<?xml version="1.0" encoding="UTF-8"?>
<!--
~ Copyright (c) 2017, WSO2 Inc. (http://www.wso2.org) All Rights Reserved.
~
~ Licensed under the Apache License, Version 2.0 (the "License");
~ you may not use this file except in compliance with the License.
~ You may obtain a copy of the License at
~
~ http://www.apache.org/licenses/LICENSE-2.0
~
~ Unless required by applicable law or agreed to in writing, software
~ distributed under the License is distributed on an "AS IS" BASIS,
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
~ See the License for the specific language governing permissions and
~ limitations under the License.
 -->
<Server xmlns="http://wso2.org/projects/carbon/carbon.xml">
    <JDBCPersistenceManager>
        <DataSource>
            <!-- Include a data source name (jndiConfigName) from the set of data
                sources defined in master-datasources.xml -->
            <Name>jdbc/WSO2AM_DB</Name>
        </DataSource>
        <!-- If the identity database is created from another place and if it is
            required to skip schema initialization during the server start up, set the
            following property to "true". -->
        <!-- <SkipDBSchemaCreation>false</SkipDBSchemaCreation> -->
        <SessionDataPersist>
            <Enable>true</Enable>
            <Temporary>true</Temporary>
            <PoolSize>0</PoolSize>
            <SessionDataCleanUp>
                <Enable>true</Enable>
                <CleanUpTimeout>20160</CleanUpTimeout>
                <CleanUpPeriod>1140</CleanUpPeriod>
                <!--Instead of deleting all the records at once, we are deleting the records in chunks to prevent the -->
                <!--possible deadlock and lock scenarios. The following property defines the chunk size.-->
                <DeleteChunkSize>50000</DeleteChunkSize>
                <!--Instead of deleting all the records at once, we are deleting the records in chunks to prevent the -->
                <!--possible deadlock and lock scenarios. The following property defines the chunk size.-->
                <DeleteChunkSize>50000</DeleteChunkSize>
            </SessionDataCleanUp>
            <OperationDataCleanUp>
                <Enable>true</Enable>
                <CleanUpPeriod>720</CleanUpPeriod>
            </OperationDataCleanUp>
        </SessionDataPersist>
    </JDBCPersistenceManager>
    <!-- Time configurations are in minutes -->
    <TimeConfig>
        <SessionIdleTimeout>15</SessionIdleTimeout>
        <RememberMeTimeout>20160</RememberMeTimeout>
    </TimeConfig>
    <!-- Security configurations -->
    <Security>
        <!-- The directory under which all other KeyStore files will be stored -->
        <KeyStoresDir>${carbon.home}/conf/keystores</KeyStoresDir>
        <KeyManagerType>SunX509</KeyManagerType>
        <TrustManagerType>SunX509</TrustManagerType>
    </Security>
    <Identity>
        <IssuerPolicy>SelfAndManaged</IssuerPolicy>
        <TokenValidationPolicy>CertValidate</TokenValidationPolicy>
        <BlackList/>
        <WhiteList/>
        <System>
            <KeyStore/>
            <StorePass/>
        </System>
    </Identity>
    <OpenID>
        <!--
            Default values for OpenIDServerUrl and OpenIDUSerPattern are built in following format
            https://<HostName>:<MgtTrpProxyPort except 443>/<ProxyContextPath>/<context>
            If above format doesn't satisfy uncomment the following configs and explicitly configure the values
         -->
        <OpenIDServerUrl>${carbon.protocol}://${carbon.host}:${carbon.management.port}/openidserver</OpenIDServerUrl>
        <OpenIDUserPattern>${carbon.protocol}://${carbon.host}:${carbon.management.port}/openid</OpenIDUserPattern>
        <OpenIDLoginUrl>${carbon.protocol}://${carbon.host}:${carbon.management.port}/authenticationendpoint/openid_login.do</OpenIDLoginUrl>
        <!-- If the users must be prompted for approval -->
        <OpenIDSkipUserConsent>false</OpenIDSkipUserConsent>
        <!-- Expiry time of the OpenID RememberMe token in minutes -->
        <OpenIDRememberMeExpiry>7200</OpenIDRememberMeExpiry>
        <!-- To enable or disable openid dumb mode -->
        <DisableOpenIDDumbMode>false</DisableOpenIDDumbMode>
        <!--
               OpenID private association store is configurable from following configs.
               It includes two new replication stores,
                       i.   OpenIDServerAssociationStore (Default association store)
                       ii.  PrivateAssociationCryptoStore
                       iii. PrivateAssociationReplicationStore
        -->
        <!-- Specify full qualified class name of the class which going to use as private association store -->
        <!--
		<OpenIDPrivateAssociationStoreClass>org.wso2.carbon.identity.provider.openid.PrivateAssociationCryptoStore</OpenIDPrivateAssociationStoreClass>
	-->
        <!-- The expiration time (in minutes) for the OpenID association -->
        <!--
		<OpenIDAssociationExpiryTime>15</OpenIDAssociationExpiryTime>
	-->
        <!-- Configs specific to PrivateAssociationCryptoStore -->
        <!-- Server secret. This value should be the same in all nodes in the cluster -->
        <!--
		<OpenIDPrivateAssociationServerKey>qewlj324lmasc</OpenIDPrivateAssociationServerKey>
	-->
        <!-- Configs specific to PrivateAssociationCryptoStore -->
        <!-- This enable private association cleanup task which cleans expired private associations -->
        <!--
		<EnableOpenIDAssociationCleanupTask>true</EnableOpenIDAssociationCleanupTask>
	-->
        <!-- Time Period (in minutes) that cleanup task would run -->
        <!--
		<OpenIDAssociationCleanupPeriod>15</OpenIDAssociationCleanupPeriod>
	-->
    </OpenID>
    <OAuth>
        <AppInfoCacheTimeout>-1</AppInfoCacheTimeout>
        <AuthorizationGrantCacheTimeout>-1</AuthorizationGrantCacheTimeout>
        <SessionDataCacheTimeout>-1</SessionDataCacheTimeout>
        <ClaimCacheTimeout>-1</ClaimCacheTimeout>
        <!--
            Default values for OAuth1RequestTokenUrl, OAuth1AccessTokenUrl, OAuth1AuthorizeUrl
            OAuth2AuthzEPUrl, OAuth2TokenEPUrl and OAuth2UserInfoEPUrl are built in following format
            https://<HostName>:<MgtTrpProxyPort except 443>/<ProxyContextPath>/<context>/<path>
            If above format doesn't satisfy uncomment the following configs and explicitly configure the values
         -->
        <OAuth1RequestTokenUrl>${carbon.protocol}://${carbon.host}:${carbon.management.port}/oauth/request-token</OAuth1RequestTokenUrl>
        <OAuth1AuthorizeUrl>${carbon.protocol}://${carbon.host}:${carbon.management.port}/oauth/authorize-url</OAuth1AuthorizeUrl>
        <OAuth1AccessTokenUrl>${carbon.protocol}://${carbon.host}:${carbon.management.port}/oauth/access-token</OAuth1AccessTokenUrl>
        <OAuth2AuthzEPUrl>${carbon.protocol}://${carbon.host}:${carbon.management.port}/oauth2/authorize</OAuth2AuthzEPUrl>
        <OAuth2TokenEPUrl>${carbon.protocol}://${carbon.host}:${carbon.management.port}/oauth2/token</OAuth2TokenEPUrl>
        <OAuth2RevokeEPUrll>${carbon.protocol}://${carbon.host}:${carbon.management.port}/oauth2/revoke</OAuth2RevokeEPUrll>
        <OAuth2IntrospectEPUrl>${carbon.protocol}://${carbon.host}:${carbon.management.port}/oauth2/introspect</OAuth2IntrospectEPUrl>
