Tremolo Security OpenUnison Configuration & Deployment

<workflow name="updateLockout">
        <tasks>
                <ifAttrExists name="unisonFailedLogins">
                        <onFailure>
                                <customTask className="com.tremolosecurity.provisioning.customTasks.LoadAttributes">
                          <param name="name" value="unisonFailedLogins"/>
                          <param name="nameAttr" value="uid"/>
                        </customTask>
                        </onFailure>
                </ifAttrExists>
                <ifAttrExists name="unisonLastFailedLogin">
                        <onFailure>
                                <customTask className="com.tremolosecurity.provisioning.customTasks.LoadAttributes">
                          <param name="name" value="unisonLastFailedLogin"/>
                          <param name="nameAttr" value="uid"/>
                        </customTask>
                        </onFailure>
                </ifAttrExists>
                <ifAttrExists name="unisonLastSuccessLogin">
                        <onFailure>
                                <customTask className="com.tremolosecurity.provisioning.customTasks.LoadAttributes">
                          <param name="name" value="unisonLastSuccessLogin"/>
                          <param name="nameAttr" value="uid"/>
                        </customTask>
                        </onFailure>
                </ifAttrExists>
                <provision sync="true" target="activedirectory"/>
        </tasks>
</workflow>

<!-- The name is how this chain is referenced in the URL -->
<!-- The level defines how strong an authenticaiton should be -->
<!-- The root defines where in the virtual directory OpenUnison should look for users. If not set, OpenUnison will look in o=Tremolo -->
<chain name="formlogin" level="20" root="o=Tremolo">
  <!-- Optional element to enable compliance for authentication
          enabled - Determines if compliance should be enabled for this chain
          maxFailedAttempts - The number of allowed attempts until a user is considered locked out
          maxLockoutTime - The number of milliseconds a user is locked out before they can log back in
          numFailedAttribute - The name of the attribute that stores the number of failed attempts
          lastFailedAttribute - The name of the attribute that stores the last failed login attempt Timestamp
          lastSucceedAttribute - The name of the attribute that stores the last successful login attempt timestamp
          updateAttributesWorkflow - The name of the workflow that will update attributes on login attempts
          uidAttributeName - The name of the attribute in the provisioning target used to identify this user, MUST be on the authenticated user's object in the virtual directory -->

  <compliance enabled="true"
              maxFailedAttempts="5"
              maxLockoutTime="1200000"
              numFailedAttribute="unisonFailedLogins"
              lastFailedAttribute="unisonLastFailedLogin"
              lastSucceedAttribute="unisonLastSuccessLogin"
              updateAttributesWorkflow="updateLockout"
              uidAttributeName="uid" />

 <!-- Each mechanism should be listed in the order that they're to be executed in -->
 <authMech>
  <!-- The name attribute of the mechanism -->
  <name>loginForm</name>

  <!-- Determines how the mechanism is required.  If "required" then the chain can not succeed without this mechanism succeeding.  If "optional" then the chain can succeed if this mechanism fails -->
  <required>required</required>

  <!-- List of optional parameters for the mechanism while executing the chain.  For specific mechanisms, see the Authentication Mechanisms section of  -->
  <params>
   <param name="FORMLOGIN_JSP" value="/auth/forms/defaultForm.jsp"/>
  </params>
 </authMech>
</chain>

<customAzRules>
 <!-- The name is used to reference the rule configuration -->
 <!-- The className is the implementation of com.tremolosecurity.proxy.az.CustomAuthorization -->
    <azRule name="Manager1" className="com.tremolosecurity.provisioning.az.ManagerAuthorization">
     <!-- The params tag may be listed multiple times with the same name for multi-value parameters -->
        <params name="numLevels" value="1"/>
        <params name="managerID" value="manager"/>
        <params name="managerIDIsDN" value="true"/>
        <params name="allowLowerManagers" value="false"/>
    </azRule>
</customAzRules>

<addGroup name="$groupName$" />

<!--
  isUseInternalQueue - Determines if Unison should use the internal ActiveMQ system for message management or an external system.
  encryptionKeyName - The session key used to encrypt all task messages.
  connectionFactory - Implementation of javax.jms.ConnectionFactory, only if isUserInternalQueue is false
  maxProducers - Maximum number of threads generating messages
  maxConsumers - Maximum number of threads consuming messages
  taskQueueName - The name of the queue for managing workflow tasks, if multiTaskQueues is true, use {x} to represent the queue number
  smtpQueueName - The name of the queue for managing emails generated by Unison
  multiTaskQueues - true if multiple task queues are available
  numQueues - If multiTaskQueues is true, the number of queues available for tasks
  keepAliveMillis - Milliseconds between keepalive attempts for each connections.  Defaults to 60000 (60 seconds)
-->
<queueConfig isUseInternalQueue="false" encryptionKeyName="session-queues" connectionFactory="org.apache.activemq.ActiveMQConnectionFactory" maxProducers="5" maxConsumers="5" taskQueueName="TremoloUnisonTaskQueue-{x}" smtpQueueName="TremoloUnisonSMTPQueue" multiTaskQueues="true" numQueues="3" keepAliveMillis="60000" >
  <!--
    Each param tag maps to a setter method on the connectionFactory class.  For instance the brokerURL param tag maps to org.apache.activemq.ActiveMQConnectionFactory.setBrokerURL(String) method
  -->
  <param name="brokerURL" value="tcp://amq.tremolo.lan:61616/" />
</queueConfig>

<listeners>
  <!-- UNCOMMENT FOR LOADING MESSAGE LISTENERS FROM KUBERNETES OBJECTS -->
  <!--

  <dynamicListeners enabled="true" className="com.tremolosecurity.provisioning.listeners.LoadQueueListenersFromK8s">
    <params name="k8starget" value="k8s" />
    <params name="namespace" value="#[K8S_OPENUNISON_NS:openunison]" />
  </dynamicListeners>
  -->

  <!-- Each listener waits for a message to be received on the named queue using the class named. -->
  <listener className="com.tremolosecurity.provisioning.listeners.UpdateApprovalAZListener" queueName="rebaseQueue"></listener>
  <listener className="com.tremolosecurity.provisioning.listeners.AutoFailApprovalListener" queueName="failQueue"></listener>
</listeners>

<!--
  useDB - If true, use a database to manage jobs. NOTE: prior to starting Unison the database must be initialed per Quartz' documentation
  threadCount - The number of threads the scheduler should use. Must be at least 3
  instanceLabel - A descriptive label for this scheduler
  instanceIPMask - This field is used to determine which IP address to use on the system to identify the particular instance
-->
<scheduler useDB="true" threadCount="3" instanceLabel="testing" instanceIPMask="127">



  <!-- This section only needed if useDB is true -->
  <!--
    delegateClassName - The delegate to use to work with the database
    driver - The JDBC Driver for the database
    url - The JDBC URL
    user - User to connect to database with
    password - Password to connect to database with
    maxConnections - Maximum number of connections to the database
    validationQuery - A query that can be used to verify the connection is still active
  -->
  <scheduleDB
    delegateClassName="org.quartz.impl.jdbcjobstore.StdJDBCDelegate"
    driver="com.mysql.jdbc.Driver"
    url="jdbc:mysql://endor.tremolo.lan/quartzDB"
    user="quartz"
    password="start123"
    maxConnections="10"
    validationQuery="SELECT 1"
  />

  <!-- UNCOMMENT FOR DYNANMICLY LOADING JOBS IN KUBERNETES -->
  <!--
  <dynamicJobs enabled="true" className="com.tremolosecurity.provisioning.jobs.LoadJobsFromK8s">
    <params name="k8starget" value="k8s" />
    <params name="namespace" value="#[K8S_OPENUNISON_NS:openunison]" />

  </dynamicJobs
  -->

  <!-- Each job extends com.tremolosecurity.provisioning.scheduler.UnisonJob -->
  <!--
    className - The name of the class
    name - Descriptive name for this scheduled job
    group - Descriptive name for a group of jobs
  -->
  <job className="com.tremolosecurity.provisioning.scheduler.jobs.UpdateApprovalAz" name="resetAllowedApprovers" group="testing">
    <!-- All jobs use a cron based scheduler - http://www.adminschoice.com/crontab-quick-reference -->
    <cronSchedule
      seconds="0/9"
      minutes="*"
      hours="*"
      dayOfMonth="*"
      month="*"
      dayOfWeek="?"
      year="*"
    />
    <!-- Each parameter is passed into the task on execution, params with the name name listed multiple times are treated as a multi-valued attribute -->
    <param name="queueName" value="rebaseQueue" />
  </job>
  <job className="com.tremolosecurity.provisioning.scheduler.jobs.AutoFail" name="autoFail" group="autoFail">
    <cronSchedule
      seconds="0/20"
      minutes="*"
      hours="*"
      dayOfMonth="*"
      month="*"
      dayOfWeek="?"
      year="*"
    />
    <param name="queueName" value="failQueue" />
    <param name="approver" value="autoFail" />
    <param name="message" value="failed : ${reason}" />
  </job>
</scheduler>

<targets>

  <!-- UNCOMMENT FOR DYNAMIC TARGETS -->
  <!--

  <dynamicTargets enabled="true" className="com.tremolosecurity.provisioning.targets.LoadTargetsFromK8s">
    <params name="k8starget" value="k8s" />
    <params name="namespace" value="#[K8S_OPENUNISON_NS:openunison]" />

  </dynamicTargets>

  -->
  <!--
    name - A unique name for this target, how it is referenced throughout the configuration and code base
    className - Name of the class backing this target, must implement the com.tremolosecurity.provisioning.core.UserStoreProvider interface
  -->
  <target name="ldap2"
    className="com.tremolosecurity.provisioning.core.providers.LDAPProvider">
    <!-- Each parameter is passed into the target on initialization.  Param tags with the name name listed multiple times are treated as a multi-valued attribute -->
    <params>
      <param name="objectClass" value="inetOrgPerson" />
      <param name="host" value="127.0.0.1" />
      <param name="port" value="10983" />
      <param name="adminDN" value="cn=admin,dc=domain,dc=com" />
      <param name="adminPasswd" value="manager" />
      <param name="dnPattern" value="uid=${uid},ou=internal,dc=domain,dc=com" />
      <param name="searchBase" value="dc=domain,dc=com" />
      <param name="userIDAttribute" value="uid"/>
      <param name="useSSL" value="false"/>
      <param name="maxCons" value="10"/>
      <param name="threadsPerCons" value="10"/>

    </params>

    <!--
      Each targetAttribute maps from a source to the name
      name - The name of the attribute in the target
      source - The value to be used for the new attribute
      sourceType - Describes what the source is.  Possible values are:
        static - Takes the value from targetAttributeSource as is
        user - Takes the existing value from the attribute named in targetAttributeSource
        composite - Use a composite of multiple attributes and static values by containing attribute names in ${attributeName}
        custom - targetAttributeSource is the name of a class that implements com.tremolosecurity.provisioning.mapping.CustomMapping
      targetType (optional) - provides an optoinal mapping to a datatype.  Defaults to string
        string
        int
        long
        date
        timestamp
    -->
    <targetAttribute name="uid" sourceType="user"
      source="TREMOLO_USER_ID" />
    <targetAttribute name="sn" sourceType="user"
      source="sn" />
    <targetAttribute name="l" sourceType="user"
      source="l" />
    <targetAttribute name="cn" sourceType="user"
      source="cn" />
    <targetAttribute name="givenName"
      sourceType="user" source="givenName" />
  </target>
</targets>

<!--
  The root organization is required and should be open to all users
  name - Descriptive name of the organization
  description - Some text describing the organization
  uuid - A UUID that is unique for this organization.  This is how an organization is referenced in the configuration
  showInPortal - Shows the orgnaization in the front page of ScaleJS, defaults to true
  showInRequestsAccess - Shows the organization on request access page in ScaleJS, defaults to true
  showInReports - Shows the organization on the reports page, defaults to true
-->
<org name="MyOrg" description="MyOrg Enterprise Applications" uuid="687da09f-8ec1-48ac-b035-f2f182b9bd1e">
  <!-- Organizations can be dynamically loaded outside of the static configuration
        enabled - true if dynamic organizations should be enabled
    className - Implementation of com.tremolosecurity.provisioning.orgs.DynamicOrgs
  -->
  <dynamicOrgs enabled="true" className="com.tremolosecurity.provisioning.orgs.LoadOrgsFromK8s">
    <params name="k8starget" value="k8s" />
    <params name="namespace" value="#[K8S_OPENUNISON_NS:openunison]" />

  </dynamicOrgs>
  <!-- Each child organization is nested as an orgs tag with the same attributes as org -->
  <orgs name="User Reports" description="Reports Available to All Users" uuid="1c2cad5b-f62c-491c-84f3-068f6231f053">
    <!-- Each organization can have a set of authorization rules to determine which users can see this organization and anything contined in it -->
    <azRules/>
  </orgs>
  <orgs name="Identity Management Reports" description="Reports only available to the Identity Management Team"   uuid="d17a59d8-11bc-44d4-994c-740194f4fd03">
    <azRules>
    <!--
    Determine if the currently logged in user may access the organization.  If ANY rule succeeds, the authorization succeeds.
    The scope may be one of group, dn, filter, dynamicGroup or custom
    The constraint identifies what needs to be satisfied for the authorization to pass and is dependent on the scope:
      * group - The DN of the group in OpenUnison's virtual directory (must be an instance of groupOfUniqueNames)
      * dn - The base DN of the user or users in OpenUnison's virtual directory
      * dynamicGroup - The DN of the dynamic group in OpenUnison's virtual directory (must be an instance of groupOfUrls)
      * custom - An implementation of com.tremolosecurity.proxy.az.CustomAuthorization -->
      <rule scope="group" constraint="cn=idm-auditreports,ou=groups,o=Tremolo"/>
    </azRules>
  </orgs>
  <azRules/>
</org>

