Package swiss.trustbroker.config

Class TrustBrokerProperties

java.lang.Object
swiss.trustbroker.config.TrustBrokerProperties
@Configuration @ConfigurationProperties(prefix="trustbroker.config") @RefreshScope public class TrustBrokerProperties extends Object
The root of the XTB configuration.
It provides global defaults, some of which can be overridden in the XML configurations.

  • Constructor Details

    • TrustBrokerProperties

      public TrustBrokerProperties()

  • Method Details

    • setGitParamsFromEnv

      public void setGitParamsFromEnv()

    • getSessionLifetimeSec

      public int getSessionLifetimeSec(boolean ssoEnabled)

    • isPepIssuerMatchingEnabled

      public boolean isPepIssuerMatchingEnabled(String id)

    • getSamlConsumerUrl

      public String getSamlConsumerUrl()

    • getQoaMap

      public Map<String,Integer> getQoaMap()

    • setSloNotificationTimoutMillis

      @Deprecated(since="1.15.0", forRemoval=true) public void setSloNotificationTimoutMillis(int timeout)
      Deprecated, for removal: This API element is subject to removal in a future version.
      use sloNotificationTimeoutMillis

    • isEnabled

      public boolean isEnabled()
      Enable XML schema API.
      Default: false
      Since:
      1.15.0

    • getIssuer

      public String getIssuer()
      Issuer ID used for all SAML2 messages XTB produces.
      (The perimeterUrl can be used as issuer ID.)

    • getPerimeterUrl

      public String getPerimeterUrl()
      Perimeter URL that is used to access XTB.

    • getFrontendBaseUrl

      public String getFrontendBaseUrl()
      Unused / empty for normal setup.
      In development Angular frontend is used via proxy on http://localhost:4200

    • getKeystoreBasePath

      public String getKeystoreBasePath()
      Base path of the keystores configured in the XML configurations.
      See Also:

    • getGui

      public GuiProperties getGui()
      GUI related configuration.

    • getClaimsDefinitionMapping

      public String getClaimsDefinitionMapping()
      Relative path of the ClaimsProviderDefinitions configuration.
      See Also:

    • getRelyingPartySetup

      public String getRelyingPartySetup()
      Relative path of the SetupRP file.
      See Also:

    • getClaimsProviderSetup

      public String getClaimsProviderSetup()
      Relative path of the SetupCP file.
      See Also:

    • getSsoGroupSetup

      public String getSsoGroupSetup()
      Relative path of the SsoGroupSetup file
      See Also:

    • getScriptPath

      public String getScriptPath()
      Relative path of the Groovy scripts.
      Potentially breaking changes:
      • With 1.7.0 the last part was extracted into globalScriptPath.
      See Also:

    • getGlobalScriptPath

      public String getGlobalScriptPath()
      Relative path to scriptPath of the global Groovy scripts.
      Since:
      1.7.0
      See Also:

    • getGlobalProfilesPath

      public String getGlobalProfilesPath()
      Relative path to definition of the global profiles.
      Since:
      1.7.0
      See Also:

    • getSigner

      public swiss.trustbroker.common.config.KeystoreProperties getSigner()
      Default signer.

    • getRolloverSigner

      public swiss.trustbroker.common.config.KeystoreProperties getRolloverSigner()
      Signer used during rollover.

    • getGlobalRequestTrust

      public swiss.trustbroker.common.config.KeystoreProperties getGlobalRequestTrust()
      Optional trust anchor for SAML request test automation or monitoring.
      Since:
      1.12.0

    • getIdm

      public IdmConfig getIdm()
      Configuration for optional IDM integration.

    • getLdap

      public LdapStoreConfig getLdap()
      Configuration for optional LDAP integration.

    • getAttributes

      public AttributeConfig getAttributes()
      Configuration for attributes

    • getAdminSecret

      public String getAdminSecret()
      Secret for administrative APIs.
      E.g. the one to trigger immediate config reload.

    • getSshConfigKeyPath

      public String getSshConfigKeyPath()
      SSH key path. Set during bootstrap, not via application.yml.

