#
# ECAS Software
# Copyright (c) 2014 European Commission
# Licensed under the EUPL
# You may not use this work except in compliance with the Licence.
# You may obtain a copy of the Licence at:
# http://ec.europa.eu/idabc/eupl
#
# This product includes the CAS software developed by Yale University,
# Copyright (c) 2000-2004 Yale University. All rights reserved.
# THE CAS SOFTWARE IS PROVIDED "AS IS," AND ANY EXPRESS OR IMPLIED
# WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
# MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, ARE EXPRESSLY
# DISCLAIMED. IN NO EVENT SHALL YALE UNIVERSITY OR ITS EMPLOYEES BE
# LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED, THE COSTS OF
# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA OR
# PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
# LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
# NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
# SOFTWARE, EVEN IF ADVISED IN ADVANCE OF THE POSSIBILITY OF SUCH
# DAMAGE.
#

###############################################################################
#                                                                             #
#   ECAS Server properties file - ecas.properties                             #
#                                                                             #
###############################################################################
ejb/LDAP/ContextFactory=
ejb/LDAP/Strong/BaseDN=dc=commission,dc=europa,dc=eu
strong.ldap.passwordPolicies.dn=,dc=commission,dc=europa,dc=eu
ejb/LDAP/MailSettingsDn=,dc=commission,dc=europa,dc=eu
ejb/Mail/URL=https://mockupserver:1234/ecas/
strong.ldap.openidconnect.applications.dn=ou=OpenIDConnect,ou=ClientApplications,dc=commission,dc=europa,dc=eu

ejb/external/details/url=
ejb/LDAP/Master=dummy

# Timeout settings for the ticket caches:
edu.yale.its.tp.cas.grantingTimeout=46800
edu.yale.its.tp.cas.serviceTimeout=300
edu.yale.its.tp.cas.loginTimeout=3600
eu.cec.digit.ecas.transactionTimeout=600
eu.cec.digit.ecas.signatureTimeout=3600
eu.cec.digit.ecas.loginRequestTransactionTimeout=3600

strong.ldap.pool.maxActive=
strong.ldap.pool.maxIdle=
strong.ldap.pool.maxWait=
strong.ldap.pool.minIdle=
strong.ldap.pool.batchIncrement=
strong.ldap.pool.numTestsPerEvictionRun=
strong.ldap.pool.testOnCreate=
strong.ldap.pool.testOnBorrow=
strong.ldap.pool.testOnReturn=
strong.ldap.pool.testWhileIdle=
strong.ldap.pool.timeBetweenEvictionRunsMillis=
strong.ldap.pool.minEvictableIdleTimeMillis=
strong.ldap.pool.softMinEvictableIdleTimeMillis=
strong.ldap.pool.whenExhaustedAction=
strong.ldap.pool.monitor.creation=
strong.ldap.pool.monitor.destruction=
strong.ldap.pool.monitor.validation=
strong.ldap.pool.monitor.activation=
strong.ldap.pool.monitor.passivation=
strong.ldap.pool.command.timeout.millis=
strong.ldap.pool.connect.timeout.millis=15000
strong.ldap.pool.read.timeout.millis=15000