<reports>
  <!--
    Each report is assigned to an organization to control access.  If a user has access to an organization, they can view the reports in that organization.
    orgID - The uuid of the org(s) tag that the report is associated with
    name - A descriptive name for the report
    description - A few words about the report
    groupings - If true, the report results will be broken up into multiple sections when the field identified by the groupBy attribute changes.
    groupBy - Determines which attribute causes a new grouping in the report when it chages
  -->
  <report orgID="1c2cad5b-f62c-491c-84f3-068f6231f053" name="My Open Requests" description="List of your currently open requests and the approvers responsible for acting on them" groupBy="id" groupings="true">
    <!-- Any of the parameters described above, may be listed multiple times -->
    <paramater>currentUser</paramater>
    <!-- The SQL that drives the report.  Each field should be aliased using "AS" to match with a headerField or dataField.  Parameters are marked using JDBC syntax using a question mark (?).  Parameters are used in the order defined in the previous parameter tag -->
    <sql>select  approvals.id,approvals.label AS Approval ,
                 approvals.createTS AS `Approval Opened`,
                 workflows.name AS `Workflow Name`,
                 workflows.requestReason AS `Request Reason`,
                 concat(users.givenName,' ',users.sn) as `Subject Name`,
                 users.mail as `Subject Email`,
                 approvers.givenName as `First Name`,
                 approvers.sn as `Last Name`,approvers.mail as `Email`
        from approvals inner join workflows on approvals.workflow=workflows.id
                       inner join users on workflows.userid=users.id
                       inner join allowedApprovers on approvals.id=allowedApprovers.approval
                       inner join approvers on approvers.id=allowedApprovers.approver
        where users.userKey=? AND approvedTS is null
        order by approvals.createTS ASC, approvals.id ASC</sql>
    <!-- Fields that should be displayed in a data set's header. NOTE - fields MUST map to a field that is in the SQL SELECT clause. -->
    <headerFields>Approval</headerFields>
    <headerFields>Subject Name</headerFields>
    <headerFields>Subject Email</headerFields>
    <headerFields>Workflow Name</headerFields>
    <headerFields>Request Reason</headerFields>
    <!-- Fields that should be displayed in a data set. NOTE - fields MUST map to a field that is in the SQL SELECT clause. -->
    <dataFields>First Name</dataFields>
    <dataFields>Last Name</dataFields>
    <dataFields>Email</dataFields>
  </report>
</reports>

$ cat /path/to/icon.png | base64

<portal>
    <!-- URLs can by dynamically loaded by implementing the com.tremolosecurity.provisioning.portal.DynamicPortalUrls interface
         enabled - if dynamic URLs should be use
         className - The implementation of com.tremolosecurity.provisioning.portal.DynamicPortalUrls interface -->
    <dynamicUrls enabled="true" className="com.tremolosecurity.provisioning.portal.LoadUrlsFromK8s">
      <params name="k8starget" value="k8s" />
      <params name="namespace" value="#[K8S_OPENUNISON_NS:openunison]" />

    </dynamicUrls>
    <!--
      Each url is listed with a urls tag
      label - What users in Scale will see
      url - The URL the browser will run when the user clicks on the icon
      name - A simple name for the URL
      org - The orgUUID of the organization to list this url in if URLs are going to be displayed via the organization tree
      icon - A base64 encoded 240x210 PNG file that will be displayed in Scale
    -->
    <urls label="Reset your password" url="/scale-password/" name="PasswordReset" org="8daa55cd-dd52-4fa9-8edd-09a820811d05" icon="iVBORw0KGgoAAAA...">
        <!--
          The azRules will tell Unison if the link should be displayed to the user
        -->
        <azRules>
            <rule scope="dn" constraint="CN=users,ou=users,o=Tremolo"/>
        </azRules>
    </urls>
</portal>

<approvalDB>
  <!-- The Hibernate SQL Dialect -->
  <hibernateDialect>org.hibernate.dialect.PostgreSQL9Dialect</hibernateDialect>
  <!-- The JDBC Driver, must be part of the classpath -->
  <driver>com.mysql.jdbc.Driver</driver>
  <!-- JDBC URL for the database -->
  <url>jdbc:mysql://127.0.0.1:3306/unison</url>
  <!-- User for accessing the database -->
  <user>unison</user>
  <!-- Password for the database -->
  <password>start123</password>
  <!-- Maximum number of connections to the database -->
  <maxConns>10</maxConns>
  <!-- Maxixum number of idle connections -->
  <maxIdleConns>10</maxIdleConns>
  <!-- An optional list of additional properties for Hibernate, may be listed multiple times -->
  <!-- <hibernateProperty name="hibernate.default_schema" value="public" /> -->

  <!-- The name of the attribute on the user that is a unique identifier -->
  <userIdAttribute>uid</userIdAttribute>
  <!-- Query used to verify that the connection is alive -->
  <validationQuery>SELECT 1</validationQuery>

  <!-- The list of attributes to record in the approvers table.  NOTE: each value tag MUST line up with a column created on the approvers table -->
  <approverAttributes>
    <value>uid</value>
    <value>givenName</value>
    <value>sn</value>
    <value>mail</value>
  </approverAttributes>

  <!-- The list of attributes to record in the users table.  NOTE: each value tag MUST line up with a column created on the users table -->
  <userAttributes>
    <value>uid</value>
    <value>givenName</value>
    <value>sn</value>
    <value>mail</value>
  </userAttributes>
  <!-- determines if the audit database should be enabled, not required for using Just-In-Time provisioning -->
  <enabled>true</enabled>
  <!-- The alias of the key used to encrypt all workflows stored in the database -->
  <encryptionKey>session-workflows</encryptionKey>
  <!-- SMTP Server host name -->
  <smtpHost>smtp.gmail.com</smtpHost>
  <!-- SMTP Server port -->
  <smtpPort>587</smtpPort>
  <!-- User for accessing the SMTP server -->
  <smtpUser>donotreply@mydomain.com</smtpUser>
  <!-- Password for the smtp server -->
  <smtpPassword>********</smtpPassword>
  <!-- Subject of emails sent to approvers -->
  <smtpSubject>Awaiting Approvals</smtpSubject>
  <!-- Email address for the "From" field of all emails -->
  <smtpFrom>donotreply@mydomain.com</smtpFrom>
  <!-- Determines if TLS should be used with the SMTP server -->
  <smtpTLS>true</smtpTLS>
  <!-- Set to true if an outbound SOCKS proxy is required for access to the SMTP server -->
  <smtpUseSOCKSProxy>false</smtpUseSOCKSProxy>
  <!-- Host of the SOCKS proxy -->
  <smtpSOCKSProxyHost></smtpSOCKSProxyHost>
  <!-- Port of the SOCKS proxy -->
  <smtpSOCKSProxyPort>0</smtpSOCKSProxyPort>
  <!-- How Unison should identify its self to the SMTP server -->
  <smtpLocalhost></smtpLocalhost>

  <!-- Optional - The mapping file (.hbx.xml) to use if the default mapping doesn't work, must be in the classpath -->
  <hibernateConfig></hibernateConfig>
  <!-- Optional - If true, create tables.  After initial configuration, you may want to disable this depending on the dialect. -->
  <hibernateCreateSchema>true</hibernateCreateSchema>

</approvalDB>

<mechanism name="anonymous">
  <uri>/auth/anon</uri>
  <className>com.tremolosecurity.proxy.auth.AnonAuth</className>
  <init>
    <!-- The RDN of unauthenticated users -->
    <param name="userName" value="uid=Anonymous"/>

    <!-- Any number of attributes can be added to the anonymous user -->
    <param name="role" value="Users" />
  </init>
  <params>

  </params>
</mechanism>

<filter class="com.tremolosecurity.prelude.filters.Group2Attribute">
  <!-- The name of the attribute to create if the user is a member of this group        -->
        <param name="attributeName" value="roles"/>
  <!-- The value to be added or set if the user is a member of the specified group      -->
        <param name="attributeValue" value="admin"/>
  <!-- The full LDAP DN of the group being checked. This DN must be the mapped DN from inside of Unison. The ??? button next to this option may be used to search for the group based on it?s CN.       -->
        <param name="groupDN" value="cn=staticgroup,ou=internal,ou=GenericLDAP,o=Tremolo" />
</filter>

<filter class="com.tremolosecurity.prelude.filters.DNBase2Attribute">
  <!-- The name of the attribute to create if the user is a member of this group        -->
        <param name="attributeName" value="roles"/>
  <!-- The value to be added or set if the user is a member of the specified group      -->
        <param name="attributeValue" value="admin"/>
  <!-- The full LDAP DN of the base being checked. This DN must be the mapped DN from inside of Unison.                 -->
        <param name="dn" value="cn=Users,ou=MyEnterprise,O=Tremolo" />
</filter>

<filter class="com.tremolosecurity.prelude.filters.LoginTest">
  <!-- The URI of the JSP that will echo the information -->
  <param name="jspURI" value="/auth/forms/loginTest.jsp" />
  <!-- The path of the logout URI               -->
        <param name="logoutURI" value="/logout"/>
</filter>

<filter class="com.tremolosecurity.proxy.filters.XForward">
  <!-- Determine if plain HTTP Headers or Secure Headers should be used. If checked, standard headers are created, if not checked then attributes are created with the same names that can be added as Secure Headers to the LastMile filter.           -->
        <param name="createHeaders" value="false"/>
</filter>

<filter class="com.tremolosecurity.proxy.filters.custom.CreateAWSRoleAttribute">
  <!-- The name of an attribute on the user object that contains all of the names of roles to be included in the assertion. NOTE: each role should exist in IAM or the authentication will fail. -->
        <param name="sourceAttribute" value="roleNames"/>
  <!-- The AWS account number that should be included in the role mapping.      -->
  <param name="idpName" value="1234567"/>
  <!-- The name of the identity provider in your AWS IAM configuration to bind to.      -->
  <param name="accountNumber" value="MyIdp"/>
</filter>

<filter class="com.tremolosecurity.prelude.filters.StopProcessing" />

<filter class="com.tremolosecurity.proxy.filters.ExecuteWorkflow">
  <!-- The name of the workflow to execute       -->
        <param name="workflowName" value="jitdbwf" />
  <!-- The name of the attribute on the user object used to identify the user   -->
        <param name="uidAttributeName" value="uid" />
</filter>

<filter class="com.tremolosecurity.proxy.filters.UserToJSON">
  <!-- If set to ?true? the request is continued to be proxied. If set to false, the request completes  -->
  <param name="doProxy" value="false" />
</filter>

<filter class="com.tremolosecurity.proxy.filters.AzFilter" />

<filter class="com.tremolosecurity.proxy.filters.RemoteBasic">
  <!-- The name of the realm on the remote web server the authentication is against     -->
        <param name="realmName" value="Tremolo Basic Realm"/>
  <!-- The url to use to test the authentication        -->
        <param name="url" value="http://localhost.localdomain:9090/echo/echo4"/>
</filter>

<filter class="com.tremolosecurity.proxy.filters.LastMile">
  <!-- The key used to encrypt the last mile header     -->
  <param value="lastmile-userreg" name="encKeyAlias" />
  <!-- The number of milliseconds that the last mile token is valid     -->
        <param value="1000" name="timeScew" />
  <!-- The name of the header   -->
        <param value="tremoloHeader" name="headerName" />
        <!-- Static text to put in front of the token, ie for OAuth2 bearer tokens -->
        <param value="" name="headerPrefix" />
  <!-- Each attribs lists a mapping from a user attribute to the attribute in the last mile token -->
  <param value="uid=displayName" name="attribs" />
        <param value="uid=mail" name="attribs" />
</filter>

<filter class="com.tremolosecurity.proxy.filters.CheckADShadowAccounts">
  <!-- The UPN suffix for AD forest storing shadow accounts      -->
  <param name="nonShadowSuffix" value="shadows.ad.local" />
  <!-- The attribute that?s used for the source of the shadow account?s UPN      -->
  <param name="upnAttributeName" value="mail" />
  <!-- Attribute to store a flag value if the account is to be a shadow account  -->
  <param name="flagAttributeName" value="description" />
  <!-- Flag value if the user will become a shadow account       -->
  <param name="flagAttributeValue" value="shadow" />
</filter>

<filter class="com.tremolosecurity.proxy.filters.BasicAuth">
  <!-- The name of the realm to be presented to the browser      -->
  <param name="realmName" value="Tremolo Basic Realm"/>
  <!-- The name of the attribute to use to lookup the user      -->
  <param name="uidAttr" value="uid"/>
</filter>

<filter class="com.tremolosecurity.proxy.filters.AnonAz">
  <!-- RDN of the anonymous user -->
        <param name="userName" value="uid=Anonymous"/>
</filter>

<filter class="com.tremolosecurity.proxy.filters.HideCookie" />

<filter class="com.tremolosecurity.proxy.filters.LastMileJSON">
    <!-- Last Mile encryption key        -->
    <param name="encKeyAlias" value="sessionkey"/>
    <!-- The number of seconds the returned token is valid      -->
    <param name="secondsScew" value="300" />
    <!-- The number of seconds to adjust for if clocks are not synced   -->
    <param name="secondsToLive" value="100"/>
</filter>

<filter class="com.tremolosecurity.proxy.filters.PreAuthFilter">
    <!-- Determines if a SAML assertion should be generated and posted to the Pre-Auth URL. If checked an Identity Provider MUST be created to supply the configuration information to generate the assertion.  -->
    <param name="postSAML" value="true"/>
    <!-- The fully qualified domain name (FQDN) and uri of the URL in Unison configured with a LastMile filter configured, only needed if postSAML is true -->
    <param name="url" value="http://mysite.company.com/myapp/login"/>
    <!-- The name of the identity provider that has the configuration information for generating the assertion  -->
    <param name="idpName" value="saml2" />
    <!-- The host name that should be in the issuer     -->
    <param name="issuerHost" value="localhost.localdomain"/>
    <!-- If the issuer is on a non-standard port, it can be specified here. This field is optional      -->
    <param name="issuerPort" value="6060"/>
    <!-- If the issuer should be https (checked) or http (not checked)  -->
    <param name="issuerSSL" value="false"/>
    <!-- If the application expects a RelayState -->
    <param name="relayState" value="/echo/echo"/>
</filter>