    • getRemoteRepoUri

      public String getRemoteRepoUri()
      Git repo. Set during bootstrap, not via application.yml.

    • getConfigBranch

      public String getConfigBranch()
      Configuration branch. Set during bootstrap, not via application.yml.

    • getConfigurationPath

      public String getConfigurationPath()
      Configuration path. Set during bootstrap, not via application.yml.

    • getMonitoring

      public MonitoringConfig getMonitoring()
      Montiforing configuration.
      Since:
      1.15.0

    • getWstrust

      public WsTrustConfig getWstrust()
      WS-Trust protocol configuration.

    • getWsfed

      public WsFedConfig getWsfed()
      WS-Fed protocol configuration.
      Since:
      1.13.0

    • getSaml

      public SamlProperties getSaml()
      SAML protocol configuration.

    • getOidc

      public OidcProperties getOidc()
      OIDC protocol configuration.

    • getSecurity

      public SecurityChecks getSecurity()
      Security check configuration.

    • getCors

      public CorsPolicies getCors()
      HTTP CORS configuration.

    • getCsp

      public ContentSecurityPolicies getCsp()
      HTTP CSP configuration.

    • getFrameOptions

      public FrameOptionsPolicies getFrameOptions()
      HTTP Frame Options configuration.

    • isServerMultiProcessed

      public boolean isServerMultiProcessed()
      Run session and auth cache in DB
      Default: true

    • isServerSingleUser

      public boolean isServerSingleUser()
      Development feature flag to simulate multi-pod behavior with a single service.
      Default: false

    • getSupport

      public Support getSupport()
      Support features.
      Default: null, disabled
      Since:
      1.7.0

    • getAudit

      public AuditConfig getAudit()
      Audit configuration.
      Since:
      1.8.0

    • isSecureBrowserHeaders

      public boolean isSecureBrowserHeaders()
      Default should be secure, disable in DEV only if needed for picky user-agents.
      Default: true

    • isUseSessionCookieForSso

      public boolean isUseSessionCookieForSso()
      Use session cookie for SSO, should always be true.
      Default: true

    • getCookieSameSite

      public String getCookieSameSite()
      Global default cookie sameSite flag.
      Default: None

    • getTraceIdHeader

      public String getTraceIdHeader()
      HTTP header that supplies a request trace ID.

    • getSessionLifetimeSec

      public int getSessionLifetimeSec()
      Session lifetime for non-SSO login exchanges. State used to correlate pending AuthnRequest with Response received from CP after a user has logged in there. A too short value leads to aborted logins when users continue their login on the CP after a longer delay.

    • getSsoSessionLifetimeSec

      public int getSsoSessionLifetimeSec()
      Session lifetime during which SSO is possible on XTB.

    • getSsoMinQoaLevel

      public int getSsoMinQoaLevel()
      Global minimum for QoA level for SSO.
      See Also:

    • getSloNotificationTimeoutMillis

      public int getSloNotificationTimeoutMillis()
      Stop waiting for SLO notifications after that and submit LogoutResponse.
      Default: 2000
      See Also:

    • getSloNotificationMinWaitMillis

      public int getSloNotificationMinWaitMillis()
      Minimum wait in case of fire-and-forget SLO notifications
      Default: 200
      See Also:

    • getSloDefaultSamlDestinationPath

      public String getSloDefaultSamlDestinationPath()
      Global default for SAML logout responses. Relative path or known absolute URL (e.g. to confirmation page).
      See Also:

    • getSloDefaultOidcDestinationPath

      public String getSloDefaultOidcDestinationPath()
      Global default for OIDC logout responses. Relative path or known absolute URL (e.g. to confirmation page).
      See Also:

    • getSsoSessionIdPolicy

      public String getSsoSessionIdPolicy()
      SSO session ID policy.
      See Also:

    • getSloPepIssuerIdPrefix

      public String getSloPepIssuerIdPrefix()
      Prefix for PEP (Policy Enforcement Point) issuer matching.