# GUESTS:
guests.cudgroup=AIDA_SELFRG

# For now, the GroupHandler implementing class has to match the one in ecas-jaas.config
ecas.auth.groupHandler=eu.cec.digit.ecas.auth.provider.EcasGroupHandler
## The defaultStrength used for authentication, may be PASSWORD for a real ECAS or BASIC for a Mock-up Server
ecas.auth.defaultStrength=BASIC
## The ordered list of strengths which can be used in ECAS (all the strengths defined here must also exist in ecas-jaas.config)
## The order of the strengths is only taken from this property (the order in JAAS does not matter)
ecas.auth.orderedEnabledStrengths=BASIC,MOBILE_APP,PASSWORD_MOBILE_APP,PASSWORD_SOFTWARE_TOKEN,PASSWORD_SMS,PASSWORD_TOKEN,PASSWORD_TOKEN_CRAM,STORK,SOCIAL_NETWORKS,CLIENT_CERT
## These are the default strengths for /cas/login, which are used only when no strength is requested by the client:
ecas.auth.ecas.defaultStrengths=BASIC,MOBILE_APP,PASSWORD_MOBILE_APP,PASSWORD_SOFTWARE_TOKEN,PASSWORD_SMS,PASSWORD_TOKEN,PASSWORD_TOKEN_CRAM,STORK,SOCIAL_NETWORKS,CLIENT_CERT
## These are the previous default strengths per version, which are used only when no strength is requested by the client:
ecas.auth.client.defaultStrengths.version.1.11=BASIC,CLIENT_CERT
ecas.auth.client.defaultStrengths.version.1.18=BASIC,PASSWORD_SMS,CLIENT_CERT
ecas.auth.client.defaultStrengths.version.3.1=BASIC,PASSWORD_SMS,PASSWORD_TOKEN,CLIENT_CERT

ecas.auth.adminStrengths=PASSWORD_SMS,MOBILE_APP,PASSWORD_MOBILE_APP,PASSWORD_SOFTWARE_TOKEN,PASSWORD_SMS,PASSWORD_TOKEN,PASSWORD_TOKEN_CRAM
ecas.auth.admin.multiFactorEnforced=true
ecas.auth.jaasConfigFile=ecas-jaas.config

# Do we have to check whether new passwords are the same as basic passwords (Internet) ?
ecas.policy.basicPassword.checkEnabled=true

# Stats persistence interval in milliseconds:
stats.persistence.interval=300000

contextRoot.cas=cas
#contextRoot.ecas=cas/ec
contextRoot.ecas.redir=ecas

ecas.hostname=eulogin-mock-server
ecas.port.HTTP=7101
ecas.port.HTTPS=7102
ecas.port.HTTPS.2waySSL=7103

ecas.production.hostname=ecas.cc.cec.eu.int
ecas.production.port.HTTP=7001
ecas.production.port.HTTPS=7002
ecas.production.port.HTTPS.2waySSL=7003

# expected concurrency level (i.e. number of concurrent threads):
expectedConcurrency=64

authentication.domains.dn=ou=AuthenticationDomains,dc=commission,dc=europa,dc=eu
domain.categories.dn=ou=DomainCategories,dc=commission,dc=europa,dc=eu

# implementation classes:
signature.service=eu.cec.digit.ecas.signature.impl.SignatureControllerImpl

# DaoFactory:
dao.factory=eu.cec.digit.ecas.data.impl.PropertyDaoFactory
dao.user=eu.europa.ec.ecas.mockup.data.impl.UserSaxDao
dao.policy.attributes=eu.europa.ec.ecas.mockup.data.impl.PropertyFilePolicyAttributesDao
dao.authentication.domainsAndCategories=eu.europa.ec.ecas.mockup.data.memory.MemoryAuthenticationDomainsAndCategoriesDao
dao.mail.settings=eu.europa.ec.ecas.mockup.data.memory.MemoryMailSettingsDAO
dao.registration.service=eu.cec.digit.ecas.registration.persistence.impl.DerbyServiceRegistrationDAO
dao.messageResources=eu.cec.digit.ecas.data.impl.derby.DerbyMessageResourcesDAO
dao.monitoringConfig=eu.cec.digit.ecas.data.impl.derby.DerbyMonitoringConfigDAO
dao.antiAbuseProxyConfig=eu.cec.digit.ecas.data.impl.derby.DerbyAntiDenialOfServiceProxyConfigurationDAO
dao.applicationSettings=eu.cec.digit.ecas.data.impl.CompositeApplicationSettingsDAO
dao.stsConfiguration=eu.europa.ec.ecas.sts.data.jaxb.JaxbStsConfigurationDAO
dao.selfRegistration=eu.europa.ec.ecas.mockup.data.memory.SelfRegistrationMockupDao
dao.samlConfiguration=eu.europa.ec.ecas.saml.data.jaxb.JaxbSamlConfigurationDAO
dao.tokenCram=eu.europa.ec.ecas.mockup.data.impl.tokencram.MockTokenCramDAO
dao.mdmCert=eu.europa.ec.ecas.mockup.data.impl.mdm.MockMdmDAO
dao.mdmCert.getDevice.path=/api/v1/dm/devices/
dao.mdmCert.wakeupDevice.path=/api/v1/dm/devices/wakeup/
dao.signature=eu.cec.digit.ecas.data.impl.softwaretoken.Log4jSoftwareTokenSignatureAuditTrailDao