<filter class="com.tremolosecurity.prelude.filters.Groups2Attribute">
  <!-- The base in the virtual directory to begin searching for groups.  -->
  <param name="base" value="o=Tremolo" />
  <!-- Name of the attribute to create  -->
  <param name="attrName" value="roles" />
  <!-- A regular expression to filter out group memberships     -->
  <param name="pattern" value="groups-(.*)" />
  <!-- If a pattern is specified, the group from that pattern to add to the attribute   -->
  <param name="groupNum" value="1" />
</filter>

<filter class="com.tremolosecurity.proxy.filters.CookieFilter">
  <!-- List of cookie names (or regular expressions) to filter  -->
        <param name="ignore" value="cookie2"/>
  <!-- If checked, the values to filter are treated as Java regular expressions. (http://docs.oracle.com/javase/7/docs/api/java/util/regex/Pattern.html)        -->
  <param name="supportRegex" value="false" />
</filter>

<filter class="com.tremolosecurity.proxy.filters.SetNoCacheHeaders">
</filter>

<filter class="com.tremolosecurity.proxy.filters.AddHttpsToRedirect">
</filter>

<filter class="com.tremolosecurity.proxy.filters.CheckSession">
        <!-- The name of the application who's session cookie data to check -->
    <param name="applicationName" value="ScaleJS"/>
</filter>

 <filter class="com.tremolosecurity.proxy.filters.RemovePrefix">
    <!-- The part of the URI to trim off -->
    <param name="prefix" value="/scale"/>
    <!-- The attribute to set with the new URI -->
    <param name="attributeName" value="trimmedURI"/>
</filter>

$ kubectl --token=$(curl https://openunison.server/service/idtoken?refresh_token=....) get nodes

<filter class="com.tremolosecurity.proxy.filters.RetrieveIdToken">
  <!-- The name of the identity provider to pull the id_token from -->
  <param name="idpName" value="oidc" />
  <!-- The name of the trust to pull the id_otken from -->
  <param name="trustName" value="kubernetes" />
</filter>

<filter class="com.tremolosecurity.proxy.filters.CallWorkflow">
    <!-- Determines which workflows can be called, can be listed multiple times -->
    <param name="allowedWorkflow" value="updateLockout"/>
 </filter>

<filter class="com.tremolosecurity.proxy.filters.HeaderFilter">
  <!-- May be listed multiple times for multiple headers -->
  <param name="headerName" value="ToBeRemoved" />
</filter>

<filter class="com.tremolosecurity.unison.google.u2f.Registration">
        <!-- Encryption key for encrypting/decrypting the attribute that stores the user's tokens -->
        <param name="encryptionKeyName" value="sessionKey" />
        <!-- The name of the attribute to retrieve the registered keys from -->
        <param name="attribute" value="carLicense" />
        <!-- The URI of the JSP page that will challenge the U2F device and provide the registration response -->
        <param name="challengeURI" value="/auth/forms/u2fRegistration.jsp" />
        <!-- The name of the workflow to run to update the keys attribute -->
        <param name="workflowName" value="registerU2f" />
        <!-- The attribute to identify the user during the challenge and in the workflow -->
        <param name="uidAttributeName" value="uid" />
        <!-- The URI of the jsp page to send the user to once the regitration process is completed -->
        <param name="completedURI" value="/auth/forms/u2fRegistrationComplete.jsp" />
        <!-- If you only want to allow certain devices or manufacturers -->
        <param name="requireAttestation" value="true" />
        <!-- If requiring attestation of the device, list of certificates used to check the attestation.  May be listed multiple times. -->
        <param name="trustedCertificate" value="trusted-yubico" />
</filter>

<workflow name="registerU2f">
        <tasks>
            <customTask className="com.tremolosecurity.provisioning.customTasks.LoadGroups">
                        <param name="nameAttr" value="uid"/>
                        <param name="inverse" value="false"/>
                </customTask>
                <provision sync="true" target="ldap"/>
        </tasks>
</workflow>

<filter class="com.tremolosecurity.proxy.filters.LdapOnJson" />

swagger: '2.0'
info:
  version: "1.0.17"
  title: OpenUnison Ldap2Json

definitions:
  Attributes:
    type: object
    additionalProperties:
      type: array
      items:
        type: string
    description: Map of attribute name --> multiple values

  LdapJsonBindRequest:
    type: object
    properties:
      password:
        type: string
        description: Secret for authentication
    description: in java package com.tremolosecurity.ldapJson

  LdapJsonError:
    type: object
    description: in java package com.tremolosecurity.ldapJson
    properties:
      responseCode:
        type: integer
        description: LDAP Response code
      errorMessage:
        type: string
        description: response message

  LdapJsonEntry:
    type: object
    description: in java package com.tremolosecurity.ldapJson
    properties:
      dn:
        type: string
        description: The distinguished name of the entry
      attrs:
        $ref: '#/definitions/Attributes'

paths:
  /{base_dn}/{search_scope}:
    get:
      description: performs an LDAP Search
      parameters:
        -
          name: base_dn
          in: path
          description: Search base
          required: true
          type: string
        -
          name: search_scope
          in: path
          description: One of base, sub, one
          required: true
          type: string
        -
          name: filter
          in: query
          description: LDAP Filter
          required: true
          type: string
        -
          name: attributes
          in: query
          description: each value is an attribute to be returned
          type: string
          minimum: 0
      responses:
        200:
          description: list of entries
          schema:
            type: array
            items:
              $ref: '#/definitions/LdapJsonEntry'
        500:
          description: error
          schema:
            $ref: '#/definitions/LdapJsonError'

  /{user_dn}:
    post:
      description: performs an LDAP Bind to verify the user's credentials
      parameters:
        -
          name: user_dn
          in: path
          description: The distinguished name of the user to check
          type: string
          required: true
        -
          name: body
          in: body
          schema:
            $ref: '#/definitions/LdapJsonBindRequest'
          description: Bind request
      responses:
        200:
          description: valid credentials
          schema:
            $ref: '#/definitions/LdapJsonError'
        500:
          description: error
          schema:
            $ref: '#/definitions/LdapJsonError'

<filter class="com.tremolosecurity.prometheus.filter.MetricsFilter" >
  <!-- Optional - implementation of com.tremolosecurity.prometheus.sdk.LocalMetrics to add custom metrics -->
  <param name="localMetricsClassName" value="com.tremolosecurity.MyMetrics" />
</filter>

<filter class="com.tremolosecurity.prometheus.aggregate.JMSPull" >
  <!-- Request queue -->
  <param name="requeustQueueName" value="prometheus-request.fifo" />
  <!-- Response queue -->
  <param name="responseQueueName" value="prometheus-response.fifo" />
  <!-- Job name -->
  <param name="job" value="remote" />
  <!-- instance name -->
  <param name="instance" value="prometheus" />
  <!-- Time in milliseconds to wait for a response on the response queue -->
  <param name="maxWaitTime" value="60000" />
  <!-- Implementation of com.tremolosecurity.prometheus.sdk.AdditionalMetrics for additional metrics -->
  <param name="additionalMetricsClassName" value="com.domain.idm.ExtraChecks" />
  <!-- Additional options -->
  <param name="loginTestURL" value="#[PROMETHEUS_LOGIN_URL]" />
  <param name="loginTestUserName" value="#[PROMETHEUS_LOGIN_USERNAME]" />
  <param name="loginTestPassword" value="#[PROMETHEUS_LOGIN_PASSWORD]" />
  <param name="internal" value="false" />
</filter>

<filter class="com.tremolosecurity.proxy.filters.K8sInjectImpersonation">
  <!-- The name of the OpenShift (kubernetes) target -->
  <param name="targetName" value="k8s" />
  <!-- The username attribute from the logged in user's account -->
  <param name="userNameAttribute" value="sub" />
  <!-- If true, groups are pulled directly from an LDAP search -->
  <param name="useLdapGroups" value="false" />
  <!-- if useLdapGroups is false, the attribute to use to load groups -->
  <param name="groupAttribute" value="groups" />
</filter>

<target name="ldap2"
                                className="com.tremolosecurity.provisioning.core.providers.LDAPProvider">
        <params>
    <!-- The object class for new user objects -->
                <param name="objectClass" value="inetOrgPerson" />
    <!-- Host for the ldap server       -->
                <param name="host" value="127.0.0.1" />
    <!-- The port to connect to -->
                <param name="port" value="10983" />
    <!-- A DN for a user with administrator rights to create and update accounts        -->
                <param name="adminDN" value="cn=admin,dc=domain,dc=com" />
    <!-- Credential passwords   -->
                <param name="adminPasswd" value="manager" />
    <!-- The DN pattern for new users with user attributes in ${}       -->
                <param name="dnPattern" value="uid=${uid},ou=internal,dc=domain,dc=com" />
    <!-- The base that should be used for searching for users and groups        -->
                <param name="searchBase" value="dc=domain,dc=com" />
    <!-- The name of the attribute used to identify the user    -->
                <param name="userIDAttribute" value="uid"/>
    <!-- If set to true SSL is used for the connection  -->
                <param name="useSSL" value="false"/>
    <!-- Maximum number of connections to the directory -->
                <param name="maxCons" value="10"/>
    <!-- Maximum number of individual operations per connection -->
                <param name="threadsPerCons" value="10"/>
    <!-- Millisconds an idle connection can stay open -->
    <param name="idleTimeout" value="90000" />
    <!-- Allow for users from outside the directory to be provisioned into directory groups -->
    <param name="allowExternalUsers" value="false" />

        </params>
  <!-- User mappings -->
        <targetAttribute name="uid" sourceType="user"
                source="TREMOLO_USER_ID" />
        <targetAttribute name="sn" sourceType="user"
                source="sn" />
        <targetAttribute name="l" sourceType="user"
                source="l" />
        <targetAttribute name="cn" sourceType="user"
                source="cn" />
        <targetAttribute name="givenName"
                sourceType="user" source="givenName" />
</target>

<target name="activedirectory" className="com.tremolosecurity.provisioning.core.providers.ADProvider">
        <params>
                <!-- Host for the ldap server   -->
                <param name="host" value="ad.tremolo.lan"/>
    <!-- The port to connect to -->
                <param name="port" value="636"/>
    <!-- A DN for a user with administrator rights to create and update accounts        -->
                <param name="adminDN" value="cn=Administrator,cn=Users,dc=enterprise,dc=domain,dc=com"/>
    <!-- Credential passwords   -->
                <param name="adminPasswd" value=""/>
    <!-- The DN pattern for new users with user attributes in ${}       -->
                <param name="dnPattern" value="cn=${cn},cn=Users,dc=enterprise,dc=domain,dc=com"/>
    <!-- The base that should be used for searching for users and groups        -->
                <param name="searchBase" value="dc=enterprise,dc=domain,dc=com"/>
    <!-- The name of the attribute used to identify the user    -->
                <param name="userIDAttribute" value="samAccountName"/>
    <!-- If set to true SSL is used for the connection  -->
                <param name="useSSL" value="true"/>
    <!-- Maximum number of connections to the directory -->
                <param name="maxCons" value="10"/>
    <!-- Maximum number of individual operations per connection -->
                <param name="threadsPerCons" value="10"/>
    <!-- If set to true a shadow account is created. A shadow account is just like a regular account except the password is randomly generated. -->
    <param name="createShadowAccount" value="true"/>
    <!-- Millisconds an idle connection can stay open -->
    <param name="idleTimeout" value="90000" />
    <!-- Allow for users from outside the directory to be provisioned into directory groups -->
    <param name="allowExternalUsers" value="false" />


        </params>
        <targetAttribute name="uid" sourceType="user" source="TREMOLO_USER_ID"  />
        <targetAttribute name="lastname" sourceType="user" source="sn"  />
        <targetAttribute name="givenName" sourceType="static" source="staticValue"  />
        <targetAttribute name="cn" sourceType="custom" source="com.tremolosecurity.test.provisioning.CreateCN"  />
        <targetAttribute name="login" sourceType="composite" source="${firstname}.${sn}@TEST"  />
</target>

<target name="jitdb" className="com.tremolosecurity.provisioning.core.providers.AmazonSimpleDBProvider">
  <params>
      <!-- Domain for storing user information          -->
      <param name="userDomain" value="Users"/>
      <!-- Domain for storing group information -->
      <param name="groupDomain" value="Groups"/>
      <!-- Access Key   -->
      <param name="accessKey" value=""/>
      <!-- Secret Key   -->
      <param name="secretKey" value=""/>
      <!-- The attribute that stores the userid -->
      <param name="uidAttributeName" value="uid"/>
  </params>
  <!-- Attribute mapping -->
  <targetAttribute name="login" source="uid" sourceType="user"/>
  <targetAttribute name="last" source="sn" sourceType="user"/>
  <targetAttribute name="first" source="givenName" sourceType="user"/>
</target>

<target name="jitdb" className="com.tremolosecurity.provisioning.core.providers.BasicDB">
  <params>
      <!-- The class of the JDBC driver -->
      <param name="driver" value="com.mysql.jdbc.Driver"/>
      <!-- The JDBC URL for accessing the database      -->
      <param name="url" value="jdbc:mysql://endor.tremolo.lan/autogroups"/>
      <!-- An optional character used to escape field names in SQL      -->
      <param name="beginEscape" value="`" />
      <!-- An optional character used to escape field names in SQL      -->
      <param name="endEscape" value="`" />
      <!-- The user for connecting to the database      -->
      <param name="user" value="myvd"/>
      <!-- The password for the database        -->
      <param name="password" value=""/>
      <!-- The maximum number of connections to the database    -->
      <param name="maxCons" value="0"/>

