configmap.yaml

apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ template "cas.fullname" . }}
  labels:
    app: {{ template "cas.name" . }}
    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
    heritage: {{ .Release.Service }}
    release: {{ .Release.Name }}
data:
{{- define "cas.jetty.preprint-services" }}
africarxiv:
  id: '203948234207264'
  name: 'AfricArXiv Preprints'
arabixiv:
  id: '203948234207262'
  name: Arabixiv Preprints
  domain: arabixiv.org
banglarxiv:
  id: '203948234207266'
  name: Banglarxiv Preprints
biohackrxiv:
  id: '203948234207272'
  name: BioHackrXiv Preprints
  domain: biohackrxiv.org
bitss:
  id: '203948234207245'
  name: BITSS Preprints
bodoarxiv:
  id: '203948234207268'
  name: BodoArXiv Preprints
eartharxiv:
  id: '203948234207261'
  name: EarthArXiv Preprints
  domain: eartharxiv.org
ecoevorxiv:
  id: '203948234207265'
  name: EcoEvoRxiv Preprints
  domain: ecoevorxiv.org
ecsarxiv:
  id: '203948234207259'
  name: ECSarXiv Preprints
  domain: ecsarxiv.org
edarxiv:
  id: '203948234207270'
  name: EdArXiv Preprints
  domain: edarxiv.org
engrxiv:
  id: '203948234207242'
  name: engrXiv Preprints
  domain: engrxiv.org
experimentalprotocols:
  id: '203948234207258'
  name: Experimental Protocols Preprints
focusarchive:
  id: '203948234207248'
  name: FocUS Archive Preprints
frenxiv:
  id: '203948234207263'
  name: Frenxiv Preprints
  domain: frenxiv.org
hsrxiv:
  id: '203948234207273'
  name: HSRxiv Preprints
inarxiv:
  id: '203948234207257'
  name: INA-Rxiv Preprints
indiarxiv:
  id: '203948234207271'
  name: IndiaRxiv Preprints
  domain: indiarxiv.org
lawarxiv:
  id: '203948234207247'
  name: LawArXiv Papers
lissa:
  id: '203948234207249'
  name: LIS Scholarship Archive Preprints
livedata:
  id: '203948234207254'
  name: LiveData
marxiv:
  id: '203948234207260'
  name: MarXiv Papers
  domain: marxiv.org
medarxiv:
  id: '203948234207256'
  name: MedArXiv Preprints
mediarxiv:
  id: '203948234207267'
  name: MediArXiv Preprints
  domain: mediarxiv.org
metaarxiv:
  id: '203948234207269'
  name: MetaArXiv Preprints
mindrxiv:
  id: '203948234207250'
  name: MindRxiv Preprints
  domain: mindrxiv.org
nutrixiv:
  id: '203948234207255'
  name: NutriXiv Preprints
paleorxiv:
  id: '203948234207251'
  name: PaleorXiv Preprints
  domain: paleorxiv.org
psyarxiv:
  id: '203948234207243'
  name: PsyArXiv Preprints
  domain: psyarxiv.com
scielo:
  id: '203948234207246'
  name: SciELO Preprints
socarxiv:
  id: '203948234207241'
  name: SocArXiv Preprints
sportrxiv:
  id: '203948234207252'
  name: SportRxiv Preprints
  domain: sportrxiv.org
thesiscommons:
  id: '203948234207253'
  name: Thesis Commons
  domain: thesiscommons.org
{{- end -}}
{{- define "cas.apache.inlineconfigs" }}
shibboleth/shibboleth2.xml: |-
  <SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"
      xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"
      xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
      xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
      xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
      clockSkew="180">

      <InProcess logger="native.logger" checkSpoofing="true"/>

      <!--
      By default, in-memory StorageService, ReplayCache, ArtifactMap, and SessionCache
      are used. See example-shibboleth2.xml for samples of explicitly configuring them.
      -->

      <!--
      To customize behavior for specific resources on Apache, and to link vhosts or
      resources to ApplicationOverride settings below, use web server options/commands.
      See https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPConfigurationElements for help.

      For examples with the RequestMap XML syntax instead, see the example-shibboleth2.xml
      file, and the https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPRequestMapHowTo topic.
      -->

      <!-- The ApplicationDefaults element is where most of Shibboleth's SAML bits are defined. -->
      <ApplicationDefaults entityID="https://{{ .Values.casDomain }}/shibboleth"
                            REMOTE_USER="eppn persistent-id targeted-id" attributePrefix="AUTH-">

          <!--
          Controls session lifetimes, address checks, cookie handling, and the protocol handlers.
          You MUST supply an effectively unique handlerURL value for each of your applications.
          The value defaults to /Shibboleth.sso, and should be a relative path, with the SP computing
          a relative value based on the virtual host. Using handlerSSL="true", the default, will force
          the protocol to be https. You should also set cookieProps to "https" for SSL-only sites.
          Note that while we default checkAddress to "false", this has a negative impact on the
          security of your site. Stealing sessions via cookie theft is much easier with this disabled.
          -->
          <Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
                    checkAddress="false" handlerSSL="false" cookieProps="http">

              <!--
              Configures SSO for a default IdP. To allow for >1 IdP, remove
              entityID property and adjust discoveryURL to point to discovery service.
              (Set discoveryProtocol to "WAYF" for legacy Shibboleth WAYF support.)
              You can also override entityID on /Login query string, or in RequestMap/htaccess.
              -->
              <!-- <SSO entityID="https://idp.testshib.org/idp/shibboleth"
                    discoveryProtocol="SAMLDS" discoveryURL="https://ds.example.org/DS/WAYF">
                SAML2 SAML1
              </SSO> -->
              <!-- <SSO entityID="https://idp.testshib.org/idp/shibboleth">SAML2 SAML1</SSO> -->
              <!-- <SSO discoveryProtocol="SAMLDS" discoveryURL="https://wayf.incommonfederation.org/DS/WAYF">SAML2 SAML1</SSO> -->
              <SSO>SAML2 SAML1</SSO>