debug.mode=true
mockup.mode=true
mobile.mockup.mode=true
peps.attribute.validation.level=lax
production.mode=false

ecas.default.locale=en
ecas.default.timeZone=Europe/Brussels

captcha.alphabet=ABCDEFGHJKLMNPQRSTUVWXYZabcdefhijkmnpqrstuvwxyz23456789
captcha.minAcceptedWordLength=5
captcha.maxAcceptedWordLength=5
captcha.fonts=Lucida Sans,Lucida Bright
captcha.audio.backgroundSound.enabled=true
captcha.audio.backgroundSound.list=background_0,background_1,background_2,background_3,background_4,background_5,background_6,background_7,background_8,background_9,background_10,background_11,background_12,background_13,background_14
captcha.audio.echoFilter.enabled=true
captcha.audio.echoFilter.echoDelay=250
captcha.audio.echoFilter.decay=5
captcha.audio.pitchFilter.enabled=true
captcha.audio.pitchFilter.pitchMinValue=80
captcha.audio.pitchFilter.pitchMaxValue=110
captcha.audio.voices.de.enabled=klara,reiner,reinhard
captcha.audio.voices.en.enabled=anjali,audrey,charles,claire,crystal,george,jane,john,judith,kate,lauren,mike,patrick,rich
captcha.audio.voices.es.enabled=alberto,daniel,dolores,martha,rene,rosa
captcha.audio.voices.fr.enabled=alain,arnaud,juliette,lutece,pascal

#ECAS XML Schema in all XML messages:
xml.schema=https://ecas.ec.europa.eu/cas/schemas

# comma separated list of IP addresses used for end-to-end monitoring using 2-way SSL
monitoring.ipAddresses=
## configured in reloading properties:
#monitoring.userAgentPatterns=

i18n.supportedLanguages=bg,cs,da,de,et,el,en,es,fr,ga,hr,it,lv,lt,hu,mt,nl,pl,pt,ro,sk,sl,fi,sv

###########################################################################
antiDenialOfService.filters=COSTLY,FRONTEND,BACKEND,OIDC_FRONTEND,OIDC_BACKEND,DEFAULT

antiDenialOfService.DEFAULT.warn.threshold=100
antiDenialOfService.DEFAULT.kick.threshold=200
antiDenialOfService.DEFAULT.ban.threshold=400
antiDenialOfService.DEFAULT.sampling.seconds=1
antiDenialOfService.DEFAULT.kick.release.seconds=900
antiDenialOfService.DEFAULT.ban.release.seconds=3600

antiDenialOfService.DEFAULT.bypass.list=127.0.0.1,eulogin-mock-server
antiDenialOfService.DEFAULT.invalidateCaches.hours=24
antiDenialOfService.DEFAULT.notifyOnKickAndBan=false
antiDenialOfService.DEFAULT.notifyEmailAddresses=

antiDenialOfService.COSTLY.warn.threshold=10
antiDenialOfService.COSTLY.kick.threshold=20
antiDenialOfService.COSTLY.ban.threshold=50
antiDenialOfService.COSTLY.sampling.seconds=1
antiDenialOfService.COSTLY.kick.release.seconds=900
antiDenialOfService.COSTLY.ban.release.seconds=3600

antiDenialOfService.COSTLY.bypass.list=127.0.0.1,eulogin-mock-server
antiDenialOfService.COSTLY.invalidateCaches.hours=24
antiDenialOfService.COSTLY.notifyOnKickAndBan=false
antiDenialOfService.COSTLY.notifyEmailAddresses=