        <OAuth2UserInfoEPUrl>${carbon.protocol}://${carbon.host}:${carbon.management.port}/oauth2/userinfo</OAuth2UserInfoEPUrl>
        <OIDCCheckSessionEPUrl>${carbon.protocol}://${carbon.host}:${carbon.management.port}/oidc/checksession</OIDCCheckSessionEPUrl>
        <OIDCLogoutEPUrl>${carbon.protocol}://${carbon.host}:${carbon.management.port}/oidc/logout</OIDCLogoutEPUrl>
        <OAuth2ConsentPage>${carbon.protocol}://${carbon.host}:${carbon.management.port}/devicemgt/consent.do</OAuth2ConsentPage>
        <OAuth2ErrorPage>${carbon.protocol}://${carbon.host}:${carbon.management.port}/authenticationendpoint/oauth2_error.do</OAuth2ErrorPage>
        <OIDCConsentPage>${carbon.protocol}://${carbon.host}:${carbon.management.port}/devicemgt/consent.do</OIDCConsentPage>
        <OIDCLogoutConsentPage>${carbon.protocol}://${carbon.host}:${carbon.management.port}/authenticationendpoint/oauth2_logout_consent.do</OIDCLogoutConsentPage>
        <OIDCLogoutPage>${carbon.protocol}://${carbon.host}:${carbon.management.port}/authenticationendpoint/oauth2_logout.do</OIDCLogoutPage>
        <OIDCWebFingerEPUrl>${carbon.protocol}://${carbon.host}:${carbon.management.port}/.well-known/webfinger</OIDCWebFingerEPUrl>
        <!-- For tenants below urls will be modified as https://<hostname>:<port>/t/<tenant domain>/<path>-->
        <OAuth2DCREPUrl>${carbon.protocol}://${carbon.host}:${carbon.management.port}/identity/connect/register</OAuth2DCREPUrl>
        <OAuth2JWKSPage>${carbon.protocol}://${carbon.host}:${carbon.management.port}/oauth2/jwks</OAuth2JWKSPage>
        <OIDCDiscoveryEPUrl>${carbon.protocol}://${carbon.host}:${carbon.management.port}/oauth2/oidcdiscovery</OIDCDiscoveryEPUrl>
        <!-- Default validity period for Authorization Code in seconds -->
        <AuthorizationCodeDefaultValidityPeriod>300</AuthorizationCodeDefaultValidityPeriod>
        <!-- Default validity period for application access tokens in seconds -->
        <AccessTokenDefaultValidityPeriod>3600</AccessTokenDefaultValidityPeriod>
        <!-- Default validity period for user access tokens in seconds -->
        <UserAccessTokenDefaultValidityPeriod>3600</UserAccessTokenDefaultValidityPeriod>
        <!-- Validity period for refresh token -->
        <RefreshTokenValidityPeriod>1555200000</RefreshTokenValidityPeriod>
        <!-- Timestamp skew in seconds -->
        <TimestampSkew>300</TimestampSkew>
        <!-- Enable OAuth caching -->
        <EnableOAuthCache>false</EnableOAuthCache>
        <!-- Enable renewal of refresh token for refresh_token grant -->
        <RenewRefreshTokenForRefreshGrant>false</RenewRefreshTokenForRefreshGrant>
        <!-- Process the token before storing it in database, e.g. encrypting -->
        <TokenPersistenceProcessor>org.wso2.carbon.identity.oauth.tokenprocessor.PlainTextPersistenceProcessor</TokenPersistenceProcessor>
        <!-- Supported Client Authentication Methods -->
        <ClientAuthHandlers>
            <ClientAuthHandler Class="org.wso2.carbon.identity.oauth2.token.handlers.clientauth.BasicAuthClientAuthHandler">
                <Property Name="StrictClientCredentialValidation">false</Property>
            </ClientAuthHandler>
        </ClientAuthHandlers>
        <!-- Supported Response Types -->
        <SupportedResponseTypes>
            <SupportedResponseType>
                <ResponseTypeName>token</ResponseTypeName>
                <ResponseTypeHandlerImplClass>org.wso2.carbon.identity.oauth2.authz.handlers.TokenResponseTypeHandler</ResponseTypeHandlerImplClass>
            </SupportedResponseType>
            <SupportedResponseType>
                <ResponseTypeName>code</ResponseTypeName>
                <ResponseTypeHandlerImplClass>org.wso2.carbon.identity.oauth2.authz.handlers.CodeResponseTypeHandler</ResponseTypeHandlerImplClass>
            </SupportedResponseType>
            <SupportedResponseType>
                <ResponseTypeName>id_token</ResponseTypeName>
                <ResponseTypeHandlerImplClass>org.wso2.carbon.identity.oauth2.authz.handlers.TokenResponseTypeHandler</ResponseTypeHandlerImplClass>
            </SupportedResponseType>
            <SupportedResponseType>
                <ResponseTypeName>id_token token</ResponseTypeName>
                <ResponseTypeHandlerImplClass>org.wso2.carbon.identity.oauth2.authz.handlers.TokenResponseTypeHandler</ResponseTypeHandlerImplClass>
            </SupportedResponseType>
        </SupportedResponseTypes>
        <!-- Supported Grant Types -->
        <SupportedGrantTypes>
            <SupportedGrantType>
                <GrantTypeName>authorization_code</GrantTypeName>
                <GrantTypeHandlerImplClass>org.wso2.carbon.apimgt.keymgt.handlers.ExtendedAuthorizationCodeGrantHandler</GrantTypeHandlerImplClass>
            </SupportedGrantType>
            <SupportedGrantType>
                <GrantTypeName>password</GrantTypeName>
                <GrantTypeHandlerImplClass>org.wso2.carbon.apimgt.keymgt.handlers.ExtendedPasswordGrantHandler</GrantTypeHandlerImplClass>
            </SupportedGrantType>
            <SupportedGrantType>
                <GrantTypeName>refresh_token</GrantTypeName>
                <GrantTypeHandlerImplClass>org.wso2.carbon.identity.oauth2.token.handlers.grant.RefreshGrantHandler</GrantTypeHandlerImplClass>
            </SupportedGrantType>
            <SupportedGrantType>
                <GrantTypeName>client_credentials</GrantTypeName>
                <GrantTypeHandlerImplClass>org.wso2.carbon.apimgt.keymgt.handlers.ExtendedClientCredentialsGrantHandler</GrantTypeHandlerImplClass>
            </SupportedGrantType>
            <SupportedGrantType>
                <GrantTypeName>urn:ietf:params:oauth:grant-type:saml2-bearer</GrantTypeName>
                <GrantTypeHandlerImplClass>org.wso2.carbon.apimgt.keymgt.handlers.ExtendedSAML2BearerGrantHandler</GrantTypeHandlerImplClass>
            </SupportedGrantType>
            <SupportedGrantType>
                <GrantTypeName>iwa:ntlm</GrantTypeName>
                <GrantTypeValidatorImplClass>org.wso2.carbon.identity.oauth.common.NTLMAuthenticationValidator</GrantTypeValidatorImplClass>
                <GrantTypeHandlerImplClass>org.wso2.carbon.identity.oauth2.token.handlers.grant.iwa.ntlm.NTLMAuthenticationGrantHandlerWithHandshake</GrantTypeHandlerImplClass>
            </SupportedGrantType>
            <SupportedGrantType>
                <GrantTypeName>urn:ietf:params:oauth:grant-type:jwt-bearer</GrantTypeName>
                <GrantTypeHandlerImplClass>org.wso2.carbon.device.mgt.oauth.extensions.handlers.grant.ExtendedJWTGrantHandler</GrantTypeHandlerImplClass>
                <GrantTypeValidatorImplClass>org.wso2.carbon.identity.oauth2.grant.jwt.JWTGrantValidator</GrantTypeValidatorImplClass>
            </SupportedGrantType>
            <SupportedGrantType>
                <GrantTypeName>access_token</GrantTypeName>
                <GrantTypeHandlerImplClass>org.wso2.carbon.device.mgt.oauth.extensions.handlers.grant.AccessTokenGrantHandler</GrantTypeHandlerImplClass>
                <GrantTypeValidatorImplClass>org.wso2.carbon.device.mgt.oauth.extensions.validators.AccessTokenGrantValidator</GrantTypeValidatorImplClass>
            </SupportedGrantType>
        </SupportedGrantTypes>

