#---------------------------------------------------
# List of allowed redirect URIs. Authentication server
# client should pass valid redirect URI to /authorize endpoint.
#---------------------------------------------------
authentication.redirect.uri.whitelist=https://127.0.0.1:8443/,https://127.0.0.1:8111/,https://md_redirect

#-------------------------------------------------------------------------------
# Authentication ID token expiration time in seconds.
#-------------------------------------------------------------------------------
#authentication.token.expirity=604800

#-------------------------------------------------------------------------------
# Authentication code expiration time in seconds.
#-------------------------------------------------------------------------------
#authentication.code.token.expirity=15

#-------------------------------------------------------------------------------
# Authentication refresh token expiration time in seconds.
#-------------------------------------------------------------------------------
#authentication.refresh.token.expirity=1209600

#-------------------------------------------------------------------------------
# Authentication ID token expiration time in seconds
# for the implicit authentication flow (for ex., used
# for MagicDraw UML).
#-------------------------------------------------------------------------------
#authentication.implicit.token.expirity=86400

#-------------------------------------------------------------------------------
# Authentication ID token that has extremely long
# expiration time and should only be used in
# server-server requests when there is a need to
# perform regular batch jobs.
#-------------------------------------------------------------------------------
#authentication.unlimited.token.expirity=630720000

#-------------------------------------------------------------------------------
# Properties used for keystore reading:
#
# - Path to keystore file (absolute or relative)
# - Keystore type (JKS or PKCS12)
# - Keystore password
# - Private key password
# - Private key alias in the keystore
#
# If service is deployed on a cluster, all instances should use the same keystore.
#-------------------------------------------------------------------------------
authentication.server.key-store=./conf/keystore.p12
authentication.server.key-store-type=PKCS12
authentication.server.key-store-password=nomagic
authentication.server.key-password=nomagic
authentication.server.key-alias=teamworkcloud

#-------------------------------------------------------------------------------
# Valid client IDs (separated by commas).
#-------------------------------------------------------------------------------
#authentication.client.ids=MAGICDRAW,webApplicationPlatform,twcSynchronizationManager

#-------------------------------------------------------------------------------
# Implicit authentication flow client IDs (separated by commas).
#-------------------------------------------------------------------------------
#authentication.client.implicit=MAGICDRAW

#-------------------------------------------------------------------------------
# Client IDs that use token ID of unlimited expiration (separated by commas).
#-------------------------------------------------------------------------------
#authentication.client.unlimited=twcSynchronizationManager

#-------------------------------------------------------------------------------
# IDs of clients that do not see Remember Me flag (separated by commas).
#-------------------------------------------------------------------------------
#authentication.remember.me.hidden.client.ids=MAGICDRAW

#---------------------------------------------------
# SAML integration parameters:
# * Enabling/disabling flag
# * Name of Authentication Server as service provider
# configured in SAML based Identity Provider.
# * SAML Identity Provider metadata URL (for IdP that
# has metadata URL, for ex., Forgerock OpenAM).
# * Path to SAML Identity Provider metadata file (for IdP
# that has no metadata URL, for ex., WSO2). File should
# be created in accordance with IdP provided specification.
# * Title of the button for SAML user login displayed
# in login page.
# * Signature algorithm (SHA1, SHA256 or SHA512).
# * List of AuthN Contexts separated by comma.
# * AuthN Context comparison type (exact, better, maximum, minimum).
# * Flag indicating if SAML authentication detailed error text should be displayed for user.
#---------------------------------------------------
authentication.saml.enabled=false
#authentication.saml.entity.id=com.nomagic.authentication.server
#authentication.saml.name.id.format=urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName
#authentication.saml.idp.metadata.url=
#authentication.saml.idp.metadata.file=
#authentication.saml.link=SAML User
#authentication.saml.disable.force.authentication=false
#authentication.saml.signature.algorithm=SHA1
#authentication.saml.authn.contexts=
#authentication.saml.authn.context.comparison.type=exact
#authentication.saml.error.visible=false

#-------------------------------------------------------------------------------
# Indicates if authentication by certificate is available.
#-------------------------------------------------------------------------------
authentication.certificate.enabled=false

#-------------------------------------------------------------------------------
# If certificate authentication is enabled, following parameters are used for
# username extraction from the certificate subject DN (distinguished name) or
# SAN (subject alternative name) field. User name is stored in the TWCloud
# server.
# * Source of the user name. Available values: dn (distinguished name), san 
#   (subject alternative name)
# * SAN type. Available values: 0 (other name), 1 (RFC 822 name), 2 (DNS name),
#   4 (directory name).
# * Template to use if user name source is DN or SAN type is 4.
#-------------------------------------------------------------------------------
#authentication.certificate.username.source=dn
#authentication.certificate.username.san.type=4
#authentication.certificate.username.template=(CN)

#-------------------------------------------------------------------------------
# If certificate authentication is enabled, following parameters are used for
# user display name extraction from the certificate subject DN (distinguished
# name) or SAN (subject alternative name) field. Display name is used for
# display purposes only, and describes the text that is shown on authentication
# button.
# * Source of the display name. Available values: dn (distinguished name), san 
#   (subject alternative name)
# * SAN type. Available values: 0 (other name), 1 (RFC 822 name), 2 (DNS name),
#   4 (directory name).
# * Template to use if display name source is DN or SAN type is 4.
#-------------------------------------------------------------------------------
#authentication.certificate.displayname.source=dn
#authentication.certificate.displayname.san.type=4
#authentication.certificate.displayname.template=(CN)

#-------------------------------------------------------------------------------
# URL or absolute filesystem path to the CRL file that
# contains the list of the certificates revoked by the
# certificate authority.
#-------------------------------------------------------------------------------
#authentication.certificate.revocation.list.url=
#authentication.certificate.revocation.list.file=

#-------------------------------------------------------------------------------
# Flag indicating of secured connection is used to communicate with Cassandra.
# Flag indicating if SSL certificate check should be done while connecting to Cassandra.
# Cassandra contact points, separated by commas;
# Cassandra port for CQL clients;
# Cassandra keyspace replication factor;
# Number of max attempts to connect to Cassandra on server startup;
# Time interval between attempts in milliseconds.
#-------------------------------------------------------------------------------
cassandra.ssl.enabled=false
cassandra.ssl.ignore.certificate=true
cassandra.contactPoints=127.0.0.1
cassandra.port=9042
cassandra.keyspace.replication.factor=1
cassandra.connection.max.attempts=10
cassandra.connection.sleep.before.attempt=30000
#cassandra.username=cassandra
#cassandra.password=cassandra

#-------------------------------------------------------------------------------
# Properties for GUI transformation:
# 1. Path to the banner logo if such used, for ex., ./config/banner.png.
# File types JPEG, GIF and PNG are supported.
# 2. Banner text. Only new line (\n) special symbol is supported.
# 3. Color for login page background. Different formats allowed,
# for ex., #FFFFFF, rgb(220,220,220), etc. Default color is rgb(250,250,250).
#-------------------------------------------------------------------------------
#classification.loginbannerlogo=
#classification.loginbannertext=
#classification.loginbackground=

#-------------------------------------------------------------------------------
# Ability to disable username/password authentication
# if external user authentication (CAC, SAML) is used.
#-------------------------------------------------------------------------------
#authentication.disable.credentials=false