%set %%boolean = {'oui': 1, 'non': 0}
%set %%ssoFilters = %%getSSOFilters
%set %%exported_vars = ['"UA": "HTTP_USER_AGENT"']
%set %%cas_attributes = []
%for %%attr in %%casAttribute
    %silent %%exported_vars.append('"' + %%attr + '": "' + %%attr + '.casLDAPAttribute"')
    %silent %%cas_attributes.append('"' + %%attr + '": "' + %%attr + '.casLDAPAttribute"')
%end for
%for %%key, %%value in %%ssoFilters
    %silent %%exported_vars.append('"' + %%key + '": "' + %%value + '"')
    %silent %%cas_attributes.append('"' + %%key + '": "' + %%value + '"')
%end for
%silent %%exported_vars.sort()
%silent %%cas_attributes.sort()
{
%if %%lemon_user_db == "AD"
    "ADPwdExpireWarning": %%llADPasswordExpireWarn,
    "ADPwdMaxAge": %%llADPasswordMaxAge,
%end if
    "CAS_authnLevel": 1,
    "CAS_pgtFile": "/tmp/pgt.txt",
    "CAS_proxiedServices": {},
    "SMTPServer": "",
    "SSLAuthnLevel": 5,
    "Soap": 1,
    "activeTimer": 1,
    "apacheAuthnLevel": 4,
    "applicationList": {
        "1administration": {
            "catname": "Administration",
            "manager": {
                "options": {
                    "description": "Configure LemonLDAP::NG WebSSO",
                    "display": "auto",
                    "logo": "configure.png",
                    "name": "WebSSO Manager",
                    "uri": "https://%%managerWebName/"
                },
                "type": "application"
            },
            "notifications": {
                "options": {
                    "description": "Explore WebSSO notifications",
                    "display": "auto",
                    "logo": "database.png",
                    "name": "Notifications explorer",
                    "uri": "https://%%managerWebName/notifications.pl"
                },
                "type": "application"
            },
            "sessions": {
                "options": {
                    "description": "Explore WebSSO sessions",
                    "display": "auto",
                    "logo": "database.png",
                    "name": "Sessions explorer",
                    "uri": "https://%%managerWebName/sessions.pl"
                },
                "type": "application"
            },
            "type": "category"
        },
        "2documentation": {
            "catname": "Documentation",
            "localdoc": {
                "options": {
                    "description": "Documentation supplied with LemonLDAP::NG",
                    "display": "on",
                    "logo": "help.png",
                    "name": "Local documentation",
                    "uri": "http://%%managerWebName/doc/"
                },
                "type": "application"
            },
            "officialwebsite": {
                "options": {
                    "description": "Official LemonLDAP::NG Website",
                    "display": "on",
                    "logo": "network.png",
                    "name": "Offical Website",
                    "uri": "http://lemonldap-ng.org/"
                },
                "type": "application"
            },
            "type": "category"
        }
    },
    "authChoiceModules": {},
    "authChoiceParam": "lmAuth",
    "authentication": "%%lemon_user_db",
    "browserIdAuthnLevel": 1,
    "captchaStorage": "Apache::Session::File",
    "captchaStorageOptions": {
        "Directory": "/var/lib/lemonldap-ng/captcha/"
    },
    "captcha_login_enabled": 0,
    "captcha_mail_enabled": 0,
    "captcha_register_enabled": 1,
    "captcha_size": 6,
    "casAccessControlPolicy": "none",
    "casAttributes": {
        %%custom_join(%%cas_attributes, ',\n        ')
    },
    "casStorageOptions": {},
    "cda": 0,
    "cfgAuthor": "EOLE",
