#================configs related to carbon.xml=============
[server]
hostname = "IS_HOSTNAME"
node_ip = "127.0.0.1"
base_path = "https://$ref{server.hostname}:${carbon.management.port}"
serverDetails = "WSO2 IS as KM 5.11.0"
mode = "single"
userAgent = "WSO2 IS as KM 5.11.0"
offset = 3

[keystore.primary]
name = "wso2carbon.jks"
password = "wso2carbon"

[tenant_mgt]
enable_email_domain = true

#================configs related to user-mgt.xml=============

[super_admin]
username = "admin@wso2.com"
password = "wso2123"
create_admin_account = true

[realm_manager]
data_source= "WSO2USER_DB"

[user_store]
type = "database_unique_id"
class = "org.wso2.carbon.user.core.jdbc.UniqueIDJDBCUserStoreManager"

[user_store.properties]
UsernameJavaRegEx = "a-zA-Z0-9@._-{3,30}$"
UsernameJavaScriptRegEx = "^[a-zA-Z0-9._-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,4}$"
SCIMEnabled = false
IsBulkImportSupported = false
LeadingOrTrailingSpaceAllowedInUserName = false
UsernameWithEmailJavaScriptRegEx = "^[\\S]{3,30}$"

[authorization_manager]
class = "org.wso2.carbon.user.core.authorization.JDBCAuthorizationManager"

[authorization_manager.properties]
AdminRoleManagementPermissions = "/permission"
AuthorizationCacheEnabled = true
GetAllRolesOfUserEnabled = false

#================configs related to master-datasources.xml=============

# for registry data
[database.shared_db]
url = "DB_GOV_URL"
username = "DB_USER"
password = "DB_PASS"
driver = "DB_DRIVER"

[database.shared_db.pool_options]
maxActive = "150"
maxWait = "60000"
minIdle ="5"
testOnBorrow = true
validationQuery="SELECT 1"
#Use below for oracle
#validationQuery="SELECT 1 FROM DUAL"
validationInterval="30000"
defaultAutoCommit=false

# for api manager data
[database.identity_db]
url = "DB_APIMGT_URL"
username = "DB_USER"
password = "DB_PASS"
driver = "DB_DRIVER"

[database.identity_db.pool_options]
maxActive = "150"
maxWait = "60000"
minIdle ="5"
testOnBorrow = true
validationQuery="SELECT 1"
#Use below for oracle
#validationQuery="SELECT 1 FROM DUAL"
validationInterval="30000"
defaultAutoCommit=false

# for km-config registry
[database.config]
url = "DB_IS_CONFIG_URL"
username = "DB_USER"
password = "DB_PASS"
driver = "DB_DRIVER"

[database.config.pool_options]
maxActive = "150"
maxWait = "60000"
minIdle ="5"
testOnBorrow = true
validationQuery="SELECT 1"
#Use below for oracle
#validationQuery="SELECT 1 FROM DUAL"
validationInterval="30000"
defaultAutoCommit=false

# for user-mgt data
[database.user]
url = "DB_USER_STORE_URL"
username = "DB_USER"
password = "DB_PASS"
driver = "DB_DRIVER"

[database.user.pool_options]
maxActive = "150"
maxWait = "60000"
minIdle ="5"
testOnBorrow = true
validationQuery="SELECT 1"
#Use below for oracle
#validationQuery="SELECT 1 FROM DUAL"
validationInterval="30000"
defaultAutoCommit=false

# for Open Banking  data
[[datasource]]
id="WSO2OB_DB"
url = "DB_OB_STORE_URL"
username = "DB_USER"
password = "DB_PASS"
driver = "DB_DRIVER"
jmx_enable=false
pool_options.maxActive = "150"
pool_options.maxWait = "60000"
pool_options.minIdle = "5"
pool_options.testOnBorrow = true
pool_options.validationQuery="SELECT 1"
#Use below for oracle
#validationQuery="SELECT 1 FROM DUAL"
pool_options.validationInterval="30000"
pool_options.defaultAutoCommit=false

