##########################################################
#
# Copyright (c) Ergon Informatik AG
# All Rights Reserved.
# 
##########################################################

#
# This is a configuration example for authentication against LDAP with the Airlock Authentication Service
# for the Airlock Configuration Center on WAF 5 and newer.
#
# By default Airlock Configuration Center accounts are only authenticated against local authentication file. 
# To enable ldap authentication, replace the placeholders like "<text>" with the corresponding value
# example: replace <ldap server IP> with the IP of your ldap Server e.g 172.18.60.169
#
# Copy this file to /opt/airlock/custom-settings/mgt-auth/authenticator.properties
# Restart the Authenticaton Service: service airlock-mgt-tomcat restart
#
# $Id: authenticator.properties $ 
#

#
# log settings
#
# For debugging purpose set global.logMode to DEBUG
# Note: global.logFile is only used if used on airlock 4.x with special log4j.properties
#
global.logMode=PRODUCTION
global.logComponent=SY-AA
global.logCategory=C
global.logFile=/var/log/airlock/mgt-tomcat/auth.log
global.logMaskPattern=password|token|passphrase

global.usernamevariable=${username}
global.sessionTimeout=5m
global.failureDelayFix=3s
global.failureRandomDelay=1s

#
# password management
#
global.changePasswordForm=change_password.jsp
global.changePasswordSuccessPage=change_password_success.jsp
# regex defining password policy when using properties file 
# for authentication and user is able to change the password himself
#
global.passwordPolicyPattern=.{6,}

#
# language
#
global.languageList=en
global.defaultLanguage=en
#
# airlock cookies
#
global.controlCookieName=AL_CONTROL
global.environmentCookiePrefix=AL_ENV_

#
# pages or redirects to show after login/logout (NOTE: only one at once can be defined)
# both may be overriden by 'Location' parameter.
#
global.defaultLoginSuccessPage=login_success.jsp
#global.defaultLoginSuccessRedirectURL=https://entryserver/myapp/welcome.html
global.defaultLogoutSuccessPage=logout_success.jsp
#global.defaultLogoutSuccessRedirectURL=https://entryserver/myapp/bye.hmtl

#
# page for logout confirmation
#
global.defaultLogoutConfirmationPage=logout_confirmation.jsp

#
# allowed redirect url pattern for 'Location' parameter
#
global.allowedRedirectURLPattern=.*

#
# request authorizer
#
requestAuthorizer.enabled=true
requestAuthorizer.delayPeriod=10s
requestAuthorizer.observationPeriod=30m
requestAuthorizer.maxFailedLogins=5
requestAuthorizer.denyURL=denied.jsp
requestAuthorizer.sleepTime=1s

#
# error pages
#
errorPageJSP.default=error.jsp
errorPageJSP.noClientCertificate=error.jsp
errorPageJSP.clientCertNotYetValid=/error/README.txt
errorPageJSP.clientCertExpired=/error/Introduction.html
errorPageJSP.nonInteractiveFailedJSP=cert_failed.jsp
errorPageJSP.noClientCert=cert_missing.jsp

#===============================
# ldap server definition 
#-------------------------------
ldap.0.refName=LDAP_Server0
ldap.0.testMode=false
ldap.0.url=ldap://<ldap server IP>:389
ldap.0.timeout=10s
ldap.0.authenticationMethod=simple
ldap.0.username=<tech user>
ldap.0.password=<tech user password>

#
# Read passphrase from file
#
6.action=setVariableFromProperties
6.src=file:/opt/airlock/custom-settings/mgt-auth/assertion-key.properties
6.key=assertionKey
6.variableName=passphrase