    • getSloIssuerIdDropPatterns

      public String[] getSloIssuerIdDropPatterns()
      Parts of issuer ID ignored when determining Single Logout (SLO). These are common parts of RP aliases.
      See Also:

    • isHandleResponderErrors

      public boolean isHandleResponderErrors()
      SAML responder error handling enabled.
      Default: false

    • isHandleEnterpriseSwitch

      @Deprecated public boolean isHandleEnterpriseSwitch()
      Deprecated.
      XTB does not support CP/IDP switching based on CP error responses anymore with v1.10.
      User request switch to Enterprise IDP feature flag. If enabled XTB will redirect the user to the intranet IDP when requested.
      Default: false

    • getEnterpriseIdpId

      @Deprecated public String getEnterpriseIdpId()
      Deprecated.
      Replaced by the 'first' marker on the network, e.g. INTRANET-first.
      Intranet IDP ID that can be used for CP filtering in HRD.

    • getBrokerIdpId

      @Deprecated public String getBrokerIdpId()
      Deprecated.
      Replaced by the 'first' marker on the network, e.g. INTERNET-first.
      Broker IDP ID that can be used for CP filtering in HRD.
      See Also:
      • HrdService

    • getPublicIdpId

      @Deprecated public String getPublicIdpId()
      Deprecated.
      Replaced by the 'first' marker on the network, e.g. INTERNET-first.
      Public IDP ID that can be used for CP filtering in HRD.

    • getMobileIdpId

      public String getMobileIdpId()
      Mobile IDP ID that is used for CP filtering in HRD when XTB is accessed via configured IP addresses (mobileGatewayIpRegex). Special case: A single IDP that can be identified by its IP address and then automatically dispatched to the that CP.

    • getHrdHintParameter

      public String getHrdHintParameter()
      HTTP GET query parameter (or POST parameter) that can be sent to request selection of an IDP instead of showing the HRD screen.
      See ClaimsProvider for the fields matched against this parameter.
      Since:
      1.10.0
      See Also:

    • getHrdHintTestParameter

      public String getHrdHintTestParameter()
      HTTP header / cookie name to allow a testing framework to pass a CP to be selected in HRD.
      For normal applications, setting HTTP headers or cookies is usually not convenient (see hrdHintParameter).
      See ClaimsProvider for the fields matched against this parameter.
      Note: This is ignored if the request is not from INTRANET (see hrdHintTestAllowedFromInternet). If set, it also suppresses the AccessRequest.
      Since:
      1.10.0
      See Also:

    • getHrdHintTestAllowedFromInternet

      public Boolean getHrdHintTestAllowedFromInternet()
      Allow hrdHintTestParameter without a network header or from INTERNET.
      Note: In case you use AccessRequest, only enable this if AccessRequest may be skipped without security impact.
      Default: false
      Since:
      1.10.0

    • getPublicAutoLoginCookie

      public String getPublicAutoLoginCookie()
      Autologin cookie that can be used for CP filtering in HRD.

    • getPublicPenTestCookie

      public String getPublicPenTestCookie()
      PEN testing cookie that can be used to implement penetration testing scenarios on the OnMessage hook. If not configured, the OnMessage hook is disabled.
      Since:
      1.13.0

    • getPublicTestCookie

      public String getPublicTestCookie()
      Testing cookie us used to signal special handling for test users e.g. showing invisible IDPs on the HRD screen.
      Since:
      1.15.0

    • getNetwork

      public NetworkConfig getNetwork()
      Network configuration.

    • getStateCache

      public StateCacheProperties getStateCache()
      Configuration for DB state cache.

    • getVersionInfo

      public String getVersionInfo()
      XTB version information for the GUI

    • getSupportedTlsVersions

      public String getSupportedTlsVersions()
      Comma-separated list of supported TLS versions.

    • getVelocityTemplatePath

      public String getVelocityTemplatePath()
      Development feature: Set this to 
      ../trustbroker-service/src/main/resources
      for faster template development - templates will be loaded from the file system on each access

    • getSso

      public SsoConfig getSso()
      SSO configuration.
      Since:
      1.15.0

    • getAnnouncements

      public AnnouncementConfig getAnnouncements()
      Announcement configuration.