#================configs related to application-authentication.xml=============

[authentication.endpoints]
login_url = "https://IS_HOSTNAME:9446/authenticationendpoint/login.do"
retry_url = "https://IS_HOSTNAME:9446/authenticationendpoint/retry.do"

[authentication.endpoint.redirect_params]
filter_policy = "include"
remove_on_consume_from_api = "true"
parameters = ["sessionDataKeyConsent","relyingParty", "authenticators", "authFailureMsg", "authFailure"]

[authentication.authenticator.sms_otp.parameters]
EnableAccountLockingForFailedAttempts = true
BackupCode = false
TokenExpiryTime = 60

[[authentication.custom_authenticator]]
name = "IdentifierExecutor"
parameters.ValidateUsername = true
parameters.throttleLimit = 3
parameters.throttleTimePeriod = 300
parameters.authRequestURL = "https://IS_HOSTNAME:9446/api/identity/auth/v1.1/data/AuthRequestKey/"


#================configs related to identity.xml=============

[identity_data_source]
skip_db_schema_creation = true

[oauth]
allowed_scopes = ["consent.*"]

[oauth.token_renewal]
renew_refresh_token = false

[oauth.endpoints]
oauth2_consent_page = "${carbon.protocol}://IS_HOSTNAME:${carbon.management.port}/ob/authenticationendpoint/oauth2_authz.do"
oidc_consent_page = "${carbon.protocol}://IS_HOSTNAME:${carbon.management.port}/ob/authenticationendpoint/oauth2_consent.do"

[oauth.response_type]
token.enable = true
code.enable = false
id_token.enable = true
id_token_token.enable = false
device.enable = true

[[oauth.custom_response_type]]
name = "code"
class = "com.wso2.openbanking.accelerator.identity.auth.extensions.response.handler.OBCodeResponseTypeHandlerExtension"
validator = "com.wso2.openbanking.accelerator.identity.auth.extensions.response.validator.OBCodeResponseTypeValidator"

[[oauth.custom_response_type]]
name = "code id_token"
class = "com.wso2.openbanking.accelerator.identity.auth.extensions.response.handler.OBHybridResponseTypeHandlerExtension"
validator = "com.wso2.openbanking.accelerator.identity.auth.extensions.response.validator.OBHybridResponseTypeValidator"

[[event_listener]]
id = "token_revocation"
type = "org.wso2.carbon.identity.core.handler.AbstractIdentityHandler"
name = "org.wso2.is.notification.ApimOauthEventInterceptor"
order = 1

[event_listener.properties]
PreventTokenReuse= false
RejectBeforeInMinutes= "100"
TokenEndpointAlias= "https://IS_HOSTNAME:9446/oauth2/token"
notification_endpoint = "https://APIM_HOSTNAME:9443/internal/data/v1/notify"
username = "${admin.username}"
password = "${admin.password}"
'header.X-WSO2-KEY-MANAGER' = "WSO2-IS"

[[event_listener]]
id = "ob_private_key_jwt_authenticator"
type = "org.wso2.carbon.identity.core.handler.AbstractIdentityHandler"
name = "com.wso2.openbanking.accelerator.identity.clientauth.jwt.OBPrivateKeyJWTClientAuthenticator"
order = "897"
enable = true

[event_listener.properties]
ParEndpointAlias = "https://IS_HOSTNAME:9446/api/openbanking/push-authorization/par"

[event.default_listener.mutual_tls_authenticator]
enable = false

[[event_listener]]
id = "ob_mutual_tls_authenticator"
type = "org.wso2.carbon.identity.core.handler.AbstractIdentityHandler"
name = "com.wso2.openbanking.accelerator.identity.clientauth.OBMutualTLSClientAuthenticator"
order = "898"
enable = true

[[event_listener]]
id = "private_key_jwt_authenticator"
type = "org.wso2.carbon.identity.core.handler.AbstractIdentityHandler"
name = "org.wso2.carbon.identity.oauth2.token.handler.clientauth.jwt.PrivateKeyJWTClientAuthenticator"
order = "899"
enable = false