    "cfgAuthorIP": "127.0.0.1",
    "cfgDate": 1600257889,
    "cfgLog": "",
    "cfgNum": "1",
    "checkXSS": 1,
    "confirmFormMethod": "post",
    "cookieName": "lemonldap",
    "dbiAuthnLevel": 2,
    "dbiExportedVars": {},
    "demoExportedVars": {
        "cn": "cn",
        "mail": "mail",
        "uid": "uid"
    },
    "domain": "%%nom_domaine_local",
    "exportedHeaders": {
        "%%managerWebName": {}
    },
    "exportedVars": {
        %%custom_join(%%exported_vars, ',\n        ')
    },
    "facebookAuthnLevel": 1,
    "facebookExportedVars": {},
    "failedLoginNumber": 5,
    "globalStorage": "Apache::Session::File",
    "globalStorageOptions": {
        "Directory": "/var/lib/lemonldap-ng/sessions",
        "LockDirectory": "/var/lib/lemonldap-ng/sessions/lock"
    },
    "googleAuthnLevel": 1,
    "googleExportedVars": {},
    "grantSessionRules": {},
    "groups": {},
    "hiddenAttributes": "_password",
    "hideOldPassword": 0,
    "httpOnly": 1,
    "https": 0,
    "infoFormMethod": "get",
    "issuerDBCASActivation": 1,
    "issuerDBCASPath": "^/%%casFolder/",
    "issuerDBCASRule": 1,
    "issuerDBGetParameters": {},
    "issuerDBOpenIDActivation": "1",
    "issuerDBOpenIDPath": "^/openidserver/",
    "issuerDBOpenIDRule": 1,
    "issuerDBSAMLActivation": 0,
    "issuerDBSAMLPath": "^/saml/",
    "issuerDBSAMLRule": 1,
    "jsRedirect": 0,
    "key": "e\"bTCt3*eU9^\\V%b",
%if %%llResetPassword == "oui"
  %if %%llResetExpiredPassword == "oui"
    %if %%lemon_user_db == "AD"
    "ldapPpolicyControl": 0,
    %else
    "ldapPpolicyControl": 1,
    %end if
    "ldapAllowResetExpiredPassword": 1,
    "ldapChangePasswordAsUser": 1,
  %else
    "ldapPpolicyControl": 0,
    "ldapAllowResetExpiredPassword": 0,
    "ldapChangePasswordAsUser": 1,
  %end if
%end if
    "ldapAuthnLevel": 2,
    "ldapSearchDeref": "find",
    "ldapBase": "%%ldapUserBaseDN",
    "ldapExportedVars": {
        "cn": "cn",
        "mail": "mail",
        "uid": "uid"
    },
    "ldapGroupAttributeName": "memberUid",
    "ldapGroupAttributeNameGroup": "dn",
    "ldapGroupAttributeNameSearch": "cn",
    "ldapGroupAttributeNameUser": "uid",
    "ldapGroupObjectClass": "eolegroupe",
    "ldapGroupRecursive": 0,
    "ldapPasswordResetAttribute": "pwdReset",
    "ldapPasswordResetAttributeValue": "TRUE",
    "ldapPort": "%%ldapServerPort",
    "ldapPwdEnc": "utf-8",
    "ldapServer": "%%ldapScheme://%%ldapServer",
%if %%ldapScheme == "ldaps"
   %if %%lmldapverify == "oui"
    "ldapVerify": "required",
   %else
    "ldapVerify": "none",
   %end if
%end if
    "ldapSetPassword": 0,
    "ldapTimeout": 120,
    "ldapUsePasswordResetAttribute": 1,
    "ldapVersion": 3,
    "localSessionStorage": "Cache::FileCache",
    "localSessionStorageOptions": {
        "cache_depth": 3,
        "cache_root": "/tmp",
        "default_expires_in": 600,
        "directory_umask": "007",
        "namespace": "lemonldap-ng-sessions"
    },
    "locationRules": {
        "%%managerWebName": {
            "default": "$uid eq \"%%lemonAdmin\""
        }
    },
    "loginHistoryEnabled": 1,
    "logoutServices": {},
    "lwpSslOpts": {},
    "macros": {
        "_whatToTrace": "$_auth eq 'SAML' ? \"$_user\\@$_idpConfKey\" : \"$_user\""
    },
    "mailCharset": "utf-8",
    "mailConfirmSubject": "[LemonLDAP::NG] Password reset confirmation",
    "mailFrom": "noreply@%%nom_domaine_local",
    "mailOnPasswordChange": 0,
    "mailSessionKey": "mail",
    "mailSubject": "[LemonLDAP::NG] Your new password",
    "mailTimeout": 0,
%if %%llResetPassword == "oui"
    %if %%is_empty(%%llResetUrl)
    "mailUrl": "https://%%authWebName/resetpwd",
    %else
    "mailUrl": "%%llResetUrl",
    %end if
%end if
    "maintenance": 0,
    "managerDn": "%%ldapBindUserDN",
