diff --git a/eidas-qa-proxy/overlay/opt/se/cache/.placeholder b/eidas-qa-proxy/overlay/opt/se/cache/.placeholder new file mode 100644 index 00000000..e69de29b diff --git a/eidas-qa-proxy/overlay/opt/se/cfg/application-se.properties b/eidas-qa-proxy/overlay/opt/se/cfg/application-se.properties new file mode 100644 index 00000000..64233d98 --- /dev/null +++ b/eidas-qa-proxy/overlay/opt/se/cfg/application-se.properties @@ -0,0 +1,116 @@ +# Logging +logging.level.org.springframework.web=INFO + +# Service path +server.servlet.context-path=/eidas-ps + +#proxy-service.path.prefix=${spring.config.additional.location}.. +#proxy-service.config.location=file://${spring.config.additional.location} + +proxy-service.image.logo=${spring.config.additional.location}/img/idp-logo.svg +proxy-service.image.icon=${spring.config.additional.location}/img/idp-logo-notext.svg + +# Service port connector settings +server.port=8443 +#server.ssl.key-store=${proxy-service.path.prefix}/keystore/sslSnakeOil.p12 +#server.ssl.key-store-type=PKCS12 +#server.ssl.key-store-password=secret +#server.ssl.key-password=secret + +tomcat.ajp.port=8009 +tomcat.ajp.remoteauthentication=false +tomcat.ajp.enabled=true + +# For development. Allowing signature check on metadata to be skipped. Default false. +#proxy-service.dev.ignoreMetadataSignCheck=true + +# Initial delay in milliseconds (default 5000) and seconds between metadata configuration recache (default 240 sec). +#proxy-service.daemon.inital.delay.ms=5000 +proxy-service.daemon.recache.delay.sec=240 + +# Location of other properties files (general-metadata.properties, psidp-metadata.properties and natsp-metadata.properties) +# Example specifying external location: 'proxy-service.config.location=file:///opt/webapp/eidas-ps/cfg/' +# Example specifying src/main/resources config location: 'classpath:' + +proxy-service.country=SE + +# Key Store properties +# Location can be specified as "classpath:" or as file path e.g "/opt/webapp/eidas-ps/keystore/keyStore.jks" +proxy-service.keySourceType=PKCS12 +proxy-service.keySourceLocation=${proxy-service.path.prefix}/proxy.p12 +proxy-service.keySourcePass=dummy +proxy-service.keySourceAlias=proxy + +proxy-service.natsp.keySourceType=PKCS12 +proxy-service.natsp.keySourceLocation=${proxy-service.path.prefix}/proxy.p12 +proxy-service.natsp.keySourcePass=dummy +proxy-service.natsp.keySourceAlias=proxy + +proxy-service.metadata.keySourceType=PKCS12 +proxy-service.metadata.keySourceLocation=${proxy-service.path.prefix}/metadata.p12 +proxy-service.metadata.keySourcePass=dummy +proxy-service.metadata.keySourceAlias=metadata + +# Session Encryption properties +#proxy-service.cookieEncryptPw=changeme + +# Requirements to show consent dialogue (Default false); +proxy-service.consent=true +proxy-service.consent.attributes=urn:oid:1.2.752.201.3.7,\ + urn:oid:2.5.4.4,\ + urn:oid:2.5.4.42,\ + urn:oid:1.3.6.1.5.5.7.9.3,\ + urn:oid:1.3.6.1.5.5.7.9.1 +proxy-service.consent.valuetranslation=urn:oid:1.3.6.1.5.5.7.9.3 + +# Welcome page presentation text location +proxy-service.welcomepage.markdown=${proxy-service.path.prefix}/cfg/infotext.md + +#Metadata Service List location specified as either URL (http or https), "file://" or "classpath:" +proxy-service.eidasMdListLocation=https://qa.md.eidas.swedenconnect.se/mdservicelist-aggregate.xml + +# Optional certificate file for validating metadata service list file signatures +# If no certificate is specified then proxy-service.dev.ignoreMetadataSignCheck=true must be set +proxy-service.eidasMdListCertFile=${proxy-service.path.prefix}/cfg/metadata.crt + +#Metadata location for aggregated metadata specified as either URL (http or https), "file://" or "classpath:" +proxy-service.eidasMetadataLocation=https://qa.md.eidas.swedenconnect.se/role/sp.xml + +# Optional certificate file for validating metadata signatures +# If no certificate is specified then proxy-service.dev.ignoreMetadataSignCheck=true must be set +proxy-service.eidasMetadataCertFile=${proxy-service.path.prefix}/cfg/metadata.crt + +# Optional cache dir for caching downloaded metadata. If not set, cache is stored in memory. +proxy-service.eidasMetadataCacheDirName=${proxy-service.path.prefix}/ps-mdcache + +#Metadata location for national IdP metadata specified as either URL (http or https), "file://" or "classpath:" + +#proxy-service.nationalMetadata.test.location=http://eid.svelegtest.se/metadata/mdx/role/idp.xml +#proxy-service.nationalMetadata.test.certFile=${proxy-service.path.prefix}/cfg/se-metadata-cert.crt +#proxy-service.nationalMetadata.test.cacheFile=${proxy-service.path.prefix}/cache/test-metadata.xml +#proxy-service.nationalMetadata.test.index=1 + +proxy-service.nationalMetadata.qa.location=https://qa.md.swedenconnect.se/role/idp.xml +proxy-service.nationalMetadata.qa.certFile=${proxy-service.path.prefix}/cfg/metadata.crt +proxy-service.nationalMetadata.qa.cacheFile=${proxy-service.path.prefix}/cache/qa-metadata.xml +proxy-service.nationalMetadata.qa.index=0 + +management.server.context-path=/manage +management.server.security.enabled=false +management.server.port=8444 +management.server.ssl.enabled=true + +proxy-service.syslog.enabled=true + +# Override default signature algorithms +proxy-service.signature-algorithm=http://www.w3.org/2007/05/xmldsig-more#sha256-rsa-MGF1 +proxy-service.signature-algorithm.md=${proxy-service.signature-algorithm} +proxy-service.signature-algorithm.natsp=http://www.w3.org/2001/04/xmldsig-more#rsa-sha256 +proxy-service.signature-algorithm.natsp.md=${proxy-service.signature-algorithm.natsp} + +#Private SP requests from other eIDAS countries +proxy-service.private-sp.enabled=true + +#These configuration properties allow configuration of the HTTP client used to obtain metadata as well as for OpenID connect operations such as retrieving ID tokens and user-info tokens from the OP. +proxy-service.http.connect-timeout=1000 +proxy-service.http.read-timeout=5000 diff --git a/eidas-qa-proxy/overlay/opt/se/cfg/general-metadata.properties b/eidas-qa-proxy/overlay/opt/se/cfg/general-metadata.properties new file mode 100644 index 00000000..c179dcf4 --- /dev/null +++ b/eidas-qa-proxy/overlay/opt/se/cfg/general-metadata.properties @@ -0,0 +1,18 @@ +psgen.country=${proxy-service.country} +psgen.name=Sweden eIDAS ProxyService +psgen.orgName={\ + en:'Sweden Connect',\ + sv:'Sweden Connect'\ +} +psgen.dispName={\ + en:'Sweden Connect QA',\ + sv:'Sweden Connect QA'\ +} +psgen.orgUrl=https://swedenconnect.se +psgen.supportGivenName=Customer support +psgen.techGivenName=Technical support +psgen.supportEmail=operations@swedenconnect.se +psgen.techEmail=operations@swedenconnect.se + + + diff --git a/eidas-qa-proxy/overlay/opt/se/cfg/idpdisco.properties b/eidas-qa-proxy/overlay/opt/se/cfg/idpdisco.properties new file mode 100644 index 00000000..bf8203ae --- /dev/null +++ b/eidas-qa-proxy/overlay/opt/se/cfg/idpdisco.properties @@ -0,0 +1,67 @@ +# Available policies are: natToEidasMapping, natToEidasNotifiedMapping, justEidasLoa +# Defined meaning: +# - justEidasLoa = IdP is only allowed if it supports the national eIDAS LoAs +# - natToEidasMapping = National IdP:s are allowed to respond with national LoA. These counts as non notified eID +# - natToEidasNotifiedMapping = National IdP:s are allowed to respond with national LoA. These counts as notified eID + +idp.testIdp.entityid=http://qa.test.swedenconnect.se/idp +idp.testIdp.loapolicy=justEidasLoa +idp.testIdp.consent=true +idp.testIdp.privateSpSupport=true +idp.testIdp.deriveDob=false +idp.testIdp.index=1 + +idp.freja.entityid=https://idp-sweden-connect-valfr-2017-ct.test.frejaeid.com +idp.freja.name.sv=Freja+ +idp.freja.name.en=Freja+ +idp.freja.loapolicy=justEidasLoa +idp.freja.consent=false +idp.freja.deriveDob=false +idp.freja.privateSpSupport=true +idp.freja.index=0 + +idp.bankid.entityid=https://oidc.test.bankid.com +idp.bankid.name.sv=BankID +idp.bankid.name.en=BankID +idp.bankid.logo.uri=https://www.bankid.com/assets/bankid/img/logo-bank-id.svg +idp.bankid.logo.height=150 +idp.bankid.logo.width=159 +idp.bankid.loapolicy=natToEidasNotifiedMapping +idp.bankid.consent=false +idp.bankid.deriveDob=false +idp.bankid.privateSpSupport=false +idp.bankid.index=2 +idp.bankid.protocol=oidc + +#idp.mobIdp.entityid=https://midp.svelegtest.se/idp +#idp.mobIdp.name.sv=Legacy Test ID Tjänst +#idp.mobIdp.name.en=Legacy Test IdP +#idp.mobIdp.logo.uri=${proxy-service.domain.prefix}/img/se-flag-rnd.svg +#idp.mobIdp.logo.height=67 +#idp.mobIdp.logo.width=68 +#idp.mobIdp.loapolicy=natToEidasNotifiedMapping +#idp.mobIdp.consent=false +#idp.mobIdp.deriveDob=true +#idp.mobIdp.index=2 + +#idp.ccBankid.entityid=https://eid.identityhub.se/demo/bankid/ +#idp.ccBankid.name.sv=BankID +#idp.ccBankid.name.en=BankID +#idp.ccBankid.logo.uri=img/disco/bankid_logo.png +#idp.ccBankid.logo.height=94 +#idp.ccBankid.logo.width=100 +#idp.ccBankid.loapolicy=natToEidasNotifiedMapping +#idp.ccBankid.consent=true +#idp.ccBankid.deriveDob=true +#idp.ccBankid.index=3 + +#idp.ccTelia.entityid=https://eid.identityhub.se/demo/teliabrowserplugin/ +#idp.ccTelia.name.sv=Telia +#dp.ccTelia.name.en=Telia +#idp.ccTelia.logo.uri=img/disco/telia_min_logo.png +#idp.ccTelia.logo.height=89 +#idp.ccTelia.logo.width=86 +#idp.ccTelia.loapolicy=natToEidasNotifiedMapping +#idp.ccTelia.consent=true +#idp.ccTelia.deriveDob=true +#idp.ccTelia.index=4 diff --git a/eidas-qa-proxy/overlay/opt/se/cfg/img/favicon.ico b/eidas-qa-proxy/overlay/opt/se/cfg/img/favicon.ico new file mode 100644 index 00000000..2c33a9cf Binary files /dev/null and b/eidas-qa-proxy/overlay/opt/se/cfg/img/favicon.ico differ diff --git a/eidas-qa-proxy/overlay/opt/se/cfg/img/idp-logo-notext.svg b/eidas-qa-proxy/overlay/opt/se/cfg/img/idp-logo-notext.svg new file mode 100644 index 00000000..037227a5 --- /dev/null +++ b/eidas-qa-proxy/overlay/opt/se/cfg/img/idp-logo-notext.svg @@ -0,0 +1,9 @@ + + + + + + + + + diff --git a/eidas-qa-proxy/overlay/opt/se/cfg/img/idp-logo.svg b/eidas-qa-proxy/overlay/opt/se/cfg/img/idp-logo.svg new file mode 100644 index 00000000..406331fc --- /dev/null +++ b/eidas-qa-proxy/overlay/opt/se/cfg/img/idp-logo.svg @@ -0,0 +1,17 @@ + + + + + + + + + + + + + + + + + diff --git a/eidas-qa-proxy/overlay/opt/se/cfg/img/sweden-connect-color-yellow-on-blue-no-text.svg b/eidas-qa-proxy/overlay/opt/se/cfg/img/sweden-connect-color-yellow-on-blue-no-text.svg new file mode 100644 index 00000000..b9930ac4 --- /dev/null +++ b/eidas-qa-proxy/overlay/opt/se/cfg/img/sweden-connect-color-yellow-on-blue-no-text.svg @@ -0,0 +1 @@ +yellow-on-blue \ No newline at end of file diff --git a/eidas-qa-proxy/overlay/opt/se/cfg/img/sweden-connect-color-yellow-on-blue.svg b/eidas-qa-proxy/overlay/opt/se/cfg/img/sweden-connect-color-yellow-on-blue.svg new file mode 100644 index 00000000..2dad5586 --- /dev/null +++ b/eidas-qa-proxy/overlay/opt/se/cfg/img/sweden-connect-color-yellow-on-blue.svg @@ -0,0 +1,123 @@ + + + + + + + + + + + image/svg+xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/eidas-qa-proxy/overlay/opt/se/cfg/infotext.md b/eidas-qa-proxy/overlay/opt/se/cfg/infotext.md new file mode 100644 index 00000000..26b9e20b --- /dev/null +++ b/eidas-qa-proxy/overlay/opt/se/cfg/infotext.md @@ -0,0 +1,38 @@ +### Proxy Service + +This is the Swedish proxy service of the Swedish eIDAS Pilot + +- Application ID: **${proxy-service.applicationId}** +- Supported eIDAS protocol versions: **${proxy-service.eidasVersions}** + +**Relevant resources:** + + + + + + + + + + + + + + + +
Sweden Connect Home Pagehttps://swedenconnect.se
eIDAS Proxy Service Metadata${proxy-service.domain.prefix}/ServiceMetadata
National SP Metadata${proxy-service.domain.prefix}/nat-metadata
Private Sector SP Metadata${proxy-service.domain.prefix}/nat-metadata${proxy-service.private-sp.suffix}
+ +**Metadata validation certificate:** +
+ + +``` +${proxy.service.metadata.cert} +``` +
+ +**Developers:** + +>Stefan Santesson
+>Martin Lindström diff --git a/eidas-qa-proxy/overlay/opt/se/cfg/metadata.crt b/eidas-qa-proxy/overlay/opt/se/cfg/metadata.crt new file mode 100644 index 00000000..a4750708 --- /dev/null +++ b/eidas-qa-proxy/overlay/opt/se/cfg/metadata.crt @@ -0,0 +1,30 @@ +-----BEGIN CERTIFICATE----- +MIIFIjCCAwoCCQCVO3v9xSA+FDANBgkqhkiG9w0BAQsFADBTMQswCQYDVQQGEwJT +RTEnMCUGA1UECgweU3dlZGlzaCBFLWlkZW50aWZpY2F0aW9uIEJvYXJkMRswGQYD +VQQDDBJRQSBNZXRhZGF0YSBTaWduZXIwHhcNMTcxMjE5MTIyMDI1WhcNMjcxMjE3 +MTIyMDI1WjBTMQswCQYDVQQGEwJTRTEnMCUGA1UECgweU3dlZGlzaCBFLWlkZW50 +aWZpY2F0aW9uIEJvYXJkMRswGQYDVQQDDBJRQSBNZXRhZGF0YSBTaWduZXIwggIi +MA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDYzcmlNTMkBzIYUXxT13zNMakh +xR9BO1Qnlt2euUNdvL8FhgiNo+2AJDxFWts8nsg9Jam15F38nTqRMt4r1zFHYFJ5 +22h8urckpwvFVu/kjQrY8pztLE/pPvGXLPlySDkiRifCGibXuACngZx5chCwNs2h +2OoMgKH7d5aZmUcB2mIc/Ybd98W9jtch1gh5/QM0aJsYnDTYuB840YGwHXCyiBUf +1teUT9bJ/Y90OSXBdib9kuOmtQNMTYtyX8FAodYXVx8ibXNDfhdGaBJh+2J4lFTA +DQQ1tM1YigZyvBuslBcuLDfZce0OaWPYPAf8PE8voxJhGkA026GGNjXP/9nRK146 +bkN4nd/Aa6842aYEOjjcDAl43tjHKZBu0+pnq/2GRiN7Dw4Y+Td/2y8PqD/W87CV +ttrU6yniSMr7Y1+TfzzESSVPXs+csyatH9MJ2IA184Oh7TL6tPh5N96ugh7s85pN +zswG+Gouw1BVCfqpSJmmNMheEOr6igOYQ0LY5aOooLoqET9gu0ks9cixjANFhnhE +vRVkMfbnFVAnvXQEWPQY5NgqO4b0Z65ey011L+slNo6EIiw0FkznAwER0aYzrM2r +hs/hJAAbjnxEhgMKN9bdoXpnrAehwbTOTipOWwrdcd3IKNdDEyFY15j5rGgyIBcK +8gNnvGJLKcaC4vBd1QIDAQABMA0GCSqGSIb3DQEBCwUAA4ICAQBuws48HrfwW/Eq +WN4+VSZ1cMgkp/mgqyyDdXoCPUf5o7ro17oDSocmpdQypiCr6M88MACBX8cqKmie +kIyptrzp1x2seo8rTJpno97dt3hSwbe6+SbRh2bjDpDzL2ecrtv/GXjR41b2CbMO +wu4WTgiFhWmKGNDNcEem37VUpKEYe7u/ucie71AQi49jM0rJ5uSVdBONKj3iAH5d +mckw2nt6HKMJ0S+ckM/aq+m8ACgAyYmMr74Yt6wcpl/NORtIxaGUeT7Z8rN7TUmk +gP9scbYF16xJJkxtylnK2BrSwSFOIuB5KJo2xxhuMffxEgdy4711TfwMCUaTPKmF +dlYzPKeBaYzWFU42jcVsiQz4mSqgvS2dS8nZpYe2K0zHIzKwytn+HQ36KhRRDAVR +7aKH9S8FZJXC6wqXFdEwwZujkGhu/BxgfjGkde8qOQMUwHboX9+aflQ9okB1Tha6 +xVB1kG86WdgJLmrsfqaX1FVyO761ZXYHTuoAZ0iuzIRhteUksfRZchnKpUX0fF1i +yB9M0E6JfqvFeVfLlo8c2FI4MUYFWgqciizaXSfw0waMFdX5+U33eXr1RWF0POZX +JERf83JkjVLanESP9/U9nsZYgIiSX88PahYtuSZLhqamzzFvK+wuVcNKark8s1kS +2d8EIOY6h4jmS2ds9ORaavkV/xxTAA== +-----END CERTIFICATE----- diff --git a/eidas-qa-proxy/overlay/opt/se/cfg/natsp-metadata.properties b/eidas-qa-proxy/overlay/opt/se/cfg/natsp-metadata.properties new file mode 100644 index 00000000..b97b0cf6 --- /dev/null +++ b/eidas-qa-proxy/overlay/opt/se/cfg/natsp-metadata.properties @@ -0,0 +1,25 @@ +#EntityID of the n +natsp.entityId=${proxy-service.domain.prefix}/nat-ps-sp +natsp.logos={\ + '${proxy-service.domain.prefix}/image/logo.svg':'60,171',\ + '${proxy-service.domain.prefix}/image/icon.svg':'32,32'\ + } +natsp.displayNames={\ + en:'Sweden Connect – Cross-border Digital Identification',\ + sv:'Sveriges internationella nod för e-legitimering'\ + } +natsp.descriptions={\ + en:'Test service for the Swedish eIDAS Pilot New Local',\ + sv:'Testtjänst för Svenska eIDAS piloten'\ + } +natsp.assertionConsumerServices={\ + 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST':'${proxy-service.domain.prefix}/assertionconsumer'\ + } +natsp.nameIDFormats=\ + urn:oasis:names:tc:SAML:2.0:nameid-format:persistent,\ + urn:oasis:names:tc:SAML:2.0:nameid-format:transient +natsp.entityCategories=\ + http://id.elegnamnden.se/ec/1.0/loa3-pnr,\ + http://id.elegnamnden.se/ec/1.0/eidas-pnr-delivery + + diff --git a/eidas-qa-proxy/overlay/opt/se/cfg/oidc-rp.properties b/eidas-qa-proxy/overlay/opt/se/cfg/oidc-rp.properties new file mode 100644 index 00000000..2b1a2473 --- /dev/null +++ b/eidas-qa-proxy/overlay/opt/se/cfg/oidc-rp.properties @@ -0,0 +1,23 @@ +oidc-enabled=true + +# OIDC client metadata +client-metadata.client-key[0].alias=oidc-rp +client-metadata.client-key[0].key-store-location=file://${proxy-service.path.prefix}/keystore/oidc-rp.jks +client-metadata.client-key[0].password=S3cr3t +client-metadata.client-key[0].supported-jws-algos=PS256, RS256 +client-metadata.preferred-userinfo-signed-response-algs=ES256,PS256,RS256 +client-metadata.redirect-uris[0]=${proxy-service.domain.prefix}/oidc/return +client-metadata.redirect-uris[1]=https://qa.proxy.eidas.swedenconnect.se/oidc/return +client-metadata.subject-type=pairwise +client-metadata.default-acr-values=http://id.elegnamnden.se/loa/1.0/loa3 + +# OIDC config +oidc-config.op.bid-op.client-id=swedenconnectqa +oidc-config.op.bid-op.op-metadata-location=file://${proxy-service.path.prefix}/metadata/oidc/bid-op-metadata.json +oidc-config.op.bid-op.op-jwks-metadata-location=file://${proxy-service.path.prefix}/metadata/oidc/bid-op-jwks.json +oidc-config.return-url=${proxy-service.domain.prefix}/oidc/return + +# User messages +user-message.default.sv=Sveriges internationella nod för e-legitimering +user-message.default.en=Sweden Connect - Cross-border Digital Identification + diff --git a/eidas-qa-proxy/overlay/opt/se/cfg/psidp-metadata.properties b/eidas-qa-proxy/overlay/opt/se/cfg/psidp-metadata.properties new file mode 100644 index 00000000..c27f6538 --- /dev/null +++ b/eidas-qa-proxy/overlay/opt/se/cfg/psidp-metadata.properties @@ -0,0 +1,34 @@ +psmd.gen.entityID=${proxy-service.domain.prefix}/ServiceMetadata +# Protocol version is the supported eIDAS protocol version. A coma separated list of versions may be provided if more than one are supported. +psmd.gen.supportedProtocolVersions=1.1,1.2 +# Application ID prefix MUST have the format {provider name}:{application ID}: e.g. "SE-eidas:proxy-service:" +psmd.gen.applicationIdPrefix=SE:proxy-service: +psmd.ext.supportedEncAlgos=\ + http://www.w3.org/2009/xmlenc11#aes128-gcm,\ + http://www.w3.org/2009/xmlenc11#aes192-gcm,\ + http://www.w3.org/2009/xmlenc11#aes256-gcm +psmd.ext.supportedSigAlgorithms=\ + http://www.w3.org/2001/04/xmldsig-more#rsa-sha512,\ + http://www.w3.org/2001/04/xmldsig-more#rsa-sha256,\ + http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256 +psmd.ext.supportedDigestAlgorithms=\ + http://www.w3.org/2001/04/xmldsig-more#sha384,\ + http://www.w3.org/2001/04/xmlenc#sha512,\ + http://www.w3.org/2001/04/xmlenc#sha256 +psmd.idp.nameIDFormats=\ + urn:oasis:names:tc:SAML:2.0:nameid-format:persistent,\ + urn:oasis:names:tc:SAML:2.0:nameid-format:transient,\ + urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified +psmd.idp.ssoList={'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST':'${proxy-service.domain.prefix}/ColleagueRequest'} +psmd.idp.supportedAttributes=\ + http://eidas.europa.eu/attributes/naturalperson/CurrentFamilyName,\ + http://eidas.europa.eu/attributes/naturalperson/CurrentGivenName,\ + http://eidas.europa.eu/attributes/naturalperson/DateOfBirth,\ + http://eidas.europa.eu/attributes/naturalperson/PersonIdentifier,\ + http://eidas.europa.eu/attributes/naturalperson/Gender +psmd.idp.assuranceCertifications=\ + http://eidas.europa.eu/LoA/substantial,\ + http://eidas.europa.eu/LoA/low,\ + http://eidas.europa.eu/NotNotified/LoA/substantial +psmd.idp.termsofaccessRequesterId=false +psmd.gen.supportedProtocolVersions=1.2,1.3,1.4 diff --git a/eidas-qa-proxy/overlay/opt/se/cfg/se-metadata-cert.crt b/eidas-qa-proxy/overlay/opt/se/cfg/se-metadata-cert.crt new file mode 100644 index 00000000..3686046a --- /dev/null +++ b/eidas-qa-proxy/overlay/opt/se/cfg/se-metadata-cert.crt @@ -0,0 +1,15 @@ +-----BEGIN CERTIFICATE----- +MIICyzCCAbMCBgFEwQFDRDANBgkqhkiG9w0BAQUFADApMScwJQYDVQQDDB5Td2VkaXNoIEUtaWRl +bnRpZmljYXRpb24gYm9hcmQwHhcNMTQwMzE0MTIzMTI5WhcNMTkwMzE0MTQzMTI5WjApMScwJQYD +VQQDDB5Td2VkaXNoIEUtaWRlbnRpZmljYXRpb24gYm9hcmQwggEiMA0GCSqGSIb3DQEBAQUAA4IB +DwAwggEKAoIBAQCGxrPbCuZYeMZniwOAIO1MiQjGD3LIfaLBddNucsAVrxpYW7bYMwzvgL2Gp4yV +6IyAx5kUgHPjEkEEIjH+NhxYdChD8iWBkLuaOkxyYNXFjFQ3APk5kqP+BB+fP8peWlKGX6S2mfcB +7eObDQqb28osfXE+bak4X2rNf5i+Yx9VdXBpRhDxk7umDdWTSJlc+ZCxWUt3ldc58/sXIgAzVWk4 +9A3GIvOHlBVgm/5g3yzU9HnxD1fyOKT+NkF5J9mjM0x8Qg9K/Zep3n1xmb8kZ/vcRxv+AounGDd7 +w/QWW84sPegySHqm5GkLSgwB63nJZr5wS+qoT9sTooCM0AhBhY1FAgMBAAEwDQYJKoZIhvcNAQEF +BQADggEBAESqy6GrAEbL/blJQxDb/LCCW4y3KAAs/pqvR4SQMP0rvVe5FJiUJsE/6DEhk+cl0N+o +5e8/NusIUD7f6vKSYTHgCodSeDYGdrkRrOucDBWgIlYVsR3yTb/za3AlgiTW6eGGqiY6SeEzXNTM +5o0GpoZbknQZEK/xCJLtMAU6oX7pDBLahtYeJAJJNFVjtPKsERr2Ob2ni9XW8+fxyjv0v2gmlQvW +i6VnpD6VJ3nwAFDsGHBgzli32YBd62rukqyiqvC595LNg0Dg4fyv1ZuOiqajWSd3x8JI6bS01QvY +3fNKY84wMQXpRq9C3zRtpPKmh22W6mcQvh1uN3qNaIEEklE= +-----END CERTIFICATE----- \ No newline at end of file diff --git a/eidas-qa-proxy/overlay/opt/se/cfg/syslog.properties b/eidas-qa-proxy/overlay/opt/se/cfg/syslog.properties new file mode 100644 index 00000000..a72ae560 --- /dev/null +++ b/eidas-qa-proxy/overlay/opt/se/cfg/syslog.properties @@ -0,0 +1,16 @@ +# Parameters: +# - host : Arrray of hostname or IP adresses separated by comma. +# - port : TCP or UDP port +# - protocol : udp, tcp or ssl +# - bsd : Using message format RFC_3164 when set to true. Using RFC_5424 (UDP) or RFC_5425 (TCP) when false +# - facility : The syslog facility identifier (0-23) +# - severity : The syslog sverity code 0-7 +# - clienthostname : Name of the sending client host +# - clientapp : Name of the sending client application + +syslog.1.host=log.qa.sveidas.se +syslog.1.port=514 +syslog.1.protocol=udp +syslog.1.bsd=false +syslog.1.facility=19 +syslog.1.clientapp=eidas-proxy-service diff --git a/eidas-qa-proxy/overlay/opt/se/metadata/oidc/bid-op-jwks.json b/eidas-qa-proxy/overlay/opt/se/metadata/oidc/bid-op-jwks.json new file mode 100644 index 00000000..709ad0e6 --- /dev/null +++ b/eidas-qa-proxy/overlay/opt/se/metadata/oidc/bid-op-jwks.json @@ -0,0 +1,21 @@ +{ + "keys" : [ { + "kty" : "RSA", + "e" : "AQAB", + "use" : "sig", + "kid" : "FU06ji53d1xJVy4BhUXw3pWSe3SpDZwZdsetIL8qh1Q", + "n" : "gClrCXP5Ff9ON-Hfkqp9fZiK_OUWfz4ERWlKZUq54bswJml4oTywhLHdzIf2BK8oHMYUPzAM4uTmf2p37lkgsHHkZUCDbb5UT3TKHmbbtvRbJ7StWea9kmDXRcG0RW_FjfRbFNCrwuc1Z7gzILOXVGcE5nc1-WXSz-6XYAd84U562uTkbZIlolMSVXr_ZHkYAKNNGRyESfsU34kj3SXN9eJmooFUUGXRikskHEDE1otWC8Hds8DmnDcZXmH_MaioJGbJpK3OA6dpkeT5K55ygegO7ADkjWrbmuzPOhIHBovQGhMmkTJGCSJmwX82jZWgT8jEr8JgWc6dsSnPTg91NOqIFegiYyS-4UrlXOcf9h9OHftiPgysHqemAaFS_S_NYEWEcnKoPsPnE2dUxf7OjQuWESknjgqy8N6Jm4Y8srj5fE_4fXKV7ept8tsSFS2Fc3g4Wqpd4XYuiKUYeq8JDISf15jqWw4p129X1nRTskMKrF0FjhMCgWCJDOnD57one6sGsXz9toQ4AKJRjC2O0zylD0cFfmuWN1T5e4dGEiu5Q8nJEyXbQaiOneD1kC5x2pFIEUMuvZ2YRkbVLTzEieyOELbdwegMA6vkiU4IMLSUB3ondIz5IuqaLnp4T0OnWU-d9sdelw_liHA9n__188zrnktvSge5bf8B-SuhLsc" + }, { + "kty" : "RSA", + "e" : "AQAB", + "use" : "sig", + "kid" : "Cez4Zz2YANA6d9JfVFHzADqsWw_RWqdQ7_L1CPy7dFE", + "n" : "nu4CC39I0lwnm6qV1ZSb3lHqpOOiS5XOZGPnszxWqLCPU6K1eFjL62vO2pIN9EC5cKVbJMjSA9-XCJYlLufHm7C80INlyuBOzKYqS7WP6dKc3KX2jsTzvhJpPiBNxyUEm760YpiKB3cHAf7NNa_V0EGnWToTc_jbRTG8GZSgv8lCNNgpBFlJ0LcDTAlB8oau-yKNY4s5Ik3RktVy5IkhO2cXIFSpzYVB3N8I9RD_yeWMrzPv2j_GVHL4wSoaXIZbEz-LVw2VpbKBEzcO-SGSaXpbE58doW15kdj6EipuPxOQKH81Lmi-CTz3D91tQUPjTaACqe_M7_ny3I-gIomhlw" + }, { + "kty" : "RSA", + "e" : "AQAB", + "use" : "enc", + "kid" : "fF5EqLffTfFXPAoKlwS1m8FxE55jvrjTaAd7H_R41xs", + "n" : "yHQ9rcmfPjvHw1MGKb0X56nF5_s3b7FAtH_3XgZP71j_Qf3ez6Go_RuCob74oN-jlUdSNmilYda2w40uYB49J3ZbpIoH9GcPz6KC3qyZjg17Rk2m7_SnERNvZxjn_nd5uC-qfcpRXS2_I7Zu3VPg4TvjU8Zxe5Z6U9a0zmQoco0DLYMbt1mi707EkCjMooTILDKZR9uk_QWGBQKxwmMs8pNag0s9kLzWX1CD7bToWR1637wDv-NjSz3_kHkws0nLEWBYm0cmtXuU51R6OrcOif5Lh9j38P8MQUUC72dv8LwMgT_42DxAyZsbVXn5n-xwjeyVvtZVLfInU8rgdHXmcQ" + } ] +} diff --git a/eidas-qa-proxy/overlay/opt/se/metadata/oidc/bid-op-metadata.json b/eidas-qa-proxy/overlay/opt/se/metadata/oidc/bid-op-metadata.json new file mode 100644 index 00000000..d8bd5cfe --- /dev/null +++ b/eidas-qa-proxy/overlay/opt/se/metadata/oidc/bid-op-metadata.json @@ -0,0 +1,35 @@ +{ + "issuer" : "https://oidc.test.bankid.com", + "authorization_endpoint" : "https://oidc.test.bankid.com/authorize", + "token_endpoint" : "https://oidc.test.bankid.com/token", + "userinfo_endpoint" : "https://oidc.test.bankid.com/userinfo", + "jwks_uri" : "https://oidc.test.bankid.com/jwks", + "scopes_supported" : [ "openid", "profile", "https://id.oidc.se/scope/naturalPersonNumber", "https://id.oidc.se/scope/naturalPersonName", "https://id.oidc.se/scope/authnInfo", "https://id.oidc.se/scope/sign" ], + "response_types_supported" : [ "code" ], + "response_modes_supported" : [ "query" ], + "grant_types_supported" : [ "authorization_code" ], + "acr_values_supported" : [ "http://id.elegnamnden.se/loa/1.0/loa3" ], + "subject_types_supported" : [ "public", "pairwise" ], + "id_token_signing_alg_values_supported" : [ "RS256", "RS384", "RS512", "PS256", "PS384", "PS512" ], + "userinfo_signing_alg_values_supported" : [ "RS256", "RS384", "RS512", "PS256", "PS384", "PS512" ], + "request_object_signing_alg_values_supported" : [ "none", "RS256", "ES256", "PS256" ], + "request_object_encryption_alg_values_supported" : [ "RSA1_5", "RSA-OAEP", "RSA-OAEP-256" ], + "request_object_encryption_enc_values_supported" : [ "A128CBC-HS256", "A128GCM", "A192CBC-HS384", "A192GCM", "A256CBC-HS512", "A256GCM" ], + "token_endpoint_auth_methods_supported" : [ "client_secret_post", "client_secret_basic", "private_key_jwt" ], + "token_endpoint_auth_signing_alg_values_supported" : [ "RS256", "ES256", "PS256" ], + "display_values_supported" : [ "page", "popup", "touch", "wap" ], + "claim_types_supported" : [ "normal" ], + "claims_supported" : [ "sub", "name", "given_name", "family_name", "txn", "auth_time", "https://id.oidc.se/claim/personalIdentityNumber", "https://id.oidc.se/claim/userCertificate", "https://id.oidc.se/claim/userSignature", "https://id.oidc.se/claim/credentialValidFrom", "https://id.oidc.se/claim/credentialValidTo", "https://id.oidc.se/claim/deviceIp", "https://id.oidc.se/claim/authnEvidence", "https://id.oidc.se/claim/age" ], + "service_documentation" : "https://oidc.test.bankid.com/about", + "claims_parameter_supported" : true, + "request_parameter_supported" : true, + "request_uri_parameter_supported" : false, + "require_request_uri_registration" : false, + "op_policy_uri" : "https://oidc.test.bankid.com/about", + "op_tos_uri" : "https://oidc.test.bankid.com/about", + "introspection_endpoint" : "https://oidc.test.bankid.com/introspect", + "code_challenge_methods_supported" : [ "S256" ], + "https://id.oidc.se/disco/userMessageSupported" : true, + "https://id.oidc.se/disco/userMessageSupportedMimeTypes" : [ "text/plain", "text/markdown" ], + "https://id.oidc.se/disco/authnProviderSupported" : false +} diff --git a/eidas-qa-proxy/overlay/opt/se/ps-mdcache/.placeholder b/eidas-qa-proxy/overlay/opt/se/ps-mdcache/.placeholder new file mode 100644 index 00000000..e69de29b