper="TIME_EPOCH"/>
				<Definition name="address" namespaceUri="address"
							oidcNames="address"/>
				<Definition name="displayName" namespaceUri="2.16.840.1.113730.3.1.241"
							oidcNames="name" multiValued="LIST"/>
				<Definition name="displayName" namespaceUri="2.16.840.1.113730.3.1.241"
							oidcNames="name" multiValued="LIST"/>
			</ClaimsSelection>
		</Client>
	</Oidc>
	<Saml>
		<ArtifactBinding inboundMode="SUPPORTED" outboundMode="SUPPORTED"/>
		<!-- XML security defaults according to https://www.w3.org/TR/xmlsec-algorithms/ -->
		<Signature>
			<CanonicalizationAlgorithm>http://www.w3.org/2001/10/xml-exc-c14n#</CanonicalizationAlgorithm>
			<SignatureMethodAlgorithm>http://www.w3.org/2001/04/xmldsig-more#rsa-sha256</SignatureMethodAlgorithm>
			<DigestMethod>http://www.w3.org/2001/04/xmlenc#sha256</DigestMethod>
		</Signature>
	</Saml>
	<!-- SSO also is used in disabled mode so XTB knows where to send the LogoutResponse to -->
	<SSO enabled="false" sloUrl="please-define-if-rp-does-saml-logouts"/>
	<!-- Processing: Accepted incoming original issuer attributes -->
	<AttributesSelection>
		<Definition name="EMail" namespaceUri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"/>
		<Definition name="FirstName" namespaceUri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname"/>
		<Definition name="FamilyName" namespaceUri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname"/>
		<Definition name="dateOfBirth" namespaceUri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dateofbirth"/>
		<Definition name="displayName" namespaceUri="2.16.840.1.113730.3.1.241"/>
		<!-- CP is visible only in SAML OriginalIssuer in RP response. Make it visible as an OIDC claim. -->
		<Definition name="HomeRealmHint" namespaceUri="HomeRealmHint" oidcNames="homerealmhint"/>
	</AttributesSelection>
	<!-- Processing: Attributes computed in groovy scripts. It's possible to use oidcNames declarations already on any selection definition. -->
	<PropertiesSelection>
		<!-- Computed birthdate can be picked exclusively (remove from AttributesSelection above, or in the groovy script. -->
		<Definition name="displayName" namespaceUri="2.16.840.1.113730.3.1.241" oidcNames="name" multiValued="LIST"/>
		<!-- ssoSessionId is an XTB specific claim that allows to identify the federation session source -->
		<Definition name="ssoSessionId" namespaceUri="http://trustbroker.swiss/claims/ssoSessionId" oidcNames="ssoSessionId"/>
	</PropertiesSelection>
	<!-- Processing: All RP side hooks dumping provided request/response data -->
	<Scripts>
		<Script type="BeforeHrd">DebugRpRequest.groovy</Script>
		<Script type="BeforeIdm">DebugCpResponse.groovy</Script>
		<Script type="AfterIdm">DebugCpResponse.groovy</Script>
		<Script type="OnToken">DebugCpResponse.groovy</Script>
		<Script type="OnUserInfo">DebugCpResponse.groovy</Script>
	</Scripts>
</RelyingParty>

<?xml version="1.0" encoding="utf-8"?>
<!-- relying party setup showing the basics of non-SSO usage -->
<RelyingPartySetup>
	<RelyingParty id="urn:trustbroker.swiss:sp:DEMO-RP-1" base="ProfileRP_DemoDefaults.xml">
		<ACWhitelist>
			<ACUrl>http://localhost:7070/authn/consumer</ACUrl>
		</ACWhitelist>
		<Saml>
			<ProtocolEndpoints>
				<MetadataUrl>http://localhost:7070/saml/metadata</MetadataUrl>
				<ArtifactResolutionUrl>http://localhost:7070/authn/arp</ArtifactResolutionUrl>
				<ArtifactResolutionIndex>0</ArtifactResolutionIndex>
			</ProtocolEndpoints>
			<ArtifactBinding inboundMode="SUPPORTED" outboundMode="SUPPORTED"/>
		</Saml>
		<SSO enabled="false" sloUrl="http://localhost:7070/auth/saml/slo"/>
		<ClaimsProviderMappings>
			<ClaimsProvider id="urn:trustbroker.swiss:idp:SAML-MOCK-1"/>
			<ClaimsProvider id="urn:trustbroker.swiss:idp:SAML-MOCK-2"/>
			<ClaimsProvider id="urn:trustbroker.swiss:idp:SAML-MOCK-3"/>
			<!-- invisible but addressable CP, remove the previous entry to make SAML-MOCK-3 invisible on the HRD screen -->
			<ClaimsProvider id="urn:trustbroker.swiss:idp:SAML-MOCK-3" relyingPartyAlias="urn:trustbroker.swiss:sp:DEMO-RP-3"/>
		</ClaimsProviderMappings>
		<Scripts>
			<Script type="BeforeHrd">HrdAutoSelectClaimsProvider.groovy</Script>
			<Script type="AfterIdm">ComputeDerivedAttributes.groovy</Script>
		</Scripts>
	</RelyingParty>
</RelyingPartySetup>

<?xml version="1.0" encoding="utf-8"?>
<RelyingPartySetup>
	<RelyingParty id="urn:trustbroker.swiss:sp:QOA-RP-2" base="ProfileRP_DemoDefaults.xml">
		<ACWhitelist>
			<ACUrl>http://localhost:7070/authn/consumer</ACUrl>
		</ACWhitelist>
		<SSO enabled="false" sloUrl="http://localhost:7070/auth/saml/slo"/>
		<ClaimsProviderMappings>
			<ClaimsProvider id="urn:trustbroker.swiss:idp:SAML-MOCK-2"/>
		</ClaimsProviderMappings>
		<Qoa enforce="true">
			<!-- Accepted Qoa names sent by RPs, order number is optional if trustbroker.config.qoa defines a global model -->
			<ACClass order="099">qoa-099-custom</ACClass>
			<ACClass order="100">urn:oasis:names:tc:SAML:2.0:ac:classes:MobileOneFactorUnregistered</ACClass>
			<ACClass order="200">urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</ACClass>
			<ACClass order="300">urn:oasis:names:tc:SAML:2.0:ac:classes:NomadTelephony</ACClass>
			<ACClass order="301">urn:oasis:names:tc:SAML:2.0:ac:classes:SoftwareTimeSyncToken</ACClass>
			<ACClass order="400">urn:oasis:names:tc:SAML:2.0:ac:classes:Kerberos</ACClass>
			<ACClass order="500">urn:oasis:names:tc:SAML:2.0:ac:classes:SoftwarePKI</ACClass>
			<ACClass order="501">urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorContract</ACClass>
			<ACClass order="502">urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken</ACClass>
			<ACClass order="600">urn:oasis:names:tc:SAML:2.0:ac:classes:MobileOneSmartcardPKIFactorUnregistered</ACClass>
		</Qoa>
	</RelyingParty>
</RelyingPartySetup>

<?xml version="1.0" encoding="utf-8"?>
<ClaimsProviderSetup>
	<ClaimsParty id="urn:trustbroker.swiss:idp:SAML-MOCK-2">
		<SSOUrl>http://localhost:7070/auth/saml2/idp/samples</SSOUrl>
		<Certificates>
			<SignerTruststore>
				<CertPath>token-signer/keystore.pem</CertPath>
				<Password>$PKI_PASSPHRASE</Password>
			</SignerTruststore>
		</Certificates>
		<SecurityPolicies
				requireSignedResponse="true"
				validateXmlSchema="true"
		/>
		<Saml>
			<ArtifactBinding inboundMode="SUPPORTED" outboundMode="SUPPORTED"/>
		</Saml>
		<!-- use another claim as NameID on CP side -->
		<SubjectNameMappings preserve="false">
			<SubjectName
					issuer="urn:trustbroker.swiss:idp:SAML-MOCK-2"
					source="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"
					format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
			/>
		</SubjectNameMappings>
		<!-- CP-side QoA supported mapped from RP-side context classes (100 and 600 not supported by CP) -->
		<!-- SAML comparisonType=exact is default, minimum is used when RP does not send it,  -->
		<Qoa enforce="true" comparison="minimum">
			<ACClass order="099">urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</ACClass>
			<ACClass order="200">urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</ACClass>
			<ACClass order="300">urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorContract</ACClass>
			<ACClass order="301">urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorContract</ACClass>
			<ACClass order="400">urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorContract</ACClass>
			<ACClass order="500">urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorContract</ACClass>
			<ACClass order="501">urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorContract</ACClass>
		</Qoa>
		<!-- CP attributes to be propagated -->
		<AttributesSelection>
			<Definition name="EMail" namespaceUri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"/>
			<Definition name="FirstName" namespaceUri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname"/>
			<Definition name="FamilyName" namespaceUri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname"/>
			<!-- https://schemas.xmlsoap.org/ws/2005/05/identity/Identity_Selector_Interoperability_Profile_V1.5.pdf -->
			<Definition name="dateOfBirth" namespaceUri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dateofbirth"/>
			<!-- https://docs.ldap.com/specs/rfc2798.txt (source 1) -->
			<Definition name="displayName" namespaceUri="2.16.840.1.113730.3.1.241"/>
			<!-- IDP sending HRD name for some users -->
			<Definition name="HomeRealmHint" namespaceUri="HomeRealmHint"/>
		</AttributesSelection>
		<Scripts>
			<!-- Incoming from CP we can already validate and compute some derived claims -->
			<Script type="BeforeIdm">ComputeDerivedAttributes.groovy</Script>
		</Scripts>
	</ClaimsParty>
</ClaimsProviderSetup>

#!/bin/bash
# Script allows to speed up the configuration loading on XTB.

PERIOD=${1:-5}
while [ true ]; do
	curl -k -X POST http://localhost:8090/api/v1/config \
	     -H 'Content-Type: application/json' \
	     -d '{"action":"reload","adminSecret":"trustbroker.config.adminSecret"}'
	sleep $PERIOD
done

// Purpose: Dump bound SP request date to console (bindings, see ScriptService.java)
// Note: Consider documentation and RPRequest.java members that should be used in scripts.
LOG.debug("DEMO: Process federation request from referer {}", HTTPRequest.getHeader("Referer"))
LOG.trace("DEMO RPRequest: {}", RPRequest)

// Purpose: Show how user-agent context can be used to do IDP dispatching automatically.
// Example: Loadbalancer injecting a network identifier on the network perimeter.
// Security: Either loadbalancer shields the header or IDPs we forward to are save themselves.

strongIdp = "urn:trustbroker.swiss:idp:SAML-MOCK-2"
strongQoa = "urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorContract"

def isMobileStrongAuthOnly(rpRequest) {
	return rpRequest.contextClasses && rpRequest.contextClasses.size() == 1 && rpRequest.contextClasses.contains(strongQoa)
}

if (RPRequest.getClaimsProviders().size() > 1) {
	def networkDetected = HTTPRequest.getHeader("X-ClientNetwork")
	LOG.debug("Checking automatic HRD for rpIssuer={} with qoa={} from network={} towards cpMappings='{}'",
			RPRequest.rpIssuer, RPRequest.contextClasses, networkDetected, RPRequest.claimsProviders)
	if (isMobileStrongAuthOnly(RPRequest) || "INTRANET".equals(networkDetected)) {
		RPRequest.retainClaimsProvider(strongIdp)
		LOG.info("Automatic HRD for rpIssuer={} with qoa={} from network={} towards cpMappings='{}'",
				RPRequest.rpIssuer, RPRequest.contextClasses, networkDetected, RPRequest.claimsProviders)
	}
}

// Purpose: Show how OIDC claim enrichment and structured claim assembly works.
// Note: Implements https://openid.net/specs/openid-connect-core-1_0.html#AddressClaim

// some IDP provided attributes
givenName = "" + CPResponse.getAttribute("http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname")
familiyName = "" + CPResponse.getAttribute("http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname")
// derive OIDC displayName from SAML incoming attributes as OIDC claim only
CPResponse.addClaim("name", givenName + " " + familiyName + " (source:3)")

// derive address from SAML attributes and construct new claim without honoring incoming request scopes
if (CPResponse.oidcScopes && CPResponse.oidcScopes.contains("openid")) {
	CPResponse.addJsonClaim("address", "street_address", "123 " + familiyName + " Street")
	CPResponse.addJsonClaim("address", "locality", "St. " + familiyName)
	CPResponse.addJsonClaim("address", "postal_code", "9999")
	CPResponse.addJsonClaim("address", "country", "Switzerland")
	LOG.info("OnToken hook attached a fake address for clientId={} scopes='{}'", CPResponse.oidcClientId, CPResponse.oidcScopes)
}