<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!DOCTYPE properties SYSTEM "http://java.sun.com/dtd/properties.dtd">
<properties>
	<comment>SAML Configurations</comment>

	<entry key="auth.saml">true</entry>

	<!--
		++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
		Identity Provider (IdP) Configuration
		++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
		These values are provided by the Identity Provider (IdP) 
		(e.g. Ping Identity, Okta, ADFS, Azure AD, etc.).
		They tell the Service Provider (your app) where to send 
		SAML AuthnRequests and how to validate responses.
	-->

	<!--
	Unique identifier (Entity ID) of the IdP.
	Must be exactly as configured in the IdP metadata.
	Example: https://idp.example.com/metadata
	-->
	<entry key="onelogin.saml2.idp.entityid">${IDP_ENTITY_ID}</entry>

	<!--
	Single Sign-On (SSO) endpoint of the IdP.
	SP will redirect authentication requests here.
	Example: https://idp.example.com/sso
	-->
	<entry key="onelogin.saml2.idp.single_sign_on_service.url">${IDP_SSO_URL}</entry>

	<!--
	Logout endpoint of the IdP.
	The SP will send logout requests here.
	Example: https://idp.example.com/slo
	-->
	<entry key="onelogin.saml2.idp.single_logout_service.url">${IDP_SLO_URL}</entry>
	
	<!--
	Public x509 certificate of the IdP.
	Used to verify SAML responses from the IdP.
	Copy the Base64 content of the certificate here.
	-->
	<entry key="onelogin.saml2.idp.x509cert">${IDP_X509_CERT}</entry>

	<!--
	Alternative to x509cert: Fingerprint of the IdP cert.
	Example: onelogin.saml2.idp.certfingerprint=11:22:33:...
	If used, specify the fingerprint algorithm as well (sha1, sha256, etc.).
	-->
	<!--<entry key="onelogin.saml2.idp.certfingerprint"></entry>-->
	<!-- <entry key="onelogin.saml2.idp.certfingerprint_algorithm">sha256</entry> -->

	<!--
		++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
		Service Provider (SP) Configuration
		++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
		These values configure how your application (the SP) 
		identifies itself to the IdP and where it expects responses.
	-->

	<!--
	Unique identifier (Entity ID) of your Service Provider.
	This must match what you register in the IdP.
	Example: https://<YCRASH_HOST>/saml-metadata.jsp
	-->
	<entry key="onelogin.saml2.sp.entityid"></entry>

	<!--
	Assertion Consumer Service (ACS) endpoint.
	The IdP will send authentication responses here.
	Example: https://<YCRASH_HOST>/saml-acs.jsp
	-->
	<entry key="onelogin.saml2.sp.assertion_consumer_service.url"></entry>

	<!--
	Logout endpoint of Service Provider.
	The IdP will send logout responses here.
	Example: https://<YCRASH_HOST>/saml-slo
	-->
	<entry key="onelogin.saml2.sp.single_logout_service.url"></entry>
	
	<!-- 
	  Optional:
	  This property controls whether the Service Provider (SP) will cryptographically sign 
	  the <samlp:LogoutRequest> messages it sends to the Identity Provider (IdP). 

	  - true  → The SP will sign all LogoutRequest messages using its private key.
	  - false → The SP will send LogoutRequest messages without a signature.

	  Note: Some IdPs require signed LogoutRequest, so check with your IdP setup.
	-->
	<entry key="onelogin.saml2.security.logoutrequest_signed">false</entry>

	<!-- 
      Optional:
      This property controls whether the Service Provider (SP) will cryptographically sign 
      the <samlp:LogoutResonse> messages it sends to the Identity Provider (IdP). 
    
      - true  → The SP will sign all LogoutResonse messages using its private key.
      - false → The SP will send LogoutResonse messages without a signature.
    
      Note: Some IdPs require signed LogoutResonse, so check with your IdP setup.
    -->
    <entry key="onelogin.saml2.security.logoutresponse_signed">false</entry>
	
	<!--
	Optional:
	Service Provider (SP) private key in PKCS#8 format.
	Required if signing of AuthnRequests or LogoutRequests is enabled.
	Value is the Base64-encoded private key (sp.key).
	To genrate private key you can run the below command:
		> openssl genrsa -out sp_private_key.key 2048
	Copy the "sp.key" file content and pass it to the below property.
	-->
	<entry key="onelogin.saml2.sp.privatekey"></entry>
	
	<!--
	Optional:
	Service Provider (SP) public x509 certificate.
	Used to sign requests (e.g. LogoutRequest) and encrypt assertions if required.
	Value is the Base64-encoded certificate (sp.crt).
	To genrate private key you can run the below command:
		> openssl req -new -x509 -key sp_private_key.key -out sp_cert.crt -days 365
	Copy the "sp_cert.crt" file content and pass it to the below property.
	-->
	<entry key="onelogin.saml2.sp.x509cert"></entry>
</properties>
