Security

# Single sign-on common configuration
#
# callback URL for all indirect clients (defaults to application.base-url + "/callback")
auth.callback-url = http://localhost:8080/open-platform-demo/callback

# user provisioning: create / link / none
auth.user.provisioning = create
# default group for created users
auth.user.default-group = users

# logout URL
auth.logout.default-url =
# logout URL pattern
auth.logout.url-pattern =
# remove profiles from session
auth.logout.local = true
# call identity provider logout endpoint
auth.logout.central = false

auth.provider.my-provider.client = org.pac4j.oidc.client.GoogleOidcClient
auth.provider.my-provider.title = My Google Provider
auth.provider.my-provider.icon = img/signin/google.svg
auth.provider.my-provider.exclusive = false
auth.provider.my-provider.client-id = 127736102816-tc5mmsfaasa399jhqkfbv48nftoc55ft.apps.googleusercontent.com
auth.provider.my-provider.secret = qySuozNl72zzM5SKW-0kczwV

# class name
auth.provider.oidc.state-generator = com.axelor.myapp.MyStateGenerator

# list of strings
auth.provider.saml.supported-protocols = urn:oasis:names:tc:SAML:2.0:protocol, urn:oasis:names:tc:SAML:1.1:protocol

# string-object map
auth.provider.oidc.custom-params.display = popup
auth.provider.oidc.custom-params.prompt = none

# use ClientAuthenticationMethod#parse
auth.provider.oidc.client-authentication-method = client_secret_basic

# Set of ClientAuthenticationMethod objects using ClientAuthenticationMethod#parse
auth.provider.oidc.supported-client-authentication-methods = client_secret_basic, private_key_jwt

public class MyOidcClient extends OidcClient {
  public MyOidcClient() {
    OidcConfiguration config = new OidcConfiguration();
    config.setStateGenerator(new MyStateGenerator());
    config.setCustomParams(Map.of("display", "popup", "prompt", "none"));
    config.setClientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC);
    config.setSupportedClientAuthenticationMethods(
        Set.of(
            ClientAuthenticationMethod.CLIENT_SECRET_BASIC,
            ClientAuthenticationMethod.CLIENT_SECRET_JWT));
    // etc.

    setConfiguration(config);
  }
}

# My OIDC 1
auth.provider.my-oidc1.client = org.pac4j.oidc.client.OidcClient
# name defaults to client’s simple class name, ie. "OidcClient"
auth.provider.my-oidc1.name = MyOidcClient1
# ...

# My OIDC 2
auth.provider.my-oidc2.client = org.pac4j.oidc.client.OidcClient
# name defaults to client’s simple class name, ie. "OidcClient"
auth.provider.my-oidc2.name = MyOidcClient2
# ...

# comma-separated list of provider names
auth.provider-order = my-oidc1, my-oidc2

# google auth provider is used by default
auth.provider-default = google

# SAML
# Client: org.pac4j.saml.client.SAML2Client

# Basic configuration
#
# path to keystore
auth.provider.saml.keystore-path = path/to/samlKeystore.jks
# value of the -storepass option for the keystore
auth.provider.saml.keystore-password = open-platform-demo-passwd
# value of the -keypass option
auth.provider.saml.private-key-password = open-platform-demo-passwd
# path to IdP metadata
auth.provider.saml.identity-provider-metadata-path = http://localhost:9012/simplesaml/saml2/idp/metadata.php
# path to SP metadata
auth.provider.saml.service-provider-metadata-path = path/to/sp-metadata.xml
# full callback URL for proper SP metadata generation
auth.provider.saml.callback-url = https://example.com/my-axelor-app/callback

# Additional configuration
#
# accept assertions based on a previous authentication for one hour by default
auth.provider.saml.maximum-authentication-lifetime = 3600
# custom SP entity ID
auth.provider.saml.service-provider-entity-id = sp.test.pac4j

# Advanced configuration
#
# forced authentication
auth.provider.saml.force-auth = false
# passive authentication
auth.provider.saml.passive = false

# binding type for the authentication request: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" /
# "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" / "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
auth.provider.saml.authn-request-binding-type = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"

# binding type for the authentication response: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" / "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"
auth.provider.saml.response-binding-type = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"

# force a NameQualifier in the request (defaults to false)
auth.provider.saml.use-name-qualifier = true

# attribute consuming index
auth.provider.saml.attribute-consuming-service-index = -1
# assertion consumer service index
auth.provider.saml.assertion-consumer-service-index = -1

# list of blacklisted signature signing algorithms
auth.provider.saml.blacklisted-signature-signing-algorithms =
# list of signature algorithms
auth.provider.saml.signature-algorithms =
# list of signature reference digest methods
auth.provider.saml.signature-reference-digest-methods =
# signature canonicalization algorithm
auth.provider.saml.signature-canonicalization-algorithm =

# whether assertions must be signed (defaults to true)
auth.provider.saml.wants-assertions-signed = true
# enable signing of authentication requests (defaults to false)
auth.provider.saml.authn-request-signed = true
# enable signing of logout requests sent to the IdP (defaults to false)
auth.provider.saml.sp-logout-request-signed = true

# CAS
# Client: org.pac4j.cas.client.CasClient

# Application configuration
#
# login URL of CAS server
auth.provider.cas.login-url = https://localhost:8443/cas/login
# CAS prefix URL
auth.provider.cas.prefix-url = https://localhost:8443/cas
# CAS protocol: CAS10 / CAS20 / CAS20_PROXY / CAS30 (default) / CAS30_PROXY / SAML
auth.provider.cas.protocol = CAS30

# Various parameters
#
# encoding used for parsing the CAS responses
auth.provider.cas.encoding = UTF-8
# whether the renew parameter will be used
auth.provider.cas.renew = false
# whether the gateway parameter will be used
auth.provider.cas.gateway = false
# time tolerance for the SAML ticket validation
auth.provider.cas.time-tolerance = 1000
# class name for specific UrlResolver
auth.provider.cas.url-resolver =
# class name for default TicketValidator
auth.provider.cas.default-ticket-validator =

# proxy support by specifying a CasProxyReceptor
auth.provider.cas.proxy-receptor = org.pac4j.cas.client.CasProxyReceptor

# class name for specific `LogoutHandler`
auth.provider.cas.logout-handler =