#
# Show login username and password and authenticate
#
30.action=getUserCredentials
30.url=login.jsp
30.formParam.0.name=username
30.formParam.0.label=${messages.jsp.login.username}
30.formParam.0.validationRegex=(\\p{Print}){1,}
30.formParam.0.type=text
30.formParam.0.size=10
30.formParam.0.maxlength=80
30.formParam.1.name=password
30.formParam.1.label=${messages.jsp.login.password}
30.formParam.1.validationRegex=.{6,}
30.formParam.1.type=password
30.formParam.1.size=10
30.formParam.1.maxlength=80

#
# set variable isLocalUser to false by default 
#
31.action=setVariable
31.variableName=isLocalUser
31.value=false

#===============================
# check if user has a local role, so it is a local user
#-------------------------------
32.action=setVariableFromProperties
32.src=file://opt/airlock/custom-settings/mgt-auth/roles.properties
32.key=${username}
32.variableName=role

#
# set variable isLocalUser to true
# if username matches pattern
#
33.action=setVariable
33.precond=$regex.matches(${role}, "^airlock-.+")
33.variableName=isLocalUser
33.value=true

35.action=authenticatePropFile
35.precond=${isLocalUser}==true
35.src=file:/opt/airlock/custom-settings/mgt-auth/password.properties
35.cipherMode=MD5+SALT
35.username=${username}
35.password=${password}

#===============================
# authenticate the user on ldap
#
40.action=setVariableFromLDAP
40.precond=${isLocalUser}==false
40.ldapServer=LDAP_Server0
40.searchDN=<search dn>
40.searchFilter=cn=$!{username}
40.searchScope=subtree
40.resultPrefix=userpref
40.multiValueSeparator=;

#
# try to authenticate user on ldap (if isLocalUser=false)
#
41.action=authenticateLDAP
41.precond=${isLocalUser}==false
41.ldapServer=LDAP_Server0
41.searchDN=<search dn>
41.username=cn=${userpref.cn},<search dn>
41.password=${password}

#===============================
# resolve users memberships
# (only airlock groups)
#-------------------------------
45.action=setVariableFromLDAP
45.precond=${isLocalUser}==false
45.ldapServer=LDAP_Server0
45.searchDN=<search dn>
45.searchFilter=cn=$!{username}
45.searchScope=subtree
45.resultPrefix=grouppref
45.returningAttributes=memberOf
45.includePattern=cn=airlock-supervisor.+|cn=airlock-administrator.+|cn=airlock-auditor.+|cn=airlock-app-admin.+
45.multiValueSeparator=;

#===============================
# abort workflow if user does not belong to any airlock group
#-------------------------------
46.action=abort
46.precond=${isLocalUser}==false && $regex.matches($!{grouppref.memberOf},"^$")
46.message=msg.error.nogroup

#===============================
# evaluate roles to set
#-------------------------------
47.action=setVariable
47.precond=${isLocalUser}==false && $regex.matches($!{grouppref.memberOf},"cn=airlock-.+")
47.variableName=role
47.value=$!{grouppref.memberOf.replaceAll("cn=","").replaceAll(",[^;]*","").replaceAll(";",",")}

#
# (re) issue an assertion
#
# The format of the assertion must be 'user!role[,role]!requestAddr'
# see com.visonys.airlock.alec.webclient.authentication.AlecAssertion
#
70.action=setVariable
70.variableName=assertionvalue
70.value=${username}!${role}!${request.ip}

80.action=setVariable
80.variableName=encrypted
80.value=$assertiontool.createAssertion($assertionvalue,$passphrase,"10s")

#
# this is for logging in authentication service, so we know the role we assigned
#
90.action=setControlCookie
90.command=SET_CREDENTIALS
90.value=${role}

#
# redirect to sso target
#
95.action=redirect
95.precond=$regex.matches(${Location}, ".*[?].*")
95.url=${Location}&alecAssertion=${encrypted}

97.action=redirect
97.precond=$regex.matches(${Location}, ".*[^?].*")
97.url=${Location}?alecAssertion=${encrypted}

#
# default redirect to configuration center
#
99.action=redirect
99.url=/airlock/alec_security_check?alecAssertion=${encrypted}



