From cd1de34f7ae82b15e5d721e2b5dbf9e06e6cf339 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cl=C3=A9ment=20OUDOT?= <clement@oodo.net>
Date: Fri, 28 May 2021 11:34:59 +0200
Subject: [PATCH 01/24] Fix grafana documentation

---
 doc/sources/admin/applications/grafana.rst | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/doc/sources/admin/applications/grafana.rst b/doc/sources/admin/applications/grafana.rst
index a26b22027..779ce41d1 100644
--- a/doc/sources/admin/applications/grafana.rst
+++ b/doc/sources/admin/applications/grafana.rst
@@ -46,14 +46,13 @@ Make sure you have already
 :doc:`enabled OpenID Connect<../idpopenidconnect>` on your LemonLDAP::NG
 server
 
-Then, add a Relaying Party with the following configuration
+Then, add a Relaying Party with the following configuration:
 
 -  Options » Authentification » Client ID : same as ``client_id`` above
--  Options » Allowed redirection address : same as ''client_secret ''
-   above
+-  Options » Authentification » Client Secret : same as ``client_secret`` above
+-  Options » Allowed redirection address : ``https://<grafana domain>/login/generic_oauth``
 
-If you want to transmit user attributes to Grafana, you also need to
-configure
+If you want to transmit extra user attributes to Grafana, you also need to configure:
 
 -  Extra Claims »
 
@@ -72,6 +71,11 @@ configure
 
    -  map them to your corresponding LemonLDAP::NG session attribute
 
+.. tip::
+
+    To trigger OIDC authentication directly, you can register grafana in application menu and
+    set as URL: ``https://<grafana domain>/login/generic_oauth``
+
 .. |image0| image:: /applications/grafana_logo.png
    :class: align-center
 

From 15298466eaba33b95aaf7d7763c73b0df718df21 Mon Sep 17 00:00:00 2001
From: Maxime Besson <maxime.besson@worteks.com>
Date: Mon, 31 May 2021 09:51:10 +0200
Subject: [PATCH 02/24] Fix JWT userinfo in Auth::OpenIDConnect (#2529)

---
 .../lib/Lemonldap/NG/Portal/Lib/OpenIDConnect.pm                | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Lib/OpenIDConnect.pm b/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Lib/OpenIDConnect.pm
index 40c1823ab..e843a390b 100644
--- a/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Lib/OpenIDConnect.pm
+++ b/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Lib/OpenIDConnect.pm
@@ -654,7 +654,7 @@ sub getUserInfo {
         return $self->decodeUserInfo($userinfo_content);
     }
     elsif ( $content_type =~ /jwt/ ) {
-        return unless $self->verifyJWTSignature( $op, $userinfo_content );
+        return unless $self->verifyJWTSignature( $userinfo_content, $op );
         return getJWTPayload($userinfo_content);
     }
 }

From 8992b3e789503f4a1eb7bc01410a95af115ae630 Mon Sep 17 00:00:00 2001
From: Maxime Besson <maxime.besson@worteks.com>
Date: Mon, 31 May 2021 09:52:26 +0200
Subject: [PATCH 03/24] Unit test for #2529

---
 ...uer-OIDC-authorization_code-jwt-userinfo.t | 395 ++++++++++++++++++
 lemonldap-ng-portal/t/oidc-lib.pm             |   2 +
 2 files changed, 397 insertions(+)
 create mode 100644 lemonldap-ng-portal/t/32-Auth-and-issuer-OIDC-authorization_code-jwt-userinfo.t

diff --git a/lemonldap-ng-portal/t/32-Auth-and-issuer-OIDC-authorization_code-jwt-userinfo.t b/lemonldap-ng-portal/t/32-Auth-and-issuer-OIDC-authorization_code-jwt-userinfo.t
new file mode 100644
index 000000000..fa825faf6
--- /dev/null
+++ b/lemonldap-ng-portal/t/32-Auth-and-issuer-OIDC-authorization_code-jwt-userinfo.t
@@ -0,0 +1,395 @@
+use lib 'inc';
+use Test::More;
+use strict;
+use IO::String;
+use LWP::UserAgent;
+use LWP::Protocol::PSGI;
+use MIME::Base64;
+
+BEGIN {
+    require 't/test-lib.pm';
+    require 't/oidc-lib.pm';
+}
+
+my $debug = 'error';
+my ( $op, $rp, $res );
+
+my $access_token;
+
+LWP::Protocol::PSGI->register(
+    sub {
+        my $req = Plack::Request->new(@_);
+        ok( $req->uri =~ m#http://auth.((?:o|r)p).com(.*)#, ' REST request' );
+        my $host = $1;
+        my $url  = $2;
+        my ( $res, $client );
+        count(1);
+        if ( $host eq 'op' ) {
+            pass("  Request from RP to OP,     endpoint $url");
+            $client = $op;
+        }
+        elsif ( $host eq 'rp' ) {
+            pass('  Request from OP to RP');
+            $client = $rp;
+        }
+        else {
+            fail('  Aborting REST request (external)');
+            return [ 500, [], [] ];
+        }
+        if ( $req->method =~ /^post$/i ) {
+            my $s = $req->content;
+            ok(
+                $res = $client->_post(
+                    $url, IO::String->new($s),
+                    length => length($s),
+                    type   => $req->header('Content-Type'),
+                ),
+                '  Execute request'
+            );
+        }
+        else {
+            ok(
+                $res = $client->_get(
+                    $url,
+                    custom => {
+                        HTTP_AUTHORIZATION => $req->header('Authorization'),
+                    }
+                ),
+                '  Execute request'
+            );
+        }
+        ok( $res->[0] == 200, '  Response is 200' );
+        ok( getHeader( $res, 'Content-Type' ) =~ m#^application/j(son|wt)#,
+            '  Content is JSON' )
+          or explain( $res->[1],
+            'Content-Type => application/json or application/jwt' );
+        count(4);
+        if ( $res->[2]->[0] =~ /"access_token":"(.*?)"/ ) {
+            $access_token = $1;
+            pass "Found access_token $access_token";
+            count(1);
+        }
+        return $res;
+    }
+);
+
+# Initialization
+ok( $op = op(), 'OP portal' );
+
+ok( $res = $op->_get('/oauth2/jwks'), 'Get JWKS,     endpoint /oauth2/jwks' );
+expectOK($res);
+my $jwks = $res->[2]->[0];
+
+ok(
+    $res = $op->_get('/.well-known/openid-configuration'),
+    'Get metadata, endpoint /.well-known/openid-configuration'
+);
+expectOK($res);
+my $metadata = $res->[2]->[0];
+count(3);
+
+switch ('rp');
+&Lemonldap::NG::Handler::Main::cfgNum( 0, 0 );
+ok( $rp = rp( $jwks, $metadata ), 'RP portal' );
+count(1);
+
+# Query RP for auth
+ok( $res = $rp->_get( '/', accept => 'text/html' ), 'Unauth SP request' );
+count(1);
+my ( $url, $query ) =
+  expectRedirection( $res, qr#http://auth.op.com(/oauth2/authorize)\?(.*)$# );
+
+# Push request to OP
+switch ('op');
+ok( $res = $op->_get( $url, query => $query, accept => 'text/html' ),
+    "Push request to OP,         endpoint $url" );
+count(1);
+expectOK($res);
+
+# Try to authenticate to OP
+$query = "user=french&password=french&$query";
+ok(
+    $res = $op->_post(
+        $url,
+        IO::String->new($query),
+        accept => 'text/html',
+        length => length($query),
+    ),
+    "Post authentication,        endpoint $url"
+);
+count(1);
+my $idpId = expectCookie($res);
+my ( $host, $tmp );
+( $host, $tmp, $query ) = expectForm( $res, '#', undef, 'confirm' );
+
+ok(
+    $res = $op->_post(
+        $url,
+        IO::String->new($query),
+        accept => 'text/html',
+        cookie => "lemonldap=$idpId",
+        length => length($query),
+    ),
+    "Post confirmation,          endpoint $url"
+);
+count(1);
+
+($query) = expectRedirection( $res, qr#^http://auth.rp.com/?\?(.*)$# );
+
+# Push OP response to RP
+switch ('rp');
+
+ok( $res = $rp->_get( '/', query => $query, accept => 'text/html' ),
+    'Call openidconnectcallback on RP' );
+count(1);
+my $spId = expectCookie($res);
+
+switch ('op');
+ok(
+    $res = $op->_get( '/oauth2/checksession.html', accept => 'text.html' ),
+    'Check session,      endpoint /oauth2/checksession.html'
+);
+count(1);
+expectOK($res);
+ok( getHeader( $res, 'Content-Security-Policy' ) !~ /frame-ancestors/,
+    ' Frame can be embedded' )
+  or explain( $res->[1],
+    'Content-Security-Policy does not contain a frame-ancestors' );
+count(1);
+
+# Verify UTF-8
+ok(
+    $res = $op->_get(
+        '/oauth2/userinfo', query => 'access_token=' . $access_token,
+    ),
+    'Get userinfo'
+);
+count(1);
+
+$res = expectJWT( $res->[2]->[0], name => 'Frédéric Accents' );
+
+ok( $res = $op->_get("/sessions/global/$spId"), 'Get UTF-8' );
+$res = expectJSON($res);
+ok( $res->{cn} eq 'Frédéric Accents', 'UTF-8 values' )
+  or explain( $res, 'cn => Frédéric Accents' );
+count(2);
+
+switch ('rp');
+ok( $res = $rp->_get("/sessions/global/$spId"), 'Get UTF-8' );
+$res = expectJSON($res);
+ok( $res->{cn} eq 'Frédéric Accents', 'UTF-8 values' )
+  or explain( $res, 'cn => Frédéric Accents' );
+count(2);
+
+# Logout initiated by RP
+ok(
+    $res = $rp->_get(
+        '/',
+        query  => 'logout',
+        cookie => "lemonldap=$spId",
+        accept => 'text/html'
+    ),
+    'Query RP for logout'
+);
+count(1);
+( $url, $query ) = expectRedirection( $res,
+    qr#http://auth.op.com(/oauth2/logout)\?(post_logout_redirect_uri=.+)$# );
+
+# Push logout to OP
+switch ('op');
+
+ok(
+    $res = $op->_get(
+        $url,
+        query  => $query,
+        cookie => "lemonldap=$idpId",
+        accept => 'text/html'
+    ),
+    "Push logout request to OP,     endpoint $url"
+);
+count(1);
+
+( $host, $tmp, $query ) = expectForm( $res, '#', undef, 'confirm' );
+
+ok(
+    $res = $op->_post(
+        $url, IO::String->new($query),
+        length => length($query),
+        cookie => "lemonldap=$idpId",
+        accept => 'text/html',
+    ),
+    "Confirm logout,                endpoint $url"
+);
+count(1);
+
+( $url, $query ) = expectRedirection( $res, qr#.# );
+
+my $removedCookie = expectCookie($res);
+is( $removedCookie, 0, "SSO cookie removed" );
+count(1);
+
+# Test logout endpoint without session
+ok(
+    $res = $op->_get(
+        '/oauth2/logout',
+        accept => 'text/html',
+        query  => 'post_logout_redirect_uri=http://auth.rp.com/?logout=1'
+    ),
+    'logout endpoint with redirect, endpoint /oauth2/logout'
+);
+count(1);
+expectRedirection( $res, 'http://auth.rp.com/?logout=1' );
+
+ok( $res = $op->_get('/oauth2/logout'),
+    'logout endpoint,               endpoint /oauth2/logout' );
+count(1);
+expectReject($res);
+
+# Test if logout is done
+ok(
+    $res = $op->_get(
+        '/', cookie => "lemonldap=$idpId",
+    ),
+    'Test if user is reject on IdP'
+);
+count(1);
+expectReject($res);
+
+switch ('rp');
+ok(
+    $res = $rp->_get(
+        '/',
+        accept => 'text/html',
+        cookie => "lemonldap=$spId"
+    ),
+    'Test if user is reject on SP'
+);
+count(1);
+( $url, $query ) =
+  expectRedirection( $res, qr#^http://auth.op.com(/oauth2/authorize)\?(.*)$# );
+
+# Test if consent was saved
+# -------------------------
+
+# Push request to OP
+switch ('op');
+ok( $res = $op->_get( $url, query => $query, accept => 'text/html' ),
+    "Push request to OP,         endpoint $url" );
+count(1);
+expectOK($res);
+
+# Try to authenticate to OP
+$query = "user=french&password=french&$query";
+ok(
+    $res = $op->_post(
+        $url,
+        IO::String->new($query),
+        accept => 'text/html',
+        length => length($query),
+    ),
+    "Post authentication,        endpoint $url"
+);
+count(1);
+$idpId = expectCookie($res);
+
+#expectRedirection( $res, qr#^http://auth.rp.com/# );
+
+#print STDERR Dumper($res);
+
+clean_sessions();
+done_testing( count() );
+
+sub op {
+    return LLNG::Manager::Test->new( {
+            ini => {
+                logLevel                        => $debug,
+                domain                          => 'idp.com',
+                portal                          => 'http://auth.op.com/',
+                authentication                  => 'Demo',
+                userDB                          => 'Same',
+                issuerDBOpenIDConnectActivation => "1",
+                restSessionServer               => 1,
+                oidcRPMetaDataExportedVars      => {
+                    rp => {
+                        email       => "mail",
+                        family_name => "cn",
+                        name        => "cn"
+                    }
+                },
+                oidcServiceAllowHybridFlow            => 1,
+                oidcServiceAllowImplicitFlow          => 1,
+                oidcServiceAllowAuthorizationCodeFlow => 1,
+                oidcRPMetaDataOptions                 => {
+                    rp => {
+                        oidcRPMetaDataOptionsDisplayName       => "RP",
+                        oidcRPMetaDataOptionsIDTokenExpiration => 3600,
+                        oidcRPMetaDataOptionsClientID          => "rpid",
+                        oidcRPMetaDataOptionsIDTokenSignAlg    => "HS512",
+                        oidcRPMetaDataOptionsBypassConsent     => 0,
+                        oidcRPMetaDataOptionsClientSecret      => "rpsecret",
+                        oidcRPMetaDataOptionsUserIDAttr        => "",
+                        oidcRPMetaDataOptionsAccessTokenExpiration => 3600,
+                        oidcRPMetaDataOptionsUserInfoSignAlg       => "HS512",
+                        oidcRPMetaDataOptionsPostLogoutRedirectUris =>
+                          "http://auth.rp.com/?logout=1"
+                    }
+                },
+                oidcOPMetaDataOptions           => {},
+                oidcOPMetaDataJSON              => {},
+                oidcOPMetaDataJWKS              => {},
+                oidcServiceMetaDataAuthnContext => {
+                    'loa-4' => 4,
+                    'loa-1' => 1,
+                    'loa-5' => 5,
+                    'loa-2' => 2,
+                    'loa-3' => 3
+                },
+                oidcServicePrivateKeySig => oidc_key_op_private_sig,
+                oidcServicePublicKeySig  => oidc_key_op_public_sig,
+            }
+        }
+    );
+}
+
+sub rp {
+    my ( $jwks, $metadata ) = @_;
+    return LLNG::Manager::Test->new( {
+            ini => {
+                logLevel                   => $debug,
+                domain                     => 'rp.com',
+                portal                     => 'http://auth.rp.com/',
+                authentication             => 'OpenIDConnect',
+                userDB                     => 'Same',
+                restSessionServer          => 1,
+                oidcOPMetaDataExportedVars => {
+                    op => {
+                        cn   => "name",
+                        uid  => "sub",
+                        sn   => "family_name",
+                        mail => "email"
+                    }
+                },
+                oidcOPMetaDataOptions => {
+                    op => {
+                        oidcOPMetaDataOptionsCheckJWTSignature => 1,
+                        oidcOPMetaDataOptionsJWKSTimeout       => 0,
+                        oidcOPMetaDataOptionsClientSecret      => "rpsecret",
+                        oidcOPMetaDataOptionsScope        => "openid profile",
+                        oidcOPMetaDataOptionsStoreIDToken => 0,
+                        oidcOPMetaDataOptionsMaxAge       => 30,
+                        oidcOPMetaDataOptionsDisplay      => "",
+                        oidcOPMetaDataOptionsClientID     => "rpid",
+                        oidcOPMetaDataOptionsConfigurationURI =>
+                          "https://auth.op.com/.well-known/openid-configuration"
+                    }
+                },
+                oidcOPMetaDataJWKS => {
+                    op => $jwks,
+                },
+                oidcOPMetaDataJSON => {
+                    op => $metadata,
+                }
+            }
+        }
+    );
+}
diff --git a/lemonldap-ng-portal/t/oidc-lib.pm b/lemonldap-ng-portal/t/oidc-lib.pm
index b3658beae..acb8211ef 100644
--- a/lemonldap-ng-portal/t/oidc-lib.pm
+++ b/lemonldap-ng-portal/t/oidc-lib.pm
@@ -156,8 +156,10 @@ sub expectJWT {
     my ( $token, %claims ) = @_;
     my $payload = getJWTPayload($token);
     ok( $payload, "Token is a JWT" );
+    count(1);
     for my $claim ( keys %claims ) {
         is( $payload->{$claim}, $claims{$claim}, "Found claim in JWT" );
+        count(1);
     }
     return $payload;
 }

From e98aafd6f7fbbd69a97aced60f3210f6bad460f9 Mon Sep 17 00:00:00 2001
From: Maxime Besson <maxime.besson@worteks.com>
Date: Mon, 31 May 2021 11:16:28 +0200
Subject: [PATCH 04/24] add oidcGenerateCode hook (#2532)

---
 .../NG/Portal/Issuer/OpenIDConnect.pm         | 34 +++++++++++--------
 1 file changed, 19 insertions(+), 15 deletions(-)

diff --git a/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Issuer/OpenIDConnect.pm b/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Issuer/OpenIDConnect.pm
index 75ca28e88..320b467cf 100644
--- a/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Issuer/OpenIDConnect.pm
+++ b/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Issuer/OpenIDConnect.pm
@@ -700,21 +700,25 @@ sub run {
             if ( $flow eq "authorizationcode" ) {
 
                 # Store data in session
-                my $codeSession = $self->newAuthorizationCode(
-                    $rp,
-                    {
-                        code_challenge => $oidc_request->{'code_challenge'},
-                        code_challenge_method =>
-                          $oidc_request->{'code_challenge_method'},
-                        nonce           => $oidc_request->{'nonce'},
-                        offline         => $offline,
-                        redirect_uri    => $oidc_request->{'redirect_uri'},
-                        scope           => $scope,
-                        req_scope       => $req_scope,
-                        client_id       => $client_id,
-                        user_session_id => $req->id,
-                    }
-                );
+                my $code_payload = {
+                    code_challenge => $oidc_request->{'code_challenge'},
+                    code_challenge_method =>
+                      $oidc_request->{'code_challenge_method'},
+                    nonce           => $oidc_request->{'nonce'},
+                    offline         => $offline,
+                    redirect_uri    => $oidc_request->{'redirect_uri'},
+                    scope           => $scope,
+                    req_scope       => $req_scope,
+                    client_id       => $client_id,
+                    user_session_id => $req->id,
+                };
+
+                my $h = $self->p->processHook( $req, 'oidcGenerateCode',
+                    $oidc_request, $rp, $code_payload );
+                return PE_ERROR if ( $h != PE_OK );
+
+                my $codeSession =
+                  $self->newAuthorizationCode( $rp, $code_payload );
 
                 # Generate code
                 my $code = $codeSession->id();

From ec2b904f4f6006bae2a57aa11628b0d941735b6b Mon Sep 17 00:00:00 2001
From: Maxime Besson <maxime.besson@worteks.com>
Date: Mon, 31 May 2021 11:23:38 +0200
Subject: [PATCH 05/24] Unit test for #2532

---
 lemonldap-ng-portal/t/32-OIDC-Hooks.t   | 3 ++-
 lemonldap-ng-portal/t/OidcHookPlugin.pm | 8 ++++++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/lemonldap-ng-portal/t/32-OIDC-Hooks.t b/lemonldap-ng-portal/t/32-OIDC-Hooks.t
index 78d422f7f..dfe8470c7 100644
--- a/lemonldap-ng-portal/t/32-OIDC-Hooks.t
+++ b/lemonldap-ng-portal/t/32-OIDC-Hooks.t
@@ -90,7 +90,8 @@ ok(
     "Get authorization code"
 );
 
-my ($code) = expectRedirection( $res, qr#http://rp2\.com/.*code=([^\&]*)# );
+my ($code) =
+  expectRedirection( $res, qr#http://rp2\.com/\?hooked=1.*code=([^\&]*)# );
 
 # Exchange code for AT
 $query =
diff --git a/lemonldap-ng-portal/t/OidcHookPlugin.pm b/lemonldap-ng-portal/t/OidcHookPlugin.pm
index 5d01cb6f7..1ef0b7b97 100644
--- a/lemonldap-ng-portal/t/OidcHookPlugin.pm
+++ b/lemonldap-ng-portal/t/OidcHookPlugin.pm
@@ -8,6 +8,7 @@ use Data::Dumper;
 use Test::More;
 
 use constant hook => {
+    oidcGenerateCode              => 'modifyRedirectUri',
     oidcGenerateIDToken           => 'addClaimToIDToken',
     oidcGenerateUserInfoResponse  => 'addClaimToUserInfo',
     oidcGotRequest                => 'addScopeToRequest',
@@ -47,6 +48,13 @@ sub addHardcodedScope {
     return PE_OK;
 }
 
+sub modifyRedirectUri {
+    my ( $self, $req, $oidc_request, $rp, $code_payload ) = @_;
+    my $original_uri = $oidc_request->{redirect_uri};
+    $oidc_request->{redirect_uri} = "$original_uri?hooked=1";
+    return PE_OK;
+}
+
 sub addClaimToAccessToken {
     my ( $self, $req, $payload, $rp ) = @_;
     $payload->{"access_token_hook"} = 1;

From caae30f24f237c0d3f323c305c1d6b1fab433d48 Mon Sep 17 00:00:00 2001
From: Maxime Besson <maxime.besson@worteks.com>
Date: Mon, 31 May 2021 11:27:26 +0200
Subject: [PATCH 06/24] Documentation for #2532

---
 doc/sources/admin/hooks.rst | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/doc/sources/admin/hooks.rst b/doc/sources/admin/hooks.rst
index 091f7b8f2..15aa6545f 100644
--- a/doc/sources/admin/hooks.rst
+++ b/doc/sources/admin/hooks.rst
@@ -52,6 +52,32 @@ Sample code::
    }
 
 
+oidcGenerateCode
+~~~~~~~~~~~~~~~~
+
+.. versionadded:: 2.0.12
+
+This hook is triggered when LemonLDAP::NG is about to generate an Authorization Code for a Relying Party.
+
+The hook's parameters are:
+
+* A hash of the parameters for the OIDC Authorize request, which you can modify
+* the configuration key of the relying party which will receive the token 
+* A hash of the session keys for the (internal) Authorization Code session
+
+Sample code::
+
+   use constant hook => {
+       oidcGenerateCode              => 'modifyRedirectUri',
+   };
+
+   sub modifyRedirectUri {
+       my ( $self, $req, $oidc_request, $rp, $code_payload ) = @_;
+       my $original_uri = $oidc_request->{redirect_uri};
+       $oidc_request->{redirect_uri} = "$original_uri?hooked=1";
+       return PE_OK;
+   }
+
 oidcGenerateUserInfoResponse
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 

From cf3809a0de6475a0960f4bcbf166607d496631b5 Mon Sep 17 00:00:00 2001
From: Maxime Besson <maxime.besson@worteks.com>
Date: Tue, 1 Jun 2021 11:27:45 +0200
Subject: [PATCH 07/24] Add CAS hooks (#2533)

---
 .../lib/Lemonldap/NG/Portal/Issuer/CAS.pm     | 42 +++++++++++++++----
 1 file changed, 33 insertions(+), 9 deletions(-)

diff --git a/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Issuer/CAS.pm b/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Issuer/CAS.pm
index d92c859b6..94891ad06 100644
--- a/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Issuer/CAS.pm
+++ b/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Issuer/CAS.pm
@@ -146,14 +146,22 @@ sub run {
 
         $self->logger->debug("URL $url detected as an CAS LOGIN URL");
 
-        # GET parameters
-        my $service = $self->p->getHiddenFormValue( $req, 'service' )
-          || $req->param('service');
+        my $cas_request = {};
+
+        foreach my $param (qw/service renew gateway/) {
+            $cas_request->{$param} =
+                 $self->p->getHiddenFormValue( $req, $param )
+              || $req->param($param);
+        }
+
+        my $h = $self->p->processHook( $req, 'casGotRequest', $cas_request );
+        return $h if ( $h != PE_OK );
+
+        my $service = $cas_request->{service};
         $service = '' if ( $self->p->checkXSSAttack( 'service', $service ) );
-        my $renew = $self->p->getHiddenFormValue( $req, 'renew' )
-          || $req->param('renew');
-        my $gateway = $self->p->getHiddenFormValue( $req, 'gateway' )
-          || $req->param('gateway');
+        my $renew   = $cas_request->{renew};
+        my $gateway = $cas_request->{gateway};
+
         my $casServiceTicket;
 
         # If no service defined, exit
@@ -281,6 +289,10 @@ sub run {
             $Sinfos->{_utime}  = $time;
             $Sinfos->{_casApp} = $app;
 
+            my $h = $self->p->processHook( $req, 'casGenerateServiceTicket',
+                $cas_request, $app, $Sinfos );
+            return $h if ( $h != PE_OK );
+
             my $casServiceSession = $self->getCasSession( undef, $Sinfos );
 
             unless ($casServiceSession) {
@@ -296,8 +308,9 @@ sub run {
         }
 
         # Redirect to service
-        my $service_url = $service;
-        $service_url .= ( $service =~ /\?/ ? '&' : '?' )
+        # cas_request may have been modified by hook
+        my $service_url = $cas_request->{service};
+        $service_url .= ( $service_url =~ /\?/ ? '&' : '?' )
           . build_urlencoded( ticket => $casServiceTicket );
 
         $self->logger->debug("Redirect user to $service_url");
@@ -542,6 +555,11 @@ sub validate {
 
     # Return success message
     $self->deleteCasSession($casServiceSession);
+
+    my $h =
+      $self->p->processHook( $req, 'casGenerateValidateResponse', $username );
+    return $self->returnCasValidateError() if ( $h != PE_OK );
+
     return $self->returnCasValidateSuccess( $req, $username );
 }
 
@@ -839,6 +857,12 @@ sub _validate2 {
 
     # Return success message
     $self->deleteCasSession($casServiceSession);
+
+    my $h =
+      $self->p->processHook( $req, 'casGenerateValidateResponse', $username,
+        $attributes );
+    return $self->returnCasValidateError() if ( $h != PE_OK );
+
     return $self->returnCasServiceValidateSuccess( $req, $username,
         $casProxyGrantingTicketIOU, $proxies, $attributes );
 }

From 6ef522c19392cdad6960276359047618a2c0d52e Mon Sep 17 00:00:00 2001
From: Maxime Besson <maxime.besson@worteks.com>
Date: Tue, 1 Jun 2021 11:28:34 +0200
Subject: [PATCH 08/24] Unit tests for #2533