              <!-- SAML and local-only logout. -->
              <Logout>SAML2 Local</Logout>

              <!-- Extension service that generates "approximate" metadata based on SP configuration. -->
              <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>

              <!-- Status reporting service. -->
              <!-- <Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/> -->
              <Handler type="Status" Location="/Status"/>

              <!-- Session diagnostic service. -->
              <!-- <Handler type="Session" Location="/Session" showAttributeValues="false"/> -->
              <Handler type="Session" Location="/Session" showAttributeValues="true"/>

              <!-- JSON feed of discovery information. -->
              <Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
          </Sessions>

          <!--
          Allows overriding of error template information/filenames. You can
          also add attributes with values that can be plugged into the templates.
          -->
          <Errors supportContact="support@cos.io" helpLocation="/about.html" styleSheet="/shibboleth-sp/main.css"/>
          <!-- <Errors supportContact="EMAIL" logoLocation="/shibboleth-sp/logo.jpg" styleSheet="/shibboleth-sp/main.css"/> -->

          <!-- Example of remotely supplied batch of signed metadata. -->
          <!--
          <MetadataProvider type="XML" uri="http://federation.org/federation-metadata.xml"
                backingFilePath="federation-metadata.xml" reloadInterval="7200">
              <MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/>
              <MetadataFilter type="Signature" certificate="fedsigner.pem"/>
          </MetadataProvider>
          -->

          <!-- Example of locally maintained metadata. -->
          <!--
          <MetadataProvider type="XML" file="partner-metadata.xml"/>
          -->

          <!-- InCommon -->
          <!-- <MetadataProvider type="XML" uri="http://md.incommon.org/InCommon/InCommon-metadata.xml"
                            backingFilePath="incommon-idp-metadata.xml" reloadInterval="86400">
              <MetadataFilter type="Signature" certificate="incommon-idp-signature.pem"/>
          </MetadataProvider> -->

          <!-- Map to extract attributes from SAML assertions. -->
          <AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/>

          <!-- Use a SAML query if no attributes are supplied during SSO. -->
          <AttributeResolver type="Query" subjectMatch="true"/>

          <!-- Default filtering policy for recognized attributes, lets other data pass. -->
          <AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>

          <!-- Simple file-based resolver for using a single keypair. -->
          <CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>

          <!--
          The default settings can be overridden by creating ApplicationOverride elements (see
          the https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplicationOverride topic).
          Resource requests are mapped by web server commands, or the RequestMapper, to an
          applicationId setting.

          Example of a second application (for a second vhost) that has a different entityID.
          Resources on the vhost would map to an applicationId of "admin":
          -->
          <!--
          <ApplicationOverride id="admin" entityID="https://admin.example.org/shibboleth"/>
          -->
      </ApplicationDefaults>

      <!-- Policies that determine how to process and authenticate runtime messages. -->
      <SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/>

      <!-- Low-level configuration about protocols and bindings available for use. -->
      <ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/>

  </SPConfig>
httpd/conf.d/shib.conf: |-
  LoadModule mod_shib /usr/lib64/shibboleth/mod_shib_24.so

  <VirtualHost *:{{ .Values.service.internalPort }}>
    ServerName health
    LoadModule status_module "modules/mod_status.so"

    <Location "/healthz">
      LogLevel crit
      Require ip 10.0.0.0/8
      Require local
      SetHandler server-status
    </Location>
  </VirtualHost>
  <VirtualHost *:{{ .Values.service.internalPort }}>
    ServerName https://{{ required "casDomain must be set" .Values.casDomain }}:443
    UseCanonicalName On
    ServerAdmin admin@osf.io

    # Mitigate clickjacking
    # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
    Header set X-Frame-Options "deny"

    ProxyRequests off

    # the google health check must have a 200 from /
    RewriteEngine On
    RewriteCond %{HTTP_USER_AGENT} "googlehc" [NC]
    SetEnvIfNoCase User-Agent "googlehc" dontlog
    RewriteRule ^/ - [L,R=200]

    # Redirect HTTP to HTTPS
    RewriteCond %{HTTP:X-Forwarded-Proto} =http [NC]
    RewriteRule . https://%{HTTP:Host}%{REQUEST_URI} [L,R=permanent]

    <Location />
      # ShibDisable on
      ShibRequestSetting REMOTE_ADDR X-Forwarded-For

      ProxyPass http://127.0.0.1:{{ .Values.service.externalPort }}/
      ProxyPassReverse http://127.0.0.1:{{ .Values.service.externalPort }}/
    </Location>

    <Location /login>
      AuthType shibboleth
      # ShibRequestSetting requireSession 0
      Require shibboleth

      # https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSpoofChecking
      # - Jetty 9 drops AJP Support (https://bugs.eclipse.org/bugs/show_bug.cgi?id=425244)
      ShibUseEnvironment off
      ShibUseHeaders on

      ProxyPass http://127.0.0.1:{{ .Values.service.externalPort }}/login
      ProxyPassReverse http://127.0.0.1:{{ .Values.service.externalPort }}/login
    </Location>

    <Location /Shibboleth.sso>
      ProxyPass !
      SetHandler shib
    </Location>
  </VirtualHost>
{{- end -}}
{{- define "cas.jetty.inlineconfigs" }}
config/cas.properties: |-
  ########################################################################################################################
  # Server Settings
  ########################################################################################################################
  # General
  #
  server.port=${TOMCAT_HTTP_PORT:8080}
  server.servlet.contextPath=/
  server.ssl.enabled=false
  #
  # CAS Server
  cas.server.name=https://{{ .Values.casDomain }}
  cas.server.prefix=${cas.server.name}
  # cas.server.scope={{ .Values.casDomain }}
  #
  # Tomcat Server
  #
  cas.server.tomcat.server-name=OSF CAS
  ########################################################################################################################