    • getQoa

      public QualityOfAuthenticationConfig getQoa()
      QoA configuration.

    • getProfileSelection

      public ProfileSelectionConfig getProfileSelection()
      Profile selection configuration.

    • getAccessRequest

      public AccessRequestConfig getAccessRequest()
      Access request configuration.

    • getSkinnyAssertionNamespaces

      public String getSkinnyAssertionNamespaces()
      Skinny SAML messages reducing the size of the messages (large SAML messages on picky perimeters might block).
      Default: a,no-type

    • getSkinnyHrdTriggers

      public List<swiss.trustbroker.common.config.RegexNameValue> getSkinnyHrdTriggers()
      Legacy clients that get the skinny HRD screen (monitor, testing).
      Note: Since 1.15.0 the value is ignored.

    • getMonitoringHints

      public List<swiss.trustbroker.common.config.RegexNameValue> getMonitoringHints()
      HTTP markers identifying monitoring clients that cannot deal with new features.

    • getBlockedRequestParameterNames

      public List<String> getBlockedRequestParameterNames()
      Request parameter block list.
      If any of these appear in the HTTP request, the request is blocked. Default:
      • @class used by Jackson JSON
      Since:
      1.14.0

    • getBlockedHeaderNames

      public List<String> getBlockedHeaderNames()
      Header block list.
      If any of these appear in the HTTP request, the request is blocked. Default: none
      Since:
      1.14.0

    • setEnabled

      public void setEnabled(boolean enabled)
      Enable XML schema API.
      Default: false
      Since:
      1.15.0

    • setIssuer

      public void setIssuer(String issuer)
      Issuer ID used for all SAML2 messages XTB produces.
      (The perimeterUrl can be used as issuer ID.)

    • setPerimeterUrl

      public void setPerimeterUrl(String perimeterUrl)
      Perimeter URL that is used to access XTB.

    • setFrontendBaseUrl

      public void setFrontendBaseUrl(String frontendBaseUrl)
      Unused / empty for normal setup.
      In development Angular frontend is used via proxy on http://localhost:4200

    • setKeystoreBasePath

      public void setKeystoreBasePath(String keystoreBasePath)
      Base path of the keystores configured in the XML configurations.
      See Also:

    • setGui

      public void setGui(GuiProperties gui)
      GUI related configuration.

    • setClaimsDefinitionMapping

      public void setClaimsDefinitionMapping(String claimsDefinitionMapping)
      Relative path of the ClaimsProviderDefinitions configuration.
      See Also:

    • setRelyingPartySetup

      public void setRelyingPartySetup(String relyingPartySetup)
      Relative path of the SetupRP file.
      See Also:

    • setClaimsProviderSetup

      public void setClaimsProviderSetup(String claimsProviderSetup)
      Relative path of the SetupCP file.
      See Also:

    • setSsoGroupSetup

      public void setSsoGroupSetup(String ssoGroupSetup)
      Relative path of the SsoGroupSetup file
      See Also:

    • setScriptPath

      public void setScriptPath(String scriptPath)
      Relative path of the Groovy scripts.
      Potentially breaking changes:
      • With 1.7.0 the last part was extracted into globalScriptPath.
      See Also:

    • setGlobalScriptPath

      public void setGlobalScriptPath(String globalScriptPath)
      Relative path to scriptPath of the global Groovy scripts.
      Since:
      1.7.0
      See Also:

    • setGlobalProfilesPath

      public void setGlobalProfilesPath(String globalProfilesPath)
      Relative path to definition of the global profiles.
      Since:
      1.7.0
      See Also:

    • setSigner

      public void setSigner(swiss.trustbroker.common.config.KeystoreProperties signer)
      Default signer.

    • setRolloverSigner

      public void setRolloverSigner(swiss.trustbroker.common.config.KeystoreProperties rolloverSigner)
      Signer used during rollover.