---
 lemonldap-ng-portal/t/32-CAS-Hooks.t   | 110 +++++++++++++++++++++++++
 lemonldap-ng-portal/t/CasHookPlugin.pm |  42 ++++++++++
 2 files changed, 152 insertions(+)
 create mode 100644 lemonldap-ng-portal/t/32-CAS-Hooks.t
 create mode 100644 lemonldap-ng-portal/t/CasHookPlugin.pm

diff --git a/lemonldap-ng-portal/t/32-CAS-Hooks.t b/lemonldap-ng-portal/t/32-CAS-Hooks.t
new file mode 100644
index 000000000..4769329b4
--- /dev/null
+++ b/lemonldap-ng-portal/t/32-CAS-Hooks.t
@@ -0,0 +1,110 @@
+use lib 'inc';
+use Test::More;    # skip_all => 'CAS is in rebuild';
+use strict;
+use IO::String;
+use LWP::UserAgent;
+use LWP::Protocol::PSGI;
+use MIME::Base64;
+
+BEGIN {
+    require 't/test-lib.pm';
+}
+
+my $debug = 'error';
+my ( $issuer, $res );
+
+eval { require XML::Simple };
+plan skip_all => "Missing dependencies: $@" if ($@);
+
+ok( $issuer = issuer(), 'Issuer portal' );
+count(1);
+
+my $s = "user=french&password=french";
+
+# Login
+ok(
+    $res = $issuer->_post(
+        '/',
+        IO::String->new($s),
+        accept => 'text/html',
+        length => length($s),
+    ),
+    'Post authentication'
+);
+count(1);
+my $idpId = expectCookie($res);
+
+# Hook should make it fail with status 999
+ok(
+    $res = $issuer->_get(
+        '/cas/login',
+        cookie => "lemonldap=$idpId",
+        query  => 'service=http://auth.sp2.com/',
+        accept => 'text/html'
+    ),
+    'Query CAS server'
+);
+count(1);
+
+expectPortalError( $res, 999, "Hook rejected the request" );
+
+ok(
+    $res = $issuer->_get(
+        '/cas/login',
+        cookie => "lemonldap=$idpId",
+        query  => 'service=http://auth.sp.com/',
+        accept => 'text/html'
+    ),
+    'Query CAS server'
+);
+count(1);
+my ($query) =
+  expectRedirection( $res, qr#^http://auth.sp.com/\?hooked=1&(ticket=[^&]+)$# );
+
+ok(
+    $res = $issuer->_get(
+        '/cas/p3/serviceValidate',
+        query  => 'service=http://auth.sp.com/&' . $query,
+        accept => 'text/html'
+    ),
+    'Query CAS server'
+);
+
+expectOK($res);
+count(1);
+
+ok( $res->[2]->[0] =~ m#<cas:hooked>1</cas:hooked>#, "Found hook attribute" );
+count(1);
+
+clean_sessions();
+done_testing( count() );
+
+sub issuer {
+    return LLNG::Manager::Test->new( {
+            ini => {
+                logLevel              => $debug,
+                domain                => 'idp.com',
+                portal                => 'http://auth.idp.com',
+                authentication        => 'Demo',
+                userDB                => 'Same',
+                issuerDBCASActivation => 1,
+                casAttr               => 'uid',
+                casAppMetaDataOptions => {
+                    sp => {
+                        casAppMetaDataOptionsService => 'http://auth.sp.com/',
+                    },
+                },
+                casAppMetaDataExportedVars => {
+                    sp => {
+                        cn   => 'cn',
+                        mail => 'mail',
+                        uid  => 'uid',
+                    },
+                },
+                casAccessControlPolicy => 'error',
+                multiValuesSeparator   => ';',
+                customPlugins          => 't::CasHookPlugin',
+            }
+        }
+    );
+}
diff --git a/lemonldap-ng-portal/t/CasHookPlugin.pm b/lemonldap-ng-portal/t/CasHookPlugin.pm
new file mode 100644
index 000000000..70bae0d13
--- /dev/null
+++ b/lemonldap-ng-portal/t/CasHookPlugin.pm
@@ -0,0 +1,42 @@
+package t::CasHookPlugin;
+
+use Mouse;
+extends 'Lemonldap::NG::Portal::Main::Plugin';
+
+use constant hook => {
+    casGotRequest                 => 'filterService',
+    'casGenerateServiceTicket'    => 'changeRedirectUrl',
+    'casGenerateValidateResponse' => 'genResponse',
+};
+
+sub init {
+    my ($self) = @_;
+    return 1;
+}
+
+sub filterService {
+    my ( $self, $req, $cas_request ) = @_;
+    if ( $cas_request->{service} eq "http://auth.sp.com/" ) {
+        return 0;
+    }
+    else {
+        return 999;
+    }
+}
+
+sub changeRedirectUrl {
+    my ( $self, $req, $cas_request, $app, $Sinfos ) = @_;
+    $cas_request->{service} .= "?hooked=1";
+    return 0;
+}
+
+sub genResponse {
+    my ( $self, $req, $username, $attributes ) = @_;
+
+    $attributes->{hooked} = 1;
+
+    return 0;
+}
+
+1;
+

From 603be4fe1bbbac41d31eb9253b900ae1c80ce6e2 Mon Sep 17 00:00:00 2001
From: Maxime Besson <maxime.besson@worteks.com>
Date: Tue, 1 Jun 2021 11:56:15 +0200
Subject: [PATCH 09/24] Documentation for #2533

---
 doc/sources/admin/hooks.rst | 80 +++++++++++++++++++++++++++++++++++++
 1 file changed, 80 insertions(+)

diff --git a/doc/sources/admin/hooks.rst b/doc/sources/admin/hooks.rst
index 15aa6545f..9f0bacf4a 100644
--- a/doc/sources/admin/hooks.rst
+++ b/doc/sources/admin/hooks.rst
@@ -280,3 +280,83 @@ Sample code::
 
        # Your code here
    }
+
+CAS Issuer hooks
+-----------------
+
+casGotRequest
+~~~~~~~~~~~~~
+
+.. versionadded:: 2.0.12
+
+This hook is triggered when LemonLDAP::NG received an CAS authentication request on the `/cas/login` endpoint.
+
+The hook's parameter is a hash containing the CAS request parameters.
+
+Sample code::
+
+   use constant hook => {
+       casGotRequest                 => 'filterService'
+   };
+
+   sub filterService {
+       my ( $self, $req, $cas_request ) = @_;
+       if ( $cas_request->{service} eq "http://auth.sp.com/" ) {
+           return PE_OK;
+       }
+       else {
+           return 999;
+       }
+   }
+
+
+casGenerateServiceTicket
+~~~~~~~~~~~~~~~~~~~~~~~~
+
+.. versionadded:: 2.0.12
+
+This hook is triggered when LemonLDAP::NG is about to generate a Service Ticket for a CAS application
+
+The hook's parameters are:
+
+* A hash of the parameters for the CAS request, which you can modify
+* the configuration key of the cas application which will receive the ticket 
+* A hash of the session keys for the (internal) CAS session
+
+Sample code::
+
+   use constant hook => {
+       'casGenerateServiceTicket'    => 'changeRedirectUrl',
+   };
+
+   sub changeRedirectUrl {
+       my ( $self, $req, $cas_request, $app, $Sinfos ) = @_;
+       $cas_request->{service} .= "?hooked=1";
+       return PE_OK;
+   }
+
+
+casGenerateValidateResponse
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+.. versionadded:: 2.0.12
+
+This hook is triggered when LemonLDAP::NG is about to send a CAS response to an application on the `/cas/serviceValidate` endpoint.
+
+The hook's parameters are:
+
+* The username (CAS principal)
+* A hash of modifiable attributes to be sent
+
+Sample code::
+
+   use constant hook => {
+       casGenerateValidateResponse    => 'addAttributes',
+   };
+
+   sub addAttributes {
+       my ( $self, $req, $username, $attributes ) = @_;
+       $attributes->{hooked} = 1;
+       return PE_OK;
+   }
+

From e50db3f08388e4f1e57dd7887eee3b96443a3919 Mon Sep 17 00:00:00 2001
From: Maxime Besson <maxime.besson@worteks.com>
Date: Sat, 1 May 2021 20:45:24 +0200
Subject: [PATCH 10/24] Skip registration of OIDC RP when config has errors
 (#2525)

---
 .../Lemonldap/NG/Portal/Lib/OpenIDConnect.pm  | 65 +++++++++++++------
 1 file changed, 44 insertions(+), 21 deletions(-)

diff --git a/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Lib/OpenIDConnect.pm b/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Lib/OpenIDConnect.pm
index e843a390b..a2aa61cb9 100644
--- a/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Lib/OpenIDConnect.pm
+++ b/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Lib/OpenIDConnect.pm
@@ -105,8 +105,11 @@ sub loadRPs {
             "No OpenID Connect Relying Party found in configuration");
         return 1;
     }
-    $self->oidcRPList( $self->conf->{oidcRPMetaDataOptions} );
-    foreach my $rp ( keys %{ $self->oidcRPList } ) {
+
+    foreach my $rp ( keys %{ $self->conf->{oidcRPMetaDataOptions} || {} } ) {
+        my $valid = 1;
+
+        # Handle attributes
         my $attributes = {
             profile => PROFILE,
             email   => EMAIL,
@@ -125,50 +128,70 @@ sub loadRPs {
                 $attributes->{$claim} = \@extraAttributes;
             }
         }
-        $self->rpAttributes->{$rp} = $attributes;
 
-        my $rule = $self->oidcRPList->{$rp}->{oidcRPMetaDataOptionsRule};
+        # Access rule
+        my $rule = $self->conf->{oidcRPMetaDataOptions}->{$rp}
+          ->{oidcRPMetaDataOptionsRule};
         if ( length $rule ) {
             $rule = $self->p->HANDLER->substitute($rule);
             unless ( $rule = $self->p->HANDLER->buildSub($rule) ) {
-                $self->error( 'OIDC RP rule error: '
+                $self->logger->error( "Unable to build access rule for RP $rp: "
                       . $self->p->HANDLER->tsv->{jail}->error );
-                return 0;
+                $valid = 0;
             }
-            $self->spRules->{$rp} = $rule;
         }
 
         # Load per-RP macros
-        my $macros = $self->conf->{oidcRPMetaDataMacros}->{$rp};
+        my $macros         = $self->conf->{oidcRPMetaDataMacros}->{$rp};
+        my $compiledMacros = {};
         for my $macroAttr ( keys %{$macros} ) {
             my $macroRule = $macros->{$macroAttr};
             if ( length $macroRule ) {
                 $macroRule = $self->p->HANDLER->substitute($macroRule);
-                unless ( $macroRule = $self->p->HANDLER->buildSub($macroRule) )
-                {
-                    $self->error( 'OIDC RP macro error: '
-                          . $self->p->HANDLER->tsv->{jail}->error );
-                    return 0;
+                if ( $macroRule = $self->p->HANDLER->buildSub($macroRule) ) {
+                    $compiledMacros->{$macroAttr} = $macroRule;
+                }
+                else {
+                    $self->logger->error(
+                        "Unable to build macro $macroAttr for RP $rp:"
+                          . $self->p->HANDLER->tsv->{jail}->error );
+                    $valid = 0;
                 }
-                $self->spMacros->{$rp}->{$macroAttr} = $macroRule;
             }
         }
 
         # Load per-RP dynamic scopes
-        my $scopes = $self->conf->{oidcRPMetaDataScopeRules}->{$rp};
+        my $scopes         = $self->conf->{oidcRPMetaDataScopeRules}->{$rp};
+        my $compiledScopes = {};
         for my $scopeName ( keys %{$scopes} ) {
             my $scopeRule = $scopes->{$scopeName};
             if ( length $scopeRule ) {
                 $scopeRule = $self->p->HANDLER->substitute($scopeRule);
-                unless ( $scopeRule = $self->p->HANDLER->buildSub($scopeRule) )
-                {
-                    $self->error( 'OIDC RP dynamic scope rule error: '
-                          . $self->p->HANDLER->tsv->{jail}->error );
-                    return 0;
+                if ( $scopeRule = $self->p->HANDLER->buildSub($scopeRule) ) {
+                    $compiledScopes->{$scopeName} = $scopeRule;
+                }
+                else {
+                    $self->logger->error(
+                        "Unable to build scope $scopeName for RP $rp:"
+                          . $self->p->HANDLER->tsv->{jail}->error );
+                    $valid = 0;
                 }
-                $self->spScopeRules->{$rp}->{$scopeName} = $scopeRule;
             }
         }
+        if ($valid) {
+
+            # Register RP
+            $self->oidcRPList->{$rp} =
+              $self->conf->{oidcRPMetaDataOptions}->{$rp};
+            $self->rpAttributes->{$rp} = $attributes;
+            $self->spMacros->{$rp}     = $compiledMacros;
+            $self->spScopeRules->{$rp} = $compiledScopes;
+            $self->spRules->{$rp}      = $rule;
+        }
+        else {
+            $self->logger->error(
+                "Relaying Party $rp has errors and will be ignored");
+        }
     }
     return 1;
 }

From 71a8fc6d1618876cb85cd142a40688092628969f Mon Sep 17 00:00:00 2001
From: Maxime Besson <maxime.besson@worteks.com>
Date: Sat, 1 May 2021 20:54:27 +0200
Subject: [PATCH 11/24] Skip registration of CAS App when config has errors
 (#2525)

---
 .../lib/Lemonldap/NG/Portal/Lib/CAS.pm        | 45 ++++++++++++-------
 1 file changed, 30 insertions(+), 15 deletions(-)

diff --git a/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Lib/CAS.pm b/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Lib/CAS.pm
index 9d9745d3e..f32fd3633 100644
--- a/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Lib/CAS.pm
+++ b/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Lib/CAS.pm
@@ -47,45 +47,60 @@ sub loadSrv {
 # Load CAS application list
 sub loadApp {
     my ($self) = @_;
-    if ( $self->conf->{casAppMetaDataOptions}
+    unless ( $self->conf->{casAppMetaDataOptions}
         and %{ $self->conf->{casAppMetaDataOptions} } )
     {
-        $self->casAppList( $self->conf->{casAppMetaDataOptions} );
-    }
-    else {
         $self->logger->info("No CAS apps found in configuration");
     }
 
     foreach ( keys %{ $self->conf->{casAppMetaDataOptions} } ) {
 
+        my $valid = 1;
+
         # Load access rule
-        my $rule = $self->conf->{casAppMetaDataOptions}->{$_}
+        my $rule =
+          $self->conf->{casAppMetaDataOptions}->{$_}
           ->{casAppMetaDataOptionsRule};
         if ( length $rule ) {
             $rule = $self->p->HANDLER->substitute($rule);
             unless ( $rule = $self->p->HANDLER->buildSub($rule) ) {
-                $self->error( 'CAS App rule error: '
+                $self->logger->error(
+                    "Unable to build access rule for CAS Application $_: "
                       . $self->p->HANDLER->tsv->{jail}->error );
-                return 0;
+                $valid = 0;
             }
-            $self->spRules->{$_} = $rule;
         }
 
         # Load per-application macros
-        my $macros = $self->conf->{casAppMetaDataMacros}->{$_};
+        my $macros         = $self->conf->{casAppMetaDataMacros}->{$_};
+        my $compiledMacros = {};
         for my $macroAttr ( keys %{$macros} ) {
             my $macroRule = $macros->{$macroAttr};
             if ( length $macroRule ) {
                 $macroRule = $self->p->HANDLER->substitute($macroRule);
-                unless ( $macroRule = $self->p->HANDLER->buildSub($macroRule) )
-                {
-                    $self->error( 'SAML SP macro error: '
-                          . $self->p->HANDLER->tsv->{jail}->error );
-                    return 0;
+                if ( $macroRule = $self->p->HANDLER->buildSub($macroRule) ) {
+                    $compiledMacros->{$macroAttr} = $macroRule;
+                }
+                else {
+                    $self->logger->error(
+"Unable to build macro $macroAttr for CAS Application $_: "
+                          . $self->p->HANDLER->tsv->{jail}->error );
+                    $valid = 0;
                 }
-                $self->spMacros->{$_}->{$macroAttr} = $macroRule;
             }
         }
+
+        if ($valid) {
+            $self->casAppList->{$_} =
+              $self->conf->{casAppMetaDataOptions}->{$_};
+            $self->spRules->{$_}  = $rule;
+            $self->spMacros->{$_} = $compiledMacros;
+        }
+        else {
+            $self->logger->error(
+                "CAS Application $_ has errors and will be ignored");
+
+        }
     }
     return 1;
 }

From 91cfba275aa014eabba5868c0e29d0aaf7d6c036 Mon Sep 17 00:00:00 2001
From: Maxime Besson <maxime.besson@worteks.com>
Date: Sun, 2 May 2021 18:23:37 +0200
Subject: [PATCH 12/24] Skip registration of SAML SP when config has errors
 (#2525)

---
 .../lib/Lemonldap/NG/Portal/Lib/SAML.pm       | 84 +++++++++++--------
 1 file changed, 49 insertions(+), 35 deletions(-)

diff --git a/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Lib/SAML.pm b/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Lib/SAML.pm
index fefc62cd4..6a39681ca 100644
--- a/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Lib/SAML.pm
+++ b/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Lib/SAML.pm
@@ -386,6 +386,54 @@ sub loadSPs {
             $sp_metadata = encode( "utf8", $sp_metadata );
         }
 
+        # Get SP entityID
+        my ( $tmp, $entityID ) = ( $sp_metadata =~ /entityID=(['"])(.+?)\1/si );
+
+        # Decode HTML entities from entityID
+        # TODO: see Lasso comment below
+        decode_entities($entityID);
+
+        my $valid = 1;
+        my $rule  = $self->conf->{samlSPMetaDataOptions}->{$_}
+          ->{samlSPMetaDataOptionsRule};
+
+        if ( length $rule ) {
+            $rule = $self->p->HANDLER->substitute($rule);
+            unless ( $rule = $self->p->HANDLER->buildSub($rule) ) {
+                $self->logger->error( 'SAML SP rule error: '
+                      . $self->p->HANDLER->tsv->{jail}->error );
+                $valid = 0;
+            }
+        }
+
+        # Load per-SP macros
+        my $macros         = $self->conf->{samlSPMetaDataMacros}->{$_};
+        my $compiledMacros = {};
+        for my $macroAttr ( keys %{$macros} ) {
+            my $macroRule = $macros->{$macroAttr};
+            if ( length $macroRule ) {
+                $macroRule = $self->p->HANDLER->substitute($macroRule);
+                if ( $macroRule = $self->p->HANDLER->buildSub($macroRule) ) {
+                    $compiledMacros->{$macroAttr} = $macroRule;
+                }
+                else {
+                    $valid = 0;
+                    $self->logger->error(
+                        "Error processing macro $macroAttr for SAML SP $_"
+                          . $self->p->HANDLER->tsv->{jail}->error );
+                }
+            }
+        }
+
+        if ($valid) {
+            $self->spRules->{$_}         = $rule;
+            $self->spMacros->{$entityID} = $compiledMacros;
+        }
+        else {
+            $self->logger->error("SAML SP $_ has errors and will be ignored");
+            next;
+        }
+
         # Add this SP to Lasso::Server
         # TODO: when Lasso issue #35061 is fixed in all distros,
         # we could load the metadata into a new LassoProvider, extract the
@@ -399,13 +447,7 @@ sub loadSPs {
             next;
         }
 
-        # Store SP entityID and Organization Name
-        my ( $tmp, $entityID ) = ( $sp_metadata =~ /entityID=(['"])(.+?)\1/si );
-
-        # Decode HTML entities from entityID
-        # TODO: see Lasso comment above
-        decode_entities($entityID);
-
+        # Store Org name
         my $name = $self->getOrganizationName( $self->lassoServer, $entityID )
           || ucfirst($_);
         $self->spList->{$entityID}->{confKey} = $_;
@@ -452,34 +494,6 @@ sub loadSPs {
                 "Set signature method $signature_method on SP $_");
         }
 
-        my $rule = $self->conf->{samlSPMetaDataOptions}->{$_}
-          ->{samlSPMetaDataOptionsRule};
-        if ( length $rule ) {
-            $rule = $self->p->HANDLER->substitute($rule);
-            unless ( $rule = $self->p->HANDLER->buildSub($rule) ) {
-                $self->logger->error( 'SAML SP rule error: '
-                      . $self->p->HANDLER->tsv->{jail}->error );
-                next;
-            }
-            $self->spRules->{$_} = $rule;
-        }
-
-        # Load per-SP macros
-        my $macros = $self->conf->{samlSPMetaDataMacros}->{$_};
-        for my $macroAttr ( keys %{$macros} ) {
-            my $macroRule = $macros->{$macroAttr};
-            if ( length $macroRule ) {
-                $macroRule = $self->p->HANDLER->substitute($macroRule);
-                unless ( $macroRule = $self->p->HANDLER->buildSub($macroRule) )
-                {
-                    $self->error( 'SAML SP macro error: '
-                          . $self->p->HANDLER->tsv->{jail}->error );
-                    return 0;
-                }
-                $self->spMacros->{$entityID}->{$macroAttr} = $macroRule;
-            }
-        }
-
         $self->logger->debug("SP $_ added");
     }
 

From d4aed0b3320e4ae72f6f2142c067db905aedb1d2 Mon Sep 17 00:00:00 2001
From: Maxime Besson <maxime.besson@worteks.com>
Date: Wed, 2 Jun 2021 11:07:04 +0200
Subject: [PATCH 13/24] Tidy test lib

---
 lemonldap-ng-portal/t/test-lib.pm | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lemonldap-ng-portal/t/test-lib.pm b/lemonldap-ng-portal/t/test-lib.pm
index b06bf69a8..ab90be1ef 100644
--- a/lemonldap-ng-portal/t/test-lib.pm
+++ b/lemonldap-ng-portal/t/test-lib.pm
@@ -487,9 +487,9 @@ sub expectCspChildOK {
     my ( $res, $host ) = @_;
     return 1 unless ($host);
     my $csp = getHeader( $res, 'Content-Security-Policy' );
-    ok($csp, "Content-Security-Policy header found");
+    ok( $csp, "Content-Security-Policy header found" );
     count(1);
-    like($csp, qr/child-src[^;]*\Q$host\E/, "Found $host in CSP child-src");
+    like( $csp, qr/child-src[^;]*\Q$host\E/, "Found $host in CSP child-src" );
     count(1);
 }
 

From fad337c58c0fbfd30757f2ec78fd9cf768a00297 Mon Sep 17 00:00:00 2001
From: Maxime Besson <maxime.besson@worteks.com>
Date: Wed, 2 Jun 2021 09:35:02 +0200
Subject: [PATCH 14/24] Add hooks on password change (#2510)

---
 .../lib/Lemonldap/NG/Portal/Password/Base.pm  | 43 +++++++++++++++++++
 .../NG/Portal/Plugins/MailPasswordReset.pm    |  2 +-
 .../Lemonldap/NG/Portal/Plugins/RESTServer.pm |  2 +-
 3 files changed, 45 insertions(+), 2 deletions(-)

diff --git a/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Password/Base.pm b/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Password/Base.pm
index e7b7f752e..ab4786887 100644
--- a/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Password/Base.pm
+++ b/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Password/Base.pm
@@ -91,9 +91,23 @@ sub _modifyPassword {
       : PE_OK;
     return $cpq unless ( $cpq == PE_OK );
 
+    my $hook_result = $self->p->processHook(
+        $req, 'passwordBeforeChange', $req->user,
+        $req->data->{newpassword},
+        $req->data->{oldpassword}
+    );
+    return $hook_result if ( $hook_result != PE_OK );
+
     # Call password package
     my $res = $self->modifyPassword( $req, $req->data->{newpassword} );
     if ( $res == PE_PASSWORD_OK ) {
+
+        $self->p->processHook(
+            $req, 'passwordAfterChange', $req->user,
+            $req->data->{newpassword},
+            $req->data->{oldpassword}
+        );
+
         $self->logger->debug( 'Update password in session for ' . $req->user );
         my $userlog = $req->sessionInfo->{ $self->conf->{whatToTrace} };
         my $iplog   = $req->sessionInfo->{ipAddr};
@@ -210,4 +224,33 @@ sub checkPasswordQuality {
     return PE_OK;
 }
 
+# This method should be called when resetting the password
+# in order to call the password hook
+sub setNewPassword {
+    my ( $self, $req, $pwd, $useMail ) = @_;
+
+    my $hook_result =
+      $self->p->processHook( $req, 'passwordBeforeChange', $req->user, $pwd );
+    return $hook_result if ( $hook_result != PE_OK );
+
+    # Delegate to subclass
+    my $mod_result = $self->modifyPassword( $req, $pwd, $useMail );
+
+    if ( $mod_result == PE_PASSWORD_OK ) {
+        $hook_result =
+          $self->p->processHook( $req, 'passwordAfterChange', $req->user,
+            $pwd );
+        if ( $hook_result != PE_OK ) {
+            return $hook_result;
+        }
+        else {
+            return PE_PASSWORD_OK;
+        }
+    }
+    else {
+        return $mod_result;
+    }
+
+}
+
 1;
diff --git a/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Plugins/MailPasswordReset.pm b/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Plugins/MailPasswordReset.pm
index 0662e42d2..63fc35d90 100644
--- a/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Plugins/MailPasswordReset.pm
+++ b/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Plugins/MailPasswordReset.pm
@@ -480,7 +480,7 @@ sub changePwd {
 
     $req->user( $req->{sessionInfo}->{_user} );
     my $result =
-      $self->p->_passwordDB->modifyPassword( $req,
+      $self->p->_passwordDB->setNewPassword( $req,
         $req->data->{newpassword}, 1 );
     $req->{user} = undef;
 
diff --git a/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Plugins/RESTServer.pm b/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Plugins/RESTServer.pm
index c210a5f08..23379a498 100644
--- a/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Plugins/RESTServer.pm
+++ b/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Plugins/RESTServer.pm
@@ -660,7 +660,7 @@ sub pwdReset {
         return $self->p->sendError( $req, "User not found", 400 );
     }
     $result =
-      $self->p->_passwordDB->modifyPassword( $req, $password, $mail ? 1 : 0 );
+      $self->p->_passwordDB->setNewPassword( $req, $password, $mail ? 1 : 0 );
     $req->{user} = undef;
     $self->conf->{portalRequireOldPassword} = $tmp;
 

From 3b76479bda4aafa4e0cdabb1bb6bea2c25792192 Mon Sep 17 00:00:00 2001
From: Maxime Besson <maxime.besson@worteks.com>
Date: Wed, 2 Jun 2021 11:07:53 +0200
Subject: [PATCH 15/24] Add expectPdata function to test lib

---
 lemonldap-ng-portal/t/test-lib.pm | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/lemonldap-ng-portal/t/test-lib.pm b/lemonldap-ng-portal/t/test-lib.pm
index ab90be1ef..83a89b9a1 100644
--- a/lemonldap-ng-portal/t/test-lib.pm
+++ b/lemonldap-ng-portal/t/test-lib.pm
@@ -455,6 +455,23 @@ sub expectCookie {
     return $id;
 }
 
+=head4 expectPdata( $res );
+
+Check if the pdata cookie exists and returns its deserialized value.
+
+=cut
+
+sub expectPdata {
+    my ($res) = @_;
+    my $val = expectCookie( $res, "lemonldappdata" );
+    ok( $val, "Pdata is not empty" );
+    count(1);
+    my $pdata;
+    eval { $pdata = JSON::from_json( uri_unescape($val) ); };
+    diag($@) if $@;
+    return $pdata;
+}
+
 =head4 exceptCspFormOK( $res, $host )
 
 Verify that C<Content-Security-Policy> header allows one to connect to $host.