  ########################################################################################################################
  # Throttling
  # Configuration guide: https://apereo.github.io/cas/6.2.x/installation/Configuring-Authentication-Throttling.html
  # Properties: https://apereo.github.io/cas/6.2.x/configuration/Configuration-Properties.html#authentication-throttling
  ########################################################################################################################
  #
  # Authentication Failure Throttling
  #
  cas.authn.throttle.username-parameter=username
  cas.authn.throttle.app-code=CAS
  cas.authn.throttle.failure.code=AUTHENTICATION_FAILED
  cas.authn.throttle.failure.threshold=5
  cas.authn.throttle.failure.range-seconds=1
  ########################################################################################################################

  ########################################################################################################################
  # CAS Web Application Endpoints Security
  # See: https://docs.spring.io/spring-boot/docs/2.2.8.RELEASE/reference/htmlsingle/#boot-features-security
  # Currently, no sensitive endpoint is exposed. However, set them to prevent auto-generated and logged password
  ########################################################################################################################
  # spring.security.user.name=${SPRING_SECURITY_USER_NAME:casuser}
  # spring.security.user.password=${SPRING_SECURITY_USER_PASSWORD:}
  # spring.security.user.roles=${SPRING_SECURITY_USER_ROLES:}
  ########################################################################################################################

  ########################################################################################################################
  # Logging Settings
  ########################################################################################################################
  logging.config=file:/etc/cas/config/log4j2.xml
  ########################################################################################################################

  ########################################################################################################################
  # Accept Users Authentication - Demo purpose only, must set to empty on production
  ########################################################################################################################
  cas.authn.accept.users=
  ########################################################################################################################

  ########################################################################################################################
  # JSON Service Registry
  # See: https://apereo.github.io/cas/6.2.x/services/JSON-Service-Management.html
  ########################################################################################################################
  cas.serviceRegistry.json.location=file:/etc/cas/services
  ########################################################################################################################

  ########################################################################################################################
  # CAS Logout and Single Logout (SLO)
  # https://apereo.github.io/cas/6.2.x/installation/Logout-Single-Signout.html
  ########################################################################################################################
  # CAS Logout
  #
  cas.logout.follow-service-redirects=true
  cas.logout.redirect-parameter=service
  cas.logout.confirm-logout=false
  cas.logout.remove-descendant-tickets=false
  ########################################################################################################################

  ########################################################################################################################
  # OSF URLs
  ########################################################################################################################
  # OSF
  #
  cas.authn.osf-url.home=https://{{ .Values.osfDomain }}/
  cas.authn.osf-url.dashboard=https://{{ .Values.osfDomain }}/dashboard/
  cas.authn.osf-url.login-with-next=https://{{ .Values.osfDomain }}/login?next=
  cas.authn.osf-url.logout=https://{{ .Values.osfDomain }}/logout/
  cas.authn.osf-url.resend-confirmation=https://{{ .Values.osfDomain }}/resend/
  cas.authn.osf-url.forgot-password=https://{{ .Values.osfDomain }}/forgotpassword/
  cas.authn.osf-url.forgot-password-institution=https://{{ .Values.osfDomain }}/forgotpassword-institution/
  cas.authn.osf-url.register=https://{{ .Values.osfDomain }}/register/
  cas.authn.osf-url.institutions-home=https://{{ .Values.osfDomain }}/institutions/
  ########################################################################################################################

  ########################################################################################################################
  # OSF API Settings for Institution Authentication
  ########################################################################################################################
  # Authentication Endpoint
  #
  cas.authn.osf-api.instn-authn-endpoint=https://{{ .Values.apiDomain }}/v2/institutions/auth/
  #
  # JWT / JWE secrets for signing and encrypting authentication request payload
  #
  cas.authn.osf-api.instn-authn-jwt-secret=${OSF_JWT_SECRET}
  cas.authn.osf-api.instn-authn-jwe-secret=${OSF_JWE_SECRET}
  #
  # Path of the XSL file for parsing and transforming XML authentication responses
  #
  cas.authn.osf-api.instn-authn-xsl-location=file:/etc/cas/institutions-auth.xsl
  ########################################################################################################################

  ########################################################################################################################
  # OSF PostgreSQL Authentication
  # See: https://apereo.github.io/cas/6.2.x/installation/Configuring-Custom-Authentication.html
  ########################################################################################################################
  # Authentication settings
  #
  cas.authn.osf-postgres.enabled=true
  cas.authn.osf-postgres.order=0
  #
  # JPA settings for OSF PostgreSQL
  #
  cas.authn.osf-postgres.jpa.user=${OSF_DB_USER:postgres}
  cas.authn.osf-postgres.jpa.password=${OSF_DB_PASSWORD:}
  cas.authn.osf-postgres.jpa.driver-class=${OSF_DB_DRIVER_CLASS:org.postgresql.Driver}
  cas.authn.osf-postgres.jpa.url=${OSF_DB_URL:jdbc:postgresql://192.168.168.167:5432/osf?targetServerType=master&readOnly=true}
  cas.authn.osf-postgres.jpa.dialect=${OSF_DB_HIBERNATE_DIALECT:io.cos.cas.osf.hibernate.dialect.OsfPostgresDialect}
  ########################################################################################################################