%if %%is_file(%%ldapBindUserPassword)
    "managerPassword": "%%readPass("", %%ldapBindUserPassword)",
%else
    "managerPassword": "%%ldapBindUserPassword",
%end if
    "multiValuesSeparator": ";",
    "nginxCustomHandlers": {},
    "notification": 1,
    "notificationStorage": "File",
    "notificationStorageOptions": {
        "dirName": "/var/lib/lemonldap-ng/notifications"
    },
    "notificationWildcard": "allusers",
    "notifyDeleted": 1,
    "notifyOther": 0,
    "nullAuthnLevel": 2,
    "oidcOPMetaDataExportedVars": {},
    "oidcOPMetaDataJSON": null,
    "oidcOPMetaDataJWKS": null,
    "oidcOPMetaDataOptions": null,
    "oidcRPMetaDataExportedVars": {},
    "oidcRPMetaDataOptions": {},
    "oidcRPMetaDataOptionsExtraClaims": null,
    "oidcServiceMetaDataAuthnContext": {},
    "oidcStorageOptions": {},
    "openIdAuthnLevel": 1,
    "openIdExportedVars": {},
    "openIdSPList": "0;",
    "openIdSreg_email": "mail",
    "openIdSreg_fullname": "cn",
    "openIdSreg_nickname": "uid",
    "openIdSreg_timezone": "_timezone",
    "passwordDB": "%%lemon_user_db",
    "persistentStorage": "Apache::Session::File",
    "persistentStorageOptions": {
        "Directory": "/var/lib/lemonldap-ng/psessions",
        "LockDirectory": "/var/lib/lemonldap-ng/psessions/lock"
    },
    "portal": "https://%%authWebName/",
    "portalAntiFrame": 1,
    "portalCheckLogins": %%boolean[%%llCheckLogins],
    "portalDisplayAppslist": 1,
    "portalDisplayChangePassword": "$_auth =~ /^(AD|LDAP|DBI|Demo)$/",
    "portalDisplayLoginHistory": 1,
    "portalDisplayLogout": 1,
    "portalDisplayRegister": %%boolean[%%llRegisterAccount],
    "portalDisplayResetPassword": %%boolean[%%llResetPassword],
    "portalForceAuthn": 0,
    "portalForceAuthnInterval": 0,
    "portalOpenLinkInNewWindow": 0,
    "portalPingInterval": 60000,
    "portalRequireOldPassword": 1,
    "portalSkin": "bootstrap",
    "portalSkinRules": {},
    "portalUserAttr": "_user",
    "post": {
        "%%managerWebName": {}
    },
    "radiusAuthnLevel": 3,
    "randomPasswordRegexp": "[A-Z]{3}[a-z]{5}.\\d{2}",
    "redirectFormMethod": "get",
    "registerConfirmSubject": "[LemonLDAP::NG] Account register confirmation",
%set %%register_db = %%getVar('llRegisterDB', 'Demo')
%if %%register_db == 'Custom'
    "registerDB": "Null",
    "registerUrl": "%%llRegisterURL",
%else
    "registerDB": "%%register_db",
    "registerUrl": "https://%%authWebName/register.pl",
%end if
    "registerDoneSubject": "[LemonLDAP::NG] Your new account",
    "registerTimeout": 0,
    "reloadUrls": {
        "%%reloadWebName": "https://%%reloadWebName/reload"
    },
    "remoteGlobalStorage": "Lemonldap::NG::Common::Apache::Session::SOAP",
    "remoteGlobalStorageOptions": {
        "ns": "https://%%authWebName/Lemonldap/NG/Common/CGI/SOAPService",
        "proxy": "https://%%authWebName/index.pl/sessions"
    },
    "samlAttributeAuthorityDescriptorAttributeServiceSOAP": "urn:oasis:names:tc:SAML:2.0:bindings:SOAP;#PORTAL#/saml/AA/SOAP;",
    "samlAuthnContextMapKerberos": 4,
    "samlAuthnContextMapPassword": 2,
    "samlAuthnContextMapPasswordProtectedTransport": 3,
    "samlAuthnContextMapTLSClient": 5,
    "samlCommonDomainCookieActivation": 0,
    "samlEntityID": "#PORTAL#/saml/metadata",
    "samlIDPMetaDataExportedAttributes": null,
    "samlIDPMetaDataOptions": null,
    "samlIDPMetaDataXML": {},
    "samlIDPSSODescriptorArtifactResolutionServiceArtifact": "1;0;urn:oasis:names:tc:SAML:2.0:bindings:SOAP;#PORTAL#/saml/artifact",
    "samlIDPSSODescriptorSingleLogoutServiceHTTPPost": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST;#PORTAL#/saml/singleLogout;#PORTAL#/saml/singleLogoutReturn",