    • setGlobalRequestTrust

      public void setGlobalRequestTrust(swiss.trustbroker.common.config.KeystoreProperties globalRequestTrust)
      Optional trust anchor for SAML request test automation or monitoring.
      Since:
      1.12.0

    • setIdm

      public void setIdm(IdmConfig idm)
      Configuration for optional IDM integration.

    • setLdap

      public void setLdap(LdapStoreConfig ldap)
      Configuration for optional LDAP integration.

    • setAttributes

      public void setAttributes(AttributeConfig attributes)
      Configuration for attributes

    • setAdminSecret

      public void setAdminSecret(String adminSecret)
      Secret for administrative APIs.
      E.g. the one to trigger immediate config reload.

    • setSshConfigKeyPath

      public void setSshConfigKeyPath(String sshConfigKeyPath)
      SSH key path. Set during bootstrap, not via application.yml.

    • setRemoteRepoUri

      public void setRemoteRepoUri(String remoteRepoUri)
      Git repo. Set during bootstrap, not via application.yml.

    • setConfigBranch

      public void setConfigBranch(String configBranch)
      Configuration branch. Set during bootstrap, not via application.yml.

    • setConfigurationPath

      public void setConfigurationPath(String configurationPath)
      Configuration path. Set during bootstrap, not via application.yml.

    • setMonitoring

      public void setMonitoring(MonitoringConfig monitoring)
      Montiforing configuration.
      Since:
      1.15.0

    • setWstrust

      public void setWstrust(WsTrustConfig wstrust)
      WS-Trust protocol configuration.

    • setWsfed

      public void setWsfed(WsFedConfig wsfed)
      WS-Fed protocol configuration.
      Since:
      1.13.0

    • setSaml

      public void setSaml(SamlProperties saml)
      SAML protocol configuration.

    • setOidc

      public void setOidc(OidcProperties oidc)
      OIDC protocol configuration.

    • setSecurity

      public void setSecurity(SecurityChecks security)
      Security check configuration.

    • setCors

      public void setCors(CorsPolicies cors)
      HTTP CORS configuration.

    • setCsp

      public void setCsp(ContentSecurityPolicies csp)
      HTTP CSP configuration.

    • setFrameOptions

      public void setFrameOptions(FrameOptionsPolicies frameOptions)
      HTTP Frame Options configuration.

    • setServerMultiProcessed

      public void setServerMultiProcessed(boolean serverMultiProcessed)
      Run session and auth cache in DB
      Default: true

    • setServerSingleUser

      public void setServerSingleUser(boolean serverSingleUser)
      Development feature flag to simulate multi-pod behavior with a single service.
      Default: false

    • setSupport

      public void setSupport(Support support)
      Support features.
      Default: null, disabled
      Since:
      1.7.0

    • setAudit

      public void setAudit(AuditConfig audit)
      Audit configuration.
      Since:
      1.8.0

    • setSecureBrowserHeaders

      public void setSecureBrowserHeaders(boolean secureBrowserHeaders)
      Default should be secure, disable in DEV only if needed for picky user-agents.
      Default: true

    • setUseSessionCookieForSso

      public void setUseSessionCookieForSso(boolean useSessionCookieForSso)
      Use session cookie for SSO, should always be true.
      Default: true

    • setCookieSameSite

      public void setCookieSameSite(String cookieSameSite)
      Global default cookie sameSite flag.
      Default: None

    • setTraceIdHeader

      public void setTraceIdHeader(String traceIdHeader)
      HTTP header that supplies a request trace ID.

    • setSessionLifetimeSec

      public void setSessionLifetimeSec(int sessionLifetimeSec)
      Session lifetime for non-SSO login exchanges. State used to correlate pending AuthnRequest with Response received from CP after a user has logged in there. A too short value leads to aborted logins when users continue their login on the CP after a longer delay.

    • setSsoSessionLifetimeSec

      public void setSsoSessionLifetimeSec(int ssoSessionLifetimeSec)
      Session lifetime during which SSO is possible on XTB.

