<?xml version="1.0" encoding="UTF-8"?>
<!--
 ~ Copyright (c) 2023, WSO2 LLC. (https://www.wso2.com).
 ~
 ~ WSO2 LLC. licenses this file to you under the Apache License,
 ~ Version 2.0 (the "License"); you may not use this file except
 ~ in compliance with the License.
 ~ You may obtain a copy of the License at
 ~
 ~     http://www.apache.org/licenses/LICENSE-2.0
 ~
 ~ Unless required by applicable law or agreed to in writing,
 ~ software distributed under the License is distributed on an
 ~ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 ~ KIND, either express or implied. See the License for the
 ~ specific language governing permissions and limitations
 ~ under the License.
 -->

<Server xmlns="http://wso2.org/projects/carbon/open-banking.xml" xmlns:svns="http://org.wso2.securevault/configuration">

    <JDBCPersistenceManager>
        <DataSource>
            <!-- Include a data source name (jndiConfigName) from the set of data
                sources defined in master-datasources.xml -->
            <Name>jdbc/WSO2OB_DB</Name>
        </DataSource>
        <!-- The time for the driver to verify the database connection in seconds -->
        <ConnectionVerificationTimeout>1</ConnectionVerificationTimeout>
    </JDBCPersistenceManager>

    <Identity>
        <Extensions>
            <RequestObjectValidator>
                com.wso2.openbanking.accelerator.identity.auth.extensions.request.validator.OBRequestObjectValidator
            </RequestObjectValidator>
            <ClaimProvider>com.wso2.openbanking.accelerator.identity.claims.OBDefaultClaimProvider</ClaimProvider>
            <IntrospectionDataProvider>com.wso2.openbanking.accelerator.identity.interceptor.OBDefaultIntrospectionDataProvider</IntrospectionDataProvider>
            <ResponseTypeHandler>
                com.wso2.openbanking.accelerator.identity.auth.extensions.response.handler.impl.OBDefaultResponseTypeHandlerImpl
            </ResponseTypeHandler>
        </Extensions>
        <Filters>
            <TokenFilter>com.wso2.openbanking.accelerator.identity.token.DefaultTokenFilter</TokenFilter>
        </Filters>
        <TokenFilterValidators>
            <Validator>com.wso2.openbanking.accelerator.identity.token.validators.MTLSEnforcementValidator</Validator>
            <Validator>com.wso2.openbanking.accelerator.identity.token.validators.SignatureAlgorithmEnforcementValidator</Validator>
            <Validator>com.wso2.openbanking.accelerator.identity.token.validators.ClientAuthenticatorValidator</Validator>
        </TokenFilterValidators>
        <AuthenticationWebApp>
            <ServletExtension>com.wso2.openbanking.accelerator.consent.extensions.authservlet.impl.OBDefaultAuthServletImpl</ServletExtension>
        </AuthenticationWebApp>
        <ApplicationInformationEndpoint>
            <SPMetadataFilterExtension>
                com.wso2.openbanking.accelerator.identity.sp.metadata.extension.impl.DefaultSPMetadataFilter
            </SPMetadataFilterExtension>
        </ApplicationInformationEndpoint>
        <Cache>
            <IdentityCache>
                <CacheAccessExpiry>60</CacheAccessExpiry>
                <CacheModifiedExpiry>60</CacheModifiedExpiry>
            </IdentityCache>
        </Cache>
        <MutualTLS>
            <TransportCertificateJWKS>software_jwks_endpoint</TransportCertificateJWKS>
        </MutualTLS>
    </Identity>
    <Consent>
        <PeriodicalExpiration>
            <Enabled>false</Enabled>
            <CronValue>0 0 0 * * ?</CronValue>
            <ExpiredConsentStatusValue>Expired</ExpiredConsentStatusValue>
            <EligibleStatuses>authorised</EligibleStatuses>
        </PeriodicalExpiration>
        <AuthorizeSteps>
            <Retrieve>
                <Step class="com.wso2.openbanking.accelerator.consent.extensions.authorize.impl.NonRegulatoryConsentStep" priority="1"/>
                <Step class="com.wso2.openbanking.accelerator.consent.extensions.authorize.impl.DefaultConsentRetrievalStep" priority="2"/>
            </Retrieve>
            <Persist>
                <Step class="com.wso2.openbanking.accelerator.consent.extensions.authorize.impl.DefaultConsentPersistStep" priority="1"/>
            </Persist>
        </AuthorizeSteps>
        <ManageHandler>com.wso2.openbanking.accelerator.consent.extensions.manage.impl.DefaultConsentManageHandler</ManageHandler>
        <Validation>
            <Validator>com.wso2.openbanking.accelerator.consent.extensions.validate.impl.DefaultConsentValidator</Validator>
            <RequestSignatureAlias>apim</RequestSignatureAlias>
            <JWTPayloadValidation>true</JWTPayloadValidation>
        </Validation>
        <AdminHandler>com.wso2.openbanking.accelerator.consent.extensions.admin.impl.DefaultConsentAdminHandler</AdminHandler>
    </Consent>
    <DCR>
        <Validator>com.wso2.openbanking.accelerator.identity.dcr.validation.DefaultRegistrationValidatorImpl</Validator>
        <JwksUrlSandbox>https://keystore.openbankingtest.org.uk/0015800001HQQrZAAX/9b5usDpbNtmxDcTzs7GzKp.jwks</JwksUrlSandbox>
        <JwksUrlProduction>https://keystore.openbanking.org.uk/keystore/openbanking.jwks</JwksUrlProduction>
        <ModifyResponse>false</ModifyResponse>
        <Scope>cdr-registration</Scope>
        <RegistrationClientURI>https://gateway/register/</RegistrationClientURI>
        <JWKS-Retriever>
            <ConnectionTimeout>0</ConnectionTimeout>
            <ReadTimeout>0</ReadTimeout>
        </JWKS-Retriever>
        <RegulatoryIssuers>
            <Issuer>OpenBanking Ltd</Issuer>
            <Issuer>CDR</Issuer>
        </RegulatoryIssuers>
        <ApplicationUpdaterImpl>com.wso2.openbanking.accelerator.identity.listener.application.ApplicationUpdaterImpl</ApplicationUpdaterImpl>
        <RegistrationRequestParams>
            <GrantTypes>
                <Required>true</Required>
            </GrantTypes>
            <ResponseTypes>
                <Required>false</Required>
            </ResponseTypes>
            <Issuer>
                <Required>true</Required>
            </Issuer>
            <Audience>
                <Required>true</Required>
            </Audience>
            <SoftwareStatement>
                <Required>true</Required>
            </SoftwareStatement>
            <TokenEndPointAuthentication>
                <Required>true</Required>
            </TokenEndPointAuthentication>
            <IdTokenSignedResponseAlg>
                <Required>true</Required>
            </IdTokenSignedResponseAlg>
            <CallbackUris>
                <Required>false</Required>
            </CallbackUris>
            <TokenEndPointAuthSigningAlg>
                <Required>false</Required>
            </TokenEndPointAuthSigningAlg>
            <SoftwareId>
                <Required>false</Required>
            </SoftwareId>
            <Scope>
                <Required>false</Required>
            </Scope>
            <ApplicationType>
                <Required>false</Required>
            </ApplicationType>
            <IdTokenEncryptionResponseAlg>
                <Required>false</Required>
            </IdTokenEncryptionResponseAlg>
            <IdTokenEncryptionResponseEnc>
                <Required>false</Required>
            </IdTokenEncryptionResponseEnc>
            <RequestObjectSigningAlg>
                <Required>false</Required>
            </RequestObjectSigningAlg>
            <TLSClientAuthSubjectDn>
                <Required>false</Required>
            </TLSClientAuthSubjectDn>
            <BackchannelTokenDeliveryMode>
                <Required>false</Required>
            </BackchannelTokenDeliveryMode>
            <BackchannelAuthenticationRequestSigningAlg>
                <Required>false</Required>
            </BackchannelAuthenticationRequestSigningAlg>
            <BackchannelClientNotificationEndpoint>
                <Required>false</Required>
            </BackchannelClientNotificationEndpoint>
            <BackchannelUserCodeParameterSupported>
                <Required>false</Required>
            </BackchannelUserCodeParameterSupported>
        </RegistrationRequestParams>
    </DCR>
    <SignatureValidation>
        <AllowedAlgorithms>
            <Algorithm>PS256</Algorithm>
            <Algorithm>ES256</Algorithm>
        </AllowedAlgorithms>
    </SignatureValidation>
    <DataPublishing>
        <Enabled>true</Enabled>
        <Username>admin</Username>
        <Password>admin</Password>
        <ServerURL>{tcp://localhost:7612}</ServerURL>
        <AuthURL></AuthURL>
        <!-- Allowed values: Thrift -->
        <Protocol>Thrift</Protocol>
        <PoolSize>10</PoolSize>
        <QueueSize>32768</QueueSize>
        <WorkerThreadCount>10</WorkerThreadCount>
        <PoolWaitTimeMs>60000</PoolWaitTimeMs>
        <OpenBankingDataPublisher>com.wso2.openbanking.accelerator.data.publisher.common.OBThriftDataPublisher</OpenBankingDataPublisher>
        <Thrift>
            <PublishingTimeout>2000</PublishingTimeout>
            <Streams>
                <APIInputStream>
                    <Attribute name="consentId" priority="1"/>
                    <Attribute name="userId" priority="2"/>
                    <Attribute name="clientId" priority="3"/>
                    <Attribute name="userAgent" priority="4"/>
                    <Attribute name="statusCode" priority="5"/>
                    <Attribute name="statusMessage" priority="6"/>
                    <Attribute name="httpMethod" priority="7"/>
                    <Attribute name="responsePayloadSize" priority="8"/>
                    <Attribute name="electedResource" priority="9"/>
                    <Attribute name="apiName" priority="10"/>
                    <Attribute name="apiSpecVersion" priority="11"/>
                    <Attribute name="timestamp" priority="12"/>
                </APIInputStream>
                <AuthenticationInputStream>
                    <Attribute name="userId" priority="1"/>
                    <Attribute name="authenticationStep" priority="2"/>
                    <Attribute name="authenticationStatus" priority="3"/>
                    <Attribute name="authenticationApproach" priority="4"/>
                    <Attribute name="psuChannel" priority="5"/>
                    <Attribute name="timestamp" priority="6"/>
                </AuthenticationInputStream>
                <AccessTokenInputStream>
                    <Attribute name="accessToken" priority="1"/>
                </AccessTokenInputStream>
            </Streams>
        </Thrift>
        <AuthDataPublisher>com.wso2.openbanking.accelerator.authentication.data.publisher.extension.DefaultAuthDataPublisher</AuthDataPublisher>
    </DataPublishing>
    <SCA>
        <PrimaryAuthenticator>
            <Name>BasicAuthenticator</Name>
            <DisplayName>basic</DisplayName>
        </PrimaryAuthenticator>
        <IdpName>SMSAuthentication</IdpName>
    </SCA>
    <HTTPConnectionPool>
        <MaxConnections>2000</MaxConnections>
        <MaxConnectionsPerRoute>1500</MaxConnectionsPerRoute>
    </HTTPConnectionPool>
    <PSUFederatedAuthentication>
        <Enabled>false</Enabled>
        <IDPName></IDPName>
    </PSUFederatedAuthentication>
</Server>