antiDenialOfService.BACKEND.warn.threshold=100
antiDenialOfService.BACKEND.kick.threshold=200
antiDenialOfService.BACKEND.ban.threshold=400
antiDenialOfService.BACKEND.sampling.seconds=1
antiDenialOfService.BACKEND.kick.release.seconds=900
antiDenialOfService.BACKEND.ban.release.seconds=3600

antiDenialOfService.BACKEND.bypass.list=127.0.0.1,eulogin-mock-server
antiDenialOfService.BACKEND.invalidateCaches.hours=24
antiDenialOfService.BACKEND.notifyOnKickAndBan=false
antiDenialOfService.BACKEND.notifyEmailAddresses=

antiDenialOfService.FRONTEND.warn.threshold=100
antiDenialOfService.FRONTEND.kick.threshold=200
antiDenialOfService.FRONTEND.ban.threshold=400
antiDenialOfService.FRONTEND.sampling.seconds=1
antiDenialOfService.FRONTEND.kick.release.seconds=900
antiDenialOfService.FRONTEND.ban.release.seconds=3600

antiDenialOfService.FRONTEND.bypass.list=127.0.0.1,eulogin-mock-server
antiDenialOfService.FRONTEND.invalidateCaches.hours=24
antiDenialOfService.FRONTEND.notifyOnKickAndBan=false
antiDenialOfService.FRONTEND.notifyEmailAddresses=

antiDenialOfService.OIDC_BACKEND.warn.threshold=100
antiDenialOfService.OIDC_BACKEND.kick.threshold=200
antiDenialOfService.OIDC_BACKEND.ban.threshold=400
antiDenialOfService.OIDC_BACKEND.sampling.seconds=1
antiDenialOfService.OIDC_BACKEND.kick.release.seconds=900
antiDenialOfService.OIDC_BACKEND.ban.release.seconds=3600
antiDenialOfService.OIDC_BACKEND.bypass.list=127.0.0.1,eulogin-mock-server
antiDenialOfService.OIDC_BACKEND.invalidateCaches.hours=24
antiDenialOfService.OIDC_BACKEND.notifyOnKickAndBan=false
antiDenialOfService.OIDC_BACKEND.notifyEmailAddresses=

antiDenialOfService.OIDC_FRONTEND.warn.threshold=100
antiDenialOfService.OIDC_FRONTEND.kick.threshold=200
antiDenialOfService.OIDC_FRONTEND.ban.threshold=400
antiDenialOfService.OIDC_FRONTEND.sampling.seconds=1
antiDenialOfService.OIDC_FRONTEND.kick.release.seconds=900
antiDenialOfService.OIDC_FRONTEND.ban.release.seconds=3600
antiDenialOfService.OIDC_FRONTEND.bypass.list=127.0.0.1,eulogin-mock-server
antiDenialOfService.OIDC_FRONTEND.invalidateCaches.hours=24
antiDenialOfService.OIDC_FRONTEND.notifyOnKickAndBan=false
antiDenialOfService.OIDC_FRONTEND.notifyEmailAddresses=
#
antiDenialOfService.load.samplingTimeSeconds=60
###########################################################################

# Denotes if the "sso warn me" checkbox on the login page should be checked by default (true) or not (false)
sso.warning.default.checked=true
# Denotes if the "show account details after login" checkbox on the login page should be checked by default (true) or not (false)
login.showAccount.default.checked=false

#selfcertweb crl url
crl.url=https://eulogin-mock-server:7102/cas/ca/crl

definition.smsChallenge.authn.alphabet=234679ACDEFGHJKLMNPRTUVWXYZ
definition.smsChallenge.authn.groupBy=3
definition.smsChallenge.authn.minLength=9
definition.smsChallenge.authn.maxLength=9
definition.smsChallenge.authn.separator=-
definition.smsChallenge.gsmAddition.alphabet=234679ACDEFGHJKLMNPRTUVWXYZ
definition.smsChallenge.gsmAddition.groupBy=4
definition.smsChallenge.gsmAddition.minLength=8
definition.smsChallenge.gsmAddition.maxLength=8
definition.smsChallenge.gsmAddition.separator=-
definition.smsChallenge.signature.alphabet=234679ACDEFGHJKLMNPRTUVWXYZ
definition.smsChallenge.signature.groupBy=4
definition.smsChallenge.signature.minLength=16
definition.smsChallenge.signature.maxLength=16
definition.smsChallenge.signature.separator=-

