
###############################################################################
#                                                                             #
# Configuration for OIDC-Based Authentication to the                          #
# Administrative Console and role assignment                                  #
#                                                                             #
###############################################################################

#   Some special characters in the value that need to be evaluated must be escaped (e.g., "\ " for " ").  This is also true for
#   spaces that occur at the beginning. See the Javadoc for the load method of the java.util.Properties class for a definitive
#   description of what characters need to be escaped and how to do so.

# *****************************************************************************
#                         Basic Properties
# *****************************************************************************

# ===================
# Required Attributes
# ===================

# Note that the following are all required attributes:
#
# - Client Identification (client.id)
# - Client Authentication method (client.authn.method)
# - Authorization Endpoint (authorization.endpoint)
# - Pushed Authorization Request Endpoint (pushed.authorization.request.endpoint)
# - Token Endpoint (token.endpoint)
# - Issuer (issuer)
# - Scopes (scopes)
# - Username Attribute name (username.attribute.name)
# - Role Attribute name (role.attribute.name)
# - Admin roles (role.admin, role.cryptoManager, role.userAdmin and role.expressionAdmin, role.dataCollectionAdmin)
#

#  The redirect URI sent to the OIDC provider is constructed from the property pf.admin.baseurl,
#  a combination of the deprecated property pf.admin.hostname and pf.admin.https.port
#  or a combination of the host's IP address and pf.admin.https.port. Using pf.admin.baseurl is preferred.
#
#  This base is followed by '/pingfederate/app?service=finishsso'. For example, if pf.admin.baseurl
#  is 'https://pingfederate-admin.example.com', then the redirect URI will be
#  'https://pingfederate-admin.example.com/pingfederate/app?service=finishsso'.


#   -----------------------------
#   Client Identification (REQUIRED)
#   -----------------------------
#   The client ID to communicate with the OpenID Provider (OP).
#
#   This client represents the PingFederate administrative console and is created and managed at the OP.
#
client.id=

#   -----------------------------
#   Client Authentication Type (REQUIRED)
#   -----------------------------
#   The type of authentication that is expected by the token endpoint of the OP.
#   Supported values are:
#    client_secret_basic   - Client credentials using the HTTP Basic authentication scheme.
#    client_secret_post    - Client credentials included in the request body.
#    client_secret_jwt     - Client authenticates with a JWT that was created using an HMAC SHA algorithm. The client_secret is used as the key for HMAC SHA algorithms.
#    private_key_jwt       - Client authenticates in accordance with RFC 7523. Public keys to enable the OP to perform client authentication
#                            by validating JWT signatures is published at the PingFederate runtime JWKS endpoint (e.g.: https://www.example.com:9031/pf/JWKS).
#
client.authn.method=


#   ----------------------------------------------------
#   Client Secret (OPTIONAL)
#   ----------------------------------------------------
#   This is the secret to communicate with the OP. This field is required when the client authentication is either client_secret_basic or client_secret_post.
#   This property should be obfuscated using one of the following utilities:
#
#   On Windows:
#     >obfuscate.bat <password>
#
#   On Linux:
#     >./obfuscate.sh <password>
#
#   Example:
#     obfuscate.bat secret
#       Result:
#       OBF:JWE:eyJhbGciOiJkaXIiLCJlbmMiOiJBMTI4Q0JDLUhTMjU2Iiwia2lkIjoiVEU0dVZjcU1wayIsInZlcnNpb24iOiI3LjEuMjAwLjQtU05BUFNIT1QifQ..8Zf_xQ4PuXuYkdE0culPpA.E2Lh_zAne5YpaJo9wbl39A.Z8wVd6SFB8lcQbvutU1u-Q
#   Copy complete result into property value, as shown in the example below:
#     client.secret=OBF:JWE:eyJhbGciOiJkaXIiLCJlbmMiOiJBMTI4Q0JDLUhTMjU2Iiwia2lkIjoiVEU0dVZjcU1wayIsInZlcnNpb24iOiI3LjEuMjAwLjQtU05BUFNIT1QifQ..8Zf_xQ4PuXuYkdE0culPpA.E2Lh_zAne5YpaJo9wbl39A.Z8wVd6SFB8lcQbvutU1u-Q
#
#   This property can also be specified as a secret reference in the form OBF:MGR:{secretManagerId}:{secretId}.
#       To use this form, a secret manager plugin must be configured.
#       Secret manager plugins usually include a custom action to help with constructing secret references.
#       Note: the client ID which may be returned by the secret manager is ignored.
client.secret=

#   ------------------------------------
#   Enable Proof Key Code Exchange (OPTIONAL)
#   ------------------------------------
#   Proof Key Code Exchange (PKCE): When enabled, the client sends an SHA-256 code challenge and corresponding code verifier to the
#   OpenID Provider during the authorization code flow in accordance with RFC 7636.
enable.proof.key.code.exchange=false

#   -----------------------------
#   Authorization Endpoint (REQUIRED)
#   -----------------------------
#   The full HTTPS URL of authorization endpoint at the OP.
authorization.endpoint=

#   -----------------------------
#   Pushed Authorization Request Endpoint (OPTIONAL)
#   -----------------------------
#   The full HTTPS URL of pushed authorization request (PAR) endpoint at the OP.
#   When configured, authorization requests shall be sent to PAR endpoint to obtain request_uri.
pushed.authorization.request.endpoint=

#   -----------------------------
#   Token Endpoint (REQUIRED)
#   -----------------------------
#   The full HTTPS URL of token endpoint at the OP. This is required as PingFederate OIDC login only supports the authorization code flow.
token.endpoint=