      <!-- A query to run on a connection prior to checkout to make sure it is still active -->
      <param name="validationQuery" value="SELECT 1" />
      <!-- Number of seconds between tests of idle connections -->
      <param name="idleConnectionTestPeriod" value="30" />
      <!-- Number of seconds after which a checked out connection is returned to the pool -->
      <param name="unreturnedConnectionTimeout" value="30" />
      <!-- Number of milliseconds to wait for a connection -->
      <param name="checkoutTimeout" value="30000" />
      <!-- The name of the table that stores the user objects   -->
      <param name="userTable" value="users"/>
      <!-- The name of the column in the user table that is the primary key     -->
      <param name="userPrimaryKey" value="id"/>
      <param name="userName" value="login"/>
      <!-- Determines how to manage the relationship between users and groups:
          None ? No group information is stored
          ManyToMany ? Assumes there is a table of users, table of groups and a table that links them
          OneToMany ? Assumes there?s a table of users with a one-to-many relationship with a groups table
          Custom ? Use a custom class to update user attributes and group memberships. See the SDK for implementation details
      -->
      <param name="groupMode" value="ManyToMany"/>
      <!-- The name of the table that stores group information  -->
      <param name="groupTable" value="groups"/>
      <!-- The field start stores the name of the group -->
      <param name="groupName" value="name"/>
      <!-- The name of the column in the link table that maps to the user?s primary key -->
      <param name="groupUserKey" value="userid"/>
      <!-- The name of the table used to link users and groups  -->
      <param name="groupLinkTableName" value="usergroups"/>
      <!-- The name of the column in the link table that maps to the group?s primary key        -->
      <param name="groupGroupKey" value="groupid"/>
      <!-- The name of the primary key of the group table       -->
      <param name="groupPrimaryKey" value="id"/>
      <!-- If a custom group management is used this option is used to specify how users are looked up. Use %S to specify the fields being looked up, %I for the user?s numeric ID and %L for the user?s login  -->
      <param name="userSQL" value=""/>
      <!-- If a custom group management is used this option is used to specify how groups are looked up. Use %S to specify the fields being looked up, %I for the user?s numeric ID and %L for the user?s login -->
      <param name="groupSQL" value=""/>
      <!-- The class name for a custom provider. Must implement com.tremolosecurity.provisioning.core.providers.db.CustomDB -->
      <param name="customProvider" value=""/>
      <!-- SQL for validating the connection -->
      <param name="validationQuery" value="SELECT 1"/>
      <!-- Optional - Set to true if you want to provision passwords to the database in PBKDF2 format with a 64 byte salt -->
      <param name="supportPasswords" value="false" />
      <!-- Optional - If supportPasswords is true, the column to store the password in -->
          <param name="passwordField" value="password" />

  </params>
  <!-- Attribute mapping -->
  <targetAttribute name="login" source="uid" sourceType="user"/>
  <targetAttribute name="last" source="sn" sourceType="user"/>
  <targetAttribute name="first" source="givenName" sourceType="user"/>
</target>

<target name="extUnison" className="com.tremolosecurity.provisioning.core.providers.TremoloTarget">
  <params>
      <!-- The name of the workflow used to create new users    -->
      <param name="createUsersWF" value="createUsers"/>
      <!-- The name of the workflow to delete users     -->
      <param name="deleteUserWF" value="deleteUser"/>
      <!-- The name of the workflow to set a user?s password    -->
      <param name="setUserPasswordWF" value="setPassword"/>
      <!-- The name of the workflow to synchronize a user       -->
      <param name="syncUserWF" value="syncUser"/>
      <!-- The attribute name for the user identifier   -->
      <param name="uidAttrName" value="uid"/>
      <!-- The url for the unison web service   -->
      <param name="wfUrlBase" value="https://www.tremolosecurity-test.com:9093"/>
  </params>
  <!-- Attribute mapping -->
  <targetAttribute name="login" source="uid" sourceType="user"/>
  <targetAttribute name="last" source="sn" sourceType="user"/>
  <targetAttribute name="first" source="givenName" sourceType="user"/>
</target>

<target name="extUnison" className="com.tremolosecurity.provisioning.core.providers.TremoloTarget">
  <params>
      <!-- The SugarCRM web services URL                -->
      <param name="url" value="http://sugarcrm.domain.com/sugarcrm/service/v2/rest.php"/>
      <!-- Administrative username      -->
      <param name="adminUser" value="admin"/>
      <!-- The user?s password  -->
      <param name="adminPwd" value=""/>

  </params>
  <!-- Attribute mapping -->
  <targetAttribute name="login" source="uid" sourceType="user"/>
  <targetAttribute name="last" source="sn" sourceType="user"/>
  <targetAttribute name="first" source="givenName" sourceType="user"/>
</target>

<target name="extUnison" className="com.tremolosecurity.provisioning.core.providers.TremoloTarget">
  <params>
      <!-- The URL, from Unison's perspective, of the web services url          -->
      <param name="webServicesURL" value="http://sharepoint-internal.domain.com/_vti_bin/usergroup.asmx"/>
      <!-- Mechanism for authentication to SharePoint. For JIT provisioning you must use Unison Last Mile. (ntlm/lastmile)      -->
      <param name="authMode" value="lastmile"/>
      <!-- Tell Unison if all subsites are a member of the root site or are distinct sites with their own web services endpoints        -->
      <param name="multiSite" value="false"/>
      <!-- List of paths for each site. For instance "/", "/MySite" without quotes      -->
      <param name="siteURI" value="/"/>
      <param name="siteURI" value="/MySite"/>
      <!-- Full user principal name of an administrative user   -->
      <param name="adminUPN" value="admin@domain.com"/>
      <!-- Password for NTLM access     -->
      <param name="adminPassword" value=""/>
      <!-- Lastmile Key Alias -->
      <param name="keyAlias" value=""/>
      <!-- Last mile header name -->
      <param name="headerName" value=""/>
      <!-- Variance in milliseconds between the Unison clock and sharepoint clock -->
      <param name="skew" value=""/>

  </params>
  <!-- Attribute mapping -->
  <targetAttribute name="login" source="uid" sourceType="user"/>
  <targetAttribute name="last" source="sn" sourceType="user"/>
  <targetAttribute name="first" source="givenName" sourceType="user"/>
</target>

<target name="rhelent.lan" className="com.tremolosecurity.unison.freeipa.FreeIPATarget">
    <params>
        <!-- The protocol and host of the FreeIPA IPA-Web server. Do NOT include any path information -->
        <param name="url" value="https://freeipa.rhelent.lan"/>
        <!-- The user name (uid attribute) of a member of the admins group -->
        <param name="userName" value="adminx"/>
        <!-- The password of the service account used to create accounts -->
        <param name="password" value="start123"/>
        <!-- If true, when a user is created a random password is generated so that the account is active and ready for use, but not usable with a password -->
        <param name="createShadowAccounts" value="true"/>
        <!-- If true, this freeipa target will work with cross domain trusts.  The userid will need to be the user's userPrincipalName, not uid -->
        <param name="multiDomain" value="false" />
        <!-- If multiDomain is true, this will tell the target the primary domain -->
        <param name="primaryDomain" value="rhelent.lan" />
        <!-- Determines the Trust View to use with multiDomain, default to Default Trust View -->
        <param name="trustView" value="Default Trust View" />
    </params>
    <targetAttribute name="sn" source="sn" sourceType="user"/>
    <targetAttribute name="givenname" source="givenname" sourceType="user"/>
    <targetAttribute name="mail" source="mail" sourceType="user"/>
    <targetAttribute name="uid" source="uid" sourceType="user"/>
    <targetAttribute name="cn" source="cn" sourceType="user"/>
    <targetAttribute name="displayname" source="displayname" sourceType="user"/>
    <targetAttribute name="gecos" source="gecos" sourceType="user"/>
</target>

$ oc new-project unison-service
$ oc project unison-service
$ cat <<EOF | oc create -n unison-service -f -
kind: ServiceAccount
apiVersion: v1
metadata:
  name: unison
EOF
$ oadm policy add-cluster-role-to-user cluster-admin system:serviceaccount:unison-service:unison
$ oc describe serviceaccount unison
Name:           unison
Namespace:      unison-service
Labels:         <none>

Image pull secrets:     unison-dockercfg-oe7gj

Mountable secrets:      unison-token-gmhdw
                        unison-token-vdbkq
                        unison-dockercfg-oe7gj

Tokens:                 unison-token-gmhdw
                        unison-token-vdbkq
                        unison-token-x5y1y

$ oc describe secret unison-token-x5y1y

Name:           unison-token-x5y1y
Namespace:      unison-service
Labels:         <none>
Annotations:    kubernetes.io/service-account.name=unison,kubernetes.io/service-account.uid=bda8c387-58ea-11e6-b7c9-525400b18ee2

Type:   kubernetes.io/service-account-token

Data
====
token:          eyJhbGciOiJS...
ca.crt:         1066 bytes
namespace:      14 bytes

<target name="openshift" className="com.tremolosecurity.unison.openshiftv3.OpenShiftTarget">
    <params>
        <!-- The protocol and host and port of the OpenShift api web server. Do NOT include any path information, if running inside a pod leave this field empty and OpenUnison will determine the url based on environment variables -->
        <param name="url" value="https://openshift.tremolo.lan:8443"/>
        <!-- Set to true if using an OpenShift service account instead of a user account -->
        <param name="useToken" value="false" />
        <!-- IF useToken is true, set this to the token.  See "Creating a Service Account".  If running inside of a pod, leave this field empty and OpenUnison will use the pod's service account -->

        <!-- Multiple token types can be supported

            static - set via the token parameter
            legacy - The default, will load a Secret mounted for a ServiceAccount
            tokenapi - Loads a token mounted via the TokenRequest API, and reloads as the token is updated
            oidc - Assumes that the remote connection is based on the OpenUnison management gateway

        -->
        <param name="tokenType" value="legacy" />

        <!-- if tokenType is tokenapi, the path to the token -->
        <param name="tokenPath" value="/var/run/secrets/kubernetes.io/serviceaccount/token" />

        <!-- if tokenType is oidc -->
        <!-- the name of the idp in openunison to generate the JWT -->
        <param name="oidcIdp" value="remotek8s" />
        <!-- the name of the sub for the JWT -->
        <param name="oidcSub" value="openunison" />
        <!-- the audience for the JWT -->
        <param name="oidcAudience" value="kubernetes" />

        <param name="token" value="eyJhbGciOiJSUz..." />

        <!-- can be used to specify the certificate used for trusting the remote cluster, base64 encoded PEM file -->
        <param name="certificate" value="LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUQvekNDQXVlZ0F3SUJBZ0lHQVhaRGNTN0NNQTBHQ1NxR1NJYjNEUUVCQ3dVQU1JR1ZNU293S0FZRFZRUUQKRENGck9ITmhjR2t5TG1Gd2NITXVNVGt5TGpFMk9DNHlMakUwT0M1dWFYQXVhVzh4RXpBUkJnTlZCQXNNQ2t0MQpZbVZ5Ym1WMFpYTXhEakFNQmdOVkJBb01CVTE1VDNKbk1STXdFUVlEVlFRSERBcE5lU0JEYkhWemRHVnlNUmt3CkZ3WURWUVFJREJCVGRHRjBaU0J2WmlCRGJIVnpkR1Z5TVJJd0VBWURWUVFHRXdsTmVVTnZkVzUwY25rd0hoY04KTWpBeE1qQTRNVGMwTURVNVdoY05NakV4TWpBNE1UYzBNRFU1V2pDQmxURXFNQ2dHQTFVRUF3d2hhemh6WVhCcApNaTVoY0hCekxqRTVNaTR4TmpndU1pNHhORGd1Ym1sd0xtbHZNUk13RVFZRFZRUUxEQXBMZFdKbGNtNWxkR1Z6Ck1RNHdEQVlEVlFRS0RBVk5lVTl5WnpFVE1CRUdBMVVFQnd3S1RYa2dRMngxYzNSbGNqRVpNQmNHQTFVRUNBd1EKVTNSaGRHVWdiMllnUTJ4MWMzUmxjakVTTUJBR0ExVUVCaE1KVFhsRGIzVnVkSEo1TUlJQklqQU5CZ2txaGtpRwo5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBMTZvTHlvRHcrcHVId1hmTHNOSUFVMUMzYjJVdWpTWGdzdDNmCnZrQU50aTQyWEV2K3ZaMU9BV1oyTzBQL3dXa2NMb0NQcVBWdUZsRGx4cjNEdTBIWnkzekxUU2Zjem9IYURGczYKdk54VGpuM3poQi9XelpkbEkyeVl1K0VSY0NkTGFBOGYzMmFzUjR5YUNkV1Nvc29TVEE2NkhDVm95NFAvcm90aApyU0JSV00rdTFjMnVHYzBocDVSNytBRDY2U1ljUXNLYUJJQ1FWamd4YmFiRW1zaTFzV1M0dFcwRGlWZzUyMTNjCmNPNWgxMmpPN1A0cjd4dHd5ZkNQbGwrYzFEMnhsa2xSSUNGUEZyZHkzL3d3UENwSCtrNU9hQ3hNY1MyZ0lHUFcKdGtFUElDR2IrNmY0bkFsMktueGlCQTJKR3FLVnMrZE9OMzRBRzAvT1JEZ2txU214bXdJREFRQUJvMU13VVRCUApCZ05WSFJFRVNEQkdnaUZyT0hOaGNHa3lMbUZ3Y0hNdU1Ua3lMakUyT0M0eUxqRTBPQzV1YVhBdWFXK0NJV3M0CmMyRndhVEl1WVhCd2N5NHhPVEl1TVRZNExqSXVNVFE0TG01cGNDNXBiekFOQmdrcWhraUc5dzBCQVFzRkFBT0MKQVFFQWFxc09DRFNwZWtONUp5dExleDFoNE5XQkpPblYwL2hDTnpNeWZvbkVmYUpjNDA2R09HUGFmTG8xNEd6ZApsbjVJZVVHQlJZL1VhMTdmUHpxKzhYQnVOMFEyTThNNWVNbEZMQ1lubXN1dG5TbHEyN0VsV05rQk5tbkZXZUIxCkM5bS9Sa1BoNG54THphYld4cUFtY3Bxb3JZWjNZdmFKU3lBSThqM2llbXBScUMyWTNEWmxqek1DSVFSNlk1bjYKcGM0aCtpQzAxT2lrV1JVdG10a1Y0MjBYVWt5am94ZzFrVHk2ODI5K1MrdGZJa1VJaitZaFZOZUVrei9iR0dmYwpRempXMWtkYUJucXNzcVRmdmt5UjRWR1NYVHNHNExjakE0QlBEOEFDR0NWcGVxelJ2NTI1QXIwMCt3R0U5d1ZrCnkrRWhSVHlTRjk3eWtSZXFYWURuREtSRG9RPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQ==" />