        <!--
            Defines the grant types that will filter user claims based on user consent in their responses such as
            id_token or user info response.

            Default grant types that filter user claims based on user consent are 'authorization_code' and 'implicit'.

            Supported versions: IS 5.5.0 onwards.
        -->
        <UserConsentEnabledGrantTypes>
            <UserConsentEnabledGrantType>
                <GrantTypeName>authorization_code</GrantTypeName>
            </UserConsentEnabledGrantType>
            <UserConsentEnabledGrantType>
                <GrantTypeName>implicit</GrantTypeName>
            </UserConsentEnabledGrantType>
        </UserConsentEnabledGrantTypes>

        <OAuthCallbackHandlers>
            <OAuthCallbackHandler Class="org.wso2.carbon.apimgt.keymgt.util.APIManagerOAuthCallbackHandler"/>
        </OAuthCallbackHandlers>

       <TokenValidators>
            <TokenValidator type="bearer" class="org.wso2.carbon.identity.oauth2.validators.DefaultOAuth2TokenValidator"/>
            <TokenValidator type="jwt" class="org.wso2.carbon.identity.oauth2.validators.OAuth2JWTTokenValidator"/>
        </TokenValidators>

        <!-- Scope validators list. The validators registered here wil be executed during token validation. -->
        <ScopeValidators>
            <ScopeValidator class="org.wso2.carbon.device.mgt.oauth.extensions.handlers.ScopeValidationHandler"/>
        </ScopeValidators>

        <!-- Scope handlers list. The handlers registered here will be executed at the scope validation phase while
             issuing access tokens. -->
        <ScopeHandlers>
            <ScopeHandler class="org.wso2.carbon.identity.oauth2.validators.OIDCScopeHandler" />
        </ScopeHandlers>

        <!-- Assertions can be used to embedd parameters into access token. -->
        <EnableAssertions>
            <UserName>false</UserName>
        </EnableAssertions>
        <!-- This should be set to true when using multiple user stores and keys
            should saved into different tables according to the user store. By default
            all the application keys are saved in to the same table. UserName Assertion
            should be 'true' to use this. -->
        <EnableAccessTokenPartitioning>false</EnableAccessTokenPartitioning>
        <!-- user store domain names and mapping to new table name. eg: if you
            provide 'A:foo.com', foo.com should be the user store domain name and 'A'
            represent the relavant mapping of token store table, i.e. tokens will be
            added to a table called IDN_OAUTH2_ACCESS_TOKEN_A. -->
        <AccessTokenPartitioningDomains>
            <!-- A:foo.com, B:bar.com -->
        </AccessTokenPartitioningDomains>
        <AuthorizationContextTokenGeneration>
            <Enabled>false</Enabled>
            <TokenGeneratorImplClass>org.wso2.carbon.identity.oauth2.authcontext.JWTTokenGenerator</TokenGeneratorImplClass>
            <ClaimsRetrieverImplClass>org.wso2.carbon.identity.oauth2.authcontext.DefaultClaimsRetriever</ClaimsRetrieverImplClass>
            <ConsumerDialectURI>http://wso2.org/claims</ConsumerDialectURI>
            <SignatureAlgorithm>SHA256withRSA</SignatureAlgorithm>
            <AuthorizationContextTTL>15</AuthorizationContextTTL>
        </AuthorizationContextTokenGeneration>
        <SAML2Grant>
            <!--SAML2TokenHandler></SAML2TokenHandler-->
        </SAML2Grant>
        <OpenIDConnect>
            <IDTokenBuilder>org.wso2.carbon.identity.openidconnect.DefaultIDTokenBuilder</IDTokenBuilder>
            <SignatureAlgorithm>SHA256withRSA</SignatureAlgorithm>