definition.sponsorshipCodeService.alphabet=234679ACDEFGHJKLMNPRTUVWXYZ
definition.sponsorshipCodeService.groupBy=3
definition.sponsorshipCodeService.minLength=6
definition.sponsorshipCodeService.maxLength=6
definition.sponsorshipCodeService.separator=-

definition.tokenCram.authnChallenge.alphabet=1234567890
definition.tokenCram.authnChallenge.groupBy=4
definition.tokenCram.authnChallenge.minLength=12
definition.tokenCram.authnChallenge.maxLength=12
definition.tokenCram.authnChallenge.separator=-

definition.tokenCram.authnResponse.alphabet=1234567890
definition.tokenCram.authnResponse.groupBy=4
definition.tokenCram.authnResponse.minLength=12
definition.tokenCram.authnResponse.maxLength=12
definition.tokenCram.authnResponse.separator=-

definition.tokenCram.signature.alphabet=1234567890
definition.tokenCram.signature.groupBy=4
definition.tokenCram.signature.minLength=12
definition.tokenCram.signature.maxLength=12
definition.tokenCram.signature.separator=-

definition.mobile.uniqueDeviceIdentifier.alphabet=234679ACDEFGHJKLMNPRTUVWXYZ
definition.mobile.uniqueDeviceIdentifier.groupBy=8
definition.mobile.uniqueDeviceIdentifier.minLength=64
definition.mobile.uniqueDeviceIdentifier.maxLength=64
definition.mobile.uniqueDeviceIdentifier.separator=-

definition.mobile.softwaretoken.signature.alphabet=234679ACDEFGHJKLMNPRTUVWXYZ
definition.mobile.softwaretoken.signature.length=16
definition.mobile.softwaretoken.signature.minLength=16
definition.mobile.softwaretoken.signature.maxLength=16
definition.mobile.softwaretoken.signature.groupBy=4
definition.mobile.softwaretoken.signature.separator=-
definition.mobile.softwaretoken.signature.macAlgorithm=HmacSHA512


digests.secure=ARG2,SEQ202,SEQ2,SEQ103,SEQ106,SEQ105,SEQ104,SEQ102,SEQ1,SEQH,SXDSHA,ESSHA,SSHA,SHA,CRYPT
digests.history=SEQ106,SEQ105,SEQ104,SEQ103,SEQ102,SEQ1,SEQH,SXDSHA,ESSHA,SSHA,SHA,CRYPT

# RADIUS:
radius.authenticator=eu.cec.digit.ecas.business.authentication.impl.MockRadiusCredentialBasedAuthenticator
radius.configuration=eu.europa.ec.ecas.mockup.business.MockRadiusConfiguration
radius.username.builder=eu.cec.digit.ecas.radius.StrictEcVascoUsernameBuilder

replication.server.host=
replication.server.port=
replication.nodes.hostsAndPorts=

relying.party.url.cache.timeoutSeconds=1
relying.party.url.cache.maximumSize=5000