        <!-- IF useToken is false, the user name (name attribute) of a user with cluster administration (cluster-admin role) -->
        <param name="userName" value="adminx"/>
        <!-- The password of the service account used to create accounts -->
        <param name="password" value="start123"/>

    </params>
    <!-- only the fullName attribute is supported -->
    <targetAttribute name="fullName" source="displayName" sourceType="user"/>

</target>

{
  name : "name_of_role",
  scope : "project",
  domain : "mydomain",
  project : "myproject"
 }

 <target name="openstack" className="com.tremolosecurity.unison.openstack.KeystoneProvisioningTarget">
    <params>
        <!-- The URL for Keystone's V3 base -->
        <param name="url" value="http://rdo.rheldemo.lan:5000/v3"/>
        <!-- The user name (name attribute) of a user with with global admin privileges -->
        <param name="userName" value="admin"/>
        <!-- The password of the service account used to create accounts -->
        <param name="password" value="start123"/>
        <!-- The domain holding the service account used to connect to Keystone -->
        <param name="domain" value="default" />
        <!-- The admin project for OpenStack -->
        <param name="projectName" value="admin" />
        <!-- The domain holding the admin project -->
        <param name="projectDomainName" value="default" />
        <!-- The id domain holding the users to manage -->
        <param name="usersDomain" value="e9518777a4294c6d9cbe942b2f409830" />
        <!-- Set to true if the usersDomain is not a SQL domain so that you can manage role memberships for domain members -->
        <param name="rolesOnly" value="true" />
    </params>
    <!-- only attributes supported -->
    <targetAttribute name="name" source="userPrincipalName" sourceType="user"/>
    <targetAttribute name="email" source="mail" sourceType="user"/>
    <targetAttribute name="description" source="description" sourceType="user"/>
    <targetAttribute name="enabled" source="enabled" sourceType="user"/>
    <targetAttribute name="roles" source="roles" sourceType="user"/>
</target>

<target name="jitdb" className="com.tremolosecurity.provisioning.providers.K8sCrdUserProvider">
    <params>
        <!-- The name of the openshift provisioning target to use -->
        <param name="k8sTarget" value="k8s" />
        <!-- The namespace to create users in -->
        <param name="nameSpace" value="openunison" />
    </params>
    <targetAttribute name="first_name" source="first_name" sourceType="user"  />
    <targetAttribute name="last_name" source="last_name" sourceType="user"  />
    <targetAttribute name="email" source="email" sourceType="user"  />
    <targetAttribute name="sub" source="sub" sourceType="user"  />
    <targetAttribute name="uid" source="uid" sourceType="user"  />
</target>

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: users.openunison.tremolo.io
spec:
  group: openunison.tremolo.io
  versions:
    - name: v1
      served: true
      storage: true
  version: v1
  scope: Namespaced
  names:
    plural: users
    singular: user
    kind: User
    shortNames:
    - usr
  validation:
   # openAPIV3Schema is the schema for validating custom objects.
    openAPIV3Schema:
      properties:
        spec:
          properties:
            sub:
              type: string
            groups:
              type: array
              items:
                type: string
            first_name:
              type: string
            last_name:
              type: string
            email:
              type: string

<target name="drupal" className="com.tremolosecurity.unison.drupal.drupal8.provisioning.Drupal8Target">
    <params>
        <!-- The URL for your drupal site -->
        <param name="url" value="http://192.168.56.102"/>
        <!-- Administrative credentials -->
        <param name="user" value="admin"/>
        <param name="password" value="start123"/>
    </params>
    <targetAttribute name="name" source="name" sourceType="user" targetType="string"/>
    <targetAttribute name="mail" source="mail" sourceType="user" targetType="string"/>
    <targetAttribute name="first_name" source="first_name" sourceType="user" targetType="string"/>
    <targetAttribute name="last_name" source="last_name" sourceType="user" targetType="string"/>
    <targetAttribute name="status" source="true" sourceType="static" targetType="string"/>
</target>

<target name="okta" className="com.tremolosecurity.unison.okta.provisioning.OktaTarget">
        <params>
            <!-- The token from the "API" section of your Okta domain administration console -->
                <param name="token" value="sdfgdafhh3531256afag" />
                <!-- Your Okta domain -->
                <param name="domain" value="xyz.okta.com" />
        </params>
        <targetAttribute name="login" source="uid" sourceType="user" targetType="string"/>
    <targetAttribute name="email" source="mail" sourceType="user" targetType="string"/>
    <targetAttribute name="firstName" source="givenName" sourceType="user" targetType="string"/>
    <targetAttribute name="lastName" source="sn" sourceType="user" targetType="string"/>
</target>

<target name="azuread" className="">
        <params>
                <!-- The AzureAD Client ID -->
                <param name="clientId" value="sdfsdfsdfsd" />
                <!-- The tenant id -->
                <param name="tenantId" value="sfgsdfsfd" />
                <!-- The secret key -->
                <param name="clientSecret" value="ssdfsdfsd" />
        </params>
        <targetAttribute name="displayName" source="displayName" sourceType="user" targetType="string"/>
    <targetAttribute name="givenName" source="givenName" sourceType="user" targetType="string"/>
    <targetAttribute name="surname" source="surname" sourceType="user" targetType="string"/>
    <targetAttribute name="userPrincipalName" source="userPrincipalName" sourceType="user" targetType="string"/>
    <targetAttribute name="id" source="id" sourceType="user" targetType="string"/>
    <targetAttribute name="mail" source="mail" sourceType="user" targetType="string"/>
    <targetAttribute name="accountEnabled" source="accountEnabled" sourceType="user" targetType="boolean"/>
</target>

<target name="gitlab" className="com.tremolosecurity.unison.gitlab.provisioning.targets.GitlabUserProvider">
    <params>
        <!-- The URL of your GitLab service -->
        <param name="url" value="#[GITLAB_URL]"/>
        <!-- A personal access token for an administrator account -->
        <param name="token" value="#[GITLAB_TOKEN]"/>
    </params>
    <targetAttribute name="username" source="username" sourceType="user"/>
    <targetAttribute name="email" source="email" sourceType="user"/>
    <targetAttribute name="name" source="name" sourceType="user"/>
    <targetAttribute name="isAdmin" source="isAdmin" sourceType="user"/>
    <targetAttribute name="skipConfirmation" source="true" sourceType="static"/>
    <targetAttribute name="projectsLimit" source="100000" sourceType="static" />
</target>

<target name="argocd" className="com.tremolosecurity.argocd.targets.ArgoCDTarget">
    <params>
        <!-- The URL for your ArgoCD service -->
        <param name="url" value="#[ARGOCD_URL]"/>
        <!-- API token to use -->
        <param name="token" value="#[ARGOCD_TOKEN]"/>
    </params>
</target>

<target name="mattermost" className="com.tremolosecurity.provisioning.core.providers.MatterMostProvider">
    <params>
        <!-- url for mattermost -->
        <param name="matterMostUrl" value="https://mattermost-url.domain.com"/>
        <!-- access token for mattermost -->
        <param name="accessToken" value="XXXXXXX"/>
    </params>
    <targetAttribute name="email" source="email" sourceType="user" targetType="string"/>
    <targetAttribute name="username" source="username" sourceType="user" targetType="string"/>
    <targetAttribute name="first_name" source="first_name" sourceType="user" targetType="string"/>
    <targetAttribute name="last_name" source="last_name" sourceType="user" targetType="string"/>
    <targetAttribute name="auth_service" source="auth_service" sourceType="user" targetType="string"/>
    <targetAttribute name="auth_data" source="auth_data" sourceType="user" targetType="string"/>
</target>

<customTask className="com.tremolosecurity.provisioning.customTasks.FilterGroups">
  <!-- A group name that should pass through this filter, case sensitive and can be listed multiple times       -->
  <param name="name" value="User"/>
  <param name="name" value="Admins"/>
</customTask>

<customTask className="com.tremolosecurity.provisioning.customTasks.LoadAttributes">
  <!-- An attribute name to load, case sensitive and can be listed multiple times       -->
  <param name="name" value="givenName"/>
  <param name="name" value="sn"/>
  <!-- The name of the attribute that identifies the user in the virtual directory      -->
  <param name="nameAttr" value="uid"/>
  <!-- Optional - The directory base in Unison's ldap virtual directory to begin the search at. -->
  <!-- <param name="base" value="ou=db,o=Tremolo"/> -->
</customTask>

<customTask className="com.tremolosecurity.provisioning.customTasks.MapGroups">
  <!-- A mapping of target from source. To map Admins --> SYS_ADMIN the value should be SYS_ADMIN=Admins. This attribute can be mapped multiple times.          -->
  <param name="map" value="SYS_ADMIN=Admins"/>
</customTask>

<customTask className="com.tremolosecurity.provisioning.customTasks.SetPassword">
  <!-- The name of the password reset mechanism as defined in the Auth Mechs section.   -->
  <param name="mechName" value="PasswordReset"/>
</customTask>

<customTask className="com.tremolosecurity.provisioning.customTasks.Attribute2Group">
  <!-- The name of the attribute to get the group values from. Once the values are added, the attribute is removed from the user.               -->
  <param name="attributeName" value="roles"/>
</customTask>

<customTask className="com.tremolosecurity.provisioning.customTasks.JITIgnoreGroups">
  <!-- The name of the group to ignore          -->
  <param name="groupName" value="Administrators"/>
  <!-- The name of the provisioning target to search    -->
  <param name="targetName" value="adUsers"/>
</customTask>

<customTask className="com.tremolosecurity.provisioning.customTasks.LoadGroups">
  <!-- The attribute name to search for on the user's account   -->
  <param name="nameAttr" value="uid"/>
  <!-- If set to true, only loads the groups from the virtual directory that the user's object is NOT already a member of               -->
  <param name="inverse" value="false"/>
</customTask>

<customTask className="com.tremolosecurity.provisioning.customTasks.LoadGroupsFromTarget">
  <!-- The attribute name to search for on the user's account   -->
  <param name="nameAttr" value="uid"/>
  <!-- If set to true, only loads the groups from the virtual directory that the user's object is NOT already a member of               -->
  <param name="inverse" value="false"/>
  <!-- Name of the target -->
  <param name="target" value="some-db-target"/>
</customTask>

    <customTask className="com.tremolosecurity.provisioning.customTasks.LoadAttributesFromTarget">
        <!-- Name of the target -->
        <param name="target" value="drupaldb"/>
        <!-- The attribute name to search for on the user's account     -->
        <param name="nameAttr" value="mail"/>
        <!-- list of attributes to load, can be listed multiple times -->
        <param name="attributes" value="uid"/>
    </customTask>

<customTask className="com.tremolosecurity.provisioning.customTasks.JITBasicDBCreateGroups">
  <!-- The name of a database provisioning taget                -->
  <param name="targetName" value="jitDB"/>
</customTask>

<customTask className="com.tremolosecurity.provisioning.customTasks.PrintUserInfo">
  <!-- An optional label to add to the log message      -->
  <param name="message" value="After Approval"/>
</customTask>

<customTask className="com.tremolosecurity.provisioning.customTasks.CreateOTPKey">
  <!-- The name of the attribute to store the token in          -->
  <param name="attributeName" value="l"/>
  <!-- The host name of the service, used for identification in the authenticator       -->
  <param name="hostName" value="www.someplace.com"/>
  <!-- The name of the key used to encrypt and decrypt the user's token. Can be obtained from the TOTP Authentication Mechanism on your Authentication Chain.   -->
  <param name="encryptionKey" value="lastmile-enc-totp"/>
</customTask>

<customTask className="com.tremolosecurity.unison.openstack.AddRoleTask">
  <!-- The name of the role, if not specified defaults to $role_name$ -->
  <param name="name" value="$role_name$"/>
  <!-- The scope of the role, may be project or domain -->
  <param name="scope" value="project"/>
  <!-- The name of the domain, defaults to $project_domain_name$ if not specified -->
  <param name="domain" value="$project_domain_name$"/>
  <!-- The name of the project, defaults to $project_name$ -->
  <param name="project" value="$project_name$"/>
  <!-- Set to true if the role should be removed from the user's object -->
  <param name="remove" value="false"/>
</customTask>

<customTask
        className="com.tremolosecurity.mongodb.unison.CreateMongoGroups">
        <!-- Collection to create groups in if not found -->
        <param name="collectionName" value="groups" />
        <!-- The target to search and create groups in -->
        <param name="targetName" value="mymongodb" />
        <!-- Check a request attribute for a group name, like what might by used in a dynamic workflow -->
        <param name="requestAttributes" value="approvalGroup" />
</customTask>

<customTask className="com.tremolosecurity.provisioning.customTasks.CallRemoteWorkflow">
    <!-- Name of the workflow to call on the remote OpenUnison server -->
    <param name="workflowName" value="updateLockout"/>
    <!-- Static key used to encrypt the LAstMile token -->
    <param name="lastMileKeyName" value="lastmile-portal"/
    <!-- URL to call -->
    <param name="url" value="https://openunison.domain.lan:8443/workflows/call"/>
    <!-- Attribute from LastMile user to identify the LastMile account -->
    <param name="lastMileUid" value="uid"/>
    <!-- List of request variables to include -->
    <param name="staticRequestValues" value="UNISON.EXEC.TYPE=UNISON.EXEC.SYNC"/>
    <!-- Name of the user to use in the LastMile request -->
    <param name="lastMileUser" value="system"/>
    <!-- skew to allow for time drift across servers in millis -->
    <param name="timeSkew" value="60000"/>
    <!-- name of the attribute in te workflow object that identifies the user -->
    <param name="uidAttributeName" value="uid" />
</customTask>