  ########################################################################################################################
  # JPA Ticket Registry
  # See: https://apereo.github.io/cas/6.2.x/ticketing/JPA-Ticket-Registry.html
  ########################################################################################################################
  # Global JDBC Settings
  #
  cas.jdbc.show-sql=false
  cas.jdbc.gen-ddl=true
  cas.jdbc.case-insensitive=false
  #
  # General JPA Settings
  #
  cas.ticket.registry.jpa.user=${CAS_DB_USER:postgres}
  cas.ticket.registry.jpa.password=${CAS_DB_PASSWORD:}
  cas.ticket.registry.jpa.driver-class=${CAS_DB_DRIVER_CLASS:org.postgresql.Driver}
  cas.ticket.registry.jpa.url=${CAS_DB_URL:jdbc:postgresql://127.0.0.1:5432/osf-cas?targetServerType=master}
  cas.ticket.registry.jpa.dialect=${CAS_DB_HIBERNATE_DIALECT:org.hibernate.dialect.PostgreSQL95Dialect}
  cas.ticket.registry.jpa.ddl-auto=update
  cas.ticket.registry.jpa.default-catalog=
  cas.ticket.registry.jpa.default-schema=
  cas.ticket.registry.jpa.health-query=
  cas.ticket.registry.jpa.idle-timeout=PT10M
  cas.ticket.registry.jpa.leak-threshold=6000
  cas.ticket.registry.jpa.batchSize=5
  cas.ticket.registry.jpa.fail-fast-timeout=1
  cas.ticket.registry.jpa.autocommit=false
  cas.ticket.registry.jpa.isolate-internal-queries=false
  cas.ticket.registry.jpa.isolation-level-name=ISOLATION_READ_COMMITTED
  cas.ticket.registry.jpa.data-source-name=
  cas.ticket.registry.jpa.data-source-proxy=false
  cas.ticket.registry.jpa.physical-naming-strategy-class-name=org.apereo.cas.hibernate.CasHibernatePhysicalNamingStrategy
  cas.ticket.registry.jpa.propagation-behaviorName=PROPAGATION_REQUIRED
  #
  # JPA Connection Pooling Properties
  # e.g. cas.ticket.registry.jpa.properties.property-name=propertyValue
  #
  cas.ticket.registry.jpa.pool.min-size=6
  cas.ticket.registry.jpa.pool.max-size=18
  cas.ticket.registry.jpa.pool.max-wait=PT2S
  cas.ticket.registry.jpa.pool.suspension=false
  cas.ticket.registry.jpa.pool.timeout-millis=1000
  #
  # JPA Ticket Registry Settings
  #
  cas.ticket.registry.jpa.ticket-lock-type=NONE
  cas.ticket.registry.jpa.jpa-locking-timeout=PT1H
  ########################################################################################################################

  ########################################################################################################################
  # Signing and Encryption
  # See: https://apereo.github.io/cas/6.2.x/configuration/Configuration-Properties-Common.html#signing--encryption
  ########################################################################################################################
  # Spring Client Session
  # See: https://apereo.github.io/cas/6.2.x/configuration/Configuration-Properties.html#spring-webflow-client-side-session
  #
  cas.webflow.crypto.signing.key=${WEB_FLOW_SIGNING_KEY}
  cas.webflow.crypto.encryption.key=${WEB_FLOW_ENCRYPTION_KEY}
  #
  # Ticket Granting Cookie (TGC)
  # See: https://apereo.github.io/cas/6.2.x/configuration/Configuration-Properties.html#signing--encryption-4
  #
  cas.tgc.crypto.signing.key=${TGC_SIGNING_KEY}
  cas.tgc.crypto.encryption.key=${TGC_ENCRYPTION_KEY}
  ########################################################################################################################

  ########################################################################################################################
  # Long-term Authentication: Ticket Granting Cookie (TGC) and Ticket Granting Ticket (TGT)
  # See https://apereo.github.io/cas/6.2.x/installation/Configuring-LongTerm-Authentication.html
  ########################################################################################################################
  # General Cookie Setting for Ticket Granting Cookie
  #
  cas.tgc.name=osf-cas
  cas.tgc.domain={{ .Values.casDomain }}
  cas.tgc.path=/
  cas.tgc.comment=OSF CAS Ticket Granting Cookie
  cas.tgc.maxAge=-1
  cas.tgc.secure=true
  cas.tgc.http-only=true
  cas.tgc.same-site-policy=Lax
  cas.tgc.pin-to-session=true
  #
  # Ticket Granting Cookie Specific Settings
  #
  cas.tgc.remember-me-max-age=P28D
  cas.tgc.auto-configure-cookie-path=true
  #
  # Ticket Granting Ticket Persistence Settings
  #
  cas.ticket.tgt.remember-me.enabled=true
  cas.ticket.tgt.remember-me.time-to-kill-in-seconds=7200
  ########################################################################################################################

  ########################################################################################################################
  # Pac4j Delegated Authentication
  # https://apereo.github.io/cas/6.2.x/integration/Delegate-Authentication.html
  ########################################################################################################################
  # General settings
  #
  cas.authn.pac4j.typed-id-used=true
  cas.authn.pac4j.lazy-init=true
  cas.authn.pac4j.replicate-sessions=false
  #
  # Non-institution clients
  cas.authn.osf-postgres.non-institution-clients[0]=${cas.authn.pac4j.orcid.client-name}
  #
  # Institution clients
  #
  cas.authn.osf-postgres.institution-clients[0]=${cas.authn.pac4j.cas[0].client-name}
  cas.authn.osf-postgres.institution-clients[1]=${cas.authn.pac4j.cas[1].client-name}
  #
  # Delegation Client: ORCiD
  #
  cas.authn.pac4j.orcid.id=${OAUTH_ORCID_CLIENT_ID:}
  cas.authn.pac4j.orcid.secret=${OAUTH_ORCID_CLIENT_SECRET:}
  cas.authn.pac4j.orcid.client-name=orcid
  cas.authn.pac4j.orcid.enabled=true
  cas.authn.pac4j.orcid.callback-url-type=QUERY_PARAMETER
  #
  # Delegation Client: CAS
  #
  cas.authn.pac4j.cas[0].login-url=${CAS_CORD_LOGIN_URL:https://bprdeis.cord.edu:8443/cas/login}
  cas.authn.pac4j.cas[0].client-name=cord
  cas.authn.pac4j.cas[0].protocol=SAML
  cas.authn.pac4j.cas[0].callback-url-type=QUERY_PARAMETER
  #
  cas.authn.pac4j.cas[1].login-url=${CAS_OKSTATE_LOGIN_URL:https://stwcas.okstate.edu/cas/login}
  cas.authn.pac4j.cas[1].client-name=okstate
  cas.authn.pac4j.cas[1].protocol=SAML
  cas.authn.pac4j.cas[1].callback-url-type=QUERY_PARAMETER
  ########################################################################################################################