allocateMemoryOutsideJavaHeap=false
policy.numberOfLastSecureLoginTimes=2

eimWebService.connectTimeoutMillis=30000
eimWebService.readTimeoutMillis=30000

# (01) accountFailureCountTimeout
admin.policy.constraint.AccountFailureCountTimeout.min=600
admin.policy.constraint.AccountFailureCountTimeout.default=900
admin.policy.constraint.AccountFailureCountTimeout.max=15552000
# (02) accountLockoutTimeout
admin.policy.constraint.AccountLockoutTimeout.min=600
admin.policy.constraint.AccountLockoutTimeout.default=900
admin.policy.constraint.AccountLockoutTimeout.max=7200
# (03) passwordAgeMax
admin.policy.constraint.PasswordAgeMax.min=864000
admin.policy.constraint.PasswordAgeMax.default=1576800000
admin.policy.constraint.PasswordAgeMax.max=1576800000
# (04) passwordAgeMaxWarning
admin.policy.constraint.PasswordAgeMaxWarning.min=43600
admin.policy.constraint.PasswordAgeMaxWarning.default=31536000
admin.policy.constraint.PasswordAgeMaxWarning.max=31536000
# (05) passwordAgeMin
admin.policy.constraint.PasswordAgeMin.min=60
admin.policy.constraint.PasswordAgeMin.default=60
admin.policy.constraint.PasswordAgeMin.max=432000
# (06) passwordFailureCountMax
admin.policy.constraint.PasswordFailureCountMax.min=2
admin.policy.constraint.PasswordFailureCountMax.default=5
admin.policy.constraint.PasswordFailureCountMax.max=9
# (07) passwordHistoryCountMax
admin.policy.constraint.PasswordHistoryCountMax.min=2
admin.policy.constraint.PasswordHistoryCountMax.default=5
admin.policy.constraint.PasswordHistoryCountMax.max=9
# (08) passwordLengthMin
admin.policy.constraint.PasswordLengthMin.min=1
admin.policy.constraint.PasswordLengthMin.default=1
admin.policy.constraint.PasswordLengthMin.max=15
# (09) resetCodeAgeMax
admin.policy.constraint.ResetCodeAgeMax.min=60
admin.policy.constraint.ResetCodeAgeMax.default=900
admin.policy.constraint.ResetCodeAgeMax.max=86400
# (10) resetCodeEnabled // 0 = enabled, 1 = disabled
admin.policy.constraint.ResetCodeEnabled.min=0
admin.policy.constraint.ResetCodeEnabled.default=0
admin.policy.constraint.ResetCodeEnabled.max=1
# (11) resetCodeFailureCountMax
admin.policy.constraint.ResetCodeFailureCountMax.min=2
admin.policy.constraint.ResetCodeFailureCountMax.default=5
admin.policy.constraint.ResetCodeFailureCountMax.max=9
# (12) resetCodeRequestCountMax
admin.policy.constraint.ResetCodeRequestCountMax.min=2
admin.policy.constraint.ResetCodeRequestCountMax.default=5
admin.policy.constraint.ResetCodeRequestCountMax.max=100
# (13) smsChallengeAgeMax
admin.policy.constraint.SmsChallengeAgeMax.min=0
admin.policy.constraint.SmsChallengeAgeMax.default=600
admin.policy.constraint.SmsChallengeAgeMax.max=86400
# (14) smsChallengeFailureCountMax
admin.policy.constraint.SmsChallengeFailureCountMax.min=2
admin.policy.constraint.SmsChallengeFailureCountMax.default=5
admin.policy.constraint.SmsChallengeFailureCountMax.max=9
# (15) smsChallengeRequestCountMax
admin.policy.constraint.SmsChallengeRequestCountMax.min=2
admin.policy.constraint.SmsChallengeRequestCountMax.default=5
admin.policy.constraint.SmsChallengeRequestCountMax.max=9
# (16) mobilePhoneCountMax
admin.policy.constraint.MobilePhoneCountMax.min=0
admin.policy.constraint.MobilePhoneCountMax.default=10
admin.policy.constraint.MobilePhoneCountMax.max=10
# (17) mobileDeviceCountMax
admin.policy.constraint.MobileDeviceCountMax.min=0
admin.policy.constraint.MobileDeviceCountMax.default=10
admin.policy.constraint.MobileDeviceCountMax.max=10
# (18) mobileDeviceFailureCountMax
admin.policy.constraint.MobileDeviceFailureCountMax.min=2
admin.policy.constraint.MobileDeviceFailureCountMax.default=5
admin.policy.constraint.MobileDeviceFailureCountMax.max=9
# (19) mobileDeviceRequestCountMax
admin.policy.constraint.MobileDeviceRequestCountMax.min=2
admin.policy.constraint.MobileDeviceRequestCountMax.default=5
admin.policy.constraint.MobileDeviceRequestCountMax.max=9
# (20) tokenCramFailureCountMax
admin.policy.constraint.TokenCramFailureCountMax.min=2
admin.policy.constraint.TokenCramFailureCountMax.default=5
admin.policy.constraint.TokenCramFailureCountMax.max=9
# (21) tokenCramRequestCountMax
admin.policy.constraint.TokenCramRequestCountMax.min=2
admin.policy.constraint.TokenCramRequestCountMax.default=5
admin.policy.constraint.TokenCramRequestCountMax.max=9
# (22) webAuthnDeviceCountMax
admin.policy.constraint.WebAuthnDeviceCountMax.min=0
admin.policy.constraint.WebAuthnDeviceCountMax.default=10
admin.policy.constraint.WebAuthnDeviceCountMax.max=10
# (23) webAuthnDeviceFailureCountMax
admin.policy.constraint.WebAuthnDeviceFailureCountMax.min=2
admin.policy.constraint.WebAuthnDeviceFailureCountMax.default=5
admin.policy.constraint.WebAuthnDeviceFailureCountMax.max=9
# (24) webAuthnDeviceRequestCountMax
admin.policy.constraint.WebAuthnDeviceRequestCountMax.min=2
admin.policy.constraint.WebAuthnDeviceRequestCountMax.default=5
admin.policy.constraint.WebAuthnDeviceRequestCountMax.max=9