<customTask className="com.tremolosecurity.provisioning.customTasks.AddGroupToStore">
    <!-- The name of the target to create the group in -->
        <param name="target" value="rhelent.lan"/>
        <!-- The name of the group(s) to add, may be listed multiple times.  Values can use values from the request object -->
        <param name="name" value="created-$DYN_NAME$-workflow"/>

        <!-- Parameters passed into addGroup, may be listed multiple times -->
        <param name="attributes" value="name=value" />
</customTask>

<customTask className="com.tremolosecurity.unison.openshiftv3.tasks.AddGroupToRole">
    <!-- Target to run against -->
        <param name="targetName" value="openshift"/>
        <!-- Project to add to, supports request parameters in between dollar signs -->
        <param name="projectName" value="$project$"/>
        <!-- Group to add supports request parameters in between dollar signs -->
        <param name="groupName" value="view-$project$"/>
        <!-- Role to add to, supports request parameters in between dollar signs -->
        <param name="roleName" value="view"/>
</customTask>

<customTask className="com.tremolosecurity.unison.openshiftv3.tasks.CreateProject">
        <!-- Target to run against -->
        <param name="targetName" value="openshift"/>
        <!-- The JSON template of a ProjectRequest object, supports request parameters in between dollar signs -->
        <param name="template" value="{&quot;kind&quot;:&quot;ProjectRequest&quot;,&quot;apiVersion&quot;:&quot;v1&quot;,&quot;metadata&quot;:{&quot;name&quot;:&quot;$project$&quot;,&quot;creationTimestamp&quot;:null}}"/>
</customTask>

<customTask className="com.tremolosecurity.provisioning.customTasks">
        <!-- The name of the attribute to copy, may be listed multiple times -->
        <param name="attribute" value="projectName"/>
        <!-- If false, the attribute is removed from the user object -->
        <param name="keepInUser" value="false"/>
</customTask>

<customTask className="com.tremolosecurity.provisioning.tasks.CreateK8sObject">
    <!-- An OpenShift provisioning target configured to connect to a Kubernetes API server -->
    <param name="targetName" value="k8s"/>
    <!-- determine the source type, can be json or yaml -->
    <param name="srcType" value="yaml" />
    <!-- Template for object to create, can container parameters from the request and user's object between '$' symbols -->
    <param name="template">
 <![CDATA[
kind: Namespace
apiVersion: v1
metadata:
  name: "$nameSpace$"
  labels:
    name: "$nameSpace$"
]]>
    </param>
    <!-- The type of object to create -->
    <param name="kind" value="Namespace" />
    <!-- The URI of the service to call -->
    <param name="url" value="/api/v1/namespaces" />
    <!-- A label to use in audit logs -->
    <param name="label" value="cluster" />
    <!-- If true, create new object.  If false, patch existing object if exists and create if it doesn't -->
    <param name="doPost" value="true" />

    <!-- for writing to git -->
    <!-- if true, writes the object to the workflow's request object for later processing -->
    <param name="writeToRequest" value="false" />
    <!-- if writeToRequest is true, the request object to write to -->
    <param name="requestAttribute" value="my-git-request" />
    <!-- if writeToRequest is true, the path in the git repository for the file -->
    <param name="path" value="/yaml/ns/$nameSpace$/namespace-$nameSpace$.yaml" />
</customTask>

<customTask className="com.tremolosecurity.provisioning.tasks.PatchK8sObject">
    <!-- An OpenShift provisioning target configured to connect to a Kubernetes API server -->
    <param name="targetName" value="k8s"/>
    <!-- Template for object to create, can container parameters from the request and user's object between '$' symbols -->
    <param name="template">
 <![CDATA[
 {
  "metadata": {
    "annotations": {
      "com.tremolosecurity.owner": "$userPrincipalName$"
    }
  }
}
]]>
    </param>
    <!-- The type of object to create -->
    <param name="kind" value="Namespace" />
    <!-- The URI of the service to call -->
    <param name="url" value="/api/v1/namespaces" />

    <!-- for writing to git -->
    <!-- if true, writes the object to the workflow's request object for later processing -->
    <param name="writeToRequest" value="false" />
    <!-- if writeToRequest is true, the request object to write to -->
    <param name="requestAttribute" value="my-git-request" />
    <!-- if writeToRequest is true, the path in the git repository for the file -->
    <param name="path" value="/yaml/ns/$nameSpace$/namespace-$nameSpace$.yaml" />
</customTask>

<customTask className="com.tremolosecurity.provisioning.tasks.DeleteK8sObject">
    <!-- An OpenShift provisioning target configured to connect to a Kubernetes API server -->
    <param name="targetName" value="k8s"/>

    <!-- The type of object to create -->
    <param name="kind" value="Namespace" />
    <!-- The URI of the service to call -->
    <param name="url" value="/api/v1/namespaces" />

    <!-- for writing to git -->
    <!-- if true, writes the object to the workflow's request object for later processing -->
    <param name="writeToRequest" value="false" />
    <!-- if writeToRequest is true, the request object to write to -->
    <param name="requestAttribute" value="my-git-request" />
    <!-- if writeToRequest is true, the path in the git repository for the file -->
    <param name="path" value="/yaml/ns/$nameSpace$/namespace-$nameSpace$.yaml" />
</customTask>

<customTask className="com.tremolosecurity.provisioning.tasks.PushToGit" >
  <!-- namespace where Secret that stores the ssh private key is -->
  <param name="nameSpace" value="openunison" />
  <!-- secret that stores the ssh kprivate key -->
  <param name="secretName" value="sshkey-namespace-$cluster$-$nameSpace$" />
  <!-- element of the data section of the Secret that stores the ssh private key -->
  <param name="keyName" value="id_rsa" />
  <!-- the target to use when loading the Secret -->
  <param name="target" value="k8s" />
  <!-- The git URL -->
  <param name="gitRepo" value="$namespaceGitUrl$" />
  <!-- The request object updates are stored to -->
  <param name="requestObject" value="git-secret-namespace-$cluster$-$nameSpace$" />
  <!-- The commit message -->
  <param name="commitMsg" value="For workflow $WORKFLOW.id$" />
</customTask>

<customTask className="com.tremolosecurity.provisioning.tasks.CleanLabels" >
  <!-- Character that will replace invalid characters in the named attributes -->
  <param name="replacementCharacter" value="-" />
  <!-- The suffix to use on the new request attribute.  For instance if cleaning "rawlabel", and setting this to "_clean", you would reference "rawlabel_clean" in the tasks for creating objects. -->
  <param name="newAttributeSuffix" value="_clean" />
  <!-- Request attributes to be cleaned, may be listed multiple times -->
  <param name="attributes" value="raw label" />

</customTask>

<customTask className="com.tremolosecurity.provisioning.tasks.ClearGroups">

</customTask>

<customTask className="com.tremolosecurity.provisioning.tasks.Env2Req">
    <param name="for_request" value="from_environment" />
</customTask>

<customTask className="com.tremolosecurity.provisioning.customTasks.ClearPasswordResets">
        <!-- The name of the password reset mechanism  -->
  <param name="mechName" value="passwordReset"/>
</customTask>

<customTask className="com.tremolosecurity.provisioning.customTasks.CopyGroupMembers">
  <!-- a workflow for performing the copy (see example) -->
  <param name="copyWorkflow" value="addApproverUsers"/>
  <!-- The name of the group to copy members to inside of a provisionng target -->
  <param name="copyTo" value="approvers-openshift-$name$" />
  <!-- The group in the virtual directory that is the source for members -->
  <param name="copyFrom" value="cn=administrators,ou=groups,ou=shadow,o=Tremolo" />
  <!-- The name of the user id attribute -->
  <param name="uidAttributeName" value="uid" />
  <!-- The requester for the audit trail -->
  <param name="requestor" value="system" />
</customTask>

<workflow name="addApproverUsers" label="Add approver users" description="Add new approval users" inList="false" orgid="63ada052-881e-4685-834d-dd48a3aa4bb4">
    <tasks>
        <mapping  strict="true">
          <map>
            <mapping targetAttributeName="sub" sourceType="user" targetAttributeSource="uid"/>
          </map>
            <onSuccess>
                <provision sync="false" target="jitdb" setPassword="false" onlyPassedInAttributes="false">
                    <attributes>
                        <value>sub</value>
                    </attributes>
                </provision>
            </onSuccess>
        </mapping>
    </tasks>
</workflow>

<customTask className="com.tremolosecurity.provisioning.customTasks.DoesGroupExist">
  <!-- The provisioning target to check -->
  <param name="target" value="jitdb"/>
  <!-- The name to check -->
  <param name="groupName" value="approvers-openshift-$name$" />
  <!-- The name of the request attribute to create -->
  <param name="attributeName" value="tremolo.approval.group.exists" />
</customTask>

<customTask className="com.tremolosecurity.provisioning.customTasks.com.tremolosecurity.provisioning.customTasks">
        <!-- Name of the attribute to put the uuid in -->
        <param name="attributeName" value="uuid" />
</customTask>

  <customTask className="com.tremolosecurity.provisioning.customTasks.MapJitGroups">
          <!-- The name of the attribute that stores the user's groups -->
    <param name="attributeName" value="memberOf"/>
          <!-- Each mapping is of the form internalgroup=externalgroup -->
    <param name="groupMap" value="k8s-cluster-administrators=CN=jit-k8s-admin,CN=Users,DC=ent2k12,DC=domain,DC=com" />
          <param name="groupMap" value="administrators=CN=ouadmins,CN=Users,DC=ent2k12,DC=domain,DC=com" />
        </customTask>

<customTask className="com.tremolosecurity.unison.gitlab.provisioning.tasks.AddGitlabExternalIdentity">
    <!-- Which omni_auth provider to use -->
    <param name="provider" value="openid_connect" />
    <!-- The attribue in the user object to map the user's identity to -->
    <param name="userAttribute" value="username" />
</customTask>

<customTask className="com.tremolosecurity.unison.gitlab.provisioning.tasks.AddGroupToProject">
    <!-- Group to add -->
        <param name="groupName" value="approvers-k8s-$nameSpace$" />
        <!-- GitLab provisioning target -->
    <param name="targetName" value="gitlab" />
    <!-- Entitlement level for the group in the project -->
    <param name="accessLevel" value="MAINTAINER" />
</customTask>

<customTask className="com.tremolosecurity.unison.gitlab.provisioning.tasks.CreateDeploymentKey">
  <!-- GitLab provisioning target -->
  <param name="targetName" value="gitlab" />
  <!-- project namespace -->
  <param name="namespace" value="$nameSpace$-production" />
  <!-- project name -->
  <param name="project" value="$nameSpace$-application" />
  <!-- label for the key -->
  <param name="keyLabel" value="tekton_pull" />
  <!-- if the key is writeable or read only -->
  <param name="makeWriteable" value="false" />
  <!-- The name of the request object the key is stored in, base64 encoded-->
  <param name="privateKeyReuestName" value="tektonPullecret" />
  <!-- The name of the request object the key is stored in, plain text -->
  <param name="privateKeyReuestNamePT" value="tektonPullSecretPT" />
</customTask>

<customTask className="com.tremolosecurity.unison.gitlab.provisioning.tasks.CreateGitFile">
    <!-- GitLab target -->
    <param name="targetName" value="gitlab" />
    <!-- project namespace -->
    <param name="namespace" value="$nameSpace$-production" />
    <!-- project name -->
    <param name="project" value="$nameSpace$-application" />
    <!-- branch to commit against -->
    <param name="branch" value="master" />
    <!-- path and file (excluding "/") -->
    <param name="path" value="README.md" />
    <!-- content of the file to create -->
    <param name="content">
  <![CDATA[
  # $nameSpace$-application

  Fork this project to create to create your application.  Create a pull request to trigger a build and deployment to development.

  ]]>
    </param>
    <!-- commit message -->
    <param name="commitMessage" value="initializing the repository" />
</customTask>

<customTask className="com.tremolosecurity.unison.gitlab.provisioning.tasks.CreateProject">
    <!-- project namespace -->
    <param name="namespace" value="$nameSpace$-production" />
    <!-- project name -->
    <param name="name" value="$nameSpace$-application" />
    <!-- project description -->
    <param name="description" value="Application project" />
    <param name="issuesEnabled" value="true" />
    <param name="mergeRequestsEnabled" value="true" />
    <param name="wikiEnabled" value="true" />
    <param name="snipitsEnabled" value="true" />
    <param name="visibility" value="2" />
    <param name="targetName" value="gitlab" />
    <param name="gitSshHost" value="#[GITLAB_SSH_HOST]" />
    <param name="createWebhook" value="true" />
    <param name="webhookSuffix" value="#[GITLAB_WEBHOOK_SUFFIX]" />
    <param name="webhookBranchFilter" value="master" />
    <param name="webhookSecretRequestName" value="appProjectWebhook"/>
</customTask>

<customTask className="com.tremolosecurity.unison.gitlab.provisioning.tasks.ForkProject">
    <param name="sourceProjectName" value="$nameSpace$-operations" />
    <param name="sourceProjectNamespace" value="$nameSpace$-production" />
    <param name="destinationNamespace" value="$nameSpace$-dev" />
    <param name="targetName" value="gitlab" />
    <param name="gitSshHost" value="#[GITLAB_SSH_HOST]" />
</customTask>

<customTask className="com.tremolosecurity.argocd.tasks.CreateGitRepository">
  <!-- type of repository -->
  <param name="type" value="git" />
  <!-- name of the repository -->
  <param name="name" value="$nameSpace$-build" />
  <!-- ssh URL for the repository -->
  <param name="repoUrl" value="$gitSshInternalURL$" />
  <!-- Plain text encoded SSH private key to register -->
  <param name="sshPrivateKey" value="$gitPrivateKey$" />
  <!-- ArgoCD target name -->
  <param name="target" value="argocd" />
</customTask>

