<?xml version="1.0" encoding="UTF-8"?>
<z:config xmlns:z="http://www.sourceid.org/2004/05/config">

    <!-- The length of the generated device code -->
    <z:item name="device-code-code-length">42</z:item>

    <!-- The character set used to generate the user code. -->
    <z:item name="user-code-character-set"><![CDATA[BCDFGHJKMNPQRTVWXY346789]]></z:item>

    <!-- The length of the generated user code excluding segment separators. -->
    <z:item name="user-code-code-length">8</z:item>

    <!-- Length of each segment. -->
    <z:item name="user-code-segment-length">4</z:item>

    <!-- Segment separator character, MUST be a single character. -->
    <z:item name="user-code-segment-separator"><![CDATA[-]]></z:item>

    <!--
        Indicates if the user code verification should be case sensitive.

        [System Default: false]
     -->
    <z:item name="user-code-case-sensitive-verification">false</z:item>

    <!--
        When the user code check occurs after authentication (the default),
        this setting defines the number of consecutive invalid user codes
        submitted before attempts are locked.

        [System Default: 6]
    -->
    <z:item name="MaxConsecutiveFailures">6</z:item>

    <!--
        When the user code check occurs after authentication (the default),
        this setting defines the lockout period in minutes when
        MaxConsecutiveFailures is reached.

        [System Default: 1]
    -->
    <z:item name="LockoutPeriod">1</z:item>

    <!--
        Under Authorization Server Settings, the user code check can be
        configured to happen before authentication.

        When the user code check happens before authentication, this setting
        defines the number of consecutive invalid user codes submitted before
        attempts are locked.

        This value is considerably higher than MaxConsecutiveFailures, since
        prior to authentication, the lockout key includes only the IP address,
        and so can be shared by more than one user.

        With the default code length and character set, a max of 1000
        limits the chance of an attacker finding a valid user code to less than
        1 in 100,000 per minute. This assumes at most 1000 user codes are valid
        at a given time and the attacker only uses a single IP address. Under
        different assumptions, a lower failure limit might be required, or a
        longer code.

        [System Default: 1000]
    -->
    <z:item name="MaxPreAuthenticationFailures">1000</z:item>

    <!--
        When the user code check occurs before authentication, this setting
        defines the lockout period in minutes when MaxPreAuthenticationFailures is
        reached.

        [System Default: 1]
    -->
    <z:item name="PreAuthenticationLockoutPeriod">1</z:item>

    <!--
        Indicates if token endpoint "authorization_pending" response should
        be audited or not

        [System Default: false]
    -->
    <z:item name="audit-authorization-pending-response">false</z:item>

    <!--
        When the authentication policy has an associated authentication API
        application and the user code check is configured to happen after
        authentication, this setting determines whether the API application
        handles the user code check or whether PingFederate handles this
        check. This setting is intended for backwards compatibility with API
        applications that do not support the states for user code checking.

        [System Default: true]
    -->
    <z:item name="enable-authn-api-for-user-code-validation">true</z:item>
</z:config>