    • setSsoMinQoaLevel

      public void setSsoMinQoaLevel(int ssoMinQoaLevel)
      Global minimum for QoA level for SSO.
      See Also:

    • setSloNotificationTimeoutMillis

      public void setSloNotificationTimeoutMillis(int sloNotificationTimeoutMillis)
      Stop waiting for SLO notifications after that and submit LogoutResponse.
      Default: 2000
      See Also:

    • setSloNotificationMinWaitMillis

      public void setSloNotificationMinWaitMillis(int sloNotificationMinWaitMillis)
      Minimum wait in case of fire-and-forget SLO notifications
      Default: 200
      See Also:

    • setSloDefaultSamlDestinationPath

      public void setSloDefaultSamlDestinationPath(String sloDefaultSamlDestinationPath)
      Global default for SAML logout responses. Relative path or known absolute URL (e.g. to confirmation page).
      See Also:

    • setSloDefaultOidcDestinationPath

      public void setSloDefaultOidcDestinationPath(String sloDefaultOidcDestinationPath)
      Global default for OIDC logout responses. Relative path or known absolute URL (e.g. to confirmation page).
      See Also:

    • setSsoSessionIdPolicy

      public void setSsoSessionIdPolicy(String ssoSessionIdPolicy)
      SSO session ID policy.
      See Also:

    • setSloPepIssuerIdPrefix

      public void setSloPepIssuerIdPrefix(String sloPepIssuerIdPrefix)
      Prefix for PEP (Policy Enforcement Point) issuer matching.

    • setSloIssuerIdDropPatterns

      public void setSloIssuerIdDropPatterns(String[] sloIssuerIdDropPatterns)
      Parts of issuer ID ignored when determining Single Logout (SLO). These are common parts of RP aliases.
      See Also:

    • setHandleResponderErrors

      public void setHandleResponderErrors(boolean handleResponderErrors)
      SAML responder error handling enabled.
      Default: false

    • setHandleEnterpriseSwitch

      @Deprecated public void setHandleEnterpriseSwitch(boolean handleEnterpriseSwitch)
      Deprecated.
      XTB does not support CP/IDP switching based on CP error responses anymore with v1.10.
      User request switch to Enterprise IDP feature flag. If enabled XTB will redirect the user to the intranet IDP when requested.
      Default: false

    • setEnterpriseIdpId

      @Deprecated public void setEnterpriseIdpId(String enterpriseIdpId)
      Deprecated.
      Replaced by the 'first' marker on the network, e.g. INTRANET-first.
      Intranet IDP ID that can be used for CP filtering in HRD.

    • setBrokerIdpId

      @Deprecated public void setBrokerIdpId(String brokerIdpId)
      Deprecated.
      Replaced by the 'first' marker on the network, e.g. INTERNET-first.
      Broker IDP ID that can be used for CP filtering in HRD.
      See Also:
      • HrdService

    • setPublicIdpId

      @Deprecated public void setPublicIdpId(String publicIdpId)
      Deprecated.
      Replaced by the 'first' marker on the network, e.g. INTERNET-first.
      Public IDP ID that can be used for CP filtering in HRD.

    • setMobileIdpId

      public void setMobileIdpId(String mobileIdpId)
      Mobile IDP ID that is used for CP filtering in HRD when XTB is accessed via configured IP addresses (mobileGatewayIpRegex). Special case: A single IDP that can be identified by its IP address and then automatically dispatched to the that CP.

    • setHrdHintParameter

      public void setHrdHintParameter(String hrdHintParameter)
      HTTP GET query parameter (or POST parameter) that can be sent to request selection of an IDP instead of showing the HRD screen.
      See ClaimsProvider for the fields matched against this parameter.
      Since:
      1.10.0
      See Also:

    • setHrdHintTestParameter

      public void setHrdHintTestParameter(String hrdHintTestParameter)
      HTTP header / cookie name to allow a testing framework to pass a CP to be selected in HRD.
      For normal applications, setting HTTP headers or cookies is usually not convenient (see hrdHintParameter).
      See ClaimsProvider for the fields matched against this parameter.
      Note: This is ignored if the request is not from INTRANET (see hrdHintTestAllowedFromInternet). If set, it also suppresses the AccessRequest.
      Since:
      1.10.0
      See Also:

    • setHrdHintTestAllowedFromInternet

      public void setHrdHintTestAllowedFromInternet(Boolean hrdHintTestAllowedFromInternet)
      Allow hrdHintTestParameter without a network header or from INTERNET.
      Note: In case you use AccessRequest, only enable this if AccessRequest may be skipped without security impact.
      Default: false
      Since:
      1.10.0

    • setPublicAutoLoginCookie

      public void setPublicAutoLoginCookie(String publicAutoLoginCookie)
      Autologin cookie that can be used for CP filtering in HRD.

    • setPublicPenTestCookie

      public void setPublicPenTestCookie(String publicPenTestCookie)
      PEN testing cookie that can be used to implement penetration testing scenarios on the OnMessage hook. If not configured, the OnMessage hook is disabled.
      Since:
      1.13.0

    • setPublicTestCookie

      public void setPublicTestCookie(String publicTestCookie)
      Testing cookie us used to signal special handling for test users e.g. showing invisible IDPs on the HRD screen.
      Since:
      1.15.0

    • setNetwork

      public void setNetwork(NetworkConfig network)
      Network configuration.

    • setStateCache

      public void setStateCache(StateCacheProperties stateCache)
      Configuration for DB state cache.

    • setVersionInfo

      public void setVersionInfo(String versionInfo)
      XTB version information for the GUI

    • setSupportedTlsVersions

      public void setSupportedTlsVersions(String supportedTlsVersions)
      Comma-separated list of supported TLS versions.

    • setVelocityTemplatePath

      public void setVelocityTemplatePath(String velocityTemplatePath)
      Development feature: Set this to 
      ../trustbroker-service/src/main/resources
      for faster template development - templates will be loaded from the file system on each access

    • setSso

      public void setSso(SsoConfig sso)
      SSO configuration.
      Since:
      1.15.0

    • setAnnouncements

      public void setAnnouncements(AnnouncementConfig announcements)
      Announcement configuration.

    • setQoa

      public void setQoa(QualityOfAuthenticationConfig qoa)
      QoA configuration.

    • setProfileSelection

      public void setProfileSelection(ProfileSelectionConfig profileSelection)
      Profile selection configuration.

    • setAccessRequest

      public void setAccessRequest(AccessRequestConfig accessRequest)
      Access request configuration.

    • setSkinnyAssertionNamespaces

      public void setSkinnyAssertionNamespaces(String skinnyAssertionNamespaces)
      Skinny SAML messages reducing the size of the messages (large SAML messages on picky perimeters might block).
      Default: a,no-type

    • setSkinnyHrdTriggers

      public void setSkinnyHrdTriggers(List<swiss.trustbroker.common.config.RegexNameValue> skinnyHrdTriggers)
      Legacy clients that get the skinny HRD screen (monitor, testing).
      Note: Since 1.15.0 the value is ignored.

    • setMonitoringHints

      public void setMonitoringHints(List<swiss.trustbroker.common.config.RegexNameValue> monitoringHints)
      HTTP markers identifying monitoring clients that cannot deal with new features.

    • setBlockedRequestParameterNames

      public void setBlockedRequestParameterNames(List<String> blockedRequestParameterNames)
      Request parameter block list.
      If any of these appear in the HTTP request, the request is blocked. Default:
      • @class used by Jackson JSON
      Since:
      1.14.0

    • setBlockedHeaderNames

      public void setBlockedHeaderNames(List<String> blockedHeaderNames)
      Header block list.
      If any of these appear in the HTTP request, the request is blocked. Default: none
      Since:
      1.14.0

    • equals

      public boolean equals(Object o)
      Overrides:
      equals in class Object

    • canEqual

      protected boolean canEqual(Object other)

    • hashCode

      public int hashCode()
      Overrides:
      hashCode in class Object

    • toString

      public String toString()
      Overrides:
      toString in class Object