<customTask className="com.tremolosecurity.argocd.tasks.AddtoRBAC">
  <!-- Kubernetes target -->
  <param name="k8sTarget" value="k8s" />
  <!-- rules to add -->
  <param name="toAdd">
    <![CDATA[
p, role:$nameSpace$-operations, applications, get, $nameSpace$/*, allow
p, role:$nameSpace$-operations, applications, override, $nameSpace$/*, allow
p, role:$nameSpace$-operations, applications, sync, $nameSpace$/*, allow
p, role:$nameSpace$-operations, applications, update, $nameSpace$/*, allow

p, role:$nameSpace$-operations, projects, get, $nameSpace$, allow

g, k8s-namespace-operations-$nameSpace$, role:$nameSpace$-operations


p, role:$nameSpace$-dev, applications, get, $nameSpace$/*, allow
p, role:$nameSpace$-dev, projects, get, $nameSpace$, allow
g, k8s-namespace-developer-$nameSpace$, role:$nameSpace$-dev
                          ]]>
  </param>
</customTask>

<!-- queueName - The name of the queue to listen to -->
<listener className="com.tremolosecurity.provisioning.listeners.UpdateApprovalAZListener" queueName="rebaseQueue"></listener>

<!-- queueName - The name of the queue to listen to -->
<listener className="com.tremolosecurity.provisioning.listeners.AutoFailApprovalListener" queueName="failQueue"></listener>

<listener className="com.tremolosecurity.provisioning.listeners.AsyncExecuteWorkflow" queueName="runworkflows"></listener>

<job className="com.tremolosecurity.provisioning.scheduler.jobs.UpdateApprovalAz" name="resetAllowedApprovers" group="testing">
  <!-- When to run the job -->
        <cronSchedule
                seconds="0"
                minutes="0"
                hours="*"
                dayOfMonth="*"
                month="*"
                dayOfWeek="?"
                year="*"
        />
  <!-- The name of the queue the Update Approvals Authorizations message listener is configured on      -->
        <param name="queueName" value="rebaseQueue" />
</job>

<job className="com.tremolosecurity.provisioning.scheduler.jobs.RemindApprovers" name="remindAppovers" group="testing">
  <!-- When to run the job -->
        <cronSchedule
                seconds="0"
                minutes="0"
                hours="9"
                dayOfMonth="*"
                month="*"
                dayOfWeek="?"
                year="*"
        />

  <!-- The template for the message to send to the approvers. Use %L to represent the label of the workflow that is open and %D to represent the number of days open    -->
  <param name="message" value="The request %L has been open for %D days, please login to act on this request" />
  <!-- The number of days an approval request should be open before sending a reminder  -->
  <param name="days" value="7" />
  <!-- The name of the attribute that has the user's email address      -->
  <param name="mailAttributeName" value="mail" />
</job>

<job className="com.tremolosecurity.provisioning.scheduler.jobs.AutoFail" name="autoFail" group="autoFail">
        <cronSchedule
                seconds="0"
                minutes="0"
                hours="*"
                dayOfMonth="*"
                month="*"
                dayOfWeek="?"
                year="*"
        />
  <!-- The name of the queue to add approval requests to        -->
        <param name="queueName" value="failQueue" />
  <!-- A message to be provided to users as to why the request failed   -->
        <param name="approver" value="autoFail" />
  <!-- The name of the user whom all failures are assigned, must be the value of the user identifier attribute configured on the audit database -->
        <param name="message" value="failed : ${reason}" />
</job>

<job className="com.tremolosecurity.unison.openshiftv3.jobs.DeleteObject" name="deleteSelfProvisioner" group="management">
  <cronSchedule
                seconds="0"
                minutes="*"
                hours="*"
                dayOfMonth="*"
                month="*"
                dayOfWeek="?"
                year="*"
  />
  <!-- The name of the provisioning target -->
  <param name="target" value="openshift" />
  <!-- The URI of the object to delete -->
  <param name="uri" value="/apis/authorization.openshift.io/v1/clusterrolebindings/self-provisioners" />
</job>

<azRule name="managerLevel1" className="com.tremolosecurity.provisioning.az.ManagerAuthorization">
  <!-- Use this to define what "distance" of a manager is authorized. For instance to allow the user's manager's manager to perform the authorization specify "2". This allows for escalations to be processed with multiple tiers of managers. -->
        <params name="numLevels" value="1" />
  <!-- The name of the attribute on the user's directory object that will tell Unison who their manager is.     -->
        <params name="managerID" value="manager" />
  <!-- If checked, Unison will assume that the attribute defined in "Manager Attribute Name" is the distinguished name of the user's manager. If not checked, then Unison will use a filter built from the "User Identifier Attribute" from the Approvals screen and the value of the "Manager Attribute Name"  -->
        <params name="managerIDIsDN" value="true" />
  <!-- Used when the number of levels is greater then one, allowing all the managers between the user and the current step to approve. For instance of an approval is escalated to a user's manager's manager checking this option will allow both the user's manager AND the user's manager's manager to approve.      -->
        <params name="allowLowerManagers" value="false" />
</azRule>

<azRule name="github" className="com.tremolosecurity.unison.proxy.auth.github.GithubTeamRule"/>

<job className="com.tremolosecurity.idp.providers.oidc.model.jobs.ClearSessions" name="clearSessions" group="admin">
  <cronSchedule
    seconds="0"
    minutes="0/5"
    hours="*"
    dayOfMonth="*"
    month="*"
    dayOfWeek="?"
    year="*"
  />
  <!-- The name of the identity provider to clear sessions for -->
  <param name="idpName" value="oidc" />
</job>

<application isApp="false" name="saml2">
        <results />
        <urls>

                <url regex="false">
      <!-- Set the hosts for the IdP -->
                        <host>localhost.localdomain</host>
      <!-- List filters, these filters should focus on manipulating the authenticated user's account -->
                        <filterChain>
                                <filter class="com.tremolosecurity.test.util.AddGroupFilter" />
                                <filter class="com.tremolosecurity.prelude.filters.Group2Attribute">
                                        <param name="attributeName" value="role" />
                                        <param name="attributeValue" value="users" />
                                        <param name="groupDN" value="cn=linkedSAMLUsers,ou=internal,ou=GenericLDAP,o=Tremolo" />
                                </filter>
                        </filterChain>
      <!-- URI for the IDP should ALLWAYS be this value -->
                        <uri>/auth/idp/saml2</uri>
                        <results>
                                <auSuccess></auSuccess>
                                <auFail>failure</auFail>
                                <azSuccess></azSuccess>
                                <azFail>failure</azFail>
                        </results>
      <!-- Authorize who has access to this IdP -->
                        <azRules>
                                <rule constraint="(objectClass=*)" scope="filter" />
                        </azRules>
      <!-- IdP Specific Configuration -->
                        <idp className="com.tremolosecurity.idp.providers.Saml2Idp">
        <!-- The key used for encrypting authentication requests. The key should be listed under the ?Signature and Encryption Keys? in Certs   -->
                                <params value="" name="encKey" />
        <!-- The key used for verifying signed authentication requests. The key should be listed under the ?Signature and Encryption Keys? in Certs     -->
                                <params value="idp-sig-key" name="sigKey" />
        <!-- Must the identity provider require signed metadata? If not checked, signed metadata will still be accepted and validated.  -->
        <param name="requireSignedAuthn" value="true" />
        <!-- Template for the SAML2 Post page -->
        <param name="postTemplate" value="&lt;html&gt;\n&lt;head&gt;\n&lt;meta http-equiv=\&quot;Content-Type\&quot; content=\&quot;text/html; charset=UTF-8\&quot; /&gt;\n&lt;title&gt;Completing Federation&lt;/title&gt;\n&lt;/head&gt;\n&lt;body onload=\&quot;document.forms[0].submit()\&quot;&gt;\n&lt;form method=\&quot;post\&quot; action=\&quot;$postaction$\&quot;&gt;\n&lt;input name=\&quot;SAMLResponse\&quot; value=\&quot;$postdata$\&quot; type=\&quot;hidden\&quot;/&gt;\n&lt;input name=\&quot;RelayState\&quot; value=\&quot;$relaystate$\&quot; type=\&quot;hidden\&quot;/&gt;\n&lt;/form&gt;\n&lt;center&gt;\n&lt;img src=\&quot;/auth/forms/images/ts_logo.png\&quot; /&gt;&lt;br /&gt;\n&lt;h2&gt;Completing Federation...&lt;/h2&gt;\n&lt;/center&gt;\n&lt;/body&gt;\n&lt;/html&gt;" />
        <!-- Mappings for attributes to be included in the assertion -->
        <!-- strict - If true then ONLY attributes specificly named in the mapping will be added -->
        <mappings strict="true">
                                        <mapping sourceType="user" targetAttributeSource="groupName"
                                                targetAttributeName="groupName" />
                                        <mapping sourceType="static" targetAttributeSource="Boston"
                                                targetAttributeName="l" />
                                        <mapping sourceType="user" targetAttributeSource="role" targetAttributeName="role" />
                                </mappings>
        <!-- Trusts establish connections with remote service providers -->
                                <trusts>
          <!--
            A trust establishes a connection between the SAML2 IdP and a SAML2 SP. The trust configuration establishes this connection by specifying URLs, certificates and mappings from nameid and authentication types to attributes and authentication chains respectively. The name of the trust must match with the issuer in a saml response or assertion. The only profile supported by Unison is the HTTP-POST profile.
           -->
                                        <trust name="http://shib2x.tremolo.lan/shibboleth">
            <!-- The URL used to post the response to. This is optional if included in the authentication request.      (AssertionConsumerService) -->
                                                <param
                                                        value="http://shib2x.tremolo.lan/Shibboleth.sso/SAML2/POST"
                                                        name="httpPostRespURL" />

            <!-- The key used to sign the response or assertion -->
            <param value="" name="spSigKey" />
            <!-- The key used to encrypt assertions     -->
                                                <param value="" name="spEncKey" />
            <!-- Determine if the assertion should be signed. If encrypting assertions, its expected that the assertion will be signed. -->
                                                <param value="false" name="signAssertion" />
            <!-- Should the entire response (including the assertion)   -->
                                                <param value="true" name="signResponse" />
            <!-- If no nameid format is specified in the authentication request or in the idp initiated request this setting specifies which attribute to use to identify the user      -->
                                                <param value="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
                                                        name="defaultNameId" />
            <!-- If no authentication class context reference is specified in the authentication request or in the idp initiated request specifies how to authenticate the user -->
            <param
                                                        value="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"
                                                        name="defaultAuthCtx" />
            <!-- map a requested nameid format to an attribute to look the user up by.  may be lsited multiple times, but must be listed AT LEAST once.  The default name id MUST be included -->
            <param value="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified=uid"
                                                        name="nameIdMap" />
            <!-- map a requests authentication context class ref to an authentication chain.  may be listed multiple times but must be listed AT LEAST once.  The default authnContextClassRef must be included -->
            <param
                                                        value="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport=form"
                                                        name="authCtxMap" />
                                        </trust>
                                </trusts>
                        </idp>
                </url>
        </urls>
        <cookieConfig>
                <sessionCookieName>tremoloSession</sessionCookieName>
                <domain>localhost.localdomain</domain>
                <scope>-1</scope>
                <logoutURI>/logout</logoutURI>
                <keyAlias>session-tremolosession</keyAlias>
                <keyPassword></keyPassword>
    <sameSite>None</sameSite>
        </cookieConfig>
</application>

<application name="oidc" isApp="false">
  <!-- on a single URL is allowed on an identity provider -->
  <urls>
    <!-- The regex and authChain attributes are ignored -->
    <url regex="false">
      <!-- Any number of host tags may be specified to allow for an application to work on multiple hosts.  Additionally an asterick (*) can be specified to make this URL available for ALL hosts -->
      <host>mlb.tremolo.lan</host>
      <!-- The filterChain on an IdP is typically used to add attributes to the user prior to mapping into the assertion -->
      <filterChain>
        <filter class="com.tremolosecurity.prelude.filters.Groups2Attribute">
          <!-- The base in the virtual directory to begin searching for groups.  -->
          <param name="base" value="ou=groups,ou=mongo,dc=domain,dc=com" />
          <!-- Name of the attribute to create  -->
          <param name="attrName" value="user_role" />
          <!-- A regular expression to filter out group memberships     -->
          <param name="pattern" value=".*" />
          <!-- If a pattern is specified, the group from that pattern to add to the attribute   -->
          <param name="groupNum" value="0" />
        </filter>
      </filterChain>
      <!-- The URI MUST start with /auth/idp/ -->
      <uri>/auth/idp/oidc</uri>
      <!-- List the various results that should happen -->
        <results>
          <auSuccess></auSuccess>
          <auFail>Default Login Failure</auFail>
          <azSuccess></azSuccess>
          <azFail>Default Login Failure</azFail>
        </results>
        <!-- Determine if the currently logged in user may access the idp.  If ANY rule succeeds, the authorization succeeds.
          The scope may be one of group, dn, filter, dynamicGroup or custom
          The constraint identifies what needs to be satisfied for the authorization to pass and is dependent on the scope:
            * group - The DN of the group in OpenUnison's virtual directory (must be an instance of groupOfUniqueNames)
            * dn - The base DN of the user or users in OpenUnison's virtual directory
            * dynamicGroup - The DN of the dynamic group in OpenUnison's virtual directory (must be an instance of groupOfUrls)
            * custom - An implementation of com.tremolosecurity.proxy.az.CustomAuthorization -->
        <azRules>
            <rule scope="filter" constraint="(objectClass=*)"/>
        </azRules>
        <!-- Defines the IdP specific portions of the application -->
        <idp className="com.tremolosecurity.idp.providers.OpenIDConnectIdP">
          <!-- The alias of the TLS key to use for signing JWTs -->
          <params name="jwtSigningKey" value="unison-tls"/>

          <!-- optional, transform outbound claims before encoding -->
          <!--
          <!-- Subclass of com.tremolosecurity.idp.providers.oidc.sdk.UpdateClaims -->
          <param name="updateClaimsClassName" value="com.path.to.Class" />