#   -----------------------------
#   UserInfo Endpoint (OPTIONAL)
#   -----------------------------
#   The full HTTPS URL of UserInfo endpoint. This endpoint will be accessed when the required claims are not present in the ID tokens.
user.info.endpoint=

#   -----------------------------
#   End Session Endpoint (OPTIONAL)
#   -----------------------------
#   The full URL of end session endpoint at the OP. When this property does not have a value,
#   the administrator shall be shown the default PingFederate administrative console logout page.
#
end.session.endpoint=

#   -----------------------------
#   Issuer (REQUIRED)
#   -----------------------------
#   The Issuer Identifier of the OP. The value provided here will be matched with the iss claims in the obtained ID token.
issuer=

#   -----------------------------
#   Authentication Context Class Reference Values (OPTIONAL)
#   -----------------------------
#   The Authentication Context Class Reference Values which shall be used by OP. Multiple values must be space separated.
acr.values=

#   -----------------------------
#   Scopes (REQUIRED)
#   -----------------------------
#   Requesting Scopes from OP. Include all the scopes required to obtain username and role mapping attributes. Multiple values must be space separated.
scopes=openid

#   -----------------------------
#   Type (OPTIONAL)
#   -----------------------------
#   JWT header type (typ). When left blank, it will not be included in the JWT header.
type=

#   -----------------------------
#   Audience (OPTIONAL)
#   -----------------------------
#   JWT claim audience (aud). When left blank, the token endpoint will be used for audience claim.
audience=


#   ----------------------------------
#   Username Attribute Name (REQUIRED)
#   ----------------------------------
#   The name of the claim in the ID token or UserInfo response that contains the username of the administrator. The value of the
#   username claim is used in administrative audit logs.
#
username.attribute.name=sub

#   ------------------------------
#   Role Attribute Name (REQUIRED)
#   ------------------------------
#   The name of the claim in the ID token or UserInfo response that determines the administrative role.
#
#   Example:
#     role.attribute.name=admin_role
#
role.attribute.name=

#   -------------------------------------
#   Administrator Role Mapping (REQUIRED)
#   -------------------------------------
#   The following set of properties maps the ID token and UserInfo response to roles to determine administrative permissions.
#
#   Example:
#   Assume that admin_role is set for the Role Attribute Name (role.attribute.name) and mappings are set as follows:
#
#   role.admin=admin
#   role.cryptoManager=cryptoadmin
#   role.userAdmin=useradmin
#   role.expressionAdmin=expressionadmin
#   role.dataCollectionAdmin=dataCollectionAdmin
#
#   When admin_role claim has a single value:
#   admin_role : "admin"
#   The caller will be granted the admin role.
#
#   When the admin_role claim has an array containing multiple values:
#   admin_role : ["admin","cryptoadmin","useradmin"]
#   The caller will be granted the admin, crypto and user administrator roles.
#
#   Only one value can be entered per line. If multiple values need to be mapped to a single PingFederate role, then multiple
#   properties must be created using a numeric, incremental suffix, starting with 1. Example:
#     role.admin.1=
#     role.admin.2=
#     role.admin.3=
#
role.admin=
role.cryptoManager=
role.userAdmin=

# The expressionAdmin role must only be granted to the administrators with admin role.
role.expressionAdmin=

# The dataCollectionAdmin role must only be granted to the administrators with all the admin, user admin and crypto manager roles.
role.dataCollectionAdmin=

#   -----------------------------------------------
#   Auditor Role Attribute Value Mapping (OPTIONAL)
#   -----------------------------------------------
#   The auditor role overrides the privileges associated with the assignment of any other role for the same caller.
#
role.auditor=

#   -----------------------------
#   Request Parameters (OPTIONAL)
#   -----------------------------
#   Request Parameters specified can be included in the PingFederate single sign-on (SSO) URL and will be included
#   in the Authorization Request as parameters.
#
#   The properties must be created using a unique suffix.
#
#   For each set of request.parameter there are three sub properties:
#
#     request.parameter.name.[index]
#       - The request parameter's name.
#       - This field is required.
#       - Do not use URL encoding for the name.
#
#     request.parameter.default.value.[index]
#       - The default value of the request parameter. If the parameter is not included in the request, the default
#         value will be included in the authorization request.
#       - If the parameter is not included in the request, and no default value is specified, the parameter will not
#         be included in the authorization request.
#       - This field is optional when the request parameter overridable property is set to true.
#
#     request.parameter.overridable.[index]
#       - Specify whether the request parameter can be overridden at runtime.
#       - If this property is set to false, the default value will always be included in the authorization request.
#       - This field is optional.  If not specified, the default is false.
#       - The value of this field can only be true or false.
#
#   To include a multi-value parameter, create two request.parameters with unique indexes but with the same name.
#
#   Examples:
#
#   # Basic non-overridable parameter
#   request.parameter.name.1=claims
#   request.parameter.default.value.1={"id_token": {"p1.1234.roles.ping_federate": null}}
#   request.parameter.overridable.1=false
#
#   # Basic overridable parameter with no default
#   request.parameter.name.2=sub
#   request.parameter.default.value.2=
#   request.parameter.overridable.2=true
#
#   # Multi Value Parameters
#   request.parameter.name.3=role
#   request.parameter.default.value.3=role123
#   request.parameter.overridable.3=false
#
#   request.parameter.name.4=role
#   request.parameter.default.value.4=roleABC
#   request.parameter.overridable.4=false