  ########################################################################################################################
  # OAuth 2.0 Server
  # Configuration guide: https://apereo.github.io/cas/6.2.x/installation/OAuth-OpenId-Authentication.html
  # Properties: https://apereo.github.io/cas/6.2.x/configuration/Configuration-Properties.html#oauth2
  ########################################################################################################################
  # Authorization Code
  #
  cas.authn.oauth.code.time-to-kill-in-seconds=60
  cas.authn.oauth.code.number-of-uses=1
  #
  # Access token
  #
  cas.authn.oauth.access-token.time-to-kill-in-seconds=7200
  cas.authn.oauth.access-token.max-time-to-live-in-seconds=28800
  #
  # OAuth JWT Access Tokens
  # Signing and encryption are not enabled for Token / JWT Tickets.
  # The keys will only attempt to produce signed (signing key) and plain (encryption key) objects.
  #
  cas.authn.oauth.access-token.create-as-jwt=false
  cas.authn.oauth.access-token.crypto.encryption-enabled=false
  cas.authn.oauth.access-token.crypto.signing-enabled=false
  cas.authn.oauth.access-token.crypto.signing.key=${OAUTH_JWT_ACCESS_TOKEN_SIGNING_KEY}
  cas.authn.oauth.access-token.crypto.encryption.key=${OAUTH_JWT_ACCESS_TOKEN_ENCRYPTION_KEY}
  #
  # Refresh token
  #
  cas.authn.oauth.refresh-token.time-to-kill-in-seconds=2592000
  #
  # Personal access token
  #
  cas.authn.oauth.personal-access-token.time-to-kill-in-seconds=2592000
  cas.authn.oauth.personal-access-token.max-time-to-live-in-seconds=31104000
  #
  # Signing and encryption for OAuth registered service
  #
  cas.authn.oauth.crypto.signing.key=${OAUTH_REGISTERED_SERVICE_SIGNING_KEY}
  cas.authn.oauth.crypto.encryption.key=${OAUTH_REGISTERED_SERVICE_ENCRYPTION_KEY}
  ########################################################################################################################
config/log4j2.xml: |-
  <?xml version="1.0" encoding="UTF-8" ?>
  <!-- Specify the refresh internal in seconds. -->
  <Configuration monitorInterval="5" packages="org.apereo.cas.logging">
      <Properties>
          <Property name="baseDir">/var/log</Property>
          <!-- OSF CAS logging level -->
          <Property name="cas.log.level">debug</Property>
          <!-- Apache logging levels -->
          <Property name="apache.log.level">info</Property>
          <Property name="apache.http.log.level">warn</Property>
          <!-- Apereo and Jasig logging levels -->
          <Property name="apereo.log.level">info</Property>
          <Property name="apereo.cas.log.level">debug</Property>
          <Property name="apereo.service.log.level">warn</Property>
          <Property name="apereo.inspektr.log.level">info</Property>
          <!-- Spring framework logging levels -->
          <Property name="spring.boot.admin.log.level">warn</Property>
          <Property name="spring.boot.log.level">info</Property>
          <Property name="spring.cloud.log.level">warn</Property>
          <Property name="spring.security.log.level">info</Property>
          <Property name="spring.web.log.level">debug</Property>
          <Property name="spring.webflow.log.level">debug</Property>
          <!-- Logging levels for 6.2.x packages that are explicitly used by OSF CAS -->
          <Property name="thymeleaf.log.level">info</Property>
          <Property name="pac4j.log.level">info</Property>
          <!-- Logging levels for new packages that are added by OSF CAS -->
          <Property name="hibernate.log.level">warn</Property>
          <Property name="scribejava.log.level">warn</Property>
          <Property name="google.gson.log.level">warn</Property>
          <!-- Generic logging levels for 6.2.x packages that are not explicitly used by OSF CAS -->
          <Property name="generic.off.log.level">off</Property>
          <Property name="generic.error.log.level">error</Property>
          <Property name="generic.warn.log.level">warn</Property>
          <Property name="generic.info.log.level">info</Property>
          <Property name="generic.debug.log.level">debug</Property>
      </Properties>
      <Appenders>
          <Console name="console" target="SYSTEM_OUT">
              <PatternLayout pattern="%highlight{%d %p [%c] - &lt;%m&gt;}%n"/>
          </Console>
          <RollingFile name="file" fileName="${baseDir}/cas.log" append="true"
                      filePattern="${baseDir}/cas-%d{yyyy-MM-dd-HH}-%i.log">
              <PatternLayout pattern="%d %p [%c] - &lt;%m&gt;%n"/>
              <Policies>
                  <OnStartupTriggeringPolicy/>
                  <SizeBasedTriggeringPolicy size="10 MB"/>
                  <TimeBasedTriggeringPolicy/>
              </Policies>
          </RollingFile>
          <RollingFile name="auditlogfile" fileName="${baseDir}/cas_audit.log" append="true"
                      filePattern="${baseDir}/cas_audit-%d{yyyy-MM-dd-HH}-%i.log">
              <PatternLayout pattern="%d %p [%c] - %m%n"/>
              <Policies>
                  <OnStartupTriggeringPolicy/>
                  <SizeBasedTriggeringPolicy size="10 MB"/>
                  <TimeBasedTriggeringPolicy/>
              </Policies>
          </RollingFile>
          <CasAppender name="casAudit">
              <AppenderRef ref="auditlogfile"/>
          </CasAppender>
          <CasAppender name="casFile">
              <AppenderRef ref="file"/>
          </CasAppender>
          <CasAppender name="casConsole">
              <AppenderRef ref="console"/>
          </CasAppender>
      </Appenders>
      <Loggers>
          <!-- If adding a Logger with level set higher than warn, make category as selective as possible -->
          <!-- Loggers inherit appenders from Root Logger unless additivity is false -->
          <!-- Logger: OSF CAS -->
          <AsyncLogger name="io.cos.cas" level="${sys:cas.log.level}" includeLocation="true"/>
          <!-- Logger: Apache -->
          <AsyncLogger name="org.apache" level="${sys:apache.log.level}"/>
          <AsyncLogger name="org.apache.http" level="${sys:apache.http.log.level}"/>
          <!-- Logger: Apereo and Jasig -->
          <AsyncLogger name="org.apereo" level="${sys:apereo.log.level}" includeLocation="true"/>
          <AsyncLogger name="org.apereo.cas" level="${sys:apereo.cas.log.level}" includeLocation="true"/>
          <AsyncLogger name="org.apereo.services" level="${sys:apereo.service.log.level}" includeLocation="true"/>