          -->


          <!-- BEGIN DATABASE SPECIFIC CONFIGURATION OPTIONS -->
          <!-- Database driver -->
              <params name="driver" value="com.mysql.jdbc.Driver"/>
              <!-- JDBC URL -->
              <params name="url" value="jdbc:mysql://192.168.99.100:3306/unison?useSSL=true"/>
              <!-- DB User -->
              <params name="user" value="root"/>
              <!-- DB Password -->
              <params name="password" value="start123"/>
              <!-- Maximum number of connections -->
              <params name="maxCons" value="5"/>
              <!-- Maximum number of connections not actively working -->
              <params name="maxIdleCons" value="5"/>
              <!-- The HibernateSQL dialect -->
              <params name="dialect" value="org.hibernate.dialect.MySQL5Dialect"/>
              <!-- Validation query to make sure the connection is still available -->
              <params name="validationQuery" value="SELECT 1"/>
              <!-- Optional - The mapping file (.hbx.xml) to use if the default mapping doesn't work, must be in the classpath -->
              <tns:param name="hibernateConfig" value=""/>
              <!-- Optional - If true, create tables.  After initial configuration, you may want to disable this depending on the dialect. -->
              <tns:param name="hibernateCreateSchema" value="true"/>
                  <!-- END DATABASE SPECIFIC CONFIGURATION OPTIONS -->



                <!-- UNCOMMENT FOR KUBERNETES BACKEND

                <!-- The session implementation -->
                <params name="sessionStoreClassName" value="com.tremolosecurity.oidc.k8s.K8sSessionStore"/>
        <!-- OpenShift (Kubernetes) Provisioning Target -->
        <params name="k8sTarget" value="k8s" />
        <!-- The namespace to store/retrieve sessions from -->
        <params name="k8sNameSpace" value="openunison" />


                -->


                <!-- UNCOMMENT FOR NO BACKEND

                <!-- The session implementation -->

                <params name="sessionStoreClassName" value="com.tremolosecurity.idp.providers.oidc.none.NoneBackend"/>

        -->

         <!-- UNCOMMENT for Kubernetes dynamic trusts -->
         <!--
        <params name="trustConfigurationClassName" value="com.tremolosecurity.oidc.k8s.K8sLoadTrusts" />
        <params name="trusts.k8starget" value="k8s" />
        <params name="trusts.namespace" value="#[K8S_OPENUNISON_NS:openunison]" />
         -->



          <!-- Determines which attributes to include in the assertion. -->
          <!-- strict - If true then ONLY attributes specificly named in the mapping will be added -->
          <mappings strict="true">
             <!-- Each mapping focusses on a single attribute
               targetAttributeName - The name of the attribute that will appear in the assertion
               sourceType - One of user, static, or composite
                * user - The name of an existing attribute on the user's object
                * static - A static value that does not change regardless of the user
                * composite - A mixture of user and static, allowing for one SAML attribute to be comprised of other attributes and static text.  Attributes are market as "${attributename}"
               targetAttributeSource - The value to be used based on the sourceType
             -->
            <mapping targetAttributeName="sub" targetAttributeSource="uid" sourceType="user"/>
            <mapping targetAttributeName="email" targetAttributeSource="mail" sourceType="user"/>
            <mapping targetAttributeName="user_role" targetAttributeSource="user_role" sourceType="user"/>
          </mappings>
          <!-- Trusts establish a path between the OP and SP/RP -->
          <trusts>
            <!-- The name of the trust, should be the url of the RP -->
            <trust name="http://192.168.99.100">
              <!-- used to identify the client, use this name when configuring filters that reference this trust -->
              <param name="clientID" value="mod_oidc_test"/>
              <!-- A secret shared by both OpenUnison and the client -->
              <param name="clientSecret" value="secret"/>
              <!-- If checked, no client secret is used to authenticate requests -->
              <param name="publicEndpoint" value="false"/>
              <!-- The URL OpenUnison will redirect users to after authentication -->
              <param name="redirectURI" value="http://192.168.99.100/redirect_uri"/>
              <!-- LastMile key used to encrypt code and refresh tokens -->
              <param name="codeLastMileKeyName" value="session-unison"/>
              <!-- The authentication chain to use for authentication -->
              <param name="authChainName" value="formloginFilter"/>
              <!-- Milliseconds an access token and id_token lives until it needs to be refreshed -->
              <param name="accessTokenTimeToLive" value="60000"/>
              <!-- Milliseconds that a token can be off from the current time that will be accepted -->
              <param name="accessTokenSkewMillis" value="120000" />
              <!-- The number of milliseconds the code token is valid -->
              <param name="codeTokenSkewMilis" value="90000"/>
              <!-- In a dev environment where developers don't know their host name or need to try with multiple hosts and ports, its useful to disable redirect_uri checking. -->
              <!-- DO NOT SET THIS TO FALSE UNLESS IT IS A DEV ENVIRONMENT -->
              <!-- SETTING THIS TO FALSE IS A SECURITY ISSUE -->
              <param name="verifyRedirect" value="true" />

              <!-- Should the userinfo endpoint be signed?  defaults to false -->
              <param name="signedUserInfo" value="false" />
            </trust>
            <trust name="https://172.17.4.99">
              <param name="clientID" value="kubernetes"/>
              <param name="clientSecret" value="secret"/>
              <param name="redirectURI" value="https://172.17.4.99/redirect_uri"/>
              <param name="codeLastMileKeyName" value="session-unison"/>
              <param name="authChainName" value="formloginFilter"/>
              <param name="codeTokenSkewMilis" value="90000"/>
              <param name="accessTokenTimeToLive" value="60000"/>
              <param name="accessTokenSkewMillis" value="120000" />
            </trust>
          </trusts>
        </idp>
      </url>
    </urls>
    <!-- The cookie configuration determines how sessions are managed for this application -->
    <cookieConfig>
      <!-- The name of the session cookie for this application.  Applications that want SSO between them should have the same cookie name -->
      <sessionCookieName>tremolosession</sessionCookieName>
      <!-- The domain of component of the cookie -->
      <domain>mlb.tremolo.lan</domain>
      <scope>-1</scope>
      <!-- The URL that OpenUnison will interpret as the URL to end the session -->
      <logoutURI>/logout</logoutURI>
      <!-- The name of the AES-256 key in the keystore to use to encrypt this session -->
      <keyAlias>session-unison</keyAlias>
      <!-- If set to true, the cookie's secure flag is set to true and the browser will only send this cookie over https connections -->
      <secure>true</secure>
      <!-- The number of seconds that the session should be allowed to be idle before no longer being valid -->
      <timeout>0</timeout>
    </cookieConfig>
</application>

<dynamicConfiguration dynamic="true" className="com.tremolosecurity.provisioning.dynamicwf.LDAPDynaicWorkflows" >
  <!-- Where to start searching for groups -->
        <param name="searchBase" value="ou=dyngroups,ou=internal,ou=GenericLDAP,o=Tremolo" />
  <!-- Filter to use when searching for groups -->
        <param name="searchFilter" value="(objectClass=groupOfUniqueNames)" />
  <!-- Name of the attribute that stores the group's name, required; Exposed as groupName in the workflow -->
        <param name="groupNameAttribute" value="cn" />
  <!-- Name of the attribute that stores the approver for access to this group; Exposed as approver in the workflow -->
        <param name="approverAttribute" value="businessCategory" />
  <!-- Name of the attribute that stores a description, optional; Exposed as descriptionAttribute in the workflow -->
        <param name="descriptionAttribute" value="description" />
</dynamicConfiguration>

<dynamicConfiguration dynamic="true" className="com.tremolosecurity.unison.openshiftv3.wf.OpenShiftWorkflows">
    <!-- The name of the provisioning target to use to communicate with OpenShift -->
    <param name="target" value="openshift"/>
    <!-- URI of service to use to build the workflows -->
    <param name="kind" value="/oapi/v1/projects"/>
    <!-- Filter out objects by name -->
    <param name="filter" value="default" />
    <param name="filter" value="kube-system" />
</dynamicConfiguration>

<dynamicConfiguration dynamic="true" className="com.tremolosecurity.unison.openstack.KeystoneDynamicWorkflow">
    <!-- Name of the OpenStack target used to communicate with Keystone -->
    <param name="targetName" value="openstack-unison"/>
    <!-- Set to true if roles for each target should be listed, otherwise only one workflow per target is created -->
    <param name="includeRoles" value="true"/>
    <!-- Determine which target to list, may be projects or domains -->
    <param name="targetScope" value="projects"/>
    <!-- Determinse if a filter should be applied to role names, and if so how:
         none - Apply no filter
         include - Include ONLY roles listed in filterRoles
         exclude - Include roles that are NOT listed in filterRoles -->
    <param name="roleFilterMode" value="none"/>
    <!-- List of role names to filter on -->
    <param name="filterRoles" value="ResellerAdmin"/>
    <param name="filterRoles" value="SwiftOperator"/>
    <!-- Determinse if a filter should be applied to target names, and if so how:
         none - Apply no filter
         include - Include ONLY roles listed in filterTargets
         exclude - Include roles that are NOT listed in filterTargets -->
    <param name="targetFilterMode" value="none"/>
    <!-- List of target ids to filter on -->
    <param name="filterTargets" value="a315b745375e4f6bb865a291b20d9799"/>
    <param name="filterTargets" value="cda92350b719486a8b9d20e080389160"/>
</dynamicConfiguration>

<dynamicConfiguration dynamic="true" className="com.tremolosecurity.provisioning.dynamicwf.DBTargetDynamicWF">
        <!-- The name of the target -->
        <param name="target" value="mydb" />
        <!-- SQL to run -->
        <param name="sql" value="SELECT id FROM x" />
</dynamicConfiguration>

<dynamicOrgs enabled="true" className="com.tremolosecurity.provisioning.orgs.LoadOrgsFromK8s">
    <!-- OpenShiftv3 Target -->
    <params name="k8starget" value="k8s" />
    <!-- namespace to lookup objects in -->
    <params name="namespace" value="#[K8S_OPENUNISON_NS:openunison]" />
  </dynamicOrgs>

apiVersion: openunison.tremolo.io/v1
kind: Org
metadata:
  name: cluster2
  namespace: openunison
spec:
  description: "My second cluster"
  uuid: 04901973-5f4c-46d9-9e22-55e88e168776
  parent: B158BD40-0C1B-11E3-8FFD-0800200C9A66
  showInPortal: true
  showInRequestAccess: false
  showInReports: false
  azRules:
  - scope: dn
    constraint: o=Tremolo

<dynamicUrls enabled="true" className="com.tremolosecurity.provisioning.portal.LoadUrlsFromK8s">
  <!-- An OpenShiftv3 target -->
  <params name="k8starget" value="k8s" />
  <!-- The namespace to look in -->
  <params name="namespace" value="#[K8S_OPENUNISON_NS:openunison]" />

</dynamicUrls>

apiVersion: openunison.tremolo.io/v1
kind: PortalUrl
metadata:
  name: argocs
  namespace: openunison
spec:
  label: ArgoCD
  org: B158BD40-0C1B-11E3-8FFD-0800200C9A66
  url: https://ArgoCD.apps.192-168-2-140.nip.io
  icon: iVBORw0KGgoAAAANSUhEUgAAANIAAADwCAYAAAB1/Tp/AAAfQ3pUWHRSYXcgcHJvZ...
  azRules:
  - constraint: o=Tremolo
    scope: dn

<Context>
  <Environment name="unisonConfigPath" value="/etc/openunison/unison.xml" type="java.lang.String"/>
  <Environment name="unisonServiceConfigPath" value="/etc/openunison/unisonService.props" type="java.lang.String"/>
</Context>

# Redirect from http to https
com.tremolosecurity.openunison.forceToSSL=true

# The port on which Tomcat is configured to listen for http requests
com.tremolosecurity.openunison.openPort=8080

# The port on which Tomcat is configured to listen for https requests
com.tremolosecurity.openunison.securePort=8443

# The external port on which OpenUnison should listen for incoming requests
com.tremolosecurity.openunison.externalOpenPort=80

# The secured/encrypted external port on which OpenUnison should listen for incoming requests
com.tremolosecurity.openunison.externalSecurePort=443

#Uncomment and set for production deployments
#com.tremolosecurity.openunison.activemqdir=/var/lib/unison-activemq

$ cp target/war/work/com.tremolosecurity.unison/open-unison-webapp/WEB-INF/tremoloConfig.xsd src/main/webapp/WEB-INF/

<?xml version="1.0" encoding="UTF-8"?>
  <tremoloConfig xmlns="http://www.tremolosecurity.com/tremoloConfig" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.tremolosecurity.com/tremoloConfig tremoloConfig.xsd ">
  <applications openSessionCookieName="openSession" openSessionTimeout="9000" openSessionSecure="true" openSessionHttpOnly="true" hsts="true" hstsTTL="31536000"/>
  <myvdConfig>WEB-INF/myvd.conf</myvdConfig>
  <authMechs/>
  <authChains/>
  <resultGroups/>
  <keyStorePath>WEB-INF/unisonKeyStore.p12</keyStorePath>
  <keyStorePassword>password</keyStorePassword>
</tremoloConfig>

$ keytool -genseckey -alias session-unison -keyalg AES -keysize 256 -storetype PKCS12 -keystore src/main/webapp/WEB-INF/unisonKeyStore.p12
Enter keystore password:
Re-enter new password:
Enter key password for <session-unison>
 (RETURN if same as keystore password):

$ keytool -genkeypair -storetype PKCS12 -alias unison-tls -keyalg RSA -keysize 2048 -sigalg SHA256withRSA -keystore src/main/webapp/WEB-INF/unisonKeyStore.p12
Enter keystore password:
What is your first and last name?
  .
  .
  .

#Global AuthMechConfig
server.globalChain=

server.nameSpaces=rootdse,myvdroot
server.rootdse.chain=dse
server.rootdse.nameSpace=
server.rootdse.weight=0
server.rootdse.dse.className=net.sourceforge.myvd.inserts.RootDSE
server.rootdse.dse.config.namingContexts=o=Tremolo
server.myvdroot.chain=root
server.myvdroot.nameSpace=o=Tremolo
server.myvdroot.weight=0
server.myvdroot.root.className=net.sourceforge.myvd.inserts.RootObject