########################################################
# Compression implementation
########################################################
compression.implementation=JZLIB

########################################################
# Ecas Mobile
########################################################
ecasMobile.pushService.providerFactory=eu.europa.ec.ecas.mockup.mobile.push.MockPushMessageServiceProviderFactory
ecasMobile.pushService.apple.productionMode=false
ecasMobile.passwordAuthService=eu.cec.digit.ecas.mobile.auth.password.PasswordMobileAuthServiceImpl

ecasMobile.cache.expiry.minutes=10

eu.cec.digit.ecas.mobile.auth.onmobile.MobileAppRequestor=eu.cec.digit.ecas.mobile.auth.onmobile.MobileAppRequestorImpl

definition.ecasMobile.authn.alphabet=0123456789
definition.ecasMobile.authn.groupBy=1000
definition.ecasMobile.authn.minLength=18
definition.ecasMobile.authn.maxLength=18
definition.ecasMobile.authn.separator=.

ecasMobile.otp.sharedSecret.lengthInBytes=64
ecasMobile.otp.macAlgorithm=HmacSHA512
ecasMobile.otp.length=8
ecasMobile.otp.alphabet=23456789ABCDEFGHJKLMNPQRSTUVWXYZ

ecasMobile.softwareToken.challenge.lengthInBytes=64

ecasMobile.mobileChallenge.lengthInBytes=64

eu.europa.ec.ecas.servlet.login.plugin.impl.PluginFactory=eu.europa.ec.ecas.servlet.login.plugin.impl.DefaultPluginFactory
eu.europa.ec.ecas.servlet.login.engine.compliance.impl.AuthenticationComplianceEngine=eu.europa.ec.ecas.servlet.login.engine.compliance.impl.DefaultAuthenticationComplianceEngine
eu.europa.ec.ecas.servlet.login.engine.attribute.impl.AdditionalAttributeProvider=eu.europa.ec.ecas.servlet.login.engine.attribute.impl.DefaultAdditionalAttributeProvider
eu.europa.ec.ecas.servlet.login.engine.accesscontrol.impl.AccessDenialEngine=eu.europa.ec.ecas.servlet.login.engine.accesscontrol.impl.ServiceWhitelistAccessDenialEngine
eu.europa.ec.ecas.servlet.login.engine.impl.ApplicationServerIntegrationEngine=eu.europa.ec.ecas.servlet.login.engine.impl.WebLogicIntegrationEngine
eu.europa.ec.ecas.servlet.login.engine.impl.AuditTrailEngine=eu.europa.ec.ecas.servlet.login.engine.impl.EcasAuditTrailEngine
eu.europa.ec.ecas.servlet.validation.engine.impl.ExtendedAttributeEngine=eu.europa.ec.ecas.servlet.validation.engine.impl.DefaultExtendedAttributeEngine

tokenCram.webService.endPoint=
tokenCram.webService.connectTimeoutMillis=30000
tokenCram.webService.requestTimeoutMillis=30000
tokenCram.forNonProd.helper=eu.europa.ec.ecas.mockup.data.impl.tokencram.MockTokenCramForNonProdHelper
tokenCram.webService.passwordFormat=4