            <!-- Default asymmetric encryption algorithm that used to encrypt CEK. -->
            <IDTokenEncryptionAlgorithm>RSA-OAEP</IDTokenEncryptionAlgorithm>
            <!-- Default symmetric encryption algorithm that used to encrypt JWT claims set. -->
            <IDTokenEncryptionMethod>A128GCM</IDTokenEncryptionMethod>

            <!-- Supported versions: IS 5.5.0 onwards. -->
            <SupportedIDTokenEncryptionAlgorithms>
                <SupportedIDTokenEncryptionAlgorithm>RSA1_5</SupportedIDTokenEncryptionAlgorithm>
                <SupportedIDTokenEncryptionAlgorithm>RSA-OAEP</SupportedIDTokenEncryptionAlgorithm>
            </SupportedIDTokenEncryptionAlgorithms>
            <SupportedIDTokenEncryptionMethods>
                <SupportedIDTokenEncryptionMethod>A128GCM</SupportedIDTokenEncryptionMethod>
                <SupportedIDTokenEncryptionMethod>A192GCM</SupportedIDTokenEncryptionMethod>
                <SupportedIDTokenEncryptionMethod>A256GCM</SupportedIDTokenEncryptionMethod>
                <SupportedIDTokenEncryptionMethod>A128CBC-HS256</SupportedIDTokenEncryptionMethod>
                <SupportedIDTokenEncryptionMethod>A128CBC+HS256</SupportedIDTokenEncryptionMethod>
            </SupportedIDTokenEncryptionMethods>

            <EnableAudiences>true</EnableAudiences>
            <!-- Comment out to add Audience values to the JWT token (id_token)  -->
            <!--Audiences>
                   <Audience>${carbon.protocol}://${carbon.host}:${carbon.management.port}/oauth2/token</Audience>
            </Audiences -->
            <!--
                Default value for IDTokenIssuerID, is OAuth2TokenEPUrl.
                If that doesn't satisfy uncomment the following config and explicitly configure the value
            -->
            <IDTokenIssuerID>${carbon.protocol}://${carbon.host}:${carbon.management.port}/oauth2/token</IDTokenIssuerID>
            <IDTokenCustomClaimsCallBackHandler>org.wso2.carbon.identity.openidconnect.SAMLAssertionClaimsCallback</IDTokenCustomClaimsCallBackHandler>
            <UserInfoJWTSignatureAlgorithm>SHA256withRSA</UserInfoJWTSignatureAlgorithm>
            <IDTokenExpiration>3600</IDTokenExpiration>
            <UserInfoEndpointClaimRetriever>org.wso2.carbon.identity.oauth.endpoint.user.impl.UserInfoUserStoreClaimRetriever</UserInfoEndpointClaimRetriever>
            <UserInfoEndpointRequestValidator>org.wso2.carbon.identity.oauth.endpoint.user.impl.UserInforRequestDefaultValidator</UserInfoEndpointRequestValidator>
            <UserInfoEndpointAccessTokenValidator>org.wso2.carbon.identity.oauth.endpoint.user.impl.UserInfoISAccessTokenValidator</UserInfoEndpointAccessTokenValidator>
            <UserInfoEndpointResponseBuilder>org.wso2.carbon.identity.oauth.endpoint.user.impl.UserInfoJSONResponseBuilder</UserInfoEndpointResponseBuilder>
            <SkipUserConsent>false</SkipUserConsent>
            <!-- Sign the ID Token with Service Provider Tenant Private Key-->
            <SignJWTWithSPKey>false</SignJWTWithSPKey>
            <!--
                Expiry period of the logout token used in OIDC Back Channel Logout in seconds.
                Supported versions: IS 5.5.0 onwards
            -->
            <LogoutTokenExpiration>120</LogoutTokenExpiration>

            <!--
                OIDC Request Object builder implementation.
                Supported versions: IS 5.4.0 onwards
            -->
            <RequestObjectBuilders>
                <RequestObjectBuilder>
                    <BuilderName>request_param_value_builder</BuilderName>
                    <RequestObjectBuilderImplClass>org.wso2.carbon.identity.openidconnect.RequestParamRequestObjectBuilder</RequestObjectBuilderImplClass>
                </RequestObjectBuilder>
            </RequestObjectBuilders>