    "samlIDPSSODescriptorSingleLogoutServiceHTTPRedirect": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect;#PORTAL#/saml/singleLogout;#PORTAL#/saml/singleLogoutReturn",
    "samlIDPSSODescriptorSingleLogoutServiceSOAP": "urn:oasis:names:tc:SAML:2.0:bindings:SOAP;#PORTAL#/saml/singleLogoutSOAP;",
    "samlIDPSSODescriptorSingleSignOnServiceHTTPArtifact": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact;#PORTAL#/saml/singleSignOnArtifact;",
    "samlIDPSSODescriptorSingleSignOnServiceHTTPPost": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST;#PORTAL#/saml/singleSignOn;",
    "samlIDPSSODescriptorSingleSignOnServiceHTTPRedirect": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect;#PORTAL#/saml/singleSignOn;",
    "samlIDPSSODescriptorSingleSignOnServiceSOAP": "urn:oasis:names:tc:SAML:2.0:bindings:SOAP;#PORTAL#/saml/singleSignOnSOAP;",
    "samlIDPSSODescriptorWantAuthnRequestsSigned": 1,
    "samlIdPResolveCookie": "lemonldapidp",
    "samlMetadataForceUTF8": 1,
    "samlNameIDFormatMapEmail": "mail",
    "samlNameIDFormatMapKerberos": "uid",
    "samlNameIDFormatMapWindows": "uid",
    "samlNameIDFormatMapX509": "mail",
    "samlOrganizationDisplayName": "Example",
    "samlOrganizationName": "%%samlOrganizationName",
    "samlOrganizationURL": "https://auth.%%nom_domaine_local",
    "samlRelayStateTimeout": 600,
    "samlSPMetaDataExportedAttributes": null,
    "samlSPMetaDataOptions": null,
    "samlSPMetaDataXML": null,
    "samlSPSSODescriptorArtifactResolutionServiceArtifact": "1;0;urn:oasis:names:tc:SAML:2.0:bindings:SOAP;#PORTAL#/saml/artifact",
    "samlSPSSODescriptorAssertionConsumerServiceHTTPArtifact": "1;0;urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact;#PORTAL#/saml/proxySingleSignOnArtifact",
    "samlSPSSODescriptorAssertionConsumerServiceHTTPPost": "0;1;urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST;#PORTAL#/saml/proxySingleSignOnPost",
    "samlSPSSODescriptorAuthnRequestsSigned": 1,
    "samlSPSSODescriptorSingleLogoutServiceHTTPPost": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST;#PORTAL#/saml/proxySingleLogout;#PORTAL#/saml/proxySingleLogoutReturn",
    "samlSPSSODescriptorSingleLogoutServiceHTTPRedirect": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect;#PORTAL#/saml/proxySingleLogout;#PORTAL#/saml/proxySingleLogoutReturn",
    "samlSPSSODescriptorSingleLogoutServiceSOAP": "urn:oasis:names:tc:SAML:2.0:bindings:SOAP;#PORTAL#/saml/proxySingleLogoutSOAP;",
    "samlSPSSODescriptorWantAssertionsSigned": 1,
    "samlServicePrivateKeyEnc": "",
    "samlServicePrivateKeyEncPwd": "",
    "samlServicePrivateKeySig": "",
    "samlServicePrivateKeySigPwd": "",
    "samlServicePublicKeyEnc": "",
    "samlServicePublicKeySig": "",
    "samlStorageOptions": {},
    "samlUseQueryStringSpecific": 0,
    "secureTokenAllowOnError": 1,
    "secureTokenAttribute": "uid",
    "secureTokenExpiration": 60,
    "secureTokenHeader": "Auth-Token",
    "secureTokenMemcachedServers": "127.0.0.1:11211",
    "secureTokenUrls": ".*",
    "securedCookie": 0,
    "sessionDataToRemember": {},
    "singleIP": 0,
    "singleSession": 0,
    "singleSessionUserByIP": 0,
    "slaveAuthnLevel": 2,
    "slaveExportedVars": {},
    "storePassword": 0,
    "successLoginNumber": 5,
    "syslog": "",
    "timeout": 72000,
    "timeoutActivity": 0,
    "trustedProxies": "",
    "twitterAuthnLevel": 1,
    "useRedirectOnError": 1,
    "useRedirectOnForbidden": 0,
    "useSafeJail": 1,
    "userControl": "^[\\w\\.\\-@]+$",
    "userDB": "%%lemon_user_db",
    "vhostOptions": {
        "%%managerWebName": {
            "vhostHttps": "1"
        }
    },
    "webIDAuthnLevel": 1,
    "webIDExportedVars": {},
    "whatToTrace": "_whatToTrace",
    "yubikeyAuthnLevel": 3,
    "yubikeyPublicIDSize": 12
}