############################
# UUMDS
############################
loginRequest.interceptor=eu.europa.ec.ecas.servlet.login.engine.impl.EmptyLoginRequestInterceptor
uumds.wayf.url=
uumds.wayf.init.transaction.path=${uumds.wayf.init.transaction.path}
uumds.wayf.login.path=${uumds.wayf.login.path}

definition.uumds.secret.alphabet=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789
definition.uumds.secret.groupBy=1000
definition.uumds.secret.minLength=12
definition.uumds.secret.maxLength=12
definition.uumds.secret.separator=.

plugin.folder=_application_files/ecas-plugins

saml.configuration.location=samlConfiguration.xml
sts.configuration.location=stsConfiguration.xml

#Always TRUE except in UUM&DS environments
showEnvironmentStamp=true

##########################################################
# Settings of the ServiceWhitelistAccessDenialEngine
##########################################################
accessDenialEngine.serviceWhitelist.location=ecas-access-denial.properties

##########################################################
# OAuth
##########################################################
eu.cec.digit.ecas.auth.oauth.settings.impl.facebook=eu.europa.ec.ecas.mockup.auth.oauth.settings.facebook.MockFacebookOAuthSettings
eu.cec.digit.ecas.auth.oauth.settings.impl.google=eu.europa.ec.ecas.mockup.auth.oauth.settings.google.MockGoogleOAuthSettings
eu.cec.digit.ecas.auth.oauth.settings.impl.twitter=eu.europa.ec.ecas.mockup.auth.oauth.settings.twitter.MockTwitterOAuthSettings

saml.assertion.issuer.eulogin.urn=urn:ec.europa.eu:eulogin:mockup:saml

#OpenID Connect
openidconnect.issuer.url=https://eulogin-mock-server:7102/cas/oauth2
openidconnect.issuer.url.path=/oauth2
openidconnect.jwks_uri.url=https://eulogin-mock-server:7102/cas/oauth2/keys
openidconnect.metadata.url=https://eulogin-mock-server:7102/cas/oauth2/.well-known/openid-configuration
openidconnect.metadataWithUserInfo.path=/.unsafe/openid-configuration
openidconnect.authorization_endpoint.url=https://eulogin-mock-server:7102/cas/oauth2/authorize
openidconnect.authorization_endpoint.path=/authorize
openidconnect.token_endpoint.url=https://eulogin-mock-server:7102/cas/oauth2/token
openidconnect.token_introspection_endpoint.url=https://eulogin-mock-server:7102/cas/oauth2/token/introspect
openidconnect.userinfo_endpoint.url=https://eulogin-mock-server:7102/cas/oauth2/userinfo
openidconnect.registration_endpoint.url=https://eulogin-mock-server:7102/cas/oauth2/register
openidconnect.token_revocation_endpoint.url=https://eulogin-mock-server:7102/cas/oauth2/token/revoke
openidconnect.end_session_endpoint.url=https://eulogin-mock-server:7102/cas/oauth2/logout


openidconnect.metadata.validityDurationSeconds=3600
openidconnect.authorizationCode.timeoutSeconds=300
openidconnect.idToken.timeoutSeconds=300
openidconnect.accessToken.timeoutSeconds=300
openidconnect.refreshToken.timeoutSeconds=60

openidconnect.configuration.location=openIdConnectConfiguration.json
dao.openidconnect=eu.europa.ec.ecas.openidconnect.data.JsonOpenIdConnectConfigurationDao

# Derby encryption and password hashing:
registration.storage.encryption.provider=com.sun.crypto.provider.SunJCE
registration.storage.encryption.keyLength=256
registration.storage.encryption.algorithm=AES/CFB/NoPadding
registration.storage.authentication.algorithm=SHA-512
registration.storage.authentication.saltLength=64
registration.storage.authentication.iterations=90000