          <AsyncLogger name="org.apereo.spring" level="${sys:apereo.log.level}" includeLocation="true"/>
          <!-- Logger: Spring framework -->
          <AsyncLogger name="org.springframework" level="warn" includeLocation="true"/>
          <AsyncLogger name="org.springframework.boot" level="${sys:spring.boot.log.level}" includeLocation="true"/>
          <AsyncLogger name="org.springframework.boot.context.embedded" level="${sys:generic.info.log.level}" includeLocation="true"/>
          <AsyncLogger name="org.springframework.boot.autoconfigure.security.servlet.UserDetailsServiceAutoConfiguration" level="${sys:spring.security.log.level}" includeLocation="true"/>
          <AsyncLogger name="org.springframework.boot.autoconfigure.security" level="${sys:spring.security.log.level}" includeLocation="true"/>
          <AsyncLogger name="org.springframework.boot.devtools" level="${sys:generic.off.log.level}" includeLocation="true"/>
          <AsyncLogger name="org.springframework.web" level="${sys:spring.web.log.level}" includeLocation="true"/>
          <AsyncLogger name="org.springframework.web.client" level="${sys:generic.warn.log.level}" includeLocation="true"/>
          <AsyncLogger name="org.springframework.web.socket" level="${sys:generic.warn.log.level}" includeLocation="true"/>
          <AsyncLogger name="org.springframework.webflow" level="${sys:spring.webflow.log.level}" includeLocation="true"/>
          <AsyncLogger name="org.springframework.webflow.engine.impl" level="${sys:generic.info.log.level}" includeLocation="true"/>
          <AsyncLogger name="org.springframework.webflow.mvc.view" level="${sys:generic.info.log.level}" includeLocation="true"/>
          <AsyncLogger name="org.springframework.cloud" level="${sys:spring.cloud.log.level}" includeLocation="true"/>
          <AsyncLogger name="org.springframework.cloud.vault" level="${sys:generic.warn.log.level}" includeLocation="true"/>
          <AsyncLogger name="org.springframework.amqp" level="${sys:generic.error.log.level}"/>
          <AsyncLogger name="org.springframework.aop" level="${sys:generic.warn.log.level}" includeLocation="true"/>
          <AsyncLogger name="org.springframework.context.annotation" level="${sys:generic.off.log.level}" includeLocation="true"/>
          <AsyncLogger name="org.springframework.integration" level="${sys:generic.warn.log.level}" includeLocation="true"/>
          <AsyncLogger name="org.springframework.messaging" level="${sys:generic.warn.log.level}" includeLocation="true"/>
          <AsyncLogger name="org.springframework.orm.jpa" level="${sys:generic.warn.log.level}" includeLocation="true"/>
          <AsyncLogger name="org.springframework.scheduling" level="${sys:generic.info.log.level}" includeLocation="true"/>
          <AsyncLogger name="org.springframework.security" level="${sys:spring.security.log.level}" includeLocation="true"/>
          <AsyncLogger name="org.springframework.session" level="${sys:generic.warn.log.level}" includeLocation="true"/>
          <AsyncLogger name="org.springframework.scheduling" level="${sys:generic.warn.log.level}" includeLocation="true"/>
          <!-- Logger: 6.2.x packages explicitly used by OSF CAS -->
          <AsyncLogger name="org.pac4j" level="${sys:pac4j.log.level}" includeLocation="true"/>
          <AsyncLogger name="org.thymeleaf" level="${org.thymeleaf.log.level}" includeLocation="true"/>
          <!-- Logger: new packages added (and explicitly used) by OSF CAS-->
          <AsyncLogger name="com.github.scribejava" level="${sys:scribejava.log.level}" includeLocation="true"/>
          <AsyncLogger name="com.google.code.gson" level="${sys:google.gson.log.level}" includeLocation="true"/>
          <AsyncLogger name="org.hibernate" level="${sys:hibernate.log.level}" includeLocation="true"/>
          <!-- Logger: 6.2.x packages not explicitly used by OSF CAS -->
          <AsyncLogger name="PROTOCOL_MESSAGE" level="${sys:generic.warn.log.level}" includeLocation="true"/>
          <AsyncLogger name="com.couchbase" level="${sys:generic.warn.log.level}" includeLocation="true"/>
          <AsyncLogger name="com.hazelcast" level="${sys:generic.warn.log.level}" includeLocation="true"/>
          <AsyncLogger name="de.codecentric" level="${sys:spring.boot.admin.log.level}" includeLocation="true"/>
          <AsyncLogger name="net.jradius" level="${sys:generic.warn.log.level}" includeLocation="true"/>
          <AsyncLogger name="net.sf.ehcache" level="${sys:generic.warn.log.level}" includeLocation="true"/>
          <AsyncLogger name="org.ldaptive" level="${sys:generic.warn.log.level}" includeLocation="true"/>
          <AsyncLogger name="org.opensaml" level="${sys:generic.warn.log.level}" includeLocation="true"/>
          <AsyncLogger name="org.openid4java" level="${sys:generic.warn.log.level}" includeLocation="true"/>
          <!-- Log audit to all root appenders, and also to audit log (additivity is not false) -->
          <AsyncLogger name="org.apereo.inspektr.audit.support" level="${sys:org.apereo.inspektr.log.level}" includeLocation="true">
              <AppenderRef ref="casAudit"/>
          </AsyncLogger>
          <!-- All Loggers inherit appenders specified here, unless additivity="false" on the Logger -->
          <AsyncRoot level="warn">
              <AppenderRef ref="casFile"/>
              <!--  For deployment to an application server running as service,  delete the casConsole appender below -->
              <AppenderRef ref="casConsole"/>
          </AsyncRoot>
      </Loggers>
  </Configuration>
services/cas-203948234207100.json: |-
  {
    "@class": "org.apereo.cas.services.RegexRegisteredService",
    "serviceId": "^https://{{ .Values.casDomain | replace "." "\\\\." }}/.*",
    "name": "",
    "description": "",
    "id": 203948234207100,
    "evaluationOrder": 10,
    "logo": "/images/osf-banner.png",
    "attributeReleasePolicy": {
      "@class": "org.apereo.cas.services.ReturnAllowedAttributeReleasePolicy",
      "allowedAttributes": [
        "java.util.ArrayList",
        [
          "givenName",
          "familyName",
          "username"
        ]
      ]
    },
    "accessStrategy": {
      "@class": "org.apereo.cas.services.DefaultRegisteredServiceAccessStrategy",
      "delegatedAuthenticationPolicy": {
        "@class": "org.apereo.cas.services.DefaultRegisteredServiceDelegatedAuthenticationPolicy",
        "allowedProviders": [
          "java.util.ArrayList",