[oauth.grant_type]
iwa_ntlm.enable = false
jwt_bearer.enable = true

[identity_mgt.user_self_registration]
allow_self_registration = true

[[resource.access_control]]
context = "(.)/keymanager-operations/user-info/claims(.)"
secure = true
http_method = "GET"
permissions = "/permission/admin/manage/identity/usermgt/list"
scopes = "internal_user_mgt_list"

[[resource.access_control]]
context = "(.*)/keymanager-operations/user-info/claims/generate"
secure = true
http_method = "POST"
permissions = "/permission/admin/manage/identity/usermgt/list"
scopes = "internal_user_mgt_list"

[[resource.access_control]]
context = "(.*)/keymanager-operations/dcr/register"
secure = true
http_method = "POST"
permissions = "/permission/admin/manage/identity/applicationmgt/create"
scopes = "internal_application_mgt_create"

[[resource.access_control]]
context = "(.*)/keymanager-operations/dcr/register(.*)"
secure = true
http_method = "GET"
permissions = "/permission/admin/manage/identity/applicationmgt/view"
scopes = "internal_application_mgt_view"

[[resource.access_control]]
context = "(.*)/keymanager-operations/dcr/register(.*)"
secure = true
http_method = "DELETE"
permissions = "/permission/admin/manage/identity/applicationmgt/delete"
scopes = "internal_application_mgt_delete"

[[resource.access_control]]
context = "(.*)/keymanager-operations/dcr/register(.*)"
secure = true
http_method = "PUT"
permissions = "/permission/admin/manage/identity/applicationmgt/update"
scopes = "internal_application_mgt_update"

[[resource.access_control]]
context = "(.)/keymanager-operations/dcr/register(.)"
secure = true
http_method = "POST"
permissions = "/permission/admin/manage/identity/applicationmgt/update"
scopes = "internal_application_mgt_update"

[[resource.access_control]]
context = "(.*)/openbanking/dynamic-client-registration/(.*)"
secure="true"
http_method="all"
permissions=["/permission/admin"]
allowed_auth_handlers = ["BasicAuthentication"]

[[resource.access_control]]
context = "(.*)/api/openbanking/push-authorization/(.*)"
secure="false"
http_method="all"
permissions=["/permission/admin"]

[[resource.access_control]]
context = "(.*)/api/openbanking/event-notifications/(.*)"
secure="true"
http_method="all"
permissions=["/permission/admin"]
allowed_auth_handlers = ["BasicAuthentication"]

[[resource.access_control]]
context = "(.*)/api/openbanking/consent/(.*)"
secure="true"
http_method="all"
permissions=["/permission/admin"]
allowed_auth_handlers = ["BasicAuthentication"]

[[resource.access_control]]
context = "(.*)/consentmgr(.*)"
secure="false"
http_method="GET, DELETE"

[[resource.access_control]]
context = "(.*)/api/openbanking/application/(.*)"
secure="false"
http_method="GET"

[authentication.adaptive.event_publisher]
url = "http://IS_HOSTNAME:8006/"

[tenant_context.rewrite]
custom_webapps = ["/keymanager-operations/"]

[oauth.mutualtls]
client_certificate_header = "x-wso2-mutual-auth-cert"

[oauth.oidc.id_token]
signature_algorithm = "SHA256withPS"

[oauth.token.validation]
include_validation_context_as_jwt_in_reponse = "true"
validation_response_signing_algorithm = "SHA256withRSA"
validation_response_jwt_validity = "15m"

[oauth.extensions]
token_context_generator = "org.wso2.carbon.identity.oauth2.authcontext.JWTTokenGenerator"
token_context_claim_retriever = "org.wso2.carbon.identity.oauth2.authcontext.DefaultClaimsRetriever"
token_context_dialect_uri = "http://wso2.org/claims"

[oauth.token_generation]
access_token_type = "self_contained"

[oauth.grant_type.uma_ticket]
retrieve_uma_permission_info_through_introspection = true