            <!--
                OIDC Request Object validator implementation.
                Supported versions: IS 5.4.0 onwards
            -->
            <RequestObjectValidator>org.wso2.carbon.identity.openidconnect.RequestObjectValidatorImpl</RequestObjectValidator>
        </OpenIDConnect>
        <!-- Configs related to OAuth2 token persistence -->
        <TokenPersistence>
            <Enable>true</Enable>
            <PoolSize>0</PoolSize>
            <RetryCount>5</RetryCount>
        </TokenPersistence>
    </OAuth>
    <MultifactorAuthentication>
        <!--Enable>false</Enable-->
        <XMPPSettings>
            <XMPPConfig>
                <XMPPProvider>gtalk</XMPPProvider>
                <XMPPServer>talk.google.com</XMPPServer>
                <XMPPPort>5222</XMPPPort>
                <XMPPExt>gmail.com</XMPPExt>
                <XMPPUserName>multifactor1@gmail.com</XMPPUserName>
                <XMPPPassword>wso2carbon</XMPPPassword>
            </XMPPConfig>
        </XMPPSettings>
    </MultifactorAuthentication>
    <SSOService>
        <PersistanceCacheTimeout>157680000</PersistanceCacheTimeout>
        <SessionIndexCacheTimeout>157680000</SessionIndexCacheTimeout>
        <EntityId>${carbon.host}</EntityId>
        <!--
            Default value for IdentityProviderURL is  built in following format
            https://<HostName>:<MgtTrpProxyPort except 443>/<ProxyContextPath>/samlsso
            If that doesn't satisfy uncomment the following config and explicitly configure the value
        -->
        <IdentityProviderURL>${carbon.protocol}://${carbon.host}:${carbon.management.port}/samlsso</IdentityProviderURL>
        <DefaultLogoutEndpoint>${carbon.protocol}://${carbon.host}:${carbon.management.port}/authenticationendpoint/samlsso_logout.do</DefaultLogoutEndpoint>
        <NotificationEndpoint>${carbon.protocol}://${carbon.host}:${carbon.management.port}/authenticationendpoint/samlsso_notification.do</NotificationEndpoint>
        <SingleLogoutRetryCount>5</SingleLogoutRetryCount>
        <SingleLogoutRetryInterval>60000</SingleLogoutRetryInterval>
        <!-- in milli seconds -->
        <TenantPartitioningEnabled>false</TenantPartitioningEnabled>
        <AttributesClaimDialect>http://wso2.org/claims</AttributesClaimDialect>
        <!--<SAMLSSOAssertionBuilder>org.wso2.carbon.identity.sso.saml.builders.assertion.ExtendedDefaultAssertionBuilder</SAMLSSOAssertionBuilder>-->
        <SAMLSSOAssertionBuilder>org.wso2.carbon.identity.sso.saml.builders.assertion.DefaultSAMLAssertionBuilder</SAMLSSOAssertionBuilder>
        <SAMLSSOEncrypter>org.wso2.carbon.identity.sso.saml.builders.encryption.DefaultSSOEncrypter</SAMLSSOEncrypter>
        <SAMLSSOSigner>org.wso2.carbon.identity.sso.saml.builders.signature.DefaultSSOSigner</SAMLSSOSigner>
        <SAML2HTTPRedirectSignatureValidator>org.wso2.carbon.identity.sso.saml.validators.SAML2HTTPRedirectDeflateSignatureValidator</SAML2HTTPRedirectSignatureValidator>
        <!--SAMLSSOResponseBuilder>org.wso2.carbon.identity.sso.saml.builders.DefaultResponseBuilder</SAMLSSOResponseBuilder-->
        <!-- SAML Token validity period in minutes -->
        <SAMLResponseValidityPeriod>5</SAMLResponseValidityPeriod>
        <UseAuthenticatedUserDomainCrypto>true</UseAuthenticatedUserDomainCrypto>
        <SAMLDefaultSigningAlgorithmURI>http://www.w3.org/2000/09/xmldsig#rsa-sha1</SAMLDefaultSigningAlgorithmURI>
        <SAMLDefaultDigestAlgorithmURI>http://www.w3.org/2000/09/xmldsig#sha1</SAMLDefaultDigestAlgorithmURI>
        <SLOHostNameVerificationEnabled>true</SLOHostNameVerificationEnabled>
    </SSOService>

    <Consent>
        <!--Specify whether consent management should be enable during SSO.-->
        <EnableSSOConsentManagement>true</EnableSSOConsentManagement>
    </Consent>

    <SecurityTokenService>
        <!--
            Default value for IdentityProviderURL is  built in following format
            https://<HostName>:<MgtTrpProxyPort except 443>/<ProxyContextPath>/services/wso2carbon-sts
            If that doesn't satisfy uncomment the following config and explicitly configure the value
        -->
        <IdentityProviderURL>${carbon.protocol}://${carbon.host}:${carbon.management.port}/services/wso2carbon-sts</IdentityProviderURL>
    </SecurityTokenService>
    <PassiveSTS>
        <!--
            Default value for IdentityProviderURL is  built in following format
            https://<HostName>:<MgtTrpProxyPort except 443>/<ProxyContextPath>/passivests
            If that doesn't satisfy uncomment the following config and explicitly configure the value
        -->
        <IdentityProviderURL>${carbon.protocol}://${carbon.host}:${carbon.management.port}/passivests</IdentityProviderURL>
        <RetryURL>${carbon.protocol}://${carbon.host}:${carbon.management.port}/authenticationendpoint/retry.do</RetryURL>
        <TokenStoreClassName>org.wso2.carbon.identity.sts.passive.utils.NoPersistenceTokenStore</TokenStoreClassName>
        <SLOHostNameVerificationEnabled>true</SLOHostNameVerificationEnabled>
    </PassiveSTS>
    <EntitlementSettings>
        <ThirftBasedEntitlementConfig>
            <EnableThriftService>false</EnableThriftService>
            <ReceivePort>${Ports.ThriftEntitlementReceivePort}</ReceivePort>
            <ClientTimeout>10000</ClientTimeout>
            <KeyStore>
                <Location>${carbon.home}/repository/resources/security/wso2carbon.jks</Location>
                <Password>wso2carbon</Password>
            </KeyStore>
            <!-- Enable this element to mention the host-name of your IS machine -->
            <ThriftHostName>${carbon.host}</ThriftHostName>
        </ThirftBasedEntitlementConfig>
    </EntitlementSettings>
    <SCIM>
        <!--
            Default value for UserEPUrl and GroupEPUrl are built in following format
            https://<HostName>:<MgtTrpProxyPort except 443>/<ProxyContextPath>/<context>/<path>
            If that doesn't satisfy uncomment the following config and explicitly configure the value
        -->
        <UserEPUrl>${carbon.protocol}://${carbon.host}:${carbon.management.port}/wso2/scim/Users</UserEPUrl>
        <GroupEPUrl>${carbon.protocol}://${carbon.host}:${carbon.management.port}/wso2/scim/Groups</GroupEPUrl>
        <SCIMAuthenticators>
            <Authenticator class="org.wso2.carbon.identity.scim.provider.auth.BasicAuthHandler">
                <Property name="Priority">5</Property>
            </Authenticator>
            <Authenticator class="org.wso2.carbon.identity.scim.provider.auth.OAuthHandler">
                <Property name="Priority">10</Property>
                <Property name="AuthorizationServer">local://services</Property>
                <!--Property name="AuthorizationServer">${carbon.protocol}://${carbon.host}:${carbon.management.port}/services</Property>
                <Property name="UserName">admin</Property>
                <Property name="Password">admin</Property-->
            </Authenticator>
        </SCIMAuthenticators>
    </SCIM>