From 2414fb4751db17c5a3d047dd2bbc978acb4456f4 Mon Sep 17 00:00:00 2001
From: Maxime Besson <maxime.besson@worteks.com>
Date: Wed, 2 Jun 2021 11:08:07 +0200
Subject: [PATCH 16/24] Unit tests for (#2510)

---
 lemonldap-ng-portal/t/02-Password-Demo-Hook.t |  91 ++++++++++++
 .../t/43-MailPasswordReset-Hook.t             | 134 ++++++++++++++++++
 lemonldap-ng-portal/t/PasswordHookPlugin.pm   |  34 +++++
 3 files changed, 259 insertions(+)
 create mode 100644 lemonldap-ng-portal/t/02-Password-Demo-Hook.t
 create mode 100644 lemonldap-ng-portal/t/43-MailPasswordReset-Hook.t
 create mode 100644 lemonldap-ng-portal/t/PasswordHookPlugin.pm

diff --git a/lemonldap-ng-portal/t/02-Password-Demo-Hook.t b/lemonldap-ng-portal/t/02-Password-Demo-Hook.t
new file mode 100644
index 000000000..b6a4fd9cd
--- /dev/null
+++ b/lemonldap-ng-portal/t/02-Password-Demo-Hook.t
@@ -0,0 +1,91 @@
+use Test::More;
+use strict;
+use IO::String;
+use JSON;
+use Lemonldap::NG::Portal::Main::Constants
+  qw(PE_BADOLDPASSWORD PE_PASSWORD_MISMATCH PE_PP_MUST_SUPPLY_OLD_PASSWORD);
+
+require 't/test-lib.pm';
+
+my $res;
+
+my $client = LLNG::Manager::Test->new( {
+        ini => {
+            logLevel                 => 'error',
+            passwordDB               => 'Demo',
+            portalRequireOldPassword => 1,
+            customPlugins            => 't::PasswordHookPlugin',
+        }
+    }
+);
+
+ok( $res = $client->_get( '/', accept => 'text/html' ), 'Get Menu' );
+count(1);
+
+# Try to authenticate
+# -------------------
+ok(
+    $res = $client->_post(
+        '/',
+        IO::String->new('user=dwho&password=dwho'),
+        length => 23
+    ),
+    'Auth query'
+);
+count(1);
+expectOK($res);
+my $id = expectCookie($res);
+
+# Test bad new password
+my $s = buildForm( {
+        oldpassword     => "dwho",
+        newpassword     => "12345",
+        confirmpassword => "12345",
+    }
+);
+ok(
+    $res = $client->_post(
+        '/',
+        IO::String->new($s),
+        cookie => "lemonldap=$id",
+        accept => 'application/json',
+        length => length($s),
+    ),
+    'Bad new password'
+);
+count(1);
+expectReject( $res, 400, 28 );
+
+# Test good new password
+$s = buildForm( {
+        oldpassword     => "dwho",
+        newpassword     => "12346",
+        confirmpassword => "12346",
+    }
+);
+ok(
+    $res = $client->_post(
+        '/',
+        IO::String->new($s),
+        cookie => "lemonldap=$id",
+        accept => 'application/json',
+        length => length($s),
+    ),
+    'Correct new password'
+);
+count(1);
+
+expectReject( $res, 200, 35, "Expect PE_PASSWORD_OK" );
+my $pdata = expectPdata($res);
+is( $pdata->{afterHook}, "dwho-dwho-12346",
+    "passwordAfterChange hook worked as expected" );
+count(1);
+
+# Test $client->logout
+$client->logout($id);
+
+#print STDERR Dumper($res);
+
+clean_sessions();
+
+done_testing( count() );
diff --git a/lemonldap-ng-portal/t/43-MailPasswordReset-Hook.t b/lemonldap-ng-portal/t/43-MailPasswordReset-Hook.t
new file mode 100644
index 000000000..449a2e1be
--- /dev/null
+++ b/lemonldap-ng-portal/t/43-MailPasswordReset-Hook.t
@@ -0,0 +1,134 @@
+use Test::More;
+use strict;
+use IO::String;
+
+BEGIN {
+    eval {
+        require 't/test-lib.pm';
+        require 't/smtp.pm';
+    };
+}
+
+my ( $res, $user, $pwd );
+my $maintests = 15;
+
+SKIP: {
+    eval
+      'require Email::Sender::Simple;use GD::SecurityImage;use Image::Magick;';
+    if ($@) {
+        skip 'Missing dependencies', $maintests;
+    }
+
+    my $client = LLNG::Manager::Test->new( {
+            ini => {
+                logLevel                   => 'error',
+                useSafeJail                => 1,
+                portalDisplayRegister      => 1,
+                authentication             => 'Demo',
+                userDB                     => 'Same',
+                passwordDB                 => 'Demo',
+                captcha_mail_enabled       => 0,
+                portalDisplayResetPassword => 1,
+                customPlugins              => 't::PasswordHookPlugin',
+            }
+        }
+    );
+
+    # Test form
+    # ------------------------
+    ok( $res = $client->_get( '/resetpwd', accept => 'text/html' ),
+        'Reset form', );
+    my ( $host, $url, $query ) = expectForm( $res, '#', undef, 'mail' );
+
+    $query = 'mail=dwho%40badwolf.org';
+
+    # Post email
+    ok(
+        $res = $client->_post(
+            '/resetpwd', IO::String->new($query),
+            length => length($query),
+            accept => 'text/html',
+            cookie => 'llnglanguage=en',
+        ),
+        'Post mail'
+    );
+
+    like( mail(), qr#<span>Hello</span>#, "Found english greeting" );
+
+    ok( mail() =~ m#a href="http://auth.example.com/resetpwd\?(.*?)"#,
+        'Found link in mail' );
+    $query = $1;
+    ok(
+        $res = $client->_get(
+            '/resetpwd',
+            query  => $query,
+            accept => 'text/html'
+        ),
+        'Post mail token received by mail'
+    );
+    ( $host, $url, $query ) = expectForm( $res, '#', undef, 'token' );
+    ok( $res->[2]->[0] =~ /newpassword/s, ' Ask for a new password' );
+
+    my $badquery = $query . '&newpassword=12345&confirmpassword=12345';
+
+    # Post failing password
+    ok(
+        $res = $client->_post(
+            '/resetpwd', IO::String->new($badquery),
+            length => length($badquery),
+            accept => 'text/html'
+        ),
+        'Post new password'
+    );
+    expectPortalError( $res, 28 );
+
+    # Post email again
+    $query = 'mail=dwho%40badwolf.org';
+    ok(
+        $res = $client->_post(
+            '/resetpwd', IO::String->new($query),
+            length => length($query),
+            accept => 'text/html',
+            cookie => 'llnglanguage=en',
+        ),
+        'Post mail'
+    );
+
+    like( mail(), qr#<span>Hello</span>#, "Found english greeting" );
+
+    ok( mail() =~ m#a href="http://auth.example.com/resetpwd\?(.*?)"#,
+        'Found link in mail' );
+    $query = $1;
+    ok(
+        $res = $client->_get(
+            '/resetpwd',
+            query  => $query,
+            accept => 'text/html'
+        ),
+        'Post mail token received by mail'
+    );
+    ( $host, $url, $query ) = expectForm( $res, '#', undef, 'token' );
+    ok( $res->[2]->[0] =~ /newpassword/s, ' Ask for a new password' );
+
+    my $goodquery = $query . '&newpassword=12346&confirmpassword=12346';
+
+    # Post accepted password
+    ok(
+        $res = $client->_post(
+            '/resetpwd', IO::String->new($goodquery),
+            length => length($goodquery),
+            accept => 'text/html'
+        ),
+        'Post new password'
+    );
+    my $pdata = expectPdata($res);
+    is( $pdata->{afterHook}, "dwho--12346",
+        "passwordAfterChange hook worked as expected" );
+
+    ok( mail() =~ /Your password was changed/, 'Password was changed' );
+}
+count($maintests);
+
+clean_sessions();
+
+done_testing( count() );
diff --git a/lemonldap-ng-portal/t/PasswordHookPlugin.pm b/lemonldap-ng-portal/t/PasswordHookPlugin.pm
new file mode 100644
index 000000000..4799b04ba
--- /dev/null
+++ b/lemonldap-ng-portal/t/PasswordHookPlugin.pm
@@ -0,0 +1,34 @@
+package t::PasswordHookPlugin;
+
+use Mouse;
+use Lemonldap::NG::Portal::Main::Constants
+  qw/PE_PP_INSUFFICIENT_PASSWORD_QUALITY PE_OK/;
+extends 'Lemonldap::NG::Portal::Main::Plugin';
+
+use constant hook => {
+    passwordBeforeChange => 'beforeChange',
+    passwordAfterChange  => 'afterChange',
+};
+
+sub init {
+    1;
+}
+
+sub beforeChange {
+    my ( $self, $req, $user, $password, $old ) = @_;
+    if ( $password eq "12345" ) {
+        $self->logger->error("I've got the same combination on my luggage");
+        return PE_PP_INSUFFICIENT_PASSWORD_QUALITY;
+    }
+    return PE_OK;
+}
+
+sub afterChange {
+    my ( $self, $req, $user, $password, $old ) = @_;
+    $old ||= "";
+    $req->pdata->{afterHook} = "$user-$old-$password";
+    $self->logger->debug("Password changed for $user: $old -> $password");
+    return PE_OK;
+}
+
+1;

From 4beaf7d46ca7b160620b7f1c83e9dce69454fe97 Mon Sep 17 00:00:00 2001
From: Maxime Besson <maxime.besson@worteks.com>
Date: Wed, 2 Jun 2021 11:14:39 +0200
Subject: [PATCH 17/24] Documentation for #2510

---
 doc/sources/admin/hooks.rst | 75 +++++++++++++++++++++++++++++++++----
 1 file changed, 67 insertions(+), 8 deletions(-)

diff --git a/doc/sources/admin/hooks.rst b/doc/sources/admin/hooks.rst
index 9f0bacf4a..92f00e93a 100644
--- a/doc/sources/admin/hooks.rst
+++ b/doc/sources/admin/hooks.rst
@@ -62,7 +62,7 @@ This hook is triggered when LemonLDAP::NG is about to generate an Authorization
 The hook's parameters are:
 
 * A hash of the parameters for the OIDC Authorize request, which you can modify
-* the configuration key of the relying party which will receive the token 
+* the configuration key of the relying party which will receive the token
 * A hash of the session keys for the (internal) Authorization Code session
 
 Sample code::
@@ -109,7 +109,7 @@ This hook is triggered when LemonLDAP::NG is generating an ID Token.
 The hook's parameters are:
 
 * A hash of the claims to be contained in the ID Token
-* the configuration key of the relying party which will receive the token 
+* the configuration key of the relying party which will receive the token
 
 Sample code::
 
@@ -187,7 +187,7 @@ The hook's parameter is the Lasso::Login object
 
 Sample code::
 
-   use constant hook => { 
+   use constant hook => {
       samlGotAuthnRequest => 'gotRequest',
    };
 
@@ -208,7 +208,7 @@ The hook's parameter is the Lasso::Login object
 
 Sample code::
 
-   use constant hook => { 
+   use constant hook => {
       samlBuildAuthnResponse => 'buildResponse',
    };
 
@@ -229,7 +229,7 @@ The hook's parameter is the Lasso::Logout object
 
 Sample code::
 
-   use constant hook => { 
+   use constant hook => {
       samlGotLogoutRequest => 'gotLogout',
    };
 
@@ -250,7 +250,7 @@ The hook's parameter is the Lasso::Logout object
 
 Sample code::
 
-   use constant hook => { 
+   use constant hook => {
       samlGotLogoutResponse => 'gotLogoutResponse',
    };
 
@@ -271,7 +271,7 @@ The hook's parameter is the Lasso::Logout object
 
 Sample code::
 
-   use constant hook => { 
+   use constant hook => {
       samlBuildLogoutResponse => 'buildLogoutResponse',
    };
 
@@ -320,7 +320,7 @@ This hook is triggered when LemonLDAP::NG is about to generate a Service Ticket
 The hook's parameters are:
 
 * A hash of the parameters for the CAS request, which you can modify
-* the configuration key of the cas application which will receive the ticket 
+* the configuration key of the cas application which will receive the ticket
 * A hash of the session keys for the (internal) CAS session
 
 Sample code::
@@ -360,3 +360,62 @@ Sample code::
        return PE_OK;
    }
 
+
+Password change hooks
+---------------------
+
+
+passwordBeforeChange
+~~~~~~~~~~~~~~~~~~~~
+
+.. versionadded:: 2.0.12
+
+This hook is triggered when LemonLDAP::NG is about to change or reset a user's password. Returning an error will cancel the password change operation
+
+The hook's parameters are:
+
+* The main user identifier
+* The new password
+* The old password, if relevant
+
+Sample code::
+
+   use constant hook => {
+       passwordBeforeChange => 'blacklistPassword',
+   };
+
+   sub blacklistPassword {
+       my ( $self, $req, $user, $password, $old ) = @_;
+       if ( $password eq "12345" ) {
+           $self->logger->error("I've got the same combination on my luggage");
+           return PE_PP_INSUFFICIENT_PASSWORD_QUALITY;
+       }
+       return PE_OK;
+   }
+
+
+passwordAfterChange
+~~~~~~~~~~~~~~~~~~~
+
+.. versionadded:: 2.0.12
+
+This hook is triggered after LemonLDAP::NG has changed the user's password successfully in the underlying password database
+
+The hook's parameters are:
+
+* The main user identifier
+* The new password
+* The old password, if relevant
+
+Sample code::
+
+   use constant hook => {
+       passwordAfterChange  => 'logPasswordChange',
+   };
+
+   sub logPasswordChange {
+       my ( $self, $req, $user, $password, $old ) = @_;
+       $old ||= "";
+       $self->userLogger->info("Password changed for $user: $old -> $password")
+       return PE_OK;
+   }

From 55cdfefd7b84ab47948d4f3dff530d956d3baab6 Mon Sep 17 00:00:00 2001
From: Maxime Besson <maxime.besson@worteks.com>
Date: Wed, 2 Jun 2021 15:30:48 +0200
Subject: [PATCH 18/24] Workaround for #2472

---
 .../lib/Lemonldap/NG/Portal/Lib/SAML.pm              | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Lib/SAML.pm b/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Lib/SAML.pm
index 6a39681ca..0da9781dc 100644
--- a/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Lib/SAML.pm
+++ b/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Lib/SAML.pm
@@ -753,13 +753,23 @@ sub addProvider {
         and defined $role
         and defined $metadata );
 
+    # https://dev.entrouvert.org/issues/51415
+    my $save_env = $ENV{'SSL_CERT_FILE'};
+    $ENV{'SSL_CERT_FILE'} = "/dev/null";
+
     eval {
         Lasso::Server::add_provider_from_buffer( $server, $role, $metadata,
             $public_key, $ca_cert_chain );
     };
 
-    return $self->checkLassoError($@);
+    if ( defined $save_env ) {
+        $ENV{'SSL_CERT_FILE'} = $save_env;
+    }
+    else {
+        delete $ENV{'SSL_CERT_FILE'};
+    }
 
+    return $self->checkLassoError($@);
 }
 
 ## @method string getOrganizationName(Lasso::Server server, string idp)

From 50225ce4381497607629dd314d9e4247bd77cb6a Mon Sep 17 00:00:00 2001
From: Maxime Besson <maxime.besson@worteks.com>
Date: Thu, 3 Jun 2021 17:40:49 +0200
Subject: [PATCH 19/24] Add option to only allow declared oidc scopes (#2496)

---
 .../lib/Lemonldap/NG/Common/Conf/Constants.pm                | 2 +-
 .../lib/Lemonldap/NG/Common/Conf/ReConstants.pm              | 2 +-
 lemonldap-ng-manager/lib/Lemonldap/NG/Manager/Attributes.pm  | 4 ++++
 .../lib/Lemonldap/NG/Manager/Build/Attributes.pm             | 5 +++++
 lemonldap-ng-manager/lib/Lemonldap/NG/Manager/Build/Tree.pm  | 1 +
 lemonldap-ng-manager/site/htdocs/static/languages/ar.json    | 3 ++-
 lemonldap-ng-manager/site/htdocs/static/languages/de.json    | 3 ++-
 lemonldap-ng-manager/site/htdocs/static/languages/en.json    | 1 +
 lemonldap-ng-manager/site/htdocs/static/languages/es.json    | 3 ++-
 lemonldap-ng-manager/site/htdocs/static/languages/fr.json    | 1 +
 lemonldap-ng-manager/site/htdocs/static/languages/it.json    | 3 ++-
 lemonldap-ng-manager/site/htdocs/static/languages/pl.json    | 3 ++-
 lemonldap-ng-manager/site/htdocs/static/languages/tr.json    | 3 ++-
 lemonldap-ng-manager/site/htdocs/static/languages/vi.json    | 3 ++-
 lemonldap-ng-manager/site/htdocs/static/languages/zh.json    | 3 ++-
 lemonldap-ng-manager/site/htdocs/static/languages/zh_TW.json | 3 ++-
 lemonldap-ng-manager/site/htdocs/static/reverseTree.json     | 2 +-
 lemonldap-ng-manager/site/htdocs/static/struct.json          | 2 +-
 lemonldap-ng-portal/site/htdocs/static/common/js/portal.js   | 4 ++--
 .../site/htdocs/static/common/js/portal.min.js               | 2 +-
 .../site/htdocs/static/common/js/portal.min.js.map           | 2 +-
 21 files changed, 38 insertions(+), 17 deletions(-)

diff --git a/lemonldap-ng-common/lib/Lemonldap/NG/Common/Conf/Constants.pm b/lemonldap-ng-common/lib/Lemonldap/NG/Common/Conf/Constants.pm
index 0493db47b..426559af3 100644
--- a/lemonldap-ng-common/lib/Lemonldap/NG/Common/Conf/Constants.pm
+++ b/lemonldap-ng-common/lib/Lemonldap/NG/Common/Conf/Constants.pm
@@ -31,7 +31,7 @@ use constant DEFAULTCONFBACKENDOPTIONS => (
 );
 our $hashParameters = qr/^(?:(?:l(?:o(?:ca(?:lSessionStorageOption|tionRule)|goutService)|dapExportedVar|wp(?:Ssl)?Opt)|(?:(?:d(?:emo|bi)|webID)ExportedVa|exported(?:Heade|Va)|issuerDBGetParamete)r|f(?:indUser(?:Exclud|Search)ingAttribute|acebookExportedVar)|re(?:moteGlobalStorageOption|st2f(?:Verify|Init)Arg|loadUrl)|g(?:r(?:antSessionRule|oup)|lobalStorageOption)|n(?:otificationStorageOption|ginxCustomHandler)|macro)s|o(?:idc(?:S(?:ervice(?:DynamicRegistrationEx(?:portedVar|traClaim)s|MetaDataAuthnContext)|torageOptions)|RPMetaData(?:(?:Option(?:sExtraClaim)?|ExportedVar|ScopeRule|Macro)s|Node)|OPMetaData(?:(?:ExportedVar|Option)s|J(?:SON|WKS)|Node))|penIdExportedVars)|c(?:as(?:A(?:ppMetaData(?:(?:ExportedVar|Option|Macro)s|Node)|ttributes)|S(?:rvMetaData(?:(?:ExportedVar|Option)s|Node)|torageOptions))|(?:ustom(?:Plugins|Add)Param|heckUserHiddenHeader|ombModule)s)|s(?:aml(?:S(?:PMetaData(?:(?:ExportedAttribute|Option|Macro)s|Node|XML)|torageOptions)|IDPMetaData(?:(?:ExportedAttribute|Option)s|Node|XML))|essionDataToRemember|laveExportedVars|fExtra)|a(?:(?:daptativeAuthenticationLevelR|ut(?:hChoiceMod|oSigninR))ules|pplicationList)|p(?:ersistentStorageOptions|o(?:rtalSkinRules|st))|v(?:hostOptions|irtualHost)|S(?:MTPTLSOpts|SLVarIf))$/;
 our $arrayParameters = qr/^mySessionAuthorizedRWKeys$/;
-our $boolKeys = qr/^(?:s(?:aml(?:IDP(?:MetaDataOptions(?:(?:Check(?:S[LS]OMessageSignatur|Audienc|Tim)|IsPassiv)e|A(?:llow(?:LoginFromIDP|ProxiedAuthn)|daptSessionUtime)|Force(?:Authn|UTF8)|StoreSAMLToken|RelayStateURL)|SSODescriptorWantAuthnRequestsSigned)|S(?:P(?:MetaDataOptions(?:(?:CheckS[LS]OMessageSignatur|OneTimeUs)e|EnableIDPInitiatedURL|ForceUTF8)|SSODescriptor(?:WantAssertion|AuthnRequest)sSigned)|erviceUseCertificateInResponse)|DiscoveryProtocol(?:Activation|IsPassive)|CommonDomainCookieActivation|UseQueryStringSpecific|MetadataForceUTF8)|f(?:RemovedUseNotif|OnlyUpgrade)|kip(?:Upgrade|Renew)Confirmation|oap(?:Session|Config)Server|t(?:ayConnecte|orePasswor)d|laveDisplayLogo|howLanguages|slByAjax)|o(?:idc(?:RPMetaDataOptions(?:A(?:llow(?:(?:ClientCredentials|Password)Grant|Offline)|ccessToken(?:Claims|JWT))|Re(?:freshToken|quirePKCE)|LogoutSessionRequired|IDTokenForceClaims|BypassConsent|Public)|ServiceAllow(?:(?:AuthorizationCode|Implicit|Hybrid)Flow|DynamicRegistration)|OPMetaDataOptions(?:(?:CheckJWTSignatur|UseNonc)e|StoreIDToken))|ldNotifFormat)|c(?:a(?:sS(?:rvMetaDataOptions(?:Gateway|Renew)|trictMatching)|ptcha_(?:register|login|mail)_enabled)|o(?:ntextSwitching(?:Allowed2fModifications|StopWithLogout)|mpactConf|rsEnabled)|heck(?:DevOps(?:Download)?|State|User|XSS)|rowdsec|da)|p(?:ortal(?:Display(?:Re(?:freshMyRights|setPassword|gister)|CertificateResetByMail|GeneratePassword|PasswordPolicy)|ErrorOn(?:ExpiredSession|MailNotFound)|(?:CheckLogin|Statu)s|OpenLinkInNewWindow|ForceAuthn|AntiFrame)|roxyUseSoap)|l(?:dap(?:(?:G(?:roup(?:DecodeSearchedValu|Recursiv)|etUserBeforePasswordChang)|UsePasswordResetAttribut)e|(?:AllowResetExpired|Set)Password|ChangePasswordAsUser|PpolicyControl|ITDS)|oginHistoryEnabled)|no(?:tif(?:ication(?:Server(?:(?:POS|GE)T|DELETE)?|sExplorer)?|y(?:Deleted|Other))|AjaxHook)|i(?:ssuerDB(?:OpenID(?:Connect)?|SAML|CAS|Get)Activation|mpersonationSkipEmptyValues)|to(?:tp2f(?:UserCan(?:Chang|Remov)eKey|DisplayExistingSecret)|kenUseGlobalStorage)|u(?:se(?:RedirectOn(?:Forbidden|Error)|SafeJail)|2fUserCanRemoveKey|pgradeSession)|re(?:st(?:(?:Password|Session|Config|Auth)Server|ExportSecretKeys)|freshSessions)|br(?:uteForceProtection(?:IncrementalTempo)?|owsersDontStorePassword)|d(?:is(?:ablePersistentStorage|playSessionId)|biDynamicHashEnabled)|(?:mai(?:lOnPasswordChang|ntenanc)|vhostMaintenanc)e|g(?:roupsBeforeMacros|lobalLogoutTimer)|a(?:voidAssignment|ctiveTimer)|h(?:ideOldPassword|ttpOnly)|yubikey2fUserCanRemoveKey|krb(?:RemoveDomain|ByJs)|(?:wsdlServ|findUs)er)$/;
+our $boolKeys = qr/^(?:s(?:aml(?:IDP(?:MetaDataOptions(?:(?:Check(?:S[LS]OMessageSignatur|Audienc|Tim)|IsPassiv)e|A(?:llow(?:LoginFromIDP|ProxiedAuthn)|daptSessionUtime)|Force(?:Authn|UTF8)|StoreSAMLToken|RelayStateURL)|SSODescriptorWantAuthnRequestsSigned)|S(?:P(?:MetaDataOptions(?:(?:CheckS[LS]OMessageSignatur|OneTimeUs)e|EnableIDPInitiatedURL|ForceUTF8)|SSODescriptor(?:WantAssertion|AuthnRequest)sSigned)|erviceUseCertificateInResponse)|DiscoveryProtocol(?:Activation|IsPassive)|CommonDomainCookieActivation|UseQueryStringSpecific|MetadataForceUTF8)|f(?:RemovedUseNotif|OnlyUpgrade)|kip(?:Upgrade|Renew)Confirmation|oap(?:Session|Config)Server|t(?:ayConnecte|orePasswor)d|laveDisplayLogo|howLanguages|slByAjax)|o(?:idc(?:RPMetaDataOptions(?:A(?:llow(?:(?:ClientCredentials|Password)Grant|Offline)|ccessToken(?:Claims|JWT))|Re(?:freshToken|quirePKCE)|LogoutSessionRequired|IDTokenForceClaims|BypassConsent|Public)|ServiceAllow(?:(?:AuthorizationCode|Implicit|Hybrid)Flow|DynamicRegistration|OnlyDeclaredScopes)|OPMetaDataOptions(?:(?:CheckJWTSignatur|UseNonc)e|StoreIDToken))|ldNotifFormat)|c(?:a(?:sS(?:rvMetaDataOptions(?:Gateway|Renew)|trictMatching)|ptcha_(?:register|login|mail)_enabled)|o(?:ntextSwitching(?:Allowed2fModifications|StopWithLogout)|mpactConf|rsEnabled)|heck(?:DevOps(?:Download)?|State|User|XSS)|rowdsec|da)|p(?:ortal(?:Display(?:Re(?:freshMyRights|setPassword|gister)|CertificateResetByMail|GeneratePassword|PasswordPolicy)|ErrorOn(?:ExpiredSession|MailNotFound)|(?:CheckLogin|Statu)s|OpenLinkInNewWindow|ForceAuthn|AntiFrame)|roxyUseSoap)|l(?:dap(?:(?:G(?:roup(?:DecodeSearchedValu|Recursiv)|etUserBeforePasswordChang)|UsePasswordResetAttribut)e|(?:AllowResetExpired|Set)Password|ChangePasswordAsUser|PpolicyControl|ITDS)|oginHistoryEnabled)|no(?:tif(?:ication(?:Server(?:(?:POS|GE)T|DELETE)?|sExplorer)?|y(?:Deleted|Other))|AjaxHook)|i(?:ssuerDB(?:OpenID(?:Connect)?|SAML|CAS|Get)Activation|mpersonationSkipEmptyValues)|to(?:tp2f(?:UserCan(?:Chang|Remov)eKey|DisplayExistingSecret)|kenUseGlobalStorage)|u(?:se(?:RedirectOn(?:Forbidden|Error)|SafeJail)|2fUserCanRemoveKey|pgradeSession)|re(?:st(?:(?:Password|Session|Config|Auth)Server|ExportSecretKeys)|freshSessions)|br(?:uteForceProtection(?:IncrementalTempo)?|owsersDontStorePassword)|d(?:is(?:ablePersistentStorage|playSessionId)|biDynamicHashEnabled)|(?:mai(?:lOnPasswordChang|ntenanc)|vhostMaintenanc)e|g(?:roupsBeforeMacros|lobalLogoutTimer)|a(?:voidAssignment|ctiveTimer)|h(?:ideOldPassword|ttpOnly)|yubikey2fUserCanRemoveKey|krb(?:RemoveDomain|ByJs)|(?:wsdlServ|findUs)er)$/;
 