[oauth.grant_type.refresh_token]
enable=true
grant_handler="com.wso2.openbanking.accelerator.identity.grant.type.handlers.OBRefreshGrantHandler"

[oauth.grant_type.authorization_code]
enable=true
grant_handler="com.wso2.openbanking.accelerator.identity.grant.type.handlers.OBAuthorizationCodeGrantHandler"

[oauth.grant_type.password]
enable=true
grant_handler="com.wso2.openbanking.accelerator.identity.grant.type.handlers.OBPasswordGrantHandler"

[oauth.grant_type.client_credentials]
enable=true
grant_handler="com.wso2.openbanking.accelerator.identity.grant.type.handlers.OBClientCredentialsGrantHandler"

[oauth.oidc.extensions]
claim_callback_handler="com.wso2.openbanking.accelerator.identity.claims.OBDefaultOIDCClaimsCallbackHandler"
request_object_validator = "com.wso2.openbanking.accelerator.identity.auth.extensions.request.validator.OBRequestObjectValidationExtension"
oauth_authz_request_class = "com.wso2.openbanking.accelerator.identity.auth.extensions.authz.request.OBOAuthAuthzRequest"

[[oauth.oidc.custom_request_object_builder]]
type = "request_uri_param_value_builder"
class = "com.wso2.openbanking.accelerator.identity.builders.DefaultOBRequestUriRequestObjectBuilder"

[transport.https.sslHostConfig.properties]
ciphers="TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"

#================configs related to identity-event.properties=============

[[event_handler]]
name="userPostSelfRegistration"
subscriptions=["POST_ADD_USER"]

#================configs related to open-banking.xml=============

[open_banking]
username="$ref{super_admin.username}"
password="$ref{super_admin.password}"

[[open_banking.jdbc_persistence_manager]]
data_source.name = "WSO2OB_DB"
connection_verification_timeout=1

#=======================dcr configs======================
[open_banking.dcr]
validator = "com.wso2.openbanking.accelerator.identity.dcr.validation.DefaultRegistrationValidatorImpl"
jwks_url_sandbox = "https://keystore.openbankingtest.org.uk/0015800001HQQrZAAX/0015800001HQQrZAAX.jwks"
jwks_url_production = "https://keystore.openbankingtest.org.uk/0015800001HQQrZAAX/0015800001HQQrZAAX.jwks"
applicationupdater = "com.wso2.openbanking.accelerator.identity.listener.application.ApplicationUpdaterImpl"
use_softwareIdForAppName = true
append_registration_attributes_in_response = false
scope = "cdr-registration"
registration_client_uri = "https://localhost:8243/open-banking/0.1/register/"
#jwks_endpoint_name = ""
[open_banking.dcr.jwks_retriever]
connection_timeout = 3000
read_timeout = 3000

[[open_banking.dcr.regulatory_issuers.iss]]
name = "OpenBanking Ltd"

[open_banking.dcr.registration.software_environment_identification]
ssa_property_name = "software_environment"
# If both below values doesnt match, Then software_environment is default to production.
ssa_property_value_for_sandbox = "sandbox"
ssa_property_value_for_production = "production"

#Signature algorithm types that are allowed
#[[open_banking.signature_validation.allowed_algorithms]]
#name = "PS256"

# Default: true. If true, authenticators will be set/updated automatically when an application is updated.
# If false, authenticators will not be set/updated automatically when an app is updated. (Carbon console or DCR update).
[open_banking.sca.authenticator_config]
enable_setting_authenticators_on_app_update = true

#[open_banking.sca.primaryauth]
#name = "IdentifierExecutor"
#display = "ob-identifier-first"

#[open_banking.sca.idp]
#name = ""
#step = ""

#[open_banking.dcr.registration.grant_types]
#required = true
#allowed_values = ["authorization_code", "refresh_token", "client_credentials"]
#
#[open_banking.dcr.registration.scope]
#required = true
#allowed_values = ["accounts", "payments"]
#
#[open_banking.dcr.registration.application_type]
#required = false
#allowed_values = ["web"]

[open_banking.analytics.elk]
enabled = false

[open_banking.data_publishing]
enable = false
username="$ref{super_admin.username}@carbon.super"
password="$ref{super_admin.password}"
server_url = "{tcp://BI_HOSTNAME:7612}"
#auth_url = "{ssl://BI_HOSTNAME:7612}"
protocol = "Thrift"
pool_size = 10
queue_size = 32768
worker_thread_count = 10
pool_wait_time_Ms = 60000
auth_data_publisher = "com.wso2.openbanking.accelerator.authentication.data.publisher.extension.DefaultAuthDataPublisher"
open_banking_data_publisher = "com.wso2.openbanking.accelerator.data.publisher.common.OBThriftDataPublisher"

[open_banking.data_publishing.thrift]
publishing_timeout = 2000
#data streams and their attributes with the priority order
[[open_banking.data_publishing.thrift.stream]]
name="AuthenticationInputStream"
[[open_banking.data_publishing.thrift.stream.attributes]]
name="userId"
priority=1
[[open_banking.data_publishing.thrift.stream.attributes]]
name="authenticationStep"
priority=2
[[open_banking.data_publishing.thrift.stream.attributes]]
name="authenticationStatus"
priority=3
required=true
[[open_banking.data_publishing.thrift.stream.attributes]]
name="authenticationApproach"
priority=4
required=true
[[open_banking.data_publishing.thrift.stream.attributes]]
name="psuChannel"
priority=5
[[open_banking.data_publishing.thrift.stream.attributes]]
name="timestamp"
priority=6
required=true
type="long"

[[open_banking.data_publishing.thrift.stream]]
name="AccessTokenInputStream"
[[open_banking.data_publishing.thrift.stream.attributes]]
name="accessTokenID"
priority=1

[[open_banking.data_publishing.thrift.stream]]
name="DisputeResolutionStream"
[[open_banking.data_publishing.thrift.stream.attributes]]
name="statusCode"
priority=1
type="int"
[[open_banking.data_publishing.thrift.stream.attributes]]
name="httpMethod"
priority=2
[[open_banking.data_publishing.thrift.stream.attributes]]
name="timestamp"
priority=3
required=true
type="long"
[[open_banking.data_publishing.thrift.stream.attributes]]
name="requestBody"
priority=4
[[open_banking.data_publishing.thrift.stream.attributes]]
name="responseBody"
priority=5
[[open_banking.data_publishing.thrift.stream.attributes]]
name="electedResource"
priority=6
[[open_banking.data_publishing.thrift.stream.attributes]]
name="headers"
priority=7

[open_banking.data_publishing.dispute_resolution]
enable = false
publishNonErrorDisputeResolutionData = false
maxRequestBodyLength = 4096
maxResponseBodyLength = 4096
maxHeaderLength = 2048

#================custom filters and filter-mappings==============
[[tomcat.filter]]
name = "DisputeResolutionFilter"
class = "com.wso2.openbanking.accelerator.identity.dispute.resolution.DisputeResolutionFilter"

[[tomcat.filter_mapping]]
name = "DisputeResolutionFilter"
url_pattern = "/oauth2/token"

[[tomcat.filter_mapping]]
name = "DisputeResolutionFilter"
url_pattern = "/oauth2/authorize*"

[[tomcat.filter]]
name = "TokenFilter"
class = "com.wso2.openbanking.accelerator.identity.token.TokenFilter"

[tomcat.filter.init_params]
isTransportCertificateMandatory = true

[[tomcat.filter_mapping]]
name = "TokenFilter"
url_pattern = "/token"

#================consent management==============
[[open_banking.consent.authorize_steps.retrieve]]
class = "com.wso2.openbanking.accelerator.consent.extensions.authorize.impl.NonRegulatoryConsentStep"
priority = 1

[[open_banking.consent.authorize_steps.retrieve]]
class = "com.wso2.openbanking.accelerator.consent.extensions.authorize.impl.DefaultConsentRetrievalStep"
priority = 2

# Remove the DefaultConsentRetrievalStep and uncomment the SampleFapiPlainConsentRetrievalStep for FAPI Plain flow
#[[open_banking.consent.authorize_steps.retrieve]]
#class = "com.wso2.openbanking.accelerator.consent.extensions.authorize.impl.SampleFapiPlainConsentRetrievalStep"
#priority = 2

[[open_banking.consent.authorize_steps.persist]]
class = "com.wso2.openbanking.accelerator.consent.extensions.authorize.impl.DefaultConsentPersistStep"
priority = 1

# Remove the DefaultConsentPersistStep and uncomment the SampleFapiPlainConsentPersistStep for FAPI Plain flow
#[[open_banking.consent.authorize_steps.persist]]
#class = "com.wso2.openbanking.accelerator.consent.extensions.authorize.impl.SampleFapiPlainConsentPersistStep"
#priority = 1

[open_banking.consent.manage]
handler="com.wso2.openbanking.accelerator.consent.extensions.manage.impl.DefaultConsentManageHandler"

[open_banking.consent.validation]
validator="com.wso2.openbanking.accelerator.consent.extensions.validate.impl.DefaultConsentValidator"

[open_banking.consent.validation.signature]
alias="wso2carbon"

[open_banking.consent.validation.jwt.payload]
enabled=true

[open_banking.consent.admin]
handler="com.wso2.openbanking.accelerator.consent.extensions.admin.impl.DefaultConsentAdminHandler"

[open_banking.consent.periodical_expiration]
# This property needs to be true in order to run the consent expiration periodical updater.
enabled=true
# Cron value for the periodical updater. "0 0 0 * * ?" cron will describe as 00:00:00am every day
cron_value="0 0 0 * * ?"
# This value to be update for expired consents.
expired_consent_status_value="Expired"
# These consent statuses will only be consider when checking for expired consents. (Comma separated value list)
eligible_statuses="authorised"

[open_banking.consent.api_credentials]
username="$ref{super_admin.username}"
password="$ref{super_admin.password}"

[open_banking.consent.portal.client_credentials]
client_id="consent_management_portal_client_id"
client_secret="consent_management_portal_client_secret"

[open_banking.consent.portal.params]
identity_server_base_url="https://localhost:9446"
api_manager_server_base_url="https://localhost:8243"

[open_banking.identity.extensions]
request_object_validator="com.wso2.openbanking.accelerator.identity.auth.extensions.request.validator.DefaultOBRequestObjectValidator"
# Use the FapiRequestObjectValidator for FAPI plain flow validations
#request_object_validator="com.wso2.openbanking.accelerator.identity.auth.extensions.request.validator.FapiRequestObjectValidator"
push_auth_request_validator="com.wso2.openbanking.accelerator.identity.push.auth.extension.request.validator.PushAuthRequestValidator"

# Use mandate_nbf_claim=true For FAPI plain flow validations
#[open_banking.identity.request_object]
#mandate_nbf_claim=true

[open_banking.identity.application_information_webapp]
sp_metadata_filter="com.wso2.openbanking.accelerator.identity.sp.metadata.extension.impl.DefaultSPMetadataFilter"

#[open_banking.push_authorisation]
#expiry_time=60
#request_uri_sub_string=""

[open_banking.identity.mutualtls]
#This property needs to be true if the certificate should be decoded when it is passed from the load balancer to the Gateway.
client_certificate_encode=true
#Specify the jwks uri for the transport certificate.
transport_jwks_uri = "software_jwks_endpoint"

#===================for Connection pool====================
[open_banking.http_connection_pool]
max_connections = 2000
max_connections_per_route = 1500

#===================for event==============================
[open_banking.event]
queue_size = 32768
worker_thread_count = 10
event_executor = "com.wso2.openbanking.accelerator.common.event.executor.DefaultOBEventExecutor"

#===================for Role Validation====================
[application_mgt]
enable_role_validation = true