    <SCIM2>
        <!--
            Default value for UserEPUrl and GroupEPUrl are built in following format
            https://<HostName>:<MgtTrpProxyPort except 443>/<ProxyContextPath>/<context>/<path>
            If that doesn't satisfy uncomment the following config and explicitly configure the value
        -->
        <!--UserEPUrl>${carbon.protocol}://${carbon.host}:${carbon.management.port}/scim2/Users</UserEPUrl-->
        <!--GroupEPUrl>${carbon.protocol}://${carbon.host}:${carbon.management.port}/scim2/Groups</GroupEPUrl-->
    </SCIM2>

    <!--Recovery>
        <Notification>
            <Password>
                <Enable>false</Enable>
            </Password>
            <Username>
                <Enable>false</Enable>
            </Username>
            <InternallyManage>true</InternallyManage>
        </Notification>
        <Question>
            <Password>
                <Enable>false</Enable>
                <NotifyStart>false</NotifyStart>
                <Separator>!</Separator>
                <MinAnswers>2</MinAnswers>
                <ReCaptcha>
                    <Enable>true</Enable>
                    <MaxFailedAttempts>2</MaxFailedAttempts>
                </ReCaptcha>
            </Password>
        </Question>
        <ExpiryTime>3</ExpiryTime>
        <NotifySuccess>false</NotifySuccess>
        <AdminPasswordReset>
            <Offline>false</Offline>
            <OTP>false</OTP>
            <RecoveryLink>false</RecoveryLink>
        </AdminPasswordReset>
    </Recovery>

    <EmailVerification>
        <Enable>false</Enable>
        <ExpiryTime>1440</ExpiryTime>
        <LockOnCreation>true</LockOnCreation>
        <Notification>
            <InternallyManage>true</InternallyManage>
        </Notification>
        <AskPassword>
            <ExpiryTime>1440</ExpiryTime>
            <PasswordGenerator>org.wso2.carbon.user.mgt.common.DefaultPasswordGenerator</PasswordGenerator>
        </AskPassword>
    </EmailVerification>

    <SelfRegistration>
        <Enable>false</Enable>
        <LockOnCreation>false</LockOnCreation>
        <Notification>
            <InternallyManage>true</InternallyManage>
        </Notification>
        <ReCaptcha>false</ReCaptcha>
    </SelfRegistration-->
    <EnableAskPasswordAdminUI>true</EnableAskPasswordAdminUI>

    <EnableRecoveryEndpoint>true</EnableRecoveryEndpoint>
    <EnableSelfSignUpEndpoint>true</EnableSelfSignUpEndpoint>

    <AuthenticationPolicy>
        <CheckAccountExist>true</CheckAccountExist>
    </AuthenticationPolicy>

    <EventListeners>
        <EventListener type="org.wso2.carbon.user.core.listener.UserOperationEventListener"
                       name="org.wso2.carbon.user.mgt.workflow.userstore.UserStoreActionListener"
                       orderId="10" enable="true"/>
        <EventListener type="org.wso2.carbon.user.core.listener.UserOperationEventListener"
                       name="org.wso2.carbon.identity.mgt.IdentityMgtEventListener"
                       orderId="50" enable="false"/>
        <EventListener type="org.wso2.carbon.user.core.listener.UserOperationEventListener"
                       name="org.wso2.carbon.identity.scim.common.listener.SCIMUserOperationListener"
                       orderId="90" enable="true"/>
        <!-- Enable the following SCIM2 event listener and disable the above SCIM event listener if SCIM2 is used. -->
        <EventListener type="org.wso2.carbon.user.core.listener.UserOperationEventListener"
                       name="org.wso2.carbon.identity.scim2.common.listener.SCIMUserOperationListener"
                       orderId="93" enable="false"/>
        <EventListener type="org.wso2.carbon.user.core.listener.UserOperationEventListener"
                       name="org.wso2.carbon.identity.governance.listener.IdentityMgtEventListener"
                       orderId="95" enable="true"/>
        <EventListener type="org.wso2.carbon.user.core.listener.UserOperationEventListener" name="org.wso2.carbon.identity.governance.listener.IdentityStoreEventListener"
                       orderId="97" enable="true">
            <Property name="Data.Store">org.wso2.carbon.identity.governance.store.JDBCIdentityDataStore</Property>
        </EventListener>
        <EventListener type="org.wso2.carbon.identity.core.handler.AbstractIdentityMessageHandler"
                       name="org.wso2.carbon.identity.data.publisher.application.authentication.impl.DASLoginDataPublisherImpl"
                       orderId="10" enable="false"/>
        <EventListener type="org.wso2.carbon.identity.core.handler.AbstractIdentityMessageHandler"
                       name="org.wso2.carbon.identity.data.publisher.application.authentication.impl.DASSessionDataPublisherImpl"
                       orderId="11" enable="false"/>
        <EventListener type="org.wso2.carbon.identity.core.handler.AbstractIdentityMessageHandler"
                       name="org.wso2.carbon.identity.data.publisher.application.authentication.AuthnDataPublisherProxy"
                       orderId="11" enable="true"/>

        <!-- Enable this listener to call DeleteEventRecorders. -->
        <EventListener type="org.wso2.carbon.user.core.listener.UserOperationEventListener"
                       name="org.wso2.carbon.user.mgt.listeners.UserDeletionEventListener"
                       orderId="98" enable="false"/>
        <EventListener type="org.wso2.carbon.identity.core.handler.AbstractIdentityHandler"
                       name="org.wso2.carbon.identity.application.authentication.framework.handler.request.impl.consent.ConsentMgtPostAuthnHandler"
                       orderId="110" enable="true"/>
    </EventListeners>

    <!-- These recorders are used to write user delete information to specific sources. Default event recorder is CSV
     file recorder. This recorder is disabled by default. Enable it by setting enable="true". To run these recorders,
     EventListener "rg.wso2.carbon.user.mgt.listeners.UserDeletionEventListener" also should be enabled. Which is
     also disabled by default. -->
    <UserDeleteEventRecorders>
        <UserDeleteEventRecorder name="org.wso2.carbon.user.mgt.recorder.DefaultUserDeletionEventRecorder" enable="false">
            <!-- Un comment below line if you need to write entries to a separate .csv file. Otherwise this will be
            written in to a log file using a separate appender. -->
            <!--<Property name="path">${carbon.home}/repository/logs/delete-records.csv</Property>-->
        </UserDeleteEventRecorder>
    </UserDeleteEventRecorders>

    <CacheConfig>
        <!-- Identity cache configuration.
             Timeouts are in seconds.
             Capacity is the maximum cache size.
             Unless specifically mentioned, you do not need to set the isDistributed flag.
         -->
        <CacheManager name="IdentityApplicationManagementCacheManager">
            <Cache name="AppAuthFrameworkSessionContextCache"
                                                     enable="true" timeout="300" capacity="5000" isDistributed="false"/>
            <Cache name="AuthenticationContextCache" enable="true" timeout="300" capacity="5000" isDistributed="false"/>
            <Cache name="AuthenticationRequestCache" enable="true" timeout="300" capacity="5000" isDistributed="false"/>
            <Cache name="AuthenticationResultCache"  enable="true" timeout="300" capacity="5000" isDistributed="false"/>
            <Cache name="AppInfoCache"               enable="true"  timeout="900" capacity="5000" isDistributed="false"/>
            <Cache name="AuthorizationGrantCache"    enable="true" timeout="300" capacity="5000" isDistributed="false"/>
            <Cache name="OAuthCache"                 enable="true" timeout="300" capacity="5000" isDistributed="false"/>
            <Cache name="OAuthScopeCache"            enable="true"  timeout="300" capacity="5000" isDistributed="false"/>
            <Cache name="OAuthSessionDataCache"      enable="true" timeout="300" capacity="5000" isDistributed="false"/>
            <Cache name="SAMLSSOParticipantCache"    enable="true" timeout="300" capacity="5000" isDistributed="false"/>
            <Cache name="SAMLSSOSessionIndexCache"   enable="true" timeout="300" capacity="5000" isDistributed="false"/>
            <Cache name="SAMLSSOSessionDataCache"    enable="true" timeout="300" capacity="5000" isDistributed="false"/>
            <Cache name="ServiceProviderCache"       enable="true"  timeout="900" capacity="5000" isDistributed="false"/>
            <Cache name="ProvisioningConnectorCache" enable="true"  timeout="900" capacity="5000" isDistributed="false"/>
            <Cache name="ProvisioningEntityCache"    enable="true" timeout="900" capacity="5000" isDistributed="false"/>
            <Cache name="ServiceProviderProvisioningConnectorCache" enable="true"  timeout="900" capacity="5000" isDistributed="false"/>
            <Cache name="IdPCacheByAuthProperty"     enable="true"  timeout="900" capacity="5000" isDistributed="false"/>
            <Cache name="IdPCacheByHRI"              enable="true"  timeout="900" capacity="5000" isDistributed="false"/>
            <Cache name="IdPCacheByName"             enable="true"  timeout="900" capacity="5000" isDistributed="false"/>
        </CacheManager>
    </CacheConfig>

    <!--Cookies>
        <Cookie name="commonAuthId" domain="localhost" httpOnly="true" secure="true" />
    </Cookies-->


    <ResourceAccessControl>
        <Resource context="(.*)/api/identity/user/v1.0/validate-code" secured="true" http-method="all"/>
        <Resource context="(.*)/api/identity/user/v1.0/resend-code" secured="true" http-method="all"/>
        <Resource context="(.*)/api/identity/user/v1.0/me" secured="true" http-method="POST"/>
        <Resource context="(.*)/api/identity/user/v1.0/me" secured="true" http-method="GET"/>
        <Resource context="(.*)/api/identity/user/v1.0/pi-info" secured="true" http-method="all">
            <Permissions>/permission/admin/manage/identity/usermgt/view</Permissions>
        </Resource>
        <Resource context="(.*)/api/identity/user/v1.0/pi-info/(.*)" secured="true" http-method="all">
            <Permissions>/permission/admin/manage/identity/usermgt/view</Permissions>
        </Resource>

        <Resource context="(.*)/api/identity/consent-mgt/v1.0/consents" secured="true" http-method="all"/>
        <Resource context="(.*)/api/identity/consent-mgt/v1.0/consents/receipts/(.*)" secured="true" http-method="all"/>

        <Resource context="(.*)/api/identity/consent-mgt/v1.0/consents/purposes" secured="true" http-method="POST">
            <Permissions>/permission/admin/manage/identity/consentmgt/add</Permissions>
        </Resource>
        <Resource context="(.*)/api/identity/consent-mgt/v1.0/consents/purposes(.*)" secured="true" http-method="GET"/>
        <Resource context="(.*)/api/identity/consent-mgt/v1.0/consents/purposes(.+)" secured="true" http-method="DELETE">
            <Permissions>/permission/admin/manage/identity/consentmgt/delete</Permissions>
        </Resource>

        <Resource context="(.*)/api/identity/consent-mgt/v1.0/consents/pii-categories" secured="true" http-method="POST">
            <Permissions>/permission/admin/manage/identity/consentmgt/add</Permissions>
        </Resource>
        <Resource context="(.*)/api/identity/consent-mgt/v1.0/consents/pii-categories(.*)" secured="true" http-method="GET"/>
        <Resource context="(.*)/api/identity/consent-mgt/v1.0/consents/pii-categories(.+)" secured="true" http-method="DELETE">
            <Permissions>/permission/admin/manage/identity/consentmgt/delete</Permissions>
        </Resource>

        <Resource context="(.*)/api/identity/consent-mgt/v1.0/consents/purpose-categories" secured="true" http-method="POST">
            <Permissions>/permission/admin/manage/identity/consentmgt/add</Permissions>
        </Resource>
        <Resource context="(.*)/api/identity/consent-mgt/v1.0/consents/purpose-categories(.*)" secured="true" http-method="GET"/>
        <Resource context="(.*)/api/identity/consent-mgt/v1.0/consents/purpose-categories(.+)" secured="true" http-method="DELETE">
            <Permissions>/permission/admin/manage/identity/consentmgt/delete</Permissions>
        </Resource>

        <Resource context="(.*)/api/identity/recovery/(.*)" secured="true" http-method="all"/>
        <Resource context="(.*)/.well-known(.*)" secured="true" http-method="all"/>
        <Resource context="(.*)/api/identity/oauth2/dcr/v1.0/register(.*)" secured="true" http-method="POST">
            <Permissions>/permission/admin/manage/identity/applicationmgt/create</Permissions>
        </Resource>
        <Resource context="(.*)/api/identity/oauth2/dcr/v1.0/register(.*)" secured="true" http-method="DELETE">
            <Permissions>/permission/admin/manage/identity/applicationmgt/delete</Permissions>
        </Resource>
        <Resource context="(.*)/api/identity/oauth2/dcr/v1.0/register(.*)" secured="true" http-method="PUT">
            <Permissions>/permission/admin/manage/identity/applicationmgt/update</Permissions>
        </Resource>
        <Resource context="(.*)/api/identity/oauth2/dcr/v1.0/register(.*)" secured="true" http-method="GET">
            <Permissions>/permission/admin/manage/identity/applicationmgt/view</Permissions>
        </Resource>
        <Resource context="(.*)/identity/register(.*)" secured="true" http-method="all">
            <Permissions>/permission/admin/manage/identity/applicationmgt/delete</Permissions>
        </Resource>
        <Resource context="(.*)/identity/connect/register(.*)" secured="true" http-method="all">
            <Permissions>/permission/admin/manage/identity/applicationmgt/create</Permissions>
        </Resource>
        <Resource context="(.*)/oauth2/introspect(.*)" secured="true" http-method="all">
            <Permissions>/permission/admin/manage/identity/applicationmgt/view</Permissions>
        </Resource>
        <Resource context="(.*)/api/identity/entitlement/(.*)" secured="true" http-method="all">
            <Permissions>/permission/admin/manage/identity/pep</Permissions>
        </Resource>
        <Resource context="(.*)/scim2/Users" secured="true" http-method="POST">
            <Permissions>/permission/admin/manage/identity/usermgt/create</Permissions>
        </Resource>
        <Resource context="(.*)/scim2/Users" secured="true" http-method="GET">
            <Permissions>/permission/admin/manage/identity/usermgt/list</Permissions>
        </Resource>
        <Resource context="(.*)/scim2/Groups" secured="true" http-method="POST">
            <Permissions>/permission/admin/manage/identity/rolemgt/create</Permissions>
        </Resource>
        <Resource context="(.*)/scim2/Groups" secured="true" http-method="GET">
            <Permissions>/permission/admin/manage/identity/rolemgt/view</Permissions>
        </Resource>
        <Resource context="(.*)/scim2/Users/(.*)" secured="true" http-method="GET">
            <Permissions>/permission/admin/manage/identity/usermgt/view</Permissions>
        </Resource>
        <Resource context="(.*)/scim2/Users/(.*)" secured="true" http-method="PUT">
            <Permissions>/permission/admin/manage/identity/usermgt/update</Permissions>
        </Resource>
        <Resource context="(.*)/scim2/Users/(.*)" secured="true" http-method="PATCH">
            <Permissions>/permission/admin/manage/identity/usermgt/update</Permissions>
        </Resource>
        <Resource context="(.*)/scim2/Users/(.*)" secured="true" http-method="DELETE">
            <Permissions>/permission/admin/manage/identity/usermgt/delete</Permissions>
        </Resource>
        <Resource context="(.*)/scim2/Groups/(.*)" secured="true" http-method="GET">
            <Permissions>/permission/admin/manage/identity/rolemgt/view</Permissions>
        </Resource>
        <Resource context="(.*)/scim2/Groups/(.*)" secured="true" http-method="PUT">
            <Permissions>/permission/admin/manage/identity/rolemgt/update</Permissions>
        </Resource>
        <Resource context="(.*)/scim2/Groups/(.*)" secured="true" http-method="PATCH">
            <Permissions>/permission/admin/manage/identity/rolemgt/update</Permissions>
        </Resource>
        <Resource context="(.*)/scim2/Groups/(.*)" secured="true" http-method="DELETE">
            <Permissions>/permission/admin/manage/identity/rolemgt/delete</Permissions>
        </Resource>
        <Resource context="(.*)/scim2/Me" secured="true"    http-method="GET">
            <Permissions>/permission/admin/login</Permissions>
        </Resource>
        <Resource context="(.*)/scim2/Me" secured="true" http-method="DELETE">
            <Permissions>/permission/admin/manage/identity/usermgt/delete</Permissions>
        </Resource>
        <Resource context="(.*)/scim2/Me" secured="true"    http-method="PUT">
            <Permissions>/permission/admin/login</Permissions>
        </Resource>
        <Resource context="(.*)/scim2/Me" secured="true"   http-method="PATCH">
            <Permissions>/permission/admin/login</Permissions>
        </Resource>
        <Resource context="(.*)/scim2/Me" secured="true" http-method="POST">
            <Permissions>/permission/admin/manage/identity/usermgt/create</Permissions>
        </Resource>
        <Resource context="/scim2/ServiceProviderConfig" secured="false" http-method="all">
            <Permissions></Permissions>
        </Resource>
        <Resource context="/scim2/ResourceType" secured="false" http-method="all">
            <Permissions></Permissions>
        </Resource>
        <Resource context="/scim2/Bulk" secured="true"  http-method="all">
            <Permissions>/permission/admin/manage/identity/usermgt</Permissions>
        </Resource>
        <Resource context="(.*)/api/identity/oauth2/dcr/(.*)" secured="true" http-method="all">
            <Permissions>/permission/admin/manage/identity/applicationmgt</Permissions>
        </Resource>
    </ResourceAccessControl>

    <ClientAppAuthentication>
        <Application name="dashboard" hash="66cd9688a2ae068244ea01e70f0e230f5623b7fa4cdecb65070a09ec06452262"/>
    </ClientAppAuthentication>

    <TenantContextsToRewrite>
        <WebApp>
            <Context>/api/identity/user/v1.0/</Context>
            <Context>/api/identity/consent-mgt/v1.0/</Context>
            <Context>/api/identity/recovery/v0.9/</Context>
            <Context>/oauth2/</Context>
            <Context>/scim2/</Context>
            <Context>/api/identity/entitlement/</Context>
            <Context>/api/identity/oauth2/dcr/v1.0/</Context>
        </WebApp>
        <Servlet>
            <Context>/identity/(.*)</Context>
        </Servlet>
    </TenantContextsToRewrite>

    <!-- Server Synchronization Tolerance Configuration in seconds -->
    <ClockSkew>300</ClockSkew>
</Server>