 our @sessionTypes = ( 'remoteGlobal', 'global', 'localSession', 'persistent', 'saml', 'oidc', 'cas' );
 
diff --git a/lemonldap-ng-common/lib/Lemonldap/NG/Common/Conf/ReConstants.pm b/lemonldap-ng-common/lib/Lemonldap/NG/Common/Conf/ReConstants.pm
index 96d83225c..f56237dc6 100644
--- a/lemonldap-ng-common/lib/Lemonldap/NG/Common/Conf/ReConstants.pm
+++ b/lemonldap-ng-common/lib/Lemonldap/NG/Common/Conf/ReConstants.pm
@@ -69,6 +69,6 @@ our $issuerParameters = {
   issuerOptions => [qw(issuersTimeout)],
 };
 our $samlServiceParameters = [qw(samlEntityID samlServicePrivateKeySig samlServicePrivateKeySigPwd samlServicePublicKeySig samlServicePrivateKeyEnc samlServicePrivateKeyEncPwd samlServicePublicKeyEnc samlServiceUseCertificateInResponse samlServiceSignatureMethod samlNameIDFormatMapEmail samlNameIDFormatMapX509 samlNameIDFormatMapWindows samlNameIDFormatMapKerberos samlAuthnContextMapPassword samlAuthnContextMapPasswordProtectedTransport samlAuthnContextMapTLSClient samlAuthnContextMapKerberos samlOrganizationDisplayName samlOrganizationName samlOrganizationURL samlSPSSODescriptorAuthnRequestsSigned samlSPSSODescriptorWantAssertionsSigned samlSPSSODescriptorSingleLogoutServiceHTTPRedirect samlSPSSODescriptorSingleLogoutServiceHTTPPost samlSPSSODescriptorSingleLogoutServiceSOAP samlSPSSODescriptorAssertionConsumerServiceHTTPArtifact samlSPSSODescriptorAssertionConsumerServiceHTTPPost samlSPSSODescriptorArtifactResolutionServiceArtifact samlIDPSSODescriptorWantAuthnRequestsSigned samlIDPSSODescriptorSingleSignOnServiceHTTPRedirect samlIDPSSODescriptorSingleSignOnServiceHTTPPost samlIDPSSODescriptorSingleSignOnServiceHTTPArtifact samlIDPSSODescriptorSingleLogoutServiceHTTPRedirect samlIDPSSODescriptorSingleLogoutServiceHTTPPost samlIDPSSODescriptorSingleLogoutServiceSOAP samlIDPSSODescriptorArtifactResolutionServiceArtifact samlAttributeAuthorityDescriptorAttributeServiceSOAP samlMetadataForceUTF8 samlRelayStateTimeout samlUseQueryStringSpecific samlOverrideIDPEntityID samlStorage samlStorageOptions samlCommonDomainCookieActivation samlCommonDomainCookieDomain samlCommonDomainCookieReader samlCommonDomainCookieWriter samlDiscoveryProtocolActivation samlDiscoveryProtocolURL samlDiscoveryProtocolPolicy samlDiscoveryProtocolIsPassive)];
-our $oidcServiceParameters = [qw(oidcServiceMetaDataIssuer oidcServiceMetaDataAuthorizeURI oidcServiceMetaDataTokenURI oidcServiceMetaDataUserInfoURI oidcServiceMetaDataJWKSURI oidcServiceMetaDataRegistrationURI oidcServiceMetaDataIntrospectionURI oidcServiceMetaDataEndSessionURI oidcServiceMetaDataCheckSessionURI oidcServiceMetaDataFrontChannelURI oidcServiceMetaDataBackChannelURI oidcServiceMetaDataAuthnContext oidcServicePrivateKeySig oidcServicePublicKeySig oidcServiceKeyIdSig oidcServiceAllowDynamicRegistration oidcServiceAllowAuthorizationCodeFlow oidcServiceAllowImplicitFlow oidcServiceAllowHybridFlow oidcServiceAuthorizationCodeExpiration oidcServiceAccessTokenExpiration oidcServiceIDTokenExpiration oidcServiceOfflineSessionExpiration oidcStorage oidcStorageOptions oidcServiceDynamicRegistrationExportedVars oidcServiceDynamicRegistrationExtraClaims)];
+our $oidcServiceParameters = [qw(oidcServiceMetaDataIssuer oidcServiceMetaDataAuthorizeURI oidcServiceMetaDataTokenURI oidcServiceMetaDataUserInfoURI oidcServiceMetaDataJWKSURI oidcServiceMetaDataRegistrationURI oidcServiceMetaDataIntrospectionURI oidcServiceMetaDataEndSessionURI oidcServiceMetaDataCheckSessionURI oidcServiceMetaDataFrontChannelURI oidcServiceMetaDataBackChannelURI oidcServiceMetaDataAuthnContext oidcServicePrivateKeySig oidcServicePublicKeySig oidcServiceKeyIdSig oidcServiceAllowDynamicRegistration oidcServiceAllowOnlyDeclaredScopes oidcServiceAllowAuthorizationCodeFlow oidcServiceAllowImplicitFlow oidcServiceAllowHybridFlow oidcServiceAuthorizationCodeExpiration oidcServiceAccessTokenExpiration oidcServiceIDTokenExpiration oidcServiceOfflineSessionExpiration oidcStorage oidcStorageOptions oidcServiceDynamicRegistrationExportedVars oidcServiceDynamicRegistrationExtraClaims)];
 
 1;
diff --git a/lemonldap-ng-manager/lib/Lemonldap/NG/Manager/Attributes.pm b/lemonldap-ng-manager/lib/Lemonldap/NG/Manager/Attributes.pm
index 006a78388..ab09a55df 100644
--- a/lemonldap-ng-manager/lib/Lemonldap/NG/Manager/Attributes.pm
+++ b/lemonldap-ng-manager/lib/Lemonldap/NG/Manager/Attributes.pm
@@ -2484,6 +2484,10 @@ m[^(?:ldapi://[^/]*/?|\w[\w\-\.]*(?::\d{1,5})?|ldap(?:s|\+tls)?://\w[\w\-\.]*(?:
             'default' => 0,
             'type'    => 'bool'
         },
+        'oidcServiceAllowOnlyDeclaredScopes' => {
+            'default' => 0,
+            'type'    => 'bool'
+        },
         'oidcServiceAuthorizationCodeExpiration' => {
             'default' => 60,
             'type'    => 'int'
diff --git a/lemonldap-ng-manager/lib/Lemonldap/NG/Manager/Build/Attributes.pm b/lemonldap-ng-manager/lib/Lemonldap/NG/Manager/Build/Attributes.pm
index d5161bc84..e0f57ffb8 100644
--- a/lemonldap-ng-manager/lib/Lemonldap/NG/Manager/Build/Attributes.pm
+++ b/lemonldap-ng-manager/lib/Lemonldap/NG/Manager/Build/Attributes.pm
@@ -4087,6 +4087,11 @@ m{^(?:ldapi://[^/]*/?|\w[\w\-\.]*(?::\d{1,5})?|ldap(?:s|\+tls)?://\w[\w\-\.]*(?:
             default       => 0,
             documentation => 'OpenID Connect allow dynamic client registration',
         },
+        oidcServiceAllowOnlyDeclaredScopes => {
+            type          => 'bool',
+            default       => 0,
+            documentation => 'OpenID Connect allow only declared scopes',
+        },
         oidcServiceAllowAuthorizationCodeFlow => {
             type          => 'bool',
             default       => 1,
diff --git a/lemonldap-ng-manager/lib/Lemonldap/NG/Manager/Build/Tree.pm b/lemonldap-ng-manager/lib/Lemonldap/NG/Manager/Build/Tree.pm
index 85bd75178..dbcc4143f 100644
--- a/lemonldap-ng-manager/lib/Lemonldap/NG/Manager/Build/Tree.pm
+++ b/lemonldap-ng-manager/lib/Lemonldap/NG/Manager/Build/Tree.pm
@@ -1326,6 +1326,7 @@ sub tree {
                             ],
                         },
                         'oidcServiceAllowDynamicRegistration',
+                        'oidcServiceAllowOnlyDeclaredScopes',
                         'oidcServiceAllowAuthorizationCodeFlow',
                         'oidcServiceAllowImplicitFlow',
                         'oidcServiceAllowHybridFlow',
diff --git a/lemonldap-ng-manager/site/htdocs/static/languages/ar.json b/lemonldap-ng-manager/site/htdocs/static/languages/ar.json
index f79f98c61..da711c87d 100644
--- a/lemonldap-ng-manager/site/htdocs/static/languages/ar.json
+++ b/lemonldap-ng-manager/site/htdocs/static/languages/ar.json
@@ -695,6 +695,7 @@
 "oidcServiceAllowHybridFlow":"تدفق هجين",
 "oidcServiceAllowImplicitFlow":"التدفق الضمني",
 "oidcServiceAllowOffline":"Allow offline access",
+"oidcServiceAllowOnlyDeclaredScopes":"Only allow declared scopes",
 "oidcServiceAuthorizationCodeExpiration":"Authorization Code expiration",
 "oidcServiceDynamicRegistrationExportedVars":"Exported vars for dynamic registration",
 "oidcServiceDynamicRegistrationExtraClaims":"Extra claims for dynamic registration",
@@ -1205,4 +1206,4 @@
 "yubikey2fUrl":"خدمة أل يو أر ل",
 "yubikey2fUserCanRemoveKey":"Allow user to remove Yubikey",
 "zeroConfExplanations":"لا يحتوي الخادم على إعدادات. استخدام قالب لحفظ الأول"
-}
\ No newline at end of file
+}
diff --git a/lemonldap-ng-manager/site/htdocs/static/languages/de.json b/lemonldap-ng-manager/site/htdocs/static/languages/de.json
index 09292afa9..909375892 100644
--- a/lemonldap-ng-manager/site/htdocs/static/languages/de.json
+++ b/lemonldap-ng-manager/site/htdocs/static/languages/de.json
@@ -695,6 +695,7 @@
 "oidcServiceAllowHybridFlow":"Hybrid Flow",
 "oidcServiceAllowImplicitFlow":"Implicit Flow",
 "oidcServiceAllowOffline":"Allow offline access",
+"oidcServiceAllowOnlyDeclaredScopes":"Only allow declared scopes",
 "oidcServiceAuthorizationCodeExpiration":"Authorization Code expiration",
 "oidcServiceDynamicRegistrationExportedVars":"Exported vars for dynamic registration",
 "oidcServiceDynamicRegistrationExtraClaims":"Extra claims for dynamic registration",
@@ -1205,4 +1206,4 @@
 "yubikey2fUrl":"Service URL",
 "yubikey2fUserCanRemoveKey":"Allow user to remove Yubikey",
 "zeroConfExplanations":"Server has no configuration. Use template to save the first."
-}
\ No newline at end of file
+}
diff --git a/lemonldap-ng-manager/site/htdocs/static/languages/en.json b/lemonldap-ng-manager/site/htdocs/static/languages/en.json
index 5df8f46b6..2641df72d 100644
--- a/lemonldap-ng-manager/site/htdocs/static/languages/en.json
+++ b/lemonldap-ng-manager/site/htdocs/static/languages/en.json
@@ -695,6 +695,7 @@
 "oidcServiceAllowHybridFlow":"Hybrid Flow",
 "oidcServiceAllowImplicitFlow":"Implicit Flow",
 "oidcServiceAllowOffline":"Allow offline access",
+"oidcServiceAllowOnlyDeclaredScopes":"Only allow declared scopes",
 "oidcServiceAuthorizationCodeExpiration":"Authorization Code expiration",
 "oidcServiceDynamicRegistrationExportedVars":"Exported vars for dynamic registration",
 "oidcServiceDynamicRegistrationExtraClaims":"Extra claims for dynamic registration",
diff --git a/lemonldap-ng-manager/site/htdocs/static/languages/es.json b/lemonldap-ng-manager/site/htdocs/static/languages/es.json
index 9efb713a0..35bcb696a 100644
--- a/lemonldap-ng-manager/site/htdocs/static/languages/es.json
+++ b/lemonldap-ng-manager/site/htdocs/static/languages/es.json
@@ -695,6 +695,7 @@
 "oidcServiceAllowHybridFlow":"Flujo híbrido",
 "oidcServiceAllowImplicitFlow":"Flujo implícito",
 "oidcServiceAllowOffline":"Permitir acceso offline",
+"oidcServiceAllowOnlyDeclaredScopes":"Only allow declared scopes",
 "oidcServiceAuthorizationCodeExpiration":"Caducidad del código de autorización",
 "oidcServiceDynamicRegistrationExportedVars":"Variables exportadas para registro dinámico",
 "oidcServiceDynamicRegistrationExtraClaims":"Extra claims for dynamic registration",
@@ -1205,4 +1206,4 @@
 "yubikey2fUrl":"Service URL",
 "yubikey2fUserCanRemoveKey":"Allow user to remove Yubikey",
 "zeroConfExplanations":"Server has no configuration. Use template to save the first."
-}
\ No newline at end of file
+}
diff --git a/lemonldap-ng-manager/site/htdocs/static/languages/fr.json b/lemonldap-ng-manager/site/htdocs/static/languages/fr.json
index 36e396dc7..8042b90dc 100644
--- a/lemonldap-ng-manager/site/htdocs/static/languages/fr.json
+++ b/lemonldap-ng-manager/site/htdocs/static/languages/fr.json
@@ -695,6 +695,7 @@
 "oidcServiceAllowHybridFlow":"Hybrid Flow",
 "oidcServiceAllowImplicitFlow":"Implicit Flow",
 "oidcServiceAllowOffline":"Autoriser l'accès hors ligne",
+"oidcServiceAllowOnlyDeclaredScopes":"N'autoriser que les scopes déclarés",
 "oidcServiceAuthorizationCodeExpiration":"Expiration des codes d'autorisation",
 "oidcServiceDynamicRegistrationExportedVars":"Variables exportées pour l'enregistrement dynamique",
 "oidcServiceDynamicRegistrationExtraClaims":"Claims supplémentaires pour l'enregistrement dynamique",
diff --git a/lemonldap-ng-manager/site/htdocs/static/languages/it.json b/lemonldap-ng-manager/site/htdocs/static/languages/it.json
index c578c8749..167c1f637 100644
--- a/lemonldap-ng-manager/site/htdocs/static/languages/it.json
+++ b/lemonldap-ng-manager/site/htdocs/static/languages/it.json
@@ -695,6 +695,7 @@
 "oidcServiceAllowHybridFlow":"Flusso ibrido",
 "oidcServiceAllowImplicitFlow":"Flusso implicito",
 "oidcServiceAllowOffline":"Allow offline access",
+"oidcServiceAllowOnlyDeclaredScopes":"Only allow declared scopes",
 "oidcServiceAuthorizationCodeExpiration":"Authorization Code expiration",
 "oidcServiceDynamicRegistrationExportedVars":"Exported vars for dynamic registration",
 "oidcServiceDynamicRegistrationExtraClaims":"Extra claims for dynamic registration",
@@ -1205,4 +1206,4 @@
 "yubikey2fUrl":"URL del servizio",
 "yubikey2fUserCanRemoveKey":"Autorizza l'utente a rimuovere la Yubikey",
 "zeroConfExplanations":"Il server non ha alcuna configurazione. Utilizza il modello per salvare il primo."
-}
\ No newline at end of file
+}
diff --git a/lemonldap-ng-manager/site/htdocs/static/languages/pl.json b/lemonldap-ng-manager/site/htdocs/static/languages/pl.json
index 1af0383b1..a2e20812f 100644
--- a/lemonldap-ng-manager/site/htdocs/static/languages/pl.json
+++ b/lemonldap-ng-manager/site/htdocs/static/languages/pl.json
@@ -695,6 +695,7 @@
 "oidcServiceAllowHybridFlow":"Przepływ hybrydowy",
 "oidcServiceAllowImplicitFlow":"Implikowany przepływ",
 "oidcServiceAllowOffline":"Zezwalaj na dostęp offline",
+"oidcServiceAllowOnlyDeclaredScopes":"Only allow declared scopes",
 "oidcServiceAuthorizationCodeExpiration":"Wygaśnięcie kodu autoryzacji",
 "oidcServiceDynamicRegistrationExportedVars":"Zmienne wyeksportowane do dynamicznej rejestracji",
 "oidcServiceDynamicRegistrationExtraClaims":"Dodatkowe roszczenia dotyczące rejestracji dynamicznej",
@@ -1205,4 +1206,4 @@
 "yubikey2fUrl":"URL usługi",
 "yubikey2fUserCanRemoveKey":"Pozwól użytkownikowi usunąć Yubikey",
 "zeroConfExplanations":"Serwer nie ma konfiguracji. Użyj szablonu, aby zapisać pierwszy."
-}
\ No newline at end of file
+}
diff --git a/lemonldap-ng-manager/site/htdocs/static/languages/tr.json b/lemonldap-ng-manager/site/htdocs/static/languages/tr.json
index 9e167926e..7f48f00fd 100644
--- a/lemonldap-ng-manager/site/htdocs/static/languages/tr.json
+++ b/lemonldap-ng-manager/site/htdocs/static/languages/tr.json
@@ -695,6 +695,7 @@
 "oidcServiceAllowHybridFlow":"Hibrit Akış",
 "oidcServiceAllowImplicitFlow":"Kapalı Akış",
 "oidcServiceAllowOffline":"Çevrimdışı erişime izin ver",
+"oidcServiceAllowOnlyDeclaredScopes":"Only allow declared scopes",
 "oidcServiceAuthorizationCodeExpiration":"Yetkilendirme Kodu sona erme",
 "oidcServiceDynamicRegistrationExportedVars":"Dinamik kayıtlanma için dışa aktarılan değişkenler",
 "oidcServiceDynamicRegistrationExtraClaims":"Dinamik kayıtlanma için ekstra talepler",
@@ -1205,4 +1206,4 @@
 "yubikey2fUrl":"Servis URL'si",
 "yubikey2fUserCanRemoveKey":"Yubikey'i kaldırmak için kullanıcıya izin ver",
 "zeroConfExplanations":"Sunucunun yapılandırması yok. Şimdi bir tane kaydetmek için şablonu kullanın."
-}
\ No newline at end of file
+}
diff --git a/lemonldap-ng-manager/site/htdocs/static/languages/vi.json b/lemonldap-ng-manager/site/htdocs/static/languages/vi.json
index 928af38a6..291717b65 100644
--- a/lemonldap-ng-manager/site/htdocs/static/languages/vi.json
+++ b/lemonldap-ng-manager/site/htdocs/static/languages/vi.json
@@ -695,6 +695,7 @@
 "oidcServiceAllowHybridFlow":"Dòng chảy hỗn hợp",
 "oidcServiceAllowImplicitFlow":"Dòng chảy ngầm",
 "oidcServiceAllowOffline":"Allow offline access",
+"oidcServiceAllowOnlyDeclaredScopes":"Only allow declared scopes",
 "oidcServiceAuthorizationCodeExpiration":"Authorization Code expiration",
 "oidcServiceDynamicRegistrationExportedVars":"Exported vars for dynamic registration",
 "oidcServiceDynamicRegistrationExtraClaims":"Extra claims for dynamic registration",
@@ -1205,4 +1206,4 @@
 "yubikey2fUrl":"Dịch vụ URL",
 "yubikey2fUserCanRemoveKey":"Allow user to remove Yubikey",
 "zeroConfExplanations":"Máy chủ không có cấu hình. Sử dụng mẫu để lưu đầu tiên. "
-}
\ No newline at end of file
+}
diff --git a/lemonldap-ng-manager/site/htdocs/static/languages/zh.json b/lemonldap-ng-manager/site/htdocs/static/languages/zh.json
index 7ede4c61d..03f1bfd5e 100644
--- a/lemonldap-ng-manager/site/htdocs/static/languages/zh.json
+++ b/lemonldap-ng-manager/site/htdocs/static/languages/zh.json
@@ -695,6 +695,7 @@
 "oidcServiceAllowHybridFlow":"Hybrid Flow",
 "oidcServiceAllowImplicitFlow":"Implicit Flow",
 "oidcServiceAllowOffline":"Allow offline access",
+"oidcServiceAllowOnlyDeclaredScopes":"Only allow declared scopes",
 "oidcServiceAuthorizationCodeExpiration":"Authorization Code expiration",
 "oidcServiceDynamicRegistrationExportedVars":"Exported vars for dynamic registration",
 "oidcServiceDynamicRegistrationExtraClaims":"Extra claims for dynamic registration",
@@ -1205,4 +1206,4 @@
 "yubikey2fUrl":"Service URL",
 "yubikey2fUserCanRemoveKey":"Allow user to remove Yubikey",
 "zeroConfExplanations":"Server has no configuration. Use template to save the first."
-}
\ No newline at end of file
+}
diff --git a/lemonldap-ng-manager/site/htdocs/static/languages/zh_TW.json b/lemonldap-ng-manager/site/htdocs/static/languages/zh_TW.json
index 968594590..27ae63374 100644
--- a/lemonldap-ng-manager/site/htdocs/static/languages/zh_TW.json
+++ b/lemonldap-ng-manager/site/htdocs/static/languages/zh_TW.json
@@ -695,6 +695,7 @@
 "oidcServiceAllowHybridFlow":"混合流程",
 "oidcServiceAllowImplicitFlow":"內含流程",
 "oidcServiceAllowOffline":"允許離線存取",
+"oidcServiceAllowOnlyDeclaredScopes":"Only allow declared scopes",
 "oidcServiceAuthorizationCodeExpiration":"授權碼到期",
 "oidcServiceDynamicRegistrationExportedVars":"用於動態註冊的已匯出變數",
 "oidcServiceDynamicRegistrationExtraClaims":"動態註冊的額外聲明",
@@ -1205,4 +1206,4 @@
 "yubikey2fUrl":"服務 URL",
 "yubikey2fUserCanRemoveKey":"允許使用者移除 Yubikey",
 "zeroConfExplanations":"伺服器未設定。使用飯本來儲存第一個。"
-}
\ No newline at end of file
+}
diff --git a/lemonldap-ng-manager/site/htdocs/static/reverseTree.json b/lemonldap-ng-manager/site/htdocs/static/reverseTree.json
index f44d1c206..2dc96ca55 100644
--- a/lemonldap-ng-manager/site/htdocs/static/reverseTree.json
+++ b/lemonldap-ng-manager/site/htdocs/static/reverseTree.json
@@ -1 +1 @@
-{"ADPwdExpireWarning":"generalParameters/authParams/adParams","ADPwdMaxAge":"generalParameters/authParams/adParams","AuthLDAPFilter":"generalParameters/authParams/ldapParams/ldapFilters","LDAPFilter":"generalParameters/authParams/ldapParams/ldapFilters","SMTPAuthPass":"generalParameters/advancedParams/SMTP","SMTPAuthUser":"generalParameters/advancedParams/SMTP","SMTPPort":"generalParameters/advancedParams/SMTP","SMTPServer":"generalParameters/advancedParams/SMTP","SMTPTLS":"generalParameters/advancedParams/SMTP","SMTPTLSOpts":"generalParameters/advancedParams/SMTP","SSLAuthnLevel":"generalParameters/authParams/sslParams","SSLVar":"generalParameters/authParams/sslParams","SSLVarIf":"generalParameters/authParams/sslParams","activeTimer":"generalParameters/advancedParams/forms","adaptativeAuthenticationLevelRules":"generalParameters/plugins","apacheAuthnLevel":"generalParameters/authParams/apacheParams","applicationList":"generalParameters/portalParams/portalMenu","authChoiceAuthBasic":"generalParameters/authParams/choiceParams","authChoiceFindUser":"generalParameters/authParams/choiceParams","authChoiceModules":"generalParameters/authParams/choiceParams","authChoiceParam":"generalParameters/authParams/choiceParams","authentication":"generalParameters/authParams","autoSigninRules":"generalParameters/plugins/autoSignin","avoidAssignment":"generalParameters/advancedParams/security","browsersDontStorePassword":"generalParameters/advancedParams/security","bruteForceProtection":"generalParameters/advancedParams/security/bruteForceAttackProtection","bruteForceProtectionIncrementalTempo":"generalParameters/advancedParams/security/bruteForceAttackProtection","bruteForceProtectionLockTimes":"generalParameters/advancedParams/security/bruteForceAttackProtection","bruteForceProtectionMaxFailed":"generalParameters/advancedParams/security/bruteForceAttackProtection","bruteForceProtectionTempo":"generalParameters/advancedParams/security/bruteForceAttackProtection","captcha_login_enabled":"generalParameters/portalParams/portalCaptcha","captcha_mail_enabled":"generalParameters/portalParams/portalCaptcha","captcha_register_enabled":"generalParameters/portalParams/portalCaptcha","captcha_size":"generalParameters/portalParams/portalCaptcha","casAccessControlPolicy":"casServiceMetadata","casAppMetaDataNodes":"","casAttr":"casServiceMetadata","casAttributes":"casServiceMetadata","casAuthnLevel":"generalParameters/authParams/casParams","casSrvMetaDataNodes":"","casStorage":"casServiceMetadata","casStorageOptions":"casServiceMetadata","casStrictMatching":"casServiceMetadata","cda":"generalParameters/cookieParams","certificateResetByMailCeaAttribute":"generalParameters/plugins/certificateResetByMailManagement/mailOther","certificateResetByMailCertificateAttribute":"generalParameters/plugins/certificateResetByMailManagement/mailOther","certificateResetByMailStep1Body":"generalParameters/plugins/certificateResetByMailManagement/certificateMailContent","certificateResetByMailStep1Subject":"generalParameters/plugins/certificateResetByMailManagement/certificateMailContent","certificateResetByMailStep2Body":"generalParameters/plugins/certificateResetByMailManagement/certificateMailContent","certificateResetByMailStep2Subject":"generalParameters/plugins/certificateResetByMailManagement/certificateMailContent","certificateResetByMailURL":"generalParameters/plugins/certificateResetByMailManagement/mailOther","certificateResetByMailValidityDelay":"generalParameters/plugins/certificateResetByMailManagement/mailOther","checkDevOps":"generalParameters/plugins/devOpsCheck","checkDevOpsDownload":"generalParameters/plugins/devOpsCheck","checkState":"generalParameters/plugins/stateCheck","checkStateSecret":"generalParameters/plugins/stateCheck","checkUser":"generalParameters/plugins/checkUsers","checkUserDisplayComputedSession":"generalParameters/plugins/checkUsers/checkUserDisplay","checkUserDisplayEmptyHeaders":"generalParameters/plugins/checkUsers/checkUserDisplay","checkUserDisplayEmptyValues":"generalParameters/plugins/checkUsers/checkUserDisplay","checkUserDisplayNormalizedHeaders":"generalParameters/plugins/checkUsers/checkUserDisplay","checkUserDisplayPersistentInfo":"generalParameters/plugins/checkUsers/checkUserDisplay","checkUserHiddenAttributes":"generalParameters/plugins/checkUsers","checkUserHiddenHeaders":"generalParameters/plugins/checkUsers","checkUserIdRule":"generalParameters/plugins/checkUsers","checkUserSearchAttributes":"generalParameters/plugins/checkUsers","checkUserUnrestrictedUsersRule":"generalParameters/plugins/checkUsers","checkXSS":"generalParameters/advancedParams/security","combModules":"generalParameters/authParams/combinationParams","combination":"generalParameters/authParams/combinationParams","compactConf":"generalParameters/reloadParams","confirmFormMethod":"generalParameters/advancedParams/forms","contextSwitchingAllowed2fModifications":"generalParameters/plugins/contextSwitching","contextSwitchingIdRule":"generalParameters/plugins/contextSwitching","contextSwitchingRule":"generalParameters/plugins/contextSwitching","contextSwitchingStopWithLogout":"generalParameters/plugins/contextSwitching","contextSwitchingUnrestrictedUsersRule":"generalParameters/plugins/contextSwitching","cookieExpiration":"generalParameters/cookieParams","cookieName":"generalParameters/cookieParams","corsAllow_Credentials":"generalParameters/advancedParams/security/crossOrigineResourceSharing","corsAllow_Headers":"generalParameters/advancedParams/security/crossOrigineResourceSharing","corsAllow_Methods":"generalParameters/advancedParams/security/crossOrigineResourceSharing","corsAllow_Origin":"generalParameters/advancedParams/security/crossOrigineResourceSharing","corsEnabled":"generalParameters/advancedParams/security/crossOrigineResourceSharing","corsExpose_Headers":"generalParameters/advancedParams/security/crossOrigineResourceSharing","corsMax_Age":"generalParameters/advancedParams/security/crossOrigineResourceSharing","crowdsec":"generalParameters/advancedParams/security/CrowdSecPlugin","crowdsecAction":"generalParameters/advancedParams/security/CrowdSecPlugin","crowdsecKey":"generalParameters/advancedParams/security/CrowdSecPlugin","crowdsecUrl":"generalParameters/advancedParams/security/CrowdSecPlugin","cspConnect":"generalParameters/advancedParams/security/contentSecurityPolicy","cspDefault":"generalParameters/advancedParams/security/contentSecurityPolicy","cspFont":"generalParameters/advancedParams/security/contentSecurityPolicy","cspFormAction":"generalParameters/advancedParams/security/contentSecurityPolicy","cspFrameAncestors":"generalParameters/advancedParams/security/contentSecurityPolicy","cspImg":"generalParameters/advancedParams/security/contentSecurityPolicy","cspScript":"generalParameters/advancedParams/security/contentSecurityPolicy","cspStyle":"generalParameters/advancedParams/security/contentSecurityPolicy","customAddParams":"generalParameters/authParams/customParams","customAuth":"generalParameters/authParams/customParams","customFunctions":"generalParameters/advancedParams","customPassword":"generalParameters/authParams/customParams","customPlugins":"generalParameters/plugins/customPluginsNode","customPluginsParams":"generalParameters/plugins/customPluginsNode","customRegister":"generalParameters/authParams/customParams","customResetCertByMail":"generalParameters/authParams/customParams","customToTrace":"generalParameters/logParams","customUserDB":"generalParameters/authParams/customParams","dbiAuthChain":"generalParameters/authParams/dbiParams/dbiConnection/dbiConnectionAuth","dbiAuthLoginCol":"generalParameters/authParams/dbiParams/dbiSchema","dbiAuthPassword":"generalParameters/authParams/dbiParams/dbiConnection/dbiConnectionAuth","dbiAuthPasswordCol":"generalParameters/authParams/dbiParams/dbiSchema","dbiAuthPasswordHash":"generalParameters/authParams/dbiParams/dbiPassword","dbiAuthTable":"generalParameters/authParams/dbiParams/dbiSchema","dbiAuthUser":"generalParameters/authParams/dbiParams/dbiConnection/dbiConnectionAuth","dbiAuthnLevel":"generalParameters/authParams/dbiParams","dbiDynamicHashEnabled":"generalParameters/authParams/dbiParams/dbiPassword/dbiDynamicHash","dbiDynamicHashNewPasswordScheme":"generalParameters/authParams/dbiParams/dbiPassword/dbiDynamicHash","dbiDynamicHashValidSaltedSchemes":"generalParameters/authParams/dbiParams/dbiPassword/dbiDynamicHash","dbiDynamicHashValidSchemes":"generalParameters/authParams/dbiParams/dbiPassword/dbiDynamicHash","dbiExportedVars":"generalParameters/authParams/dbiParams","dbiPasswordMailCol":"generalParameters/authParams/dbiParams/dbiSchema","dbiUserChain":"generalParameters/authParams/dbiParams/dbiConnection/dbiConnectionUser","dbiUserPassword":"generalParameters/authParams/dbiParams/dbiConnection/dbiConnectionUser","dbiUserTable":"generalParameters/authParams/dbiParams/dbiSchema","dbiUserUser":"generalParameters/authParams/dbiParams/dbiConnection/dbiConnectionUser","decryptValueFunctions":"generalParameters/plugins/decryptValue","decryptValueRule":"generalParameters/plugins/decryptValue","demoExportedVars":"generalParameters/authParams/demoParams","disablePersistentStorage":"generalParameters/sessionParams/persistentSessions","displaySessionId":"generalParameters/sessionParams","domain":"generalParameters/cookieParams","exportedAttr":"generalParameters/plugins/portalServers","exportedVars":"variables","ext2FSendCommand":"generalParameters/secondFactors/ext2f","ext2FValidateCommand":"generalParameters/secondFactors/ext2f","ext2fActivation":"generalParameters/secondFactors/ext2f","ext2fAuthnLevel":"generalParameters/secondFactors/ext2f","ext2fCodeActivation":"generalParameters/secondFactors/ext2f","ext2fLabel":"generalParameters/secondFactors/ext2f","ext2fLogo":"generalParameters/secondFactors/ext2f","facebookAppId":"generalParameters/authParams/facebookParams","facebookAppSecret":"generalParameters/authParams/facebookParams","facebookAuthnLevel":"generalParameters/authParams/facebookParams","facebookExportedVars":"generalParameters/authParams/facebookParams","facebookUserField":"generalParameters/authParams/facebookParams","failedLoginNumber":"generalParameters/plugins/loginHistory","findUser":"generalParameters/plugins/findUsers","findUserControl":"generalParameters/plugins/findUsers","findUserExcludingAttributes":"generalParameters/plugins/findUsers","findUserSearchingAttributes":"generalParameters/plugins/findUsers","findUserWildcard":"generalParameters/plugins/findUsers","formTimeout":"generalParameters/advancedParams/security","githubAuthnLevel":"generalParameters/authParams/githubParams","githubClientID":"generalParameters/authParams/githubParams","githubClientSecret":"generalParameters/authParams/githubParams","githubScope":"generalParameters/authParams/githubParams","githubUserField":"generalParameters/authParams/githubParams","globalLogoutCustomParam":"generalParameters/plugins/globalLogout","globalLogoutRule":"generalParameters/plugins/globalLogout","globalLogoutTimer":"generalParameters/plugins/globalLogout","globalStorage":"generalParameters/sessionParams/sessionStorage","globalStorageOptions":"generalParameters/sessionParams/sessionStorage","gpgAuthnLevel":"generalParameters/authParams/gpgParams","gpgDb":"generalParameters/authParams/gpgParams","grantSessionRules":"generalParameters/sessionParams","groups":"variables","groupsBeforeMacros":"generalParameters/advancedParams","hiddenAttributes":"generalParameters/logParams","hideOldPassword":"generalParameters/portalParams/portalCustomization/passwordManagement","httpOnly":"generalParameters/cookieParams","https":"generalParameters/advancedParams/redirection","impersonationHiddenAttributes":"generalParameters/plugins/impersonation","impersonationIdRule":"generalParameters/plugins/impersonation","impersonationMergeSSOgroups":"generalParameters/plugins/impersonation","impersonationRule":"generalParameters/plugins/impersonation","impersonationSkipEmptyValues":"generalParameters/plugins/impersonation","impersonationUnrestrictedUsersRule":"generalParameters/plugins/impersonation","infoFormMethod":"generalParameters/advancedParams/forms","issuerDBCASActivation":"generalParameters/issuerParams/issuerDBCAS","issuerDBCASPath":"generalParameters/issuerParams/issuerDBCAS","issuerDBCASRule":"generalParameters/issuerParams/issuerDBCAS","issuerDBGetActivation":"generalParameters/issuerParams/issuerDBGet","issuerDBGetParameters":"generalParameters/issuerParams/issuerDBGet","issuerDBGetPath":"generalParameters/issuerParams/issuerDBGet","issuerDBGetRule":"generalParameters/issuerParams/issuerDBGet","issuerDBOpenIDActivation":"generalParameters/issuerParams/issuerDBOpenID","issuerDBOpenIDConnectActivation":"generalParameters/issuerParams/issuerDBOpenIDConnect","issuerDBOpenIDConnectPath":"generalParameters/issuerParams/issuerDBOpenIDConnect","issuerDBOpenIDConnectRule":"generalParameters/issuerParams/issuerDBOpenIDConnect","issuerDBOpenIDPath":"generalParameters/issuerParams/issuerDBOpenID","issuerDBOpenIDRule":"generalParameters/issuerParams/issuerDBOpenID","issuerDBSAMLActivation":"generalParameters/issuerParams/issuerDBSAML","issuerDBSAMLPath":"generalParameters/issuerParams/issuerDBSAML","issuerDBSAMLRule":"generalParameters/issuerParams/issuerDBSAML","issuersTimeout":"generalParameters/issuerParams/issuerOptions","jsRedirect":"generalParameters/advancedParams/portalRedirection","key":"generalParameters/advancedParams/security","krbAllowedDomains":"generalParameters/authParams/kerberosParams","krbAuthnLevel":"generalParameters/authParams/kerberosParams","krbByJs":"generalParameters/authParams/kerberosParams","krbKeytab":"generalParameters/authParams/kerberosParams","krbRemoveDomain":"generalParameters/authParams/kerberosParams","ldapAllowResetExpiredPassword":"generalParameters/authParams/ldapParams/ldapPassword","ldapAuthnLevel":"generalParameters/authParams/ldapParams","ldapBase":"generalParameters/authParams/ldapParams/ldapConnection","ldapCAFile":"generalParameters/authParams/ldapParams/ldapConnection","ldapCAPath":"generalParameters/authParams/ldapParams/ldapConnection","ldapChangePasswordAsUser":"generalParameters/authParams/ldapParams/ldapPassword","ldapExportedVars":"generalParameters/authParams/ldapParams","ldapGetUserBeforePasswordChange":"generalParameters/authParams/ldapParams/ldapPassword","ldapGroupAttributeName":"generalParameters/authParams/ldapParams/ldapGroups","ldapGroupAttributeNameGroup":"generalParameters/authParams/ldapParams/ldapGroups","ldapGroupAttributeNameSearch":"generalParameters/authParams/ldapParams/ldapGroups","ldapGroupAttributeNameUser":"generalParameters/authParams/ldapParams/ldapGroups","ldapGroupBase":"generalParameters/authParams/ldapParams/ldapGroups","ldapGroupDecodeSearchedValue":"generalParameters/authParams/ldapParams/ldapGroups","ldapGroupObjectClass":"generalParameters/authParams/ldapParams/ldapGroups","ldapGroupRecursive":"generalParameters/authParams/ldapParams/ldapGroups","ldapIOTimeout":"generalParameters/authParams/ldapParams/ldapConnection","ldapITDS":"generalParameters/authParams/ldapParams/ldapPassword","ldapPasswordResetAttribute":"generalParameters/authParams/ldapParams/ldapPassword","ldapPasswordResetAttributeValue":"generalParameters/authParams/ldapParams/ldapPassword","ldapPort":"generalParameters/authParams/ldapParams/ldapConnection","ldapPpolicyControl":"generalParameters/authParams/ldapParams/ldapPassword","ldapPwdEnc":"generalParameters/authParams/ldapParams/ldapPassword","ldapRaw":"generalParameters/authParams/ldapParams/ldapConnection","ldapSearchDeref":"generalParameters/authParams/ldapParams/ldapFilters","ldapServer":"generalParameters/authParams/ldapParams/ldapConnection","ldapSetPassword":"generalParameters/authParams/ldapParams/ldapPassword","ldapTimeout":"generalParameters/authParams/ldapParams/ldapConnection","ldapUsePasswordResetAttribute":"generalParameters/authParams/ldapParams/ldapPassword","ldapVerify":"generalParameters/authParams/ldapParams/ldapConnection","ldapVersion":"generalParameters/authParams/ldapParams/ldapConnection","linkedInAuthnLevel":"generalParameters/authParams/linkedinParams","linkedInClientID":"generalParameters/authParams/linkedinParams","linkedInClientSecret":"generalParameters/authParams/linkedinParams","linkedInFields":"generalParameters/authParams/linkedinParams","linkedInScope":"generalParameters/authParams/linkedinParams","linkedInUserField":"generalParameters/authParams/linkedinParams","localSessionStorage":"generalParameters/sessionParams/sessionStorage","localSessionStorageOptions":"generalParameters/sessionParams/sessionStorage","loginHistoryEnabled":"generalParameters/plugins/loginHistory","logoutServices":"generalParameters/advancedParams","lwpOpts":"generalParameters/advancedParams/security","lwpSslOpts":"generalParameters/advancedParams/security","macros":"variables","mail2fActivation":"generalParameters/secondFactors/mail2f","mail2fAuthnLevel":"generalParameters/secondFactors/mail2f","mail2fBody":"generalParameters/secondFactors/mail2f","mail2fCodeRegex":"generalParameters/secondFactors/mail2f","mail2fLabel":"generalParameters/secondFactors/mail2f","mail2fLogo":"generalParameters/secondFactors/mail2f","mail2fSessionKey":"generalParameters/secondFactors/mail2f","mail2fSubject":"generalParameters/secondFactors/mail2f","mail2fTimeout":"generalParameters/secondFactors/mail2f","mailBody":"generalParameters/plugins/passwordManagement/mailContent","mailCharset":"generalParameters/advancedParams/SMTP/mailHeaders","mailConfirmBody":"generalParameters/plugins/passwordManagement/mailContent","mailConfirmSubject":"generalParameters/plugins/passwordManagement/mailContent","mailFrom":"generalParameters/advancedParams/SMTP/mailHeaders","mailLDAPFilter":"generalParameters/authParams/ldapParams/ldapFilters","mailOnPasswordChange":"generalParameters/portalParams/portalCustomization/passwordManagement","mailReplyTo":"generalParameters/advancedParams/SMTP/mailHeaders","mailSessionKey":"generalParameters/advancedParams/SMTP","mailSubject":"generalParameters/plugins/passwordManagement/mailContent","mailTimeout":"generalParameters/plugins/passwordManagement/mailOther","mailUrl":"generalParameters/plugins/passwordManagement/mailOther","maintenance":"generalParameters/advancedParams/redirection","managerDn":"generalParameters/authParams/ldapParams/ldapConnection","managerPassword":"generalParameters/authParams/ldapParams/ldapConnection","multiValuesSeparator":"generalParameters/advancedParams","nginxCustomHandlers":"generalParameters/advancedParams","noAjaxHook":"generalParameters/advancedParams/portalRedirection","notification":"generalParameters/plugins/notifications","notificationDefaultCond":"generalParameters/plugins/notifications/serverNotification","notificationServer":"generalParameters/plugins/notifications/serverNotification","notificationServerDELETE":"generalParameters/plugins/notifications/serverNotification/notificationServerMethods","notificationServerGET":"generalParameters/plugins/notifications/serverNotification/notificationServerMethods","notificationServerPOST":"generalParameters/plugins/notifications/serverNotification/notificationServerMethods","notificationServerSentAttributes":"generalParameters/plugins/notifications/serverNotification","notificationStorage":"generalParameters/plugins/notifications","notificationStorageOptions":"generalParameters/plugins/notifications","notificationWildcard":"generalParameters/plugins/notifications","notificationXSLTfile":"generalParameters/plugins/notifications","notificationsExplorer":"generalParameters/plugins/notifications","notifyDeleted":"generalParameters/sessionParams/multipleSessions","notifyOther":"generalParameters/sessionParams/multipleSessions","nullAuthnLevel":"generalParameters/authParams/nullParams","oidcAuthnLevel":"generalParameters/authParams/oidcParams","oidcOPMetaDataNodes":"","oidcRPCallbackGetParam":"generalParameters/authParams/oidcParams","oidcRPMetaDataNodes":"","oidcRPStateTimeout":"generalParameters/authParams/oidcParams","oidcServiceAccessTokenExpiration":"oidcServiceMetaData/oidcServiceMetaDataSecurity","oidcServiceAllowAuthorizationCodeFlow":"oidcServiceMetaData/oidcServiceMetaDataSecurity","oidcServiceAllowDynamicRegistration":"oidcServiceMetaData/oidcServiceMetaDataSecurity","oidcServiceAllowHybridFlow":"oidcServiceMetaData/oidcServiceMetaDataSecurity","oidcServiceAllowImplicitFlow":"oidcServiceMetaData/oidcServiceMetaDataSecurity","oidcServiceAuthorizationCodeExpiration":"oidcServiceMetaData/oidcServiceMetaDataSecurity","oidcServiceDynamicRegistrationExportedVars":"oidcServiceMetaData","oidcServiceDynamicRegistrationExtraClaims":"oidcServiceMetaData","oidcServiceIDTokenExpiration":"oidcServiceMetaData/oidcServiceMetaDataSecurity","oidcServiceKeyIdSig":"oidcServiceMetaData/oidcServiceMetaDataSecurity/oidcServiceMetaDataKeys","oidcServiceMetaDataAuthnContext":"oidcServiceMetaData","oidcServiceMetaDataAuthorizeURI":"oidcServiceMetaData/oidcServiceMetaDataEndPoints","oidcServiceMetaDataBackChannelURI":"oidcServiceMetaData/oidcServiceMetaDataEndPoints","oidcServiceMetaDataCheckSessionURI":"oidcServiceMetaData/oidcServiceMetaDataEndPoints","oidcServiceMetaDataEndSessionURI":"oidcServiceMetaData/oidcServiceMetaDataEndPoints","oidcServiceMetaDataFrontChannelURI":"oidcServiceMetaData/oidcServiceMetaDataEndPoints","oidcServiceMetaDataIntrospectionURI":"oidcServiceMetaData/oidcServiceMetaDataEndPoints","oidcServiceMetaDataIssuer":"oidcServiceMetaData","oidcServiceMetaDataJWKSURI":"oidcServiceMetaData/oidcServiceMetaDataEndPoints","oidcServiceMetaDataRegistrationURI":"oidcServiceMetaData/oidcServiceMetaDataEndPoints","oidcServiceMetaDataTokenURI":"oidcServiceMetaData/oidcServiceMetaDataEndPoints","oidcServiceMetaDataUserInfoURI":"oidcServiceMetaData/oidcServiceMetaDataEndPoints","oidcServiceOfflineSessionExpiration":"oidcServiceMetaData/oidcServiceMetaDataSecurity","oidcServicePrivateKeySig":"oidcServiceMetaData/oidcServiceMetaDataSecurity/oidcServiceMetaDataKeys","oidcServicePublicKeySig":"oidcServiceMetaData/oidcServiceMetaDataSecurity/oidcServiceMetaDataKeys","oidcStorage":"oidcServiceMetaData/oidcServiceMetaDataSessions","oidcStorageOptions":"oidcServiceMetaData/oidcServiceMetaDataSessions","oldNotifFormat":"generalParameters/plugins/notifications","openIdAttr":"generalParameters/issuerParams/issuerDBOpenID/issuerDBOpenIDOptions","openIdAuthnLevel":"generalParameters/authParams/openidParams","openIdExportedVars":"generalParameters/authParams/openidParams","openIdIDPList":"generalParameters/authParams/openidParams","openIdIssuerSecret":"generalParameters/issuerParams/issuerDBOpenID/issuerDBOpenIDOptions","openIdSPList":"generalParameters/issuerParams/issuerDBOpenID/issuerDBOpenIDOptions","openIdSecret":"generalParameters/authParams/openidParams","openIdSreg_country":"generalParameters/issuerParams/issuerDBOpenID/issuerDBOpenIDOptions/openIdSreg","openIdSreg_dob":"generalParameters/issuerParams/issuerDBOpenID/issuerDBOpenIDOptions/openIdSreg","openIdSreg_email":"generalParameters/issuerParams/issuerDBOpenID/issuerDBOpenIDOptions/openIdSreg","openIdSreg_fullname":"generalParameters/issuerParams/issuerDBOpenID/issuerDBOpenIDOptions/openIdSreg","openIdSreg_gender":"generalParameters/issuerParams/issuerDBOpenID/issuerDBOpenIDOptions/openIdSreg","openIdSreg_language":"generalParameters/issuerParams/issuerDBOpenID/issuerDBOpenIDOptions/openIdSreg","openIdSreg_nickname":"generalParameters/issuerParams/issuerDBOpenID/issuerDBOpenIDOptions/openIdSreg","openIdSreg_postcode":"generalParameters/issuerParams/issuerDBOpenID/issuerDBOpenIDOptions/openIdSreg","openIdSreg_timezone":"generalParameters/issuerParams/issuerDBOpenID/issuerDBOpenIDOptions/openIdSreg","pamAuthnLevel":"generalParameters/authParams/pamParams","pamService":"generalParameters/authParams/pamParams","passwordDB":"generalParameters/authParams","passwordPolicyActivation":"generalParameters/portalParams/portalCustomization/passwordPolicy","passwordPolicyMinDigit":"generalParameters/portalParams/portalCustomization/passwordPolicy","passwordPolicyMinLower":"generalParameters/portalParams/portalCustomization/passwordPolicy","passwordPolicyMinSize":"generalParameters/portalParams/portalCustomization/passwordPolicy","passwordPolicyMinSpeChar":"generalParameters/portalParams/portalCustomization/passwordPolicy","passwordPolicyMinUpper":"generalParameters/portalParams/portalCustomization/passwordPolicy","passwordPolicySpecialChar":"generalParameters/portalParams/portalCustomization/passwordPolicy","passwordResetAllowedRetries":"generalParameters/portalParams/portalCustomization/portalButtons","persistentStorage":"generalParameters/sessionParams/persistentSessions","persistentStorageOptions":"generalParameters/sessionParams/persistentSessions","port":"generalParameters/advancedParams/redirection","portal":"generalParameters/portalParams","portalAntiFrame":"generalParameters/portalParams/portalCustomization/portalOther","portalCheckLogins":"generalParameters/portalParams/portalCustomization/portalButtons","portalCustomCss":"generalParameters/portalParams/portalCustomization","portalDisplayAppslist":"generalParameters/portalParams/portalMenu/portalModules","portalDisplayCertificateResetByMail":"generalParameters/portalParams/portalCustomization/portalButtons","portalDisplayChangePassword":"generalParameters/portalParams/portalMenu/portalModules","portalDisplayGeneratePassword":"generalParameters/plugins/passwordManagement/mailOther","portalDisplayLoginHistory":"generalParameters/portalParams/portalMenu/portalModules","portalDisplayLogout":"generalParameters/portalParams/portalMenu/portalModules","portalDisplayOidcConsents":"generalParameters/portalParams/portalMenu/portalModules","portalDisplayPasswordPolicy":"generalParameters/portalParams/portalCustomization/passwordPolicy","portalDisplayRefreshMyRights":"generalParameters/portalParams/portalCustomization/portalOther","portalDisplayRegister":"generalParameters/portalParams/portalCustomization/portalButtons","portalDisplayResetPassword":"generalParameters/portalParams/portalCustomization/portalButtons","portalErrorOnExpiredSession":"generalParameters/portalParams/portalCustomization/portalOther","portalErrorOnMailNotFound":"generalParameters/portalParams/portalCustomization/portalOther","portalForceAuthn":"generalParameters/advancedParams/security","portalForceAuthnInterval":"generalParameters/advancedParams/security","portalMainLogo":"generalParameters/portalParams/portalCustomization","portalOpenLinkInNewWindow":"generalParameters/portalParams/portalCustomization/portalOther","portalPingInterval":"generalParameters/portalParams/portalCustomization/portalOther","portalRequireOldPassword":"generalParameters/portalParams/portalCustomization/passwordManagement","portalSkin":"generalParameters/portalParams/portalCustomization","portalSkinBackground":"generalParameters/portalParams/portalCustomization","portalSkinRules":"generalParameters/portalParams/portalCustomization","portalStatus":"generalParameters/plugins","portalUserAttr":"generalParameters/portalParams/portalCustomization/portalOther","proxyAuthService":"generalParameters/authParams/proxyParams","proxyAuthnLevel":"generalParameters/authParams/proxyParams","proxySessionService":"generalParameters/authParams/proxyParams","proxyUseSoap":"generalParameters/authParams/proxyParams","radius2fActivation":"generalParameters/secondFactors/radius2f","radius2fAuthnLevel":"generalParameters/secondFactors/radius2f","radius2fLabel":"generalParameters/secondFactors/radius2f","radius2fLogo":"generalParameters/secondFactors/radius2f","radius2fSecret":"generalParameters/secondFactors/radius2f","radius2fServer":"generalParameters/secondFactors/radius2f","radius2fTimeout":"generalParameters/secondFactors/radius2f","radius2fUsernameSessionKey":"generalParameters/secondFactors/radius2f","radiusAuthnLevel":"generalParameters/authParams/radiusParams","radiusSecret":"generalParameters/authParams/radiusParams","radiusServer":"generalParameters/authParams/radiusParams","randomPasswordRegexp":"generalParameters/plugins/passwordManagement/mailOther","redirectFormMethod":"generalParameters/advancedParams/forms","refreshSessions":"generalParameters/plugins","registerConfirmSubject":"generalParameters/plugins/register","registerDB":"generalParameters/authParams","registerDoneSubject":"generalParameters/plugins/register","registerTimeout":"generalParameters/plugins/register","registerUrl":"generalParameters/plugins/register","reloadTimeout":"generalParameters/reloadParams","reloadUrls":"generalParameters/reloadParams","remoteCookieName":"generalParameters/authParams/remoteParams","remoteGlobalStorage":"generalParameters/authParams/remoteParams","remoteGlobalStorageOptions":"generalParameters/authParams/remoteParams","remotePortal":"generalParameters/authParams/remoteParams","requireToken":"generalParameters/advancedParams/security","rest2fActivation":"generalParameters/secondFactors/rest2f","rest2fAuthnLevel":"generalParameters/secondFactors/rest2f","rest2fInitArgs":"generalParameters/secondFactors/rest2f","rest2fInitUrl":"generalParameters/secondFactors/rest2f","rest2fLabel":"generalParameters/secondFactors/rest2f","rest2fLogo":"generalParameters/secondFactors/rest2f","rest2fVerifyArgs":"generalParameters/secondFactors/rest2f","rest2fVerifyUrl":"generalParameters/secondFactors/rest2f","restAuthServer":"generalParameters/plugins/portalServers/restServices","restAuthUrl":"generalParameters/authParams/restParams","restAuthnLevel":"generalParameters/authParams/restParams","restClockTolerance":"generalParameters/plugins/portalServers/restServices","restConfigServer":"generalParameters/plugins/portalServers/restServices","restExportSecretKeys":"generalParameters/plugins/portalServers/restServices","restFindUserDBUrl":"generalParameters/plugins/findUsers","restPasswordServer":"generalParameters/plugins/portalServers/restServices","restPwdConfirmUrl":"generalParameters/authParams/restParams","restPwdModifyUrl":"generalParameters/authParams/restParams","restSessionServer":"generalParameters/plugins/portalServers/restServices","restUserDBUrl":"generalParameters/authParams/restParams","sameSite":"generalParameters/cookieParams","samlAttributeAuthorityDescriptorAttributeServiceSOAP":"samlServiceMetaData/samlAttributeAuthorityDescriptor/samlAttributeAuthorityDescriptorAttributeService","samlAuthnContextMapKerberos":"samlServiceMetaData/samlAuthnContextMap","samlAuthnContextMapPassword":"samlServiceMetaData/samlAuthnContextMap","samlAuthnContextMapPasswordProtectedTransport":"samlServiceMetaData/samlAuthnContextMap","samlAuthnContextMapTLSClient":"samlServiceMetaData/samlAuthnContextMap","samlCommonDomainCookieActivation":"samlServiceMetaData/samlAdvanced/samlCommonDomainCookie","samlCommonDomainCookieDomain":"samlServiceMetaData/samlAdvanced/samlCommonDomainCookie","samlCommonDomainCookieReader":"samlServiceMetaData/samlAdvanced/samlCommonDomainCookie","samlCommonDomainCookieWriter":"samlServiceMetaData/samlAdvanced/samlCommonDomainCookie","samlDiscoveryProtocolActivation":"samlServiceMetaData/samlAdvanced/samlDiscoveryProtocol","samlDiscoveryProtocolIsPassive":"samlServiceMetaData/samlAdvanced/samlDiscoveryProtocol","samlDiscoveryProtocolPolicy":"samlServiceMetaData/samlAdvanced/samlDiscoveryProtocol","samlDiscoveryProtocolURL":"samlServiceMetaData/samlAdvanced/samlDiscoveryProtocol","samlEntityID":"samlServiceMetaData","samlIDPMetaDataNodes":"","samlIDPSSODescriptorArtifactResolutionServiceArtifact":"samlServiceMetaData/samlIDPSSODescriptor/samlIDPSSODescriptorArtifactResolutionService","samlIDPSSODescriptorSingleLogoutServiceHTTPPost":"samlServiceMetaData/samlIDPSSODescriptor/samlIDPSSODescriptorSingleLogoutService","samlIDPSSODescriptorSingleLogoutServiceHTTPRedirect":"samlServiceMetaData/samlIDPSSODescriptor/samlIDPSSODescriptorSingleLogoutService","samlIDPSSODescriptorSingleLogoutServiceSOAP":"samlServiceMetaData/samlIDPSSODescriptor/samlIDPSSODescriptorSingleLogoutService","samlIDPSSODescriptorSingleSignOnServiceHTTPArtifact":"samlServiceMetaData/samlIDPSSODescriptor/samlIDPSSODescriptorSingleSignOnService","samlIDPSSODescriptorSingleSignOnServiceHTTPPost":"samlServiceMetaData/samlIDPSSODescriptor/samlIDPSSODescriptorSingleSignOnService","samlIDPSSODescriptorSingleSignOnServiceHTTPRedirect":"samlServiceMetaData/samlIDPSSODescriptor/samlIDPSSODescriptorSingleSignOnService","samlIDPSSODescriptorWantAuthnRequestsSigned":"samlServiceMetaData/samlIDPSSODescriptor","samlMetadataForceUTF8":"samlServiceMetaData/samlAdvanced","samlNameIDFormatMapEmail":"samlServiceMetaData/samlNameIDFormatMap","samlNameIDFormatMapKerberos":"samlServiceMetaData/samlNameIDFormatMap","samlNameIDFormatMapWindows":"samlServiceMetaData/samlNameIDFormatMap","samlNameIDFormatMapX509":"samlServiceMetaData/samlNameIDFormatMap","samlOrganizationDisplayName":"samlServiceMetaData/samlOrganization","samlOrganizationName":"samlServiceMetaData/samlOrganization","samlOrganizationURL":"samlServiceMetaData/samlOrganization","samlOverrideIDPEntityID":"samlServiceMetaData/samlAdvanced","samlRelayStateTimeout":"samlServiceMetaData/samlAdvanced","samlSPMetaDataNodes":"","samlSPSSODescriptorArtifactResolutionServiceArtifact":"samlServiceMetaData/samlSPSSODescriptor/samlSPSSODescriptorArtifactResolutionService","samlSPSSODescriptorAssertionConsumerServiceHTTPArtifact":"samlServiceMetaData/samlSPSSODescriptor/samlSPSSODescriptorAssertionConsumerService","samlSPSSODescriptorAssertionConsumerServiceHTTPPost":"samlServiceMetaData/samlSPSSODescriptor/samlSPSSODescriptorAssertionConsumerService","samlSPSSODescriptorAuthnRequestsSigned":"samlServiceMetaData/samlSPSSODescriptor","samlSPSSODescriptorSingleLogoutServiceHTTPPost":"samlServiceMetaData/samlSPSSODescriptor/samlSPSSODescriptorSingleLogoutService","samlSPSSODescriptorSingleLogoutServiceHTTPRedirect":"samlServiceMetaData/samlSPSSODescriptor/samlSPSSODescriptorSingleLogoutService","samlSPSSODescriptorSingleLogoutServiceSOAP":"samlServiceMetaData/samlSPSSODescriptor/samlSPSSODescriptorSingleLogoutService","samlSPSSODescriptorWantAssertionsSigned":"samlServiceMetaData/samlSPSSODescriptor","samlServicePrivateKeyEnc":"samlServiceMetaData/samlServiceSecurity/samlServiceSecurityEnc","samlServicePrivateKeyEncPwd":"samlServiceMetaData/samlServiceSecurity/samlServiceSecurityEnc","samlServicePrivateKeySig":"samlServiceMetaData/samlServiceSecurity/samlServiceSecuritySig","samlServicePrivateKeySigPwd":"samlServiceMetaData/samlServiceSecurity/samlServiceSecuritySig","samlServicePublicKeyEnc":"samlServiceMetaData/samlServiceSecurity/samlServiceSecurityEnc","samlServicePublicKeySig":"samlServiceMetaData/samlServiceSecurity/samlServiceSecuritySig","samlServiceSignatureMethod":"samlServiceMetaData/samlServiceSecurity","samlServiceUseCertificateInResponse":"samlServiceMetaData/samlServiceSecurity","samlStorage":"samlServiceMetaData/samlAdvanced","samlStorageOptions":"samlServiceMetaData/samlAdvanced","samlUseQueryStringSpecific":"samlServiceMetaData/samlAdvanced","securedCookie":"generalParameters/cookieParams","sessionDataToRemember":"generalParameters/plugins/loginHistory","sfExtra":"generalParameters/secondFactors","sfManagerRule":"generalParameters/secondFactors","sfOnlyUpgrade":"generalParameters/secondFactors","sfRemovedMsgRule":"generalParameters/secondFactors/sfRemovedNotification","sfRemovedNotifMsg":"generalParameters/secondFactors/sfRemovedNotification","sfRemovedNotifRef":"generalParameters/secondFactors/sfRemovedNotification","sfRemovedNotifTitle":"generalParameters/secondFactors/sfRemovedNotification","sfRemovedUseNotif":"generalParameters/secondFactors/sfRemovedNotification","sfRequired":"generalParameters/secondFactors","showLanguages":"generalParameters/portalParams/portalCustomization","singleIP":"generalParameters/sessionParams/multipleSessions","singleSession":"generalParameters/sessionParams/multipleSessions","singleUserByIP":"generalParameters/sessionParams/multipleSessions","skipRenewConfirmation":"generalParameters/advancedParams/portalRedirection","skipUpgradeConfirmation":"generalParameters/advancedParams/portalRedirection","slaveAuthnLevel":"generalParameters/authParams/slaveParams","slaveDisplayLogo":"generalParameters/authParams/slaveParams","slaveExportedVars":"generalParameters/authParams/slaveParams","slaveHeaderContent":"generalParameters/authParams/slaveParams","slaveHeaderName":"generalParameters/authParams/slaveParams","slaveMasterIP":"generalParameters/authParams/slaveParams","slaveUserHeader":"generalParameters/authParams/slaveParams","soapConfigServer":"generalParameters/plugins/portalServers/soapServices","soapSessionServer":"generalParameters/plugins/portalServers/soapServices","sslByAjax":"generalParameters/authParams/sslParams","sslHost":"generalParameters/authParams/sslParams","stayConnected":"generalParameters/plugins/stayConnect","stayConnectedCookieName":"generalParameters/plugins/stayConnect","stayConnectedTimeout":"generalParameters/plugins/stayConnect","storePassword":"generalParameters/sessionParams","successLoginNumber":"generalParameters/plugins/loginHistory","timeout":"generalParameters/sessionParams","timeoutActivity":"generalParameters/sessionParams","timeoutActivityInterval":"generalParameters/sessionParams","tokenUseGlobalStorage":"generalParameters/advancedParams/security","totp2fActivation":"generalParameters/secondFactors/totp2f","totp2fAuthnLevel":"generalParameters/secondFactors/totp2f","totp2fDigits":"generalParameters/secondFactors/totp2f","totp2fDisplayExistingSecret":"generalParameters/secondFactors/totp2f","totp2fInterval":"generalParameters/secondFactors/totp2f","totp2fIssuer":"generalParameters/secondFactors/totp2f","totp2fLabel":"generalParameters/secondFactors/totp2f","totp2fLogo":"generalParameters/secondFactors/totp2f","totp2fRange":"generalParameters/secondFactors/totp2f","totp2fSelfRegistration":"generalParameters/secondFactors/totp2f","totp2fTTL":"generalParameters/secondFactors/totp2f","totp2fUserCanChangeKey":"generalParameters/secondFactors/totp2f","totp2fUserCanRemoveKey":"generalParameters/secondFactors/totp2f","trustedDomains":"generalParameters/advancedParams/security","twitterAppName":"generalParameters/authParams/twitterParams","twitterAuthnLevel":"generalParameters/authParams/twitterParams","twitterKey":"generalParameters/authParams/twitterParams","twitterSecret":"generalParameters/authParams/twitterParams","twitterUserField":"generalParameters/authParams/twitterParams","u2fActivation":"generalParameters/secondFactors/u2f","u2fAuthnLevel":"generalParameters/secondFactors/u2f","u2fLabel":"generalParameters/secondFactors/u2f","u2fLogo":"generalParameters/secondFactors/u2f","u2fSelfRegistration":"generalParameters/secondFactors/u2f","u2fTTL":"generalParameters/secondFactors/u2f","u2fUserCanRemoveKey":"generalParameters/secondFactors/u2f","upgradeSession":"generalParameters/plugins","useRedirectOnError":"generalParameters/advancedParams/redirection","useRedirectOnForbidden":"generalParameters/advancedParams/redirection","useSafeJail":"generalParameters/advancedParams/security","userControl":"generalParameters/advancedParams/security","userDB":"generalParameters/authParams","userPivot":"generalParameters/authParams/dbiParams/dbiSchema","utotp2fActivation":"generalParameters/secondFactors/utotp2f","utotp2fAuthnLevel":"generalParameters/secondFactors/utotp2f","utotp2fLabel":"generalParameters/secondFactors/utotp2f","utotp2fLogo":"generalParameters/secondFactors/utotp2f","virtualHosts":"","webIDAuthnLevel":"generalParameters/authParams/webidParams","webIDExportedVars":"generalParameters/authParams/webidParams","webIDWhitelist":"generalParameters/authParams/webidParams","whatToTrace":"generalParameters/logParams","wsdlServer":"generalParameters/plugins/portalServers/soapServices","yubikey2fActivation":"generalParameters/secondFactors/yubikey2f","yubikey2fAuthnLevel":"generalParameters/secondFactors/yubikey2f","yubikey2fClientID":"generalParameters/secondFactors/yubikey2f","yubikey2fFromSessionAttribute":"generalParameters/secondFactors/yubikey2f","yubikey2fLabel":"generalParameters/secondFactors/yubikey2f","yubikey2fLogo":"generalParameters/secondFactors/yubikey2f","yubikey2fNonce":"generalParameters/secondFactors/yubikey2f","yubikey2fPublicIDSize":"generalParameters/secondFactors/yubikey2f","yubikey2fSecretKey":"generalParameters/secondFactors/yubikey2f","yubikey2fSelfRegistration":"generalParameters/secondFactors/yubikey2f","yubikey2fTTL":"generalParameters/secondFactors/yubikey2f","yubikey2fUrl":"generalParameters/secondFactors/yubikey2f","yubikey2fUserCanRemoveKey":"generalParameters/secondFactors/yubikey2f"}
\ No newline at end of file
+{"ADPwdExpireWarning":"generalParameters/authParams/adParams","ADPwdMaxAge":"generalParameters/authParams/adParams","AuthLDAPFilter":"generalParameters/authParams/ldapParams/ldapFilters","LDAPFilter":"generalParameters/authParams/ldapParams/ldapFilters","SMTPAuthPass":"generalParameters/advancedParams/SMTP","SMTPAuthUser":"generalParameters/advancedParams/SMTP","SMTPPort":"generalParameters/advancedParams/SMTP","SMTPServer":"generalParameters/advancedParams/SMTP","SMTPTLS":"generalParameters/advancedParams/SMTP","SMTPTLSOpts":"generalParameters/advancedParams/SMTP","SSLAuthnLevel":"generalParameters/authParams/sslParams","SSLVar":"generalParameters/authParams/sslParams","SSLVarIf":"generalParameters/authParams/sslParams","activeTimer":"generalParameters/advancedParams/forms","adaptativeAuthenticationLevelRules":"generalParameters/plugins","apacheAuthnLevel":"generalParameters/authParams/apacheParams","applicationList":"generalParameters/portalParams/portalMenu","authChoiceAuthBasic":"generalParameters/authParams/choiceParams","authChoiceFindUser":"generalParameters/authParams/choiceParams","authChoiceModules":"generalParameters/authParams/choiceParams","authChoiceParam":"generalParameters/authParams/choiceParams","authentication":"generalParameters/authParams","autoSigninRules":"generalParameters/plugins/autoSignin","avoidAssignment":"generalParameters/advancedParams/security","browsersDontStorePassword":"generalParameters/advancedParams/security","bruteForceProtection":"generalParameters/advancedParams/security/bruteForceAttackProtection","bruteForceProtectionIncrementalTempo":"generalParameters/advancedParams/security/bruteForceAttackProtection","bruteForceProtectionLockTimes":"generalParameters/advancedParams/security/bruteForceAttackProtection","bruteForceProtectionMaxFailed":"generalParameters/advancedParams/security/bruteForceAttackProtection","bruteForceProtectionTempo":"generalParameters/advancedParams/security/bruteForceAttackProtection","captcha_login_enabled":"generalParameters/portalParams/portalCaptcha","captcha_mail_enabled":"generalParameters/portalParams/portalCaptcha","captcha_register_enabled":"generalParameters/portalParams/portalCaptcha","captcha_size":"generalParameters/portalParams/portalCaptcha","casAccessControlPolicy":"casServiceMetadata","casAppMetaDataNodes":"","casAttr":"casServiceMetadata","casAttributes":"casServiceMetadata","casAuthnLevel":"generalParameters/authParams/casParams","casSrvMetaDataNodes":"","casStorage":"casServiceMetadata","casStorageOptions":"casServiceMetadata","casStrictMatching":"casServiceMetadata","cda":"generalParameters/cookieParams","certificateResetByMailCeaAttribute":"generalParameters/plugins/certificateResetByMailManagement/mailOther","certificateResetByMailCertificateAttribute":"generalParameters/plugins/certificateResetByMailManagement/mailOther","certificateResetByMailStep1Body":"generalParameters/plugins/certificateResetByMailManagement/certificateMailContent","certificateResetByMailStep1Subject":"generalParameters/plugins/certificateResetByMailManagement/certificateMailContent","certificateResetByMailStep2Body":"generalParameters/plugins/certificateResetByMailManagement/certificateMailContent","certificateResetByMailStep2Subject":"generalParameters/plugins/certificateResetByMailManagement/certificateMailContent","certificateResetByMailURL":"generalParameters/plugins/certificateResetByMailManagement/mailOther","certificateResetByMailValidityDelay":"generalParameters/plugins/certificateResetByMailManagement/mailOther","checkDevOps":"generalParameters/plugins/devOpsCheck","checkDevOpsDownload":"generalParameters/plugins/devOpsCheck","checkState":"generalParameters/plugins/stateCheck","checkStateSecret":"generalParameters/plugins/stateCheck","checkUser":"generalParameters/plugins/checkUsers","checkUserDisplayComputedSession":"generalParameters/plugins/checkUsers/checkUserDisplay","checkUserDisplayEmptyHeaders":"generalParameters/plugins/checkUsers/checkUserDisplay","checkUserDisplayEmptyValues":"generalParameters/plugins/checkUsers/checkUserDisplay","checkUserDisplayNormalizedHeaders":"generalParameters/plugins/checkUsers/checkUserDisplay","checkUserDisplayPersistentInfo":"generalParameters/plugins/checkUsers/checkUserDisplay","checkUserHiddenAttributes":"generalParameters/plugins/checkUsers","checkUserHiddenHeaders":"generalParameters/plugins/checkUsers","checkUserIdRule":"generalParameters/plugins/checkUsers","checkUserSearchAttributes":"generalParameters/plugins/checkUsers","checkUserUnrestrictedUsersRule":"generalParameters/plugins/checkUsers","checkXSS":"generalParameters/advancedParams/security","combModules":"generalParameters/authParams/combinationParams","combination":"generalParameters/authParams/combinationParams","compactConf":"generalParameters/reloadParams","confirmFormMethod":"generalParameters/advancedParams/forms","contextSwitchingAllowed2fModifications":"generalParameters/plugins/contextSwitching","contextSwitchingIdRule":"generalParameters/plugins/contextSwitching","contextSwitchingRule":"generalParameters/plugins/contextSwitching","contextSwitchingStopWithLogout":"generalParameters/plugins/contextSwitching","contextSwitchingUnrestrictedUsersRule":"generalParameters/plugins/contextSwitching","cookieExpiration":"generalParameters/cookieParams","cookieName":"generalParameters/cookieParams","corsAllow_Credentials":"generalParameters/advancedParams/security/crossOrigineResourceSharing","corsAllow_Headers":"generalParameters/advancedParams/security/crossOrigineResourceSharing","corsAllow_Methods":"generalParameters/advancedParams/security/crossOrigineResourceSharing","corsAllow_Origin":"generalParameters/advancedParams/security/crossOrigineResourceSharing","corsEnabled":"generalParameters/advancedParams/security/crossOrigineResourceSharing","corsExpose_Headers":"generalParameters/advancedParams/security/crossOrigineResourceSharing","corsMax_Age":"generalParameters/advancedParams/security/crossOrigineResourceSharing","crowdsec":"generalParameters/advancedParams/security/CrowdSecPlugin","crowdsecAction":"generalParameters/advancedParams/security/CrowdSecPlugin","crowdsecKey":"generalParameters/advancedParams/security/CrowdSecPlugin","crowdsecUrl":"generalParameters/advancedParams/security/CrowdSecPlugin","cspConnect":"generalParameters/advancedParams/security/contentSecurityPolicy","cspDefault":"generalParameters/advancedParams/security/contentSecurityPolicy","cspFont":"generalParameters/advancedParams/security/contentSecurityPolicy","cspFormAction":"generalParameters/advancedParams/security/contentSecurityPolicy","cspFrameAncestors":"generalParameters/advancedParams/security/contentSecurityPolicy","cspImg":"generalParameters/advancedParams/security/contentSecurityPolicy","cspScript":"generalParameters/advancedParams/security/contentSecurityPolicy","cspStyle":"generalParameters/advancedParams/security/contentSecurityPolicy","customAddParams":"generalParameters/authParams/customParams","customAuth":"generalParameters/authParams/customParams","customFunctions":"generalParameters/advancedParams","customPassword":"generalParameters/authParams/customParams","customPlugins":"generalParameters/plugins/customPluginsNode","customPluginsParams":"generalParameters/plugins/customPluginsNode","customRegister":"generalParameters/authParams/customParams","customResetCertByMail":"generalParameters/authParams/customParams","customToTrace":"generalParameters/logParams","customUserDB":"generalParameters/authParams/customParams","dbiAuthChain":"generalParameters/authParams/dbiParams/dbiConnection/dbiConnectionAuth","dbiAuthLoginCol":"generalParameters/authParams/dbiParams/dbiSchema","dbiAuthPassword":"generalParameters/authParams/dbiParams/dbiConnection/dbiConnectionAuth","dbiAuthPasswordCol":"generalParameters/authParams/dbiParams/dbiSchema","dbiAuthPasswordHash":"generalParameters/authParams/dbiParams/dbiPassword","dbiAuthTable":"generalParameters/authParams/dbiParams/dbiSchema","dbiAuthUser":"generalParameters/authParams/dbiParams/dbiConnection/dbiConnectionAuth","dbiAuthnLevel":"generalParameters/authParams/dbiParams","dbiDynamicHashEnabled":"generalParameters/authParams/dbiParams/dbiPassword/dbiDynamicHash","dbiDynamicHashNewPasswordScheme":"generalParameters/authParams/dbiParams/dbiPassword/dbiDynamicHash","dbiDynamicHashValidSaltedSchemes":"generalParameters/authParams/dbiParams/dbiPassword/dbiDynamicHash","dbiDynamicHashValidSchemes":"generalParameters/authParams/dbiParams/dbiPassword/dbiDynamicHash","dbiExportedVars":"generalParameters/authParams/dbiParams","dbiPasswordMailCol":"generalParameters/authParams/dbiParams/dbiSchema","dbiUserChain":"generalParameters/authParams/dbiParams/dbiConnection/dbiConnectionUser","dbiUserPassword":"generalParameters/authParams/dbiParams/dbiConnection/dbiConnectionUser","dbiUserTable":"generalParameters/authParams/dbiParams/dbiSchema","dbiUserUser":"generalParameters/authParams/dbiParams/dbiConnection/dbiConnectionUser","decryptValueFunctions":"generalParameters/plugins/decryptValue","decryptValueRule":"generalParameters/plugins/decryptValue","demoExportedVars":"generalParameters/authParams/demoParams","disablePersistentStorage":"generalParameters/sessionParams/persistentSessions","displaySessionId":"generalParameters/sessionParams","domain":"generalParameters/cookieParams","exportedAttr":"generalParameters/plugins/portalServers","exportedVars":"variables","ext2FSendCommand":"generalParameters/secondFactors/ext2f","ext2FValidateCommand":"generalParameters/secondFactors/ext2f","ext2fActivation":"generalParameters/secondFactors/ext2f","ext2fAuthnLevel":"generalParameters/secondFactors/ext2f","ext2fCodeActivation":"generalParameters/secondFactors/ext2f","ext2fLabel":"generalParameters/secondFactors/ext2f","ext2fLogo":"generalParameters/secondFactors/ext2f","facebookAppId":"generalParameters/authParams/facebookParams","facebookAppSecret":"generalParameters/authParams/facebookParams","facebookAuthnLevel":"generalParameters/authParams/facebookParams","facebookExportedVars":"generalParameters/authParams/facebookParams","facebookUserField":"generalParameters/authParams/facebookParams","failedLoginNumber":"generalParameters/plugins/loginHistory","findUser":"generalParameters/plugins/findUsers","findUserControl":"generalParameters/plugins/findUsers","findUserExcludingAttributes":"generalParameters/plugins/findUsers","findUserSearchingAttributes":"generalParameters/plugins/findUsers","findUserWildcard":"generalParameters/plugins/findUsers","formTimeout":"generalParameters/advancedParams/security","githubAuthnLevel":"generalParameters/authParams/githubParams","githubClientID":"generalParameters/authParams/githubParams","githubClientSecret":"generalParameters/authParams/githubParams","githubScope":"generalParameters/authParams/githubParams","githubUserField":"generalParameters/authParams/githubParams","globalLogoutCustomParam":"generalParameters/plugins/globalLogout","globalLogoutRule":"generalParameters/plugins/globalLogout","globalLogoutTimer":"generalParameters/plugins/globalLogout","globalStorage":"generalParameters/sessionParams/sessionStorage","globalStorageOptions":"generalParameters/sessionParams/sessionStorage","gpgAuthnLevel":"generalParameters/authParams/gpgParams","gpgDb":"generalParameters/authParams/gpgParams","grantSessionRules":"generalParameters/sessionParams","groups":"variables","groupsBeforeMacros":"generalParameters/advancedParams","hiddenAttributes":"generalParameters/logParams","hideOldPassword":"generalParameters/portalParams/portalCustomization/passwordManagement","httpOnly":"generalParameters/cookieParams","https":"generalParameters/advancedParams/redirection","impersonationHiddenAttributes":"generalParameters/plugins/impersonation","impersonationIdRule":"generalParameters/plugins/impersonation","impersonationMergeSSOgroups":"generalParameters/plugins/impersonation","impersonationRule":"generalParameters/plugins/impersonation","impersonationSkipEmptyValues":"generalParameters/plugins/impersonation","impersonationUnrestrictedUsersRule":"generalParameters/plugins/impersonation","infoFormMethod":"generalParameters/advancedParams/forms","issuerDBCASActivation":"generalParameters/issuerParams/issuerDBCAS","issuerDBCASPath":"generalParameters/issuerParams/issuerDBCAS","issuerDBCASRule":"generalParameters/issuerParams/issuerDBCAS","issuerDBGetActivation":"generalParameters/issuerParams/issuerDBGet","issuerDBGetParameters":"generalParameters/issuerParams/issuerDBGet","issuerDBGetPath":"generalParameters/issuerParams/issuerDBGet","issuerDBGetRule":"generalParameters/issuerParams/issuerDBGet","issuerDBOpenIDActivation":"generalParameters/issuerParams/issuerDBOpenID","issuerDBOpenIDConnectActivation":"generalParameters/issuerParams/issuerDBOpenIDConnect","issuerDBOpenIDConnectPath":"generalParameters/issuerParams/issuerDBOpenIDConnect","issuerDBOpenIDConnectRule":"generalParameters/issuerParams/issuerDBOpenIDConnect","issuerDBOpenIDPath":"generalParameters/issuerParams/issuerDBOpenID","issuerDBOpenIDRule":"generalParameters/issuerParams/issuerDBOpenID","issuerDBSAMLActivation":"generalParameters/issuerParams/issuerDBSAML","issuerDBSAMLPath":"generalParameters/issuerParams/issuerDBSAML","issuerDBSAMLRule":"generalParameters/issuerParams/issuerDBSAML","issuersTimeout":"generalParameters/issuerParams/issuerOptions","jsRedirect":"generalParameters/advancedParams/portalRedirection","key":"generalParameters/advancedParams/security","krbAllowedDomains":"generalParameters/authParams/kerberosParams","krbAuthnLevel":"generalParameters/authParams/kerberosParams","krbByJs":"generalParameters/authParams/kerberosParams","krbKeytab":"generalParameters/authParams/kerberosParams","krbRemoveDomain":"generalParameters/authParams/kerberosParams","ldapAllowResetExpiredPassword":"generalParameters/authParams/ldapParams/ldapPassword","ldapAuthnLevel":"generalParameters/authParams/ldapParams","ldapBase":"generalParameters/authParams/ldapParams/ldapConnection","ldapCAFile":"generalParameters/authParams/ldapParams/ldapConnection","ldapCAPath":"generalParameters/authParams/ldapParams/ldapConnection","ldapChangePasswordAsUser":"generalParameters/authParams/ldapParams/ldapPassword","ldapExportedVars":"generalParameters/authParams/ldapParams","ldapGetUserBeforePasswordChange":"generalParameters/authParams/ldapParams/ldapPassword","ldapGroupAttributeName":"generalParameters/authParams/ldapParams/ldapGroups","ldapGroupAttributeNameGroup":"generalParameters/authParams/ldapParams/ldapGroups","ldapGroupAttributeNameSearch":"generalParameters/authParams/ldapParams/ldapGroups","ldapGroupAttributeNameUser":"generalParameters/authParams/ldapParams/ldapGroups","ldapGroupBase":"generalParameters/authParams/ldapParams/ldapGroups","ldapGroupDecodeSearchedValue":"generalParameters/authParams/ldapParams/ldapGroups","ldapGroupObjectClass":"generalParameters/authParams/ldapParams/ldapGroups","ldapGroupRecursive":"generalParameters/authParams/ldapParams/ldapGroups","ldapIOTimeout":"generalParameters/authParams/ldapParams/ldapConnection","ldapITDS":"generalParameters/authParams/ldapParams/ldapPassword","ldapPasswordResetAttribute":"generalParameters/authParams/ldapParams/ldapPassword","ldapPasswordResetAttributeValue":"generalParameters/authParams/ldapParams/ldapPassword","ldapPort":"generalParameters/authParams/ldapParams/ldapConnection","ldapPpolicyControl":"generalParameters/authParams/ldapParams/ldapPassword","ldapPwdEnc":"generalParameters/authParams/ldapParams/ldapPassword","ldapRaw":"generalParameters/authParams/ldapParams/ldapConnection","ldapSearchDeref":"generalParameters/authParams/ldapParams/ldapFilters","ldapServer":"generalParameters/authParams/ldapParams/ldapConnection","ldapSetPassword":"generalParameters/authParams/ldapParams/ldapPassword","ldapTimeout":"generalParameters/authParams/ldapParams/ldapConnection","ldapUsePasswordResetAttribute":"generalParameters/authParams/ldapParams/ldapPassword","ldapVerify":"generalParameters/authParams/ldapParams/ldapConnection","ldapVersion":"generalParameters/authParams/ldapParams/ldapConnection","linkedInAuthnLevel":"generalParameters/authParams/linkedinParams","linkedInClientID":"generalParameters/authParams/linkedinParams","linkedInClientSecret":"generalParameters/authParams/linkedinParams","linkedInFields":"generalParameters/authParams/linkedinParams","linkedInScope":"generalParameters/authParams/linkedinParams","linkedInUserField":"generalParameters/authParams/linkedinParams","localSessionStorage":"generalParameters/sessionParams/sessionStorage","localSessionStorageOptions":"generalParameters/sessionParams/sessionStorage","loginHistoryEnabled":"generalParameters/plugins/loginHistory","logoutServices":"generalParameters/advancedParams","lwpOpts":"generalParameters/advancedParams/security","lwpSslOpts":"generalParameters/advancedParams/security","macros":"variables","mail2fActivation":"generalParameters/secondFactors/mail2f","mail2fAuthnLevel":"generalParameters/secondFactors/mail2f","mail2fBody":"generalParameters/secondFactors/mail2f","mail2fCodeRegex":"generalParameters/secondFactors/mail2f","mail2fLabel":"generalParameters/secondFactors/mail2f","mail2fLogo":"generalParameters/secondFactors/mail2f","mail2fSessionKey":"generalParameters/secondFactors/mail2f","mail2fSubject":"generalParameters/secondFactors/mail2f","mail2fTimeout":"generalParameters/secondFactors/mail2f","mailBody":"generalParameters/plugins/passwordManagement/mailContent","mailCharset":"generalParameters/advancedParams/SMTP/mailHeaders","mailConfirmBody":"generalParameters/plugins/passwordManagement/mailContent","mailConfirmSubject":"generalParameters/plugins/passwordManagement/mailContent","mailFrom":"generalParameters/advancedParams/SMTP/mailHeaders","mailLDAPFilter":"generalParameters/authParams/ldapParams/ldapFilters","mailOnPasswordChange":"generalParameters/portalParams/portalCustomization/passwordManagement","mailReplyTo":"generalParameters/advancedParams/SMTP/mailHeaders","mailSessionKey":"generalParameters/advancedParams/SMTP","mailSubject":"generalParameters/plugins/passwordManagement/mailContent","mailTimeout":"generalParameters/plugins/passwordManagement/mailOther","mailUrl":"generalParameters/plugins/passwordManagement/mailOther","maintenance":"generalParameters/advancedParams/redirection","managerDn":"generalParameters/authParams/ldapParams/ldapConnection","managerPassword":"generalParameters/authParams/ldapParams/ldapConnection","multiValuesSeparator":"generalParameters/advancedParams","nginxCustomHandlers":"generalParameters/advancedParams","noAjaxHook":"generalParameters/advancedParams/portalRedirection","notification":"generalParameters/plugins/notifications","notificationDefaultCond":"generalParameters/plugins/notifications/serverNotification","notificationServer":"generalParameters/plugins/notifications/serverNotification","notificationServerDELETE":"generalParameters/plugins/notifications/serverNotification/notificationServerMethods","notificationServerGET":"generalParameters/plugins/notifications/serverNotification/notificationServerMethods","notificationServerPOST":"generalParameters/plugins/notifications/serverNotification/notificationServerMethods","notificationServerSentAttributes":"generalParameters/plugins/notifications/serverNotification","notificationStorage":"generalParameters/plugins/notifications","notificationStorageOptions":"generalParameters/plugins/notifications","notificationWildcard":"generalParameters/plugins/notifications","notificationXSLTfile":"generalParameters/plugins/notifications","notificationsExplorer":"generalParameters/plugins/notifications","notifyDeleted":"generalParameters/sessionParams/multipleSessions","notifyOther":"generalParameters/sessionParams/multipleSessions","nullAuthnLevel":"generalParameters/authParams/nullParams","oidcAuthnLevel":"generalParameters/authParams/oidcParams","oidcOPMetaDataNodes":"","oidcRPCallbackGetParam":"generalParameters/authParams/oidcParams","oidcRPMetaDataNodes":"","oidcRPStateTimeout":"generalParameters/authParams/oidcParams","oidcServiceAccessTokenExpiration":"oidcServiceMetaData/oidcServiceMetaDataSecurity","oidcServiceAllowAuthorizationCodeFlow":"oidcServiceMetaData/oidcServiceMetaDataSecurity","oidcServiceAllowDynamicRegistration":"oidcServiceMetaData/oidcServiceMetaDataSecurity","oidcServiceAllowHybridFlow":"oidcServiceMetaData/oidcServiceMetaDataSecurity","oidcServiceAllowImplicitFlow":"oidcServiceMetaData/oidcServiceMetaDataSecurity","oidcServiceAllowOnlyDeclaredScopes":"oidcServiceMetaData/oidcServiceMetaDataSecurity","oidcServiceAuthorizationCodeExpiration":"oidcServiceMetaData/oidcServiceMetaDataSecurity","oidcServiceDynamicRegistrationExportedVars":"oidcServiceMetaData","oidcServiceDynamicRegistrationExtraClaims":"oidcServiceMetaData","oidcServiceIDTokenExpiration":"oidcServiceMetaData/oidcServiceMetaDataSecurity","oidcServiceKeyIdSig":"oidcServiceMetaData/oidcServiceMetaDataSecurity/oidcServiceMetaDataKeys","oidcServiceMetaDataAuthnContext":"oidcServiceMetaData","oidcServiceMetaDataAuthorizeURI":"oidcServiceMetaData/oidcServiceMetaDataEndPoints","oidcServiceMetaDataBackChannelURI":"oidcServiceMetaData/oidcServiceMetaDataEndPoints","oidcServiceMetaDataCheckSessionURI":"oidcServiceMetaData/oidcServiceMetaDataEndPoints","oidcServiceMetaDataEndSessionURI":"oidcServiceMetaData/oidcServiceMetaDataEndPoints","oidcServiceMetaDataFrontChannelURI":"oidcServiceMetaData/oidcServiceMetaDataEndPoints","oidcServiceMetaDataIntrospectionURI":"oidcServiceMetaData/oidcServiceMetaDataEndPoints","oidcServiceMetaDataIssuer":"oidcServiceMetaData","oidcServiceMetaDataJWKSURI":"oidcServiceMetaData/oidcServiceMetaDataEndPoints","oidcServiceMetaDataRegistrationURI":"oidcServiceMetaData/oidcServiceMetaDataEndPoints","oidcServiceMetaDataTokenURI":"oidcServiceMetaData/oidcServiceMetaDataEndPoints","oidcServiceMetaDataUserInfoURI":"oidcServiceMetaData/oidcServiceMetaDataEndPoints","oidcServiceOfflineSessionExpiration":"oidcServiceMetaData/oidcServiceMetaDataSecurity","oidcServicePrivateKeySig":"oidcServiceMetaData/oidcServiceMetaDataSecurity/oidcServiceMetaDataKeys","oidcServicePublicKeySig":"oidcServiceMetaData/oidcServiceMetaDataSecurity/oidcServiceMetaDataKeys","oidcStorage":"oidcServiceMetaData/oidcServiceMetaDataSessions","oidcStorageOptions":"oidcServiceMetaData/oidcServiceMetaDataSessions","oldNotifFormat":"generalParameters/plugins/notifications","openIdAttr":"generalParameters/issuerParams/issuerDBOpenID/issuerDBOpenIDOptions","openIdAuthnLevel":"generalParameters/authParams/openidParams","openIdExportedVars":"generalParameters/authParams/openidParams","openIdIDPList":"generalParameters/authParams/openidParams","openIdIssuerSecret":"generalParameters/issuerParams/issuerDBOpenID/issuerDBOpenIDOptions","openIdSPList":"generalParameters/issuerParams/issuerDBOpenID/issuerDBOpenIDOptions","openIdSecret":"generalParameters/authParams/openidParams","openIdSreg_country":"generalParameters/issuerParams/issuerDBOpenID/issuerDBOpenIDOptions/openIdSreg","openIdSreg_dob":"generalParameters/issuerParams/issuerDBOpenID/issuerDBOpenIDOptions/openIdSreg","openIdSreg_email":"generalParameters/issuerParams/issuerDBOpenID/issuerDBOpenIDOptions/openIdSreg","openIdSreg_fullname":"generalParameters/issuerParams/issuerDBOpenID/issuerDBOpenIDOptions/openIdSreg","openIdSreg_gender":"generalParameters/issuerParams/issuerDBOpenID/issuerDBOpenIDOptions/openIdSreg","openIdSreg_language":"generalParameters/issuerParams/issuerDBOpenID/issuerDBOpenIDOptions/openIdSreg","openIdSreg_nickname":"generalParameters/issuerParams/issuerDBOpenID/issuerDBOpenIDOptions/openIdSreg","openIdSreg_postcode":"generalParameters/issuerParams/issuerDBOpenID/issuerDBOpenIDOptions/openIdSreg","openIdSreg_timezone":"generalParameters/issuerParams/issuerDBOpenID/issuerDBOpenIDOptions/openIdSreg","pamAuthnLevel":"generalParameters/authParams/pamParams","pamService":"generalParameters/authParams/pamParams","passwordDB":"generalParameters/authParams","passwordPolicyActivation":"generalParameters/portalParams/portalCustomization/passwordPolicy","passwordPolicyMinDigit":"generalParameters/portalParams/portalCustomization/passwordPolicy","passwordPolicyMinLower":"generalParameters/portalParams/portalCustomization/passwordPolicy","passwordPolicyMinSize":"generalParameters/portalParams/portalCustomization/passwordPolicy","passwordPolicyMinSpeChar":"generalParameters/portalParams/portalCustomization/passwordPolicy","passwordPolicyMinUpper":"generalParameters/portalParams/portalCustomization/passwordPolicy","passwordPolicySpecialChar":"generalParameters/portalParams/portalCustomization/passwordPolicy","passwordResetAllowedRetries":"generalParameters/portalParams/portalCustomization/portalButtons","persistentStorage":"generalParameters/sessionParams/persistentSessions","persistentStorageOptions":"generalParameters/sessionParams/persistentSessions","port":"generalParameters/advancedParams/redirection","portal":"generalParameters/portalParams","portalAntiFrame":"generalParameters/portalParams/portalCustomization/portalOther","portalCheckLogins":"generalParameters/portalParams/portalCustomization/portalButtons","portalCustomCss":"generalParameters/portalParams/portalCustomization","portalDisplayAppslist":"generalParameters/portalParams/portalMenu/portalModules","portalDisplayCertificateResetByMail":"generalParameters/portalParams/portalCustomization/portalButtons","portalDisplayChangePassword":"generalParameters/portalParams/portalMenu/portalModules","portalDisplayGeneratePassword":"generalParameters/plugins/passwordManagement/mailOther","portalDisplayLoginHistory":"generalParameters/portalParams/portalMenu/portalModules","portalDisplayLogout":"generalParameters/portalParams/portalMenu/portalModules","portalDisplayOidcConsents":"generalParameters/portalParams/portalMenu/portalModules","portalDisplayPasswordPolicy":"generalParameters/portalParams/portalCustomization/passwordPolicy","portalDisplayRefreshMyRights":"generalParameters/portalParams/portalCustomization/portalOther","portalDisplayRegister":"generalParameters/portalParams/portalCustomization/portalButtons","portalDisplayResetPassword":"generalParameters/portalParams/portalCustomization/portalButtons","portalErrorOnExpiredSession":"generalParameters/portalParams/portalCustomization/portalOther","portalErrorOnMailNotFound":"generalParameters/portalParams/portalCustomization/portalOther","portalForceAuthn":"generalParameters/advancedParams/security","portalForceAuthnInterval":"generalParameters/advancedParams/security","portalMainLogo":"generalParameters/portalParams/portalCustomization","portalOpenLinkInNewWindow":"generalParameters/portalParams/portalCustomization/portalOther","portalPingInterval":"generalParameters/portalParams/portalCustomization/portalOther","portalRequireOldPassword":"generalParameters/portalParams/portalCustomization/passwordManagement","portalSkin":"generalParameters/portalParams/portalCustomization","portalSkinBackground":"generalParameters/portalParams/portalCustomization","portalSkinRules":"generalParameters/portalParams/portalCustomization","portalStatus":"generalParameters/plugins","portalUserAttr":"generalParameters/portalParams/portalCustomization/portalOther","proxyAuthService":"generalParameters/authParams/proxyParams","proxyAuthnLevel":"generalParameters/authParams/proxyParams","proxySessionService":"generalParameters/authParams/proxyParams","proxyUseSoap":"generalParameters/authParams/proxyParams","radius2fActivation":"generalParameters/secondFactors/radius2f","radius2fAuthnLevel":"generalParameters/secondFactors/radius2f","radius2fLabel":"generalParameters/secondFactors/radius2f","radius2fLogo":"generalParameters/secondFactors/radius2f","radius2fSecret":"generalParameters/secondFactors/radius2f","radius2fServer":"generalParameters/secondFactors/radius2f","radius2fTimeout":"generalParameters/secondFactors/radius2f","radius2fUsernameSessionKey":"generalParameters/secondFactors/radius2f","radiusAuthnLevel":"generalParameters/authParams/radiusParams","radiusSecret":"generalParameters/authParams/radiusParams","radiusServer":"generalParameters/authParams/radiusParams","randomPasswordRegexp":"generalParameters/plugins/passwordManagement/mailOther","redirectFormMethod":"generalParameters/advancedParams/forms","refreshSessions":"generalParameters/plugins","registerConfirmSubject":"generalParameters/plugins/register","registerDB":"generalParameters/authParams","registerDoneSubject":"generalParameters/plugins/register","registerTimeout":"generalParameters/plugins/register","registerUrl":"generalParameters/plugins/register","reloadTimeout":"generalParameters/reloadParams","reloadUrls":"generalParameters/reloadParams","remoteCookieName":"generalParameters/authParams/remoteParams","remoteGlobalStorage":"generalParameters/authParams/remoteParams","remoteGlobalStorageOptions":"generalParameters/authParams/remoteParams","remotePortal":"generalParameters/authParams/remoteParams","requireToken":"generalParameters/advancedParams/security","rest2fActivation":"generalParameters/secondFactors/rest2f","rest2fAuthnLevel":"generalParameters/secondFactors/rest2f","rest2fInitArgs":"generalParameters/secondFactors/rest2f","rest2fInitUrl":"generalParameters/secondFactors/rest2f","rest2fLabel":"generalParameters/secondFactors/rest2f","rest2fLogo":"generalParameters/secondFactors/rest2f","rest2fVerifyArgs":"generalParameters/secondFactors/rest2f","rest2fVerifyUrl":"generalParameters/secondFactors/rest2f","restAuthServer":"generalParameters/plugins/portalServers/restServices","restAuthUrl":"generalParameters/authParams/restParams","restAuthnLevel":"generalParameters/authParams/restParams","restClockTolerance":"generalParameters/plugins/portalServers/restServices","restConfigServer":"generalParameters/plugins/portalServers/restServices","restExportSecretKeys":"generalParameters/plugins/portalServers/restServices","restFindUserDBUrl":"generalParameters/plugins/findUsers","restPasswordServer":"generalParameters/plugins/portalServers/restServices","restPwdConfirmUrl":"generalParameters/authParams/restParams","restPwdModifyUrl":"generalParameters/authParams/restParams","restSessionServer":"generalParameters/plugins/portalServers/restServices","restUserDBUrl":"generalParameters/authParams/restParams","sameSite":"generalParameters/cookieParams","samlAttributeAuthorityDescriptorAttributeServiceSOAP":"samlServiceMetaData/samlAttributeAuthorityDescriptor/samlAttributeAuthorityDescriptorAttributeService","samlAuthnContextMapKerberos":"samlServiceMetaData/samlAuthnContextMap","samlAuthnContextMapPassword":"samlServiceMetaData/samlAuthnContextMap","samlAuthnContextMapPasswordProtectedTransport":"samlServiceMetaData/samlAuthnContextMap","samlAuthnContextMapTLSClient":"samlServiceMetaData/samlAuthnContextMap","samlCommonDomainCookieActivation":"samlServiceMetaData/samlAdvanced/samlCommonDomainCookie","samlCommonDomainCookieDomain":"samlServiceMetaData/samlAdvanced/samlCommonDomainCookie","samlCommonDomainCookieReader":"samlServiceMetaData/samlAdvanced/samlCommonDomainCookie","samlCommonDomainCookieWriter":"samlServiceMetaData/samlAdvanced/samlCommonDomainCookie","samlDiscoveryProtocolActivation":"samlServiceMetaData/samlAdvanced/samlDiscoveryProtocol","samlDiscoveryProtocolIsPassive":"samlServiceMetaData/samlAdvanced/samlDiscoveryProtocol","samlDiscoveryProtocolPolicy":"samlServiceMetaData/samlAdvanced/samlDiscoveryProtocol","samlDiscoveryProtocolURL":"samlServiceMetaData/samlAdvanced/samlDiscoveryProtocol","samlEntityID":"samlServiceMetaData","samlIDPMetaDataNodes":"","samlIDPSSODescriptorArtifactResolutionServiceArtifact":"samlServiceMetaData/samlIDPSSODescriptor/samlIDPSSODescriptorArtifactResolutionService","samlIDPSSODescriptorSingleLogoutServiceHTTPPost":"samlServiceMetaData/samlIDPSSODescriptor/samlIDPSSODescriptorSingleLogoutService","samlIDPSSODescriptorSingleLogoutServiceHTTPRedirect":"samlServiceMetaData/samlIDPSSODescriptor/samlIDPSSODescriptorSingleLogoutService","samlIDPSSODescriptorSingleLogoutServiceSOAP":"samlServiceMetaData/samlIDPSSODescriptor/samlIDPSSODescriptorSingleLogoutService","samlIDPSSODescriptorSingleSignOnServiceHTTPArtifact":"samlServiceMetaData/samlIDPSSODescriptor/samlIDPSSODescriptorSingleSignOnService","samlIDPSSODescriptorSingleSignOnServiceHTTPPost":"samlServiceMetaData/samlIDPSSODescriptor/samlIDPSSODescriptorSingleSignOnService","samlIDPSSODescriptorSingleSignOnServiceHTTPRedirect":"samlServiceMetaData/samlIDPSSODescriptor/samlIDPSSODescriptorSingleSignOnService","samlIDPSSODescriptorWantAuthnRequestsSigned":"samlServiceMetaData/samlIDPSSODescriptor","samlMetadataForceUTF8":"samlServiceMetaData/samlAdvanced","samlNameIDFormatMapEmail":"samlServiceMetaData/samlNameIDFormatMap","samlNameIDFormatMapKerberos":"samlServiceMetaData/samlNameIDFormatMap","samlNameIDFormatMapWindows":"samlServiceMetaData/samlNameIDFormatMap","samlNameIDFormatMapX509":"samlServiceMetaData/samlNameIDFormatMap","samlOrganizationDisplayName":"samlServiceMetaData/samlOrganization","samlOrganizationName":"samlServiceMetaData/samlOrganization","samlOrganizationURL":"samlServiceMetaData/samlOrganization","samlOverrideIDPEntityID":"samlServiceMetaData/samlAdvanced","samlRelayStateTimeout":"samlServiceMetaData/samlAdvanced","samlSPMetaDataNodes":"","samlSPSSODescriptorArtifactResolutionServiceArtifact":"samlServiceMetaData/samlSPSSODescriptor/samlSPSSODescriptorArtifactResolutionService","samlSPSSODescriptorAssertionConsumerServiceHTTPArtifact":"samlServiceMetaData/samlSPSSODescriptor/samlSPSSODescriptorAssertionConsumerService","samlSPSSODescriptorAssertionConsumerServiceHTTPPost":"samlServiceMetaData/samlSPSSODescriptor/samlSPSSODescriptorAssertionConsumerService","samlSPSSODescriptorAuthnRequestsSigned":"samlServiceMetaData/samlSPSSODescriptor","samlSPSSODescriptorSingleLogoutServiceHTTPPost":"samlServiceMetaData/samlSPSSODescriptor/samlSPSSODescriptorSingleLogoutService","samlSPSSODescriptorSingleLogoutServiceHTTPRedirect":"samlServiceMetaData/samlSPSSODescriptor/samlSPSSODescriptorSingleLogoutService","samlSPSSODescriptorSingleLogoutServiceSOAP":"samlServiceMetaData/samlSPSSODescriptor/samlSPSSODescriptorSingleLogoutService","samlSPSSODescriptorWantAssertionsSigned":"samlServiceMetaData/samlSPSSODescriptor","samlServicePrivateKeyEnc":"samlServiceMetaData/samlServiceSecurity/samlServiceSecurityEnc","samlServicePrivateKeyEncPwd":"samlServiceMetaData/samlServiceSecurity/samlServiceSecurityEnc","samlServicePrivateKeySig":"samlServiceMetaData/samlServiceSecurity/samlServiceSecuritySig","samlServicePrivateKeySigPwd":"samlServiceMetaData/samlServiceSecurity/samlServiceSecuritySig","samlServicePublicKeyEnc":"samlServiceMetaData/samlServiceSecurity/samlServiceSecurityEnc","samlServicePublicKeySig":"samlServiceMetaData/samlServiceSecurity/samlServiceSecuritySig","samlServiceSignatureMethod":"samlServiceMetaData/samlServiceSecurity","samlServiceUseCertificateInResponse":"samlServiceMetaData/samlServiceSecurity","samlStorage":"samlServiceMetaData/samlAdvanced","samlStorageOptions":"samlServiceMetaData/samlAdvanced","samlUseQueryStringSpecific":"samlServiceMetaData/samlAdvanced","securedCookie":"generalParameters/cookieParams","sessionDataToRemember":"generalParameters/plugins/loginHistory","sfExtra":"generalParameters/secondFactors","sfManagerRule":"generalParameters/secondFactors","sfOnlyUpgrade":"generalParameters/secondFactors","sfRemovedMsgRule":"generalParameters/secondFactors/sfRemovedNotification","sfRemovedNotifMsg":"generalParameters/secondFactors/sfRemovedNotification","sfRemovedNotifRef":"generalParameters/secondFactors/sfRemovedNotification","sfRemovedNotifTitle":"generalParameters/secondFactors/sfRemovedNotification","sfRemovedUseNotif":"generalParameters/secondFactors/sfRemovedNotification","sfRequired":"generalParameters/secondFactors","showLanguages":"generalParameters/portalParams/portalCustomization","singleIP":"generalParameters/sessionParams/multipleSessions","singleSession":"generalParameters/sessionParams/multipleSessions","singleUserByIP":"generalParameters/sessionParams/multipleSessions","skipRenewConfirmation":"generalParameters/advancedParams/portalRedirection","skipUpgradeConfirmation":"generalParameters/advancedParams/portalRedirection","slaveAuthnLevel":"generalParameters/authParams/slaveParams","slaveDisplayLogo":"generalParameters/authParams/slaveParams","slaveExportedVars":"generalParameters/authParams/slaveParams","slaveHeaderContent":"generalParameters/authParams/slaveParams","slaveHeaderName":"generalParameters/authParams/slaveParams","slaveMasterIP":"generalParameters/authParams/slaveParams","slaveUserHeader":"generalParameters/authParams/slaveParams","soapConfigServer":"generalParameters/plugins/portalServers/soapServices","soapSessionServer":"generalParameters/plugins/portalServers/soapServices","sslByAjax":"generalParameters/authParams/sslParams","sslHost":"generalParameters/authParams/sslParams","stayConnected":"generalParameters/plugins/stayConnect","stayConnectedCookieName":"generalParameters/plugins/stayConnect","stayConnectedTimeout":"generalParameters/plugins/stayConnect","storePassword":"generalParameters/sessionParams","successLoginNumber":"generalParameters/plugins/loginHistory","timeout":"generalParameters/sessionParams","timeoutActivity":"generalParameters/sessionParams","timeoutActivityInterval":"generalParameters/sessionParams","tokenUseGlobalStorage":"generalParameters/advancedParams/security","totp2fActivation":"generalParameters/secondFactors/totp2f","totp2fAuthnLevel":"generalParameters/secondFactors/totp2f","totp2fDigits":"generalParameters/secondFactors/totp2f","totp2fDisplayExistingSecret":"generalParameters/secondFactors/totp2f","totp2fInterval":"generalParameters/secondFactors/totp2f","totp2fIssuer":"generalParameters/secondFactors/totp2f","totp2fLabel":"generalParameters/secondFactors/totp2f","totp2fLogo":"generalParameters/secondFactors/totp2f","totp2fRange":"generalParameters/secondFactors/totp2f","totp2fSelfRegistration":"generalParameters/secondFactors/totp2f","totp2fTTL":"generalParameters/secondFactors/totp2f","totp2fUserCanChangeKey":"generalParameters/secondFactors/totp2f","totp2fUserCanRemoveKey":"generalParameters/secondFactors/totp2f","trustedDomains":"generalParameters/advancedParams/security","twitterAppName":"generalParameters/authParams/twitterParams","twitterAuthnLevel":"generalParameters/authParams/twitterParams","twitterKey":"generalParameters/authParams/twitterParams","twitterSecret":"generalParameters/authParams/twitterParams","twitterUserField":"generalParameters/authParams/twitterParams","u2fActivation":"generalParameters/secondFactors/u2f","u2fAuthnLevel":"generalParameters/secondFactors/u2f","u2fLabel":"generalParameters/secondFactors/u2f","u2fLogo":"generalParameters/secondFactors/u2f","u2fSelfRegistration":"generalParameters/secondFactors/u2f","u2fTTL":"generalParameters/secondFactors/u2f","u2fUserCanRemoveKey":"generalParameters/secondFactors/u2f","upgradeSession":"generalParameters/plugins","useRedirectOnError":"generalParameters/advancedParams/redirection","useRedirectOnForbidden":"generalParameters/advancedParams/redirection","useSafeJail":"generalParameters/advancedParams/security","userControl":"generalParameters/advancedParams/security","userDB":"generalParameters/authParams","userPivot":"generalParameters/authParams/dbiParams/dbiSchema","utotp2fActivation":"generalParameters/secondFactors/utotp2f","utotp2fAuthnLevel":"generalParameters/secondFactors/utotp2f","utotp2fLabel":"generalParameters/secondFactors/utotp2f","utotp2fLogo":"generalParameters/secondFactors/utotp2f","virtualHosts":"","webIDAuthnLevel":"generalParameters/authParams/webidParams","webIDExportedVars":"generalParameters/authParams/webidParams","webIDWhitelist":"generalParameters/authParams/webidParams","whatToTrace":"generalParameters/logParams","wsdlServer":"generalParameters/plugins/portalServers/soapServices","yubikey2fActivation":"generalParameters/secondFactors/yubikey2f","yubikey2fAuthnLevel":"generalParameters/secondFactors/yubikey2f","yubikey2fClientID":"generalParameters/secondFactors/yubikey2f","yubikey2fFromSessionAttribute":"generalParameters/secondFactors/yubikey2f","yubikey2fLabel":"generalParameters/secondFactors/yubikey2f","yubikey2fLogo":"generalParameters/secondFactors/yubikey2f","yubikey2fNonce":"generalParameters/secondFactors/yubikey2f","yubikey2fPublicIDSize":"generalParameters/secondFactors/yubikey2f","yubikey2fSecretKey":"generalParameters/secondFactors/yubikey2f","yubikey2fSelfRegistration":"generalParameters/secondFactors/yubikey2f","yubikey2fTTL":"generalParameters/secondFactors/yubikey2f","yubikey2fUrl":"generalParameters/secondFactors/yubikey2f","yubikey2fUserCanRemoveKey":"generalParameters/secondFactors/yubikey2f"}
\ No newline at end of file
diff --git a/lemonldap-ng-manager/site/htdocs/static/struct.json b/lemonldap-ng-manager/site/htdocs/static/struct.json
index 97d8f8c29..4c80f1d17 100644
--- a/lemonldap-ng-manager/site/htdocs/static/struct.json
+++ b/lemonldap-ng-manager/site/htdocs/static/struct.json
@@ -1 +1 @@
-[{"_nodes":[{"_nodes":[{"default":"http://auth.example.com/","id":"portal","title":"portal"},{"_nodes":[{"_nodes":[{"default":1,"id":"portalDisplayLogout","title":"portalDisplayLogout","type":"boolOrExpr"},{"default":"$_auth =~ /^(LDAP|DBI|Demo)$/","id":"portalDisplayChangePassword","title":"portalDisplayChangePassword","type":"boolOrExpr"},{"default":1,"id":"portalDisplayAppslist","title":"portalDisplayAppslist","type":"boolOrExpr"},{"default":1,"id":"portalDisplayLoginHistory","title":"portalDisplayLoginHistory","type":"boolOrExpr"},{"default":"$_oidcConsents && $_oidcConsents =~ /\\w+/","id":"portalDisplayOidcConsents","title":"portalDisplayOidcConsents","type":"boolOrExpr"}],"id":"portalModules","title":"portalModules","type":"simpleInputContainer"},{"cnodes":"applicationList","default":[{"data":{"catname":"Default category","type":"category"},"id":"applicationList/default","title":"default","type":"catAndAppList"}],"help":"portalmenu.html#categories-and-applications","id":"applicationList","title":"applicationList","type":"catAndAppList"}],"help":"portalmenu.html","id":"portalMenu","title":"portalMenu"},{"_nodes":[{"default":"common/logos/logo_llng_400px.png","id":"portalMainLogo","title":"portalMainLogo"},{"default":1,"id":"showLanguages","title":"showLanguages","type":"bool"},{"id":"portalCustomCss","title":"portalCustomCss"},{"default":"bootstrap","id":"portalSkin","select":[{"k":"bootstrap","v":"Bootstrap"}],"title":"portalSkin","type":"portalskin"},{"id":"portalSkinBackground","select":[{"k":"","v":"None"},{"k":"1280px-Anse_Source_d'Argent_2-La_Digue.jpg","v":"Anse"},{"k":"1280px-Autumn-clear-water-waterfall-landscape_-_Virginia_-_ForestWander.jpg","v":"Waterfall"},{"k":"1280px-BrockenSnowedTrees.jpg","v":"Snowed Trees"},{"k":"1280px-Cedar_Breaks_National_Monument_partially.jpg","v":"National Monument"},{"k":"1280px-Parry_Peak_from_Winter_Park.jpg","v":"Winter"},{"k":"Aletschgletscher_mit_Pinus_cembra1.jpg","v":"Pinus"}],"title":"portalSkinBackground","type":"portalskinbackground"},{"cnodes":"portalSkinRules","help":"portalcustom.html","id":"portalSkinRules","title":"portalSkinRules","type":"keyTextContainer"},{"_nodes":[{"default":1,"id":"portalCheckLogins","title":"portalCheckLogins","type":"bool"},{"default":0,"id":"portalDisplayResetPassword","title":"portalDisplayResetPassword","type":"bool"},{"default":3,"id":"passwordResetAllowedRetries","title":"passwordResetAllowedRetries","type":"int"},{"default":1,"id":"portalDisplayRegister","title":"portalDisplayRegister","type":"bool"},{"default":0,"id":"portalDisplayCertificateResetByMail","title":"portalDisplayCertificateResetByMail","type":"bool"}],"help":"portalcustom.html#buttons","id":"portalButtons","title":"portalButtons","type":"simpleInputContainer"},{"_nodes":[{"default":1,"id":"portalRequireOldPassword","title":"portalRequireOldPassword","type":"boolOrExpr"},{"default":0,"id":"hideOldPassword","title":"hideOldPassword","type":"bool"},{"default":0,"id":"mailOnPasswordChange","title":"mailOnPasswordChange","type":"bool"}],"help":"portalcustom.html#password-management","id":"passwordManagement","title":"passwordManagement","type":"simpleInputContainer"},{"_nodes":[{"default":1,"id":"passwordPolicyActivation","title":"passwordPolicyActivation","type":"boolOrExpr"},{"default":0,"id":"portalDisplayPasswordPolicy","title":"portalDisplayPasswordPolicy","type":"bool"},{"default":0,"id":"passwordPolicyMinSize","title":"passwordPolicyMinSize","type":"int"},{"default":0,"id":"passwordPolicyMinLower","title":"passwordPolicyMinLower","type":"int"},{"default":0,"id":"passwordPolicyMinUpper","title":"passwordPolicyMinUpper","type":"int"},{"default":0,"id":"passwordPolicyMinDigit","title":"passwordPolicyMinDigit","type":"int"},{"default":0,"id":"passwordPolicyMinSpeChar","title":"passwordPolicyMinSpeChar","type":"int"},{"default":"__ALL__","id":"passwordPolicySpecialChar","title":"passwordPolicySpecialChar"}],"help":"portalcustom.html#password-policy","id":"passwordPolicy","title":"passwordPolicy","type":"simpleInputContainer"},{"_nodes":[{"default":"_user","id":"portalUserAttr","title":"portalUserAttr"},{"default":0,"id":"portalOpenLinkInNewWindow","title":"portalOpenLinkInNewWindow","type":"bool"},{"default":1,"id":"portalAntiFrame","title":"portalAntiFrame","type":"bool"},{"default":60000,"id":"portalPingInterval","title":"portalPingInterval","type":"int"},{"default":1,"id":"portalErrorOnExpiredSession","title":"portalErrorOnExpiredSession","type":"bool"},{"default":0,"id":"portalErrorOnMailNotFound","title":"portalErrorOnMailNotFound","type":"bool"},{"default":1,"id":"portalDisplayRefreshMyRights","title":"portalDisplayRefreshMyRights","type":"bool"}],"help":"portalcustom.html#other-parameters","id":"portalOther","title":"portalOther","type":"simpleInputContainer"}],"help":"portalcustom.html","id":"portalCustomization","title":"portalCustomization"},{"_nodes":[{"default":0,"id":"captcha_login_enabled","title":"captcha_login_enabled","type":"bool"},{"default":1,"id":"captcha_mail_enabled","title":"captcha_mail_enabled","type":"bool"},{"default":1,"id":"captcha_register_enabled","title":"captcha_register_enabled","type":"bool"},{"default":6,"id":"captcha_size","title":"captcha_size","type":"int"}],"help":"captcha.html","id":"portalCaptcha","title":"portalCaptcha","type":"simpleInputContainer"}],"help":"portal.html","id":"portalParams","title":"portalParams"},{"_nodes":[{"default":"Demo","id":"authentication","select":[{"k":"Apache","v":"Apache"},{"k":"AD","v":"Active Directory"},{"k":"DBI","v":"Database (DBI)"},{"k":"Facebook","v":"Facebook"},{"k":"GitHub","v":"GitHub"},{"k":"GPG","v":"GPG"},{"k":"Kerberos","v":"Kerberos"},{"k":"LDAP","v":"LDAP"},{"k":"LinkedIn","v":"LinkedIn"},{"k":"PAM","v":"PAM"},{"k":"Radius","v":"Radius"},{"k":"REST","v":"REST"},{"k":"SSL","v":"SSL"},{"k":"Twitter","v":"Twitter"},{"k":"WebID","v":"WebID"},{"k":"Demo","v":"Demonstration"},{"k":"Choice","v":"authChoice"},{"k":"Combination","v":"combineMods"},{"k":"CAS","v":"Central Authentication Service (CAS)"},{"k":"OpenID","v":"OpenID"},{"k":"OpenIDConnect","v":"OpenID Connect"},{"k":"SAML","v":"SAML v2"},{"k":"Proxy","v":"Proxy"},{"k":"Remote","v":"Remote"},{"k":"Slave","v":"Slave"},{"k":"Null","v":"None"},{"k":"Custom","v":"customModule"}],"title":"authentication","type":"select"},{"default":"Same","id":"userDB","select":[{"k":"Same","v":"Same"},{"k":"AD","v":"Active Directory"},{"k":"DBI","v":"Database (DBI)"},{"k":"LDAP","v":"LDAP"},{"k":"REST","v":"REST"},{"k":"Null","v":"None"},{"k":"Custom","v":"customModule"}],"title":"userDB","type":"select"},{"default":"Demo","id":"passwordDB","select":[{"k":"AD","v":"Active Directory"},{"k":"Choice","v":"authChoice"},{"k":"DBI","v":"Database (DBI)"},{"k":"Demo","v":"Demonstration"},{"k":"LDAP","v":"LDAP"},{"k":"REST","v":"REST"},{"k":"Null","v":"None"},{"k":"Combination","v":"combineMods"},{"k":"Custom","v":"customModule"}],"title":"passwordDB","type":"select"},{"default":"Null","id":"registerDB","select":[{"k":"AD","v":"Active Directory"},{"k":"Demo","v":"Demonstration"},{"k":"LDAP","v":"LDAP"},{"k":"Null","v":"None"},{"k":"Custom","v":"customModule"}],"title":"registerDB","type":"select"}],"_nodes_cond":[{"_nodes":[{"default":0,"id":"ADPwdMaxAge","title":"ADPwdMaxAge","type":"int"},{"default":0,"id":"ADPwdExpireWarning","title":"ADPwdExpireWarning","type":"int"}],"help":"authad.html","id":"adParams","show":false,"title":"adParams","type":"simpleInputContainer"},{"_nodes":[{"default":"lmAuth","id":"authChoiceParam","title":"authChoiceParam"},{"cnodes":"authChoiceModules","id":"authChoiceModules","select":[[{"k":"Apache","v":"Apache"},{"k":"AD","v":"Active Directory"},{"k":"CAS","v":"Central Authentication Service (CAS)"},{"k":"DBI","v":"Database (DBI)"},{"k":"Demo","v":"Demo"},{"k":"Facebook","v":"Facebook"},{"k":"GitHub","v":"GitHub"},{"k":"GPG","v":"GPG"},{"k":"Kerberos","v":"Kerberos"},{"k":"LDAP","v":"LDAP"},{"k":"LinkedIn","v":"LinkedIn"},{"k":"PAM","v":"PAM"},{"k":"Null","v":"None"},{"k":"OpenID","v":"OpenID"},{"k":"OpenIDConnect","v":"OpenID Connect"},{"k":"Proxy","v":"Proxy"},{"k":"Radius","v":"Radius"},{"k":"REST","v":"REST"},{"k":"Remote","v":"Remote"},{"k":"SAML","v":"SAML v2"},{"k":"Slave","v":"Slave"},{"k":"SSL","v":"SSL"},{"k":"Twitter","v":"Twitter"},{"k":"WebID","v":"WebID"},{"k":"Custom","v":"customModule"}],[{"k":"AD","v":"Active Directory"},{"k":"CAS","v":"Central Authentication Service (CAS)"},{"k":"DBI","v":"Database (DBI)"},{"k":"Demo","v":"Demo"},{"k":"Facebook","v":"Facebook"},{"k":"LDAP","v":"LDAP"},{"k":"Null","v":"None"},{"k":"OpenID","v":"OpenID"},{"k":"OpenIDConnect","v":"OpenID Connect"},{"k":"Proxy","v":"Proxy"},{"k":"REST","v":"REST"},{"k":"Remote","v":"Remote"},{"k":"SAML","v":"SAML v2"},{"k":"Slave","v":"Slave"},{"k":"WebID","v":"WebID"},{"k":"Custom","v":"customModule"}],[{"k":"AD","v":"Active Directory"},{"k":"DBI","v":"Database (DBI)"},{"k":"Demo","v":"Demo"},{"k":"LDAP","v":"LDAP"},{"k":"REST","v":"REST"},{"k":"Null","v":"None"},{"k":"Custom","v":"customModule"}]],"title":"authChoiceModules","type":"authChoiceContainer"},{"id":"authChoiceAuthBasic","title":"authChoiceAuthBasic"},{"id":"authChoiceFindUser","title":"authChoiceFindUser"}],"help":"authchoice.html","id":"choiceParams","show":false,"title":"choiceParams"},{"_nodes":[{"default":3,"id":"apacheAuthnLevel","title":"apacheAuthnLevel","type":"int"}],"help":"authapache.html","id":"apacheParams","show":false,"title":"apacheParams","type":"simpleInputContainer"},{"_nodes":[{"default":1,"id":"casAuthnLevel","title":"casAuthnLevel","type":"int"}],"help":"authcas.html","id":"casParams","show":false,"title":"casParams","type":"simpleInputContainer"},{"_nodes":[{"default":2,"id":"dbiAuthnLevel","title":"dbiAuthnLevel","type":"int"},{"cnodes":"dbiExportedVars","default":[],"id":"dbiExportedVars","title":"dbiExportedVars","type":"keyTextContainer"},{"_nodes":[{"_nodes":[{"id":"dbiAuthChain","title":"dbiAuthChain"},{"id":"dbiAuthUser","title":"dbiAuthUser"},{"id":"dbiAuthPassword","title":"dbiAuthPassword","type":"password"}],"id":"dbiConnectionAuth","title":"dbiConnectionAuth","type":"simpleInputContainer"},{"_nodes":[{"id":"dbiUserChain","title":"dbiUserChain"},{"id":"dbiUserUser","title":"dbiUserUser"},{"id":"dbiUserPassword","title":"dbiUserPassword","type":"password"}],"id":"dbiConnectionUser","title":"dbiConnectionUser","type":"simpleInputContainer"}],"help":"authdbi.html#connection","id":"dbiConnection","title":"dbiConnection"},{"_nodes":[{"id":"dbiAuthTable","title":"dbiAuthTable"},{"id":"dbiUserTable","title":"dbiUserTable"},{"id":"dbiAuthLoginCol","title":"dbiAuthLoginCol"},{"id":"dbiAuthPasswordCol","title":"dbiAuthPasswordCol"},{"id":"dbiPasswordMailCol","title":"dbiPasswordMailCol"},{"id":"userPivot","title":"userPivot"}],"help":"authdbi.html#schema","id":"dbiSchema","title":"dbiSchema","type":"simpleInputContainer"},{"_nodes":[{"help":"authdbi.html#password","id":"dbiAuthPasswordHash","title":"dbiAuthPasswordHash"},{"_nodes":[{"help":"authdbi.html#password","id":"dbiDynamicHashEnabled","title":"dbiDynamicHashEnabled","type":"bool"},{"help":"authdbi.html#password","id":"dbiDynamicHashValidSchemes","title":"dbiDynamicHashValidSchemes"},{"help":"authdbi.html#password","id":"dbiDynamicHashValidSaltedSchemes","title":"dbiDynamicHashValidSaltedSchemes"},{"help":"authdbi.html#password","id":"dbiDynamicHashNewPasswordScheme","title":"dbiDynamicHashNewPasswordScheme"}],"help":"authdbi.html#password","id":"dbiDynamicHash","title":"dbiDynamicHash","type":"simpleInputContainer"}],"help":"authdbi.html#password","id":"dbiPassword","title":"dbiPassword"}],"help":"authdbi.html","id":"dbiParams","show":false,"title":"dbiParams"},{"_nodes":[{"cnodes":"demoExportedVars","default":[{"data":"cn","id":"demoExportedVars/cn","title":"cn","type":"keyText"},{"data":"mail","id":"demoExportedVars/mail","title":"mail","type":"keyText"},{"data":"uid","id":"demoExportedVars/uid","title":"uid","type":"keyText"}],"id":"demoExportedVars","title":"demoExportedVars","type":"keyTextContainer"}],"help":"authdemo.html","id":"demoParams","show":false,"title":"demoParams"},{"_nodes":[{"default":1,"id":"facebookAuthnLevel","title":"facebookAuthnLevel","type":"int"},{"cnodes":"facebookExportedVars","default":[],"id":"facebookExportedVars","title":"facebookExportedVars","type":"keyTextContainer"},{"id":"facebookAppId","title":"facebookAppId"},{"id":"facebookAppSecret","title":"facebookAppSecret"},{"default":"id","id":"facebookUserField","title":"facebookUserField"}],"help":"authfacebook.html","id":"facebookParams","show":false,"title":"facebookParams"},{"_nodes":[{"default":3,"id":"krbAuthnLevel","title":"krbAuthnLevel","type":"int"},{"id":"krbKeytab","title":"krbKeytab"},{"default":0,"id":"krbByJs","title":"krbByJs","type":"bool"},{"default":1,"id":"krbRemoveDomain","title":"krbRemoveDomain","type":"bool"},{"id":"krbAllowedDomains","title":"krbAllowedDomains"}],"help":"authkerberos.html","id":"kerberosParams","show":false,"title":"kerberosParams","type":"simpleInputContainer"},{"_nodes":[{"default":2,"id":"ldapAuthnLevel","title":"ldapAuthnLevel","type":"int"},{"cnodes":"ldapExportedVars","default":[{"data":"cn","id":"ldapExportedVars/cn","title":"cn","type":"keyText"},{"data":"mail","id":"ldapExportedVars/mail","title":"mail","type":"keyText"},{"data":"uid","id":"ldapExportedVars/uid","title":"uid","type":"keyText"}],"id":"ldapExportedVars","title":"ldapExportedVars","type":"keyTextContainer"},{"_nodes":[{"default":"ldap://localhost","id":"ldapServer","title":"ldapServer"},{"id":"ldapPort","title":"ldapPort","type":"int"},{"default":"require","id":"ldapVerify","select":[{"k":"none","v":"None"},{"k":"optional","v":"Optional"},{"k":"require","v":"Require"}],"title":"ldapVerify","type":"select"},{"default":"dc=example,dc=com","id":"ldapBase","title":"ldapBase"},{"default":"","id":"managerDn","title":"managerDn"},{"default":"","id":"managerPassword","title":"managerPassword","type":"password"},{"default":10,"id":"ldapTimeout","title":"ldapTimeout","type":"int"},{"default":10,"id":"ldapIOTimeout","title":"ldapIOTimeout","type":"int"},{"default":3,"id":"ldapVersion","title":"ldapVersion","type":"int"},{"id":"ldapRaw","title":"ldapRaw"},{"id":"ldapCAFile","title":"ldapCAFile"},{"id":"ldapCAPath","title":"ldapCAPath"}],"help":"authldap.html#connection","id":"ldapConnection","title":"ldapConnection","type":"simpleInputContainer"},{"_nodes":[{"id":"LDAPFilter","title":"LDAPFilter"},{"id":"AuthLDAPFilter","title":"AuthLDAPFilter"},{"id":"mailLDAPFilter","title":"mailLDAPFilter"},{"default":"find","id":"ldapSearchDeref","select":[{"k":"never","v":"never"},{"k":"search","v":"search"},{"k":"find","v":"find"},{"k":"always","v":"always"}],"title":"ldapSearchDeref","type":"select"}],"help":"authldap.html#filters","id":"ldapFilters","title":"ldapFilters","type":"simpleInputContainer"},{"_nodes":[{"id":"ldapGroupBase","title":"ldapGroupBase"},{"default":"groupOfNames","id":"ldapGroupObjectClass","title":"ldapGroupObjectClass"},{"default":"member","id":"ldapGroupAttributeName","title":"ldapGroupAttributeName"},{"default":"dn","id":"ldapGroupAttributeNameUser","title":"ldapGroupAttributeNameUser"},{"default":"cn","id":"ldapGroupAttributeNameSearch","title":"ldapGroupAttributeNameSearch"},{"default":0,"id":"ldapGroupDecodeSearchedValue","title":"ldapGroupDecodeSearchedValue","type":"bool"},{"default":0,"id":"ldapGroupRecursive","title":"ldapGroupRecursive","type":"bool"},{"default":"dn","id":"ldapGroupAttributeNameGroup","title":"ldapGroupAttributeNameGroup"}],"help":"authldap.html#groups","id":"ldapGroups","title":"ldapGroups","type":"simpleInputContainer"},{"_nodes":[{"default":0,"id":"ldapPpolicyControl","title":"ldapPpolicyControl","type":"bool"},{"default":0,"id":"ldapSetPassword","title":"ldapSetPassword","type":"bool"},{"default":0,"id":"ldapChangePasswordAsUser","title":"ldapChangePasswordAsUser","type":"bool"},{"default":"utf-8","id":"ldapPwdEnc","title":"ldapPwdEnc"},{"default":1,"id":"ldapUsePasswordResetAttribute","title":"ldapUsePasswordResetAttribute","type":"bool"},{"default":"pwdReset","id":"ldapPasswordResetAttribute","title":"ldapPasswordResetAttribute"},{"default":"TRUE","id":"ldapPasswordResetAttributeValue","title":"ldapPasswordResetAttributeValue"},{"default":0,"id":"ldapAllowResetExpiredPassword","title":"ldapAllowResetExpiredPassword","type":"bool"},{"default":0,"id":"ldapGetUserBeforePasswordChange","title":"ldapGetUserBeforePasswordChange","type":"bool"},{"default":0,"id":"ldapITDS","title":"ldapITDS","type":"bool"}],"help":"authldap.html#password","id":"ldapPassword","title":"ldapPassword","type":"simpleInputContainer"}],"help":"authldap.html","id":"ldapParams","show":false,"title":"ldapParams"},{"_nodes":[{"default":1,"id":"linkedInAuthnLevel","title":"linkedInAuthnLevel","type":"int"},{"id":"linkedInClientID","title":"linkedInClientID"},{"id":"linkedInClientSecret","title":"linkedInClientSecret","type":"password"},{"default":"id,first-name,last-name,email-address","id":"linkedInFields","title":"linkedInFields"},{"default":"emailAddress","id":"linkedInUserField","title":"linkedInUserField"},{"default":"r_liteprofile r_emailaddress","id":"linkedInScope","title":"linkedInScope"}],"help":"authlinkedin.html","id":"linkedinParams","show":false,"title":"linkedinParams","type":"simpleInputContainer"},{"_nodes":[{"default":1,"id":"githubAuthnLevel","title":"githubAuthnLevel","type":"int"},{"id":"githubClientID","title":"githubClientID"},{"id":"githubClientSecret","title":"githubClientSecret","type":"password"},{"default":"login","id":"githubUserField","title":"githubUserField"},{"default":"user:email","id":"githubScope","title":"githubScope"}],"help":"authgithub.html","id":"githubParams","show":false,"title":"githubParams","type":"simpleInputContainer"},{"_nodes":[{"id":"combination","title":"combination"},{"cnodes":"combModules","id":"combModules","select":[{"k":"Apache","v":"Apache"},{"k":"AD","v":"Active Directory"},{"k":"DBI","v":"Database (DBI)"},{"k":"Facebook","v":"Facebook"},{"k":"GitHub","v":"GitHub"},{"k":"GPG","v":"GPG"},{"k":"Kerberos","v":"Kerberos"},{"k":"LDAP","v":"LDAP"},{"k":"LinkedIn","v":"LinkedIn"},{"k":"PAM","v":"PAM"},{"k":"Radius","v":"Radius"},{"k":"REST","v":"REST"},{"k":"SSL","v":"SSL"},{"k":"Twitter","v":"Twitter"},{"k":"WebID","v":"WebID"},{"k":"Demo","v":"Demonstration"},{"k":"CAS","v":"Central Authentication Service (CAS)"},{"k":"OpenID","v":"OpenID"},{"k":"OpenIDConnect","v":"OpenID Connect"},{"k":"SAML","v":"SAML v2"},{"k":"Proxy","v":"Proxy"},{"k":"Remote","v":"Remote"},{"k":"Slave","v":"Slave"},{"k":"Null","v":"None"},{"k":"Custom","v":"customModule"}],"title":"combModules","type":"cmbModuleContainer"}],"help":"authcombination.html","id":"combinationParams","show":false,"title":"combinationParams"},{"_nodes":[{"default":0,"id":"nullAuthnLevel","title":"nullAuthnLevel","type":"int"}],"help":"authnull.html","id":"nullParams","show":false,"title":"nullParams","type":"simpleInputContainer"},{"_nodes":[{"default":1,"id":"openIdAuthnLevel","title":"openIdAuthnLevel","type":"int"},{"cnodes":"openIdExportedVars","default":[],"id":"openIdExportedVars","title":"openIdExportedVars","type":"keyTextContainer"},{"id":"openIdSecret","title":"openIdSecret"},{"default":"0;","id":"openIdIDPList","title":"openIdIDPList","type":"blackWhiteList"}],"help":"authopenid.html","id":"openidParams","show":false,"title":"openidParams"},{"_nodes":[{"default":1,"id":"oidcAuthnLevel","title":"oidcAuthnLevel","type":"int"},{"default":"openidconnectcallback","id":"oidcRPCallbackGetParam","title":"oidcRPCallbackGetParam"},{"default":600,"id":"oidcRPStateTimeout","title":"oidcRPStateTimeout","type":"int"}],"help":"authopenidconnect.html","id":"oidcParams","show":false,"title":"oidcParams","type":"simpleInputContainer"},{"_nodes":[{"default":5,"id":"gpgAuthnLevel","title":"gpgAuthnLevel","type":"int"},{"default":"","id":"gpgDb","title":"gpgDb"}],"help":"authgpg.html","id":"gpