#################################
# LDAP Proxy configuration file #
#################################

# Once complete, you must rename this file as config.properties

####################################
# LDAP PROXY CONFIGURATION SECTION #
####################################
# Listening IP adresses used by the LDAP proxy
# List of IP/hostname separated by ";"
# All local addresses by default
#ldap.proxy.addresses=

# Listening port for the LDAP proxy
ldap.proxy.port=389

# Listening port for the LDAP proxy to handle LDAPS requests
#ldap.proxy.ssl.port=636

# LDAP server address/hostname
ldap.host=

# LDAP server port
# Required if ldap.proxy.port is set
ldap.port=389

# LDAPS server port
#ldap.ssl.port=636

# full path to a p12 certificate associated with the LDAP
#ldap.proxy.ssl.certificate.path=

# LDAP certificate passphrase
#ldap.proxy.ssl.certificate.passphrase=

# Mode of server certificate verification
# none by default
#   jvm      : use the JVM keystore
#   none     : trust all server certificates
#   keystore : use a specific keystore define by ldap.ssl.certificate.keystore et ldap.ssl.certificate.passphrase
#ldap.ssl.certificate.verification.mode=

# The path of the keystore to use when ldap.ssl.certificate.verification.mode=keystore
#ldap.ssl.certificate.keystore.path=

# The keystore pass associated to ldap.ssl.certificate.keystore.path
#ldap.ssl.certificate.keystore.passphrase=

# Protocol used for requesting the LDAP proxy
# default is TLS
#ldap.proxy.cipher.protocol=

# Protocol used by the LDAP proxy to request the LDAP
# default is TLSv1
proxy.cipher.protocol=TLSv1.2

# Request timeout between proxy and LDAP server ( in ms )
# default 0 ( no timeout )
#ldap.proxy.request.timeout=

# Timeout of proxy requests ( in ms )
# default 10000 ( 10sc )
#ldap.proxy.connect.timeout=

# Configures the connection factory to periodically send "heart-beat" or "keep-alive" requests to the Directory Server.
# Possible values : true | false
# default is false (no heartbeat)
#ldap.proxy.heartbeat.enabled=

# Specifies the time between successive heart-beat requests
# default 10000 (10s)
#ldap.proxy.heartbeat.interval=

# Specifies the timeout for heart-beat requests, after which the remote Directory Server will be deemed to be unavailable
# default 3000 (3s)
#ldap.proxy.heartbeat.timeout=


# Number of thread used for handle LDAP request
# This value define the number of simultaneous request that the LDAP proxy can perform
# The default value is depending of the hardware (It's the maximum between 2 and the available processors / 2 )
#ldap.proxy.selector.thread.count=

# The maximum number of simultaneous push request that can handle the ldap proxy
# This value must be gretter or equal to 1
# The default value is 100
#ldap.proxy.max.simultaneous.push=

# LDAP attribute for user login (will be matched with InWebo login)
# uid by default
ldap.proxy.login.attribute=samaccountname

# Condition to authenticate users with InWebo
# all by default
#   all      : all user will be authenticated with inWebo
#   none     : no user will be authenticated with inWebo (transparent)
#   user     : user group membership. Based on the group list the user is member of
#   group    : user group membership. Based on the group member list
#ldap.proxy.do.step.up.by.type=all

# LDAP group DN for which members will be required to authenticate with inWebo. Required if ldap.proxy.do.step.up.by.type is set to "user" or "group"
#ldap.proxy.do.step.up.group.base.dn=

# LDAP attribute for group members. Required when ldap.proxy.do.step.up.by.type = group
# member by default
#ldap.proxy.do.step.up.lookup.member.attribute=

# LDAP attribute for group list. Required when ldap.proxy.do.step.up.by.type = user
# isMemberOf by default. Use memberOf for AD
#ldap.proxy.do.step.up.lookup.ismemberof.attribute=

# LDAP objectClass attribute used to define a group
# groupOfNames by default
#ldap.proxy.do.step.up.filter.group.object.class=

# LDAP objectClass attribute used to define a user
# person by default
#ldap.proxy.do.step.up.filter.user.object.class=

# Bypass inWebo authentification for a list of users (usefull for technical accounts)
# DN list separated by ";"
#ldap.proxy.whitelist.dn=

################################################################
# Parameters to enable simple login like sAMAccountName or UPN #
################################################################

# LOGIN -> DN Resolution
# When a client sends a simple login (e.g. "jsmith" or "sAMAccountName") instead of a full DN,
# the proxy searches the directory to resolve it to a DN before forwarding the bind.

# base DN for the user search (required to enable resolution)
#ldap.proxy.user.search.base.dn=

# LDAP attribute to search with the incoming login (default: value from parameter ldap.proxy.login.attribute)
#ldap.proxy.user.search.attribute=

# Admin account for PRE-BIND search (required for LOGIN -> DN Resolution)
# The proxy opens a dedicated connection (separate from the user bind connection) to perform
# directory searches during login resolution. Configure an admin account here if the
# backend LDAP server does not allow anonymous searches (e.g. Active Directory).
# If omitted, searches are attempted anonymously.
#ldap.search.admin.dn=
#ldap.search.admin.password=

# 16 characters key used to cipher logins
# No cipher by default
#inwebo.cipher.aes.secret.key=

##########################################
# TrustBuilder MFA CONFIGURATION SECTION #
##########################################

# TrustBuilder MFA API URL
# https://api.myinwebo.com/FS by default
#inwebo.base.url=

# TrustBuilder MFA service ID - Required.
inwebo.service.id=

# Full path to the p12 certificate associated with the TrustBuilder MFA service - Required.
inwebo.service.certificate.path=

# TrustBuilder MFA certificate passphrase - Required.
inwebo.service.certificate.passphrase=

# TrustBuilder MFA checkPushResult request interval (the default value is 1000 milliseconds).
# inwebo.push.poll.interval=1000

# TrustBuilder MFA Client HTTP timeout in second (the default value is 30 seconds).
#inwebo.client.http.timeout=30

# The maximum number of connections allowed across all routes. (the default value is 100).
#inwebo.pool.http.max.total=100

# The maximum number of connections allowed for a route that has not been specified. (the default value is 40).
#inwebo.pool.http.default.max.per.route=40

# Force ldap-proxy to contact TrustBuilder MFA through an http or https proxy.
# HTTP proxy host used to call TrustBuilder MFA API.
# No HTTP proxy by default
#inwebo.proxy.host=hostname_or_ip

# The HTTP proxy port
#inwebo.proxy.port=port

# Use HTTPS to proxy:
# * false - http only (http://hostname:port) - default value.
# * true - https only (https://hostname:port).
#inwebo.proxy.https=true

# The HTTP proxy login - Optional
#inwebo.proxy.username=proxy_user_login

# The HTTP proxy password - Optional
#inwebo.proxy.password=proxy_user_password