          []
        ],
        "permitUndefined": false
      }
    }
  }
services/cas-203948234207101.json: |-
  {
    "@class": "org.apereo.cas.services.RegexRegisteredService",
    "serviceId": "^/(login|logout)\\?.*",
    "name": "",
    "description": "",
    "id": 203948234207101,
    "evaluationOrder": 10,
    "logo": "/images/osf-banner.png",
    "attributeReleasePolicy": {
      "@class": "org.apereo.cas.services.ReturnAllowedAttributeReleasePolicy",
      "allowedAttributes": [
        "java.util.ArrayList",
        [
          "givenName",
          "familyName",
          "username"
        ]
      ]
    },
    "accessStrategy": {
      "@class": "org.apereo.cas.services.DefaultRegisteredServiceAccessStrategy",
      "delegatedAuthenticationPolicy": {
        "@class": "org.apereo.cas.services.DefaultRegisteredServiceDelegatedAuthenticationPolicy",
        "allowedProviders": [
          "java.util.ArrayList",
          []
        ],
        "permitUndefined": false
      }
    }
  }
services/osf-203948234207230.json: |-
  {
    "@class": "org.apereo.cas.services.RegexRegisteredService",
    "serviceId": "^https://{{ .Values.osfDomain | replace "." "\\\\." }}/(?!oauth/callback).*",
  "name": "",
    "description": "",
    "id": 203948234207230,
    "evaluationOrder": 20,
    "logo": "/images/osf-banner.png",
    "attributeReleasePolicy": {
      "@class": "org.apereo.cas.services.ReturnAllowedAttributeReleasePolicy",
      "allowedAttributes": [
        "java.util.ArrayList",
        [
          "givenName",
          "familyName",
          "username"
        ]
      ]
    },
    "accessStrategy": {
      "@class": "org.apereo.cas.services.DefaultRegisteredServiceAccessStrategy",
      "delegatedAuthenticationPolicy": {
        "@class": "org.apereo.cas.services.DefaultRegisteredServiceDelegatedAuthenticationPolicy",
        "allowedProviders": [
          "java.util.ArrayList",
          [
            "cord",
            "okstate",
            "orcid"
          ]
        ],
        "permitUndefined": false
      }
    }
  }
services/registries-203948234207340.json: |-
  {
    "@class": "org.apereo.cas.services.RegexRegisteredService",
    "serviceId": "^https://{{ .Values.osfDomain | replace "." "\\\\." }}/login/?\\?next=https(%3A|:)(%2F|/)(%2F|/){{ .Values.osfDomain | replace "." "\\\\." }}(%2F|/)registries(%2F|/).*",
    "name": "",
    "description": "",
    "id": 203948234207340,
    "evaluationOrder": 15,
    "logo": "/images/osf-registries-banner.png",
    "attributeReleasePolicy": {
      "@class": "org.apereo.cas.services.ReturnAllowedAttributeReleasePolicy",
      "allowedAttributes": [
        "java.util.ArrayList",
        [
          "givenName",
          "familyName",
          "username"
        ]
      ]
    },
    "accessStrategy": {
      "@class": "org.apereo.cas.services.DefaultRegisteredServiceAccessStrategy",
      "delegatedAuthenticationPolicy": {
        "@class": "org.apereo.cas.services.DefaultRegisteredServiceDelegatedAuthenticationPolicy",
        "allowedProviders": [
          "java.util.ArrayList",
          [
            "cord",
            "okstate",
            "orcid"
          ]
        ],
        "permitUndefined": false
      }
    }
  }
services/preprints-203948234207240.json: |-
  {
    "@class": "org.apereo.cas.services.RegexRegisteredService",
    "serviceId": "^https://{{ .Values.osfDomain | replace "." "\\\\." }}/login/?\\?next=https(%3A|:)(%2F|/)(%2F|/){{ .Values.osfDomain | replace "." "\\\\." }}(%2F|/)preprints(%2F|/).*",
    "name": "",
    "description": "",
    "id": 203948234207240,
    "evaluationOrder": 15,
    "logo": "/images/osf-preprints-banner.png",
    "attributeReleasePolicy": {
      "@class": "org.apereo.cas.services.ReturnAllowedAttributeReleasePolicy",
      "allowedAttributes": [
        "java.util.ArrayList",
        [
          "givenName",
          "familyName",
          "username"
        ]
      ]
    },
    "accessStrategy": {
      "@class": "org.apereo.cas.services.DefaultRegisteredServiceAccessStrategy",
      "delegatedAuthenticationPolicy": {
        "@class": "org.apereo.cas.services.DefaultRegisteredServiceDelegatedAuthenticationPolicy",
        "allowedProviders": [
          "java.util.ArrayList",
          [
            "cord",
            "okstate",
            "orcid"
          ]
        ],
        "permitUndefined": false
      }
    }
  }
{{- $osfDomainRegex := .Values.osfDomain | replace "." "\\\\." -}}
{{- $casDomain := .Values.casDomain -}}
{{- $domainOverride := .Values.preprintProviderDomains.override -}}
{{- $domainPrefix := .Values.preprintProviderDomains.prefix -}}
{{- $domainSuffix := .Values.preprintProviderDomains.suffix -}}
{{- range $key, $val := (include "cas.jetty.preprint-services" . | fromYaml) }}
services/preprints{{ $key }}-{{ $val.id }}.json: |-
  {
    "@class": "org.apereo.cas.services.RegexRegisteredService",
    "serviceId": "^https://{{ $osfDomainRegex }}/(login|logout)/?\\?next=https(%3A|:)(%2F|/)(%2F|/)
        {{- if hasKey $val "domain" -}}
            (
              {{- if $domainOverride -}}
                  {{- printf "%s%s%s" $domainPrefix $key $domainSuffix | replace "." "\\\\." -}}
              {{- else -}}
                  {{- $val.domain | replace "." "\\\\." -}}
              {{- end -}}
             |{{ $osfDomainRegex }}(%2F|/)preprints(%2F|/){{ $key }}($|%2F|/))
        {{- else -}}
            {{ $osfDomainRegex }}(%2F|/)preprints(%2F|/){{ $key }}
        {{- end -}}
    .*",
    "name": "{{ $val.name }}",
    "description": "",
    "id": {{ $val.id }},
    "evaluationOrder": 10,
    "logo": "https://{{ $casDomain }}/images/branded/preprints-{{ $key }}-logo.png",
    "attributeReleasePolicy": {
      "@class": "org.apereo.cas.services.ReturnAllowedAttributeReleasePolicy",
      "allowedAttributes": [
        "java.util.ArrayList",
        [
          "givenName",
          "familyName",
          "username"
        ]
      ]
    },
    "accessStrategy": {
      "@class": "org.apereo.cas.services.DefaultRegisteredServiceAccessStrategy",
      "delegatedAuthenticationPolicy": {
        "@class": "org.apereo.cas.services.DefaultRegisteredServiceDelegatedAuthenticationPolicy",
        "allowedProviders": [
          "java.util.ArrayList",
          [
            "cord",
            "okstate",
            "orcid"
          ]
        ],
        "permitUndefined": false
      }
    }
  }
{{- end -}}
{{- end -}}

