##########################################################
#
# Copyright (c) Ergon Informatik AG
# All Rights Reserved.
# 
##########################################################

#
# This is a configuration example for RADIUS authentication with the Airlock Authentication Service
# for the Airlock Configuration Center on WAF 5 and newer.
#
# By default Airlock Configuration Center accounts are only authenticated against local authentication file. 
# To enable RADIUS authentication, replace the placeholders like "<text>" with the corresponding value
# example: replace <your radius server> with the hostname of your RADIUS Server.
#
# Copy this file to /opt/airlock/custom-settings/mgt-auth/authenticator.properties
# Restart the Authenticaton Service: service airlock-mgt-tomcat restart
#

#
# log settings
#
# For debugging purpose set global.logMode to DEBUG
# Note: global.logFile is only used if used on airlock 4.x with special log4j.properties
#
global.logMode=PRODUCTION
global.logComponent=SY-AA
global.logCategory=C
global.logFile=/var/log/airlock/mgt-tomcat/auth.log
global.logMaskPattern=password|token|passphrase

global.usernamevariable=${username}
global.sessionTimeout=5m
global.failureDelayFix=3s
global.failureRandomDelay=1s

#
# password management
#
global.changePasswordForm=change_password.jsp
global.changePasswordSuccessPage=change_password_success.jsp
# regex defining password policy when using properties file 
# for authentication and user is able to change the password himself
#
global.passwordPolicyPattern=.{6,}

#
# language
#
global.languageList=en
global.defaultLanguage=en
#
# airlock cookies
#
global.controlCookieName=AL_CONTROL
global.environmentCookiePrefix=AL_ENV_

#
# pages or redirects to show after login/logout (NOTE: only one at once can be defined)
# both may be overriden by 'Location' parameter.
#
global.defaultLoginSuccessPage=login_success.jsp
#global.defaultLoginSuccessRedirectURL=https://entryserver/myapp/welcome.html
global.defaultLogoutSuccessPage=logout_success.jsp
#global.defaultLogoutSuccessRedirectURL=https://entryserver/myapp/bye.hmtl

#
# page for logout confirmation
#
global.defaultLogoutConfirmationPage=logout_confirmation.jsp

#
# allowed redirect url pattern for 'Location' parameter
#
global.allowedRedirectURLPattern=.*

#
# request authorizer
#
requestAuthorizer.enabled=true
requestAuthorizer.delayPeriod=10s
requestAuthorizer.observationPeriod=30m
requestAuthorizer.maxFailedLogins=5
requestAuthorizer.denyURL=denied.jsp
requestAuthorizer.sleepTime=1s

#
# error pages
#
errorPageJSP.default=error.jsp
errorPageJSP.noClientCertificate=error.jsp
errorPageJSP.clientCertNotYetValid=/error/README.txt
errorPageJSP.clientCertExpired=/error/Introduction.html
errorPageJSP.nonInteractiveFailedJSP=cert_failed.jsp
errorPageJSP.noClientCert=cert_missing.jsp

#===============================
# radius server definition 
#-------------------------------
Radius.0.refName=radius01
Radius.0.host=<your radius server>
Radius.0.authPort=1812
Radius.0.acctPort=1813
Radius.0.secret=<somesecret>
Radius.0.connectTimeout=10s
Radius.0.requiresToken=false
Radius.0.testMode=false

Radius.1.refName=radius02
Radius.1.host=<your radius second server>
Radius.1.authPort=1812
Radius.1.acctPort=1813
Radius.1.secret=<somesecret>
Radius.1.connectTimeout=10s
Radius.1.requiresToken=false
Radius.1.testMode=false

#
# Read passphrase from file
#
6.action=setVariableFromProperties
6.src=file:/opt/airlock/custom-settings/mgt-auth/assertion-key.properties
6.key=assertionKey
6.variableName=passphrase

#
# Show login username and password and authenticate, if not authenticated yet
# (no previous session)
#
30.action=getUserCredentials
30.precond=${authenticated}==false
30.url=login.jsp
30.formParam.0.name=username
30.formParam.0.label=${messages.jsp.login.username}
30.formParam.0.validationRegex=(\\p{Print}){1,}
30.formParam.0.type=text
30.formParam.0.size=10
30.formParam.0.maxlength=80
30.formParam.1.name=password
30.formParam.1.label=${messages.jsp.login.password}
30.formParam.1.validationRegex=.{6,}
30.formParam.1.type=password
30.formParam.1.size=10
30.formParam.1.maxlength=80

#
# set variable isLocalUser to false by default 
#
31.action=setVariable
31.variableName=isLocalUser
31.value=false

#===============================
# check if user has a local role, so it is a local user
#-------------------------------
32.action=setVariableFromProperties
32.src=file://opt/airlock/custom-settings/mgt-auth/roles.properties
32.key=${username}
32.variableName=role

#
# set variable isLocalUser to true
# if username matches pattern
#
33.action=setVariable
33.precond=$regex.matches(${role}, "^airlock-.+")
33.variableName=isLocalUser
33.value=true

35.action=authenticatePropFile
35.precond=${isLocalUser}==true
35.src=file:/opt/airlock/custom-settings/mgt-auth/password.properties
35.cipherMode=MD5+SALT
35.username=${username}
35.password=${password}


#
# If user was not defined locally, authenticate using RADIUS
#
41.action=authenticateRadius
41.precond=${isLocalUser}==false && ${authenticated}==false
41.radiusServer=radius01,radius02
41.username=${username}
41.password=${password}

#
# Set static role "airlock-administrator" for RADIUS authenticated users
#
43.action=setVariable
43.precond=${isLocalUser}==false && ${authenticated}==true
43.variableName=role
43.value=airlock-administrator
#
# (re) issue an assertion
#
# The format of the assertion must be 'user!role[,role]!requestAddr'
# see com.visonys.airlock.alec.webclient.authentication.AlecAssertion
#
70.action=setVariable
70.variableName=assertionvalue
70.value=${username}!${role}!${request.ip}

80.action=setVariable
80.variableName=encrypted
80.value=$assertiontool.createAssertion($assertionvalue,$passphrase,"10s")

#
# this is for logging in authentication service, so we know the role we assigned
#
90.action=setControlCookie
90.command=SET_CREDENTIALS
90.value=${role}

#
# redirect to sso target
#
95.action=redirect
95.precond=$regex.matches(${Location}, ".*[?].*")
95.url=${Location}&alecAssertion=${encrypted}

97.action=redirect
97.precond=$regex.matches(${Location}, ".*[^?].*")
97.url=${Location}?alecAssertion=${encrypted}

#
# default redirect to configuration center
#
99.action=redirect
99.url=/airlock/alec_security_check?alecAssertion=${encrypted}