{{- define "cas.apache.fileconfigs" -}}
{{- range $path, $bytes := .Files.Glob "files/apache/**" }}
{{ $path | trimPrefix "files/apache/" }}: |-
{{ printf "%s" $bytes | indent 2 }}
{{- end -}}
{{- end -}}

{{- define "cas.jetty.fileconfigs" -}}
{{- range $path, $bytes := .Files.Glob "files/jetty/**" }}
{{ $path | trimPrefix "files/jetty/" }}: |-
{{ printf "%s" $bytes | indent 2 }}
{{- end -}}
{{- end -}}

{{- range $key, $value := .Values.apache.configEnvs }}
  apache-{{ $key }}: {{ $value | quote }}
{{- end }}
{{- range $key, $value := merge .Values.apache.configFiles (include "cas.apache.inlineconfigs" . | fromYaml) (include "cas.apache.fileconfigs" . | fromYaml) }}
  apache-{{ $key | replace "/" "-" }}: |-
    {{- $value | nindent 4 }}
{{- end }}

{{- range $key, $value := .Values.jetty.configEnvs }}
  jetty-{{ $key }}: {{ $value | quote }}
{{- end }}
{{- range $key, $value := merge .Values.jetty.configFiles (include "cas.jetty.inlineconfigs" . | fromYaml) (include "cas.jetty.fileconfigs" . | fromYaml) }}
  jetty-{{ $key | replace "/" "-" }}: |-
    {{- $value | nindent 4 }}
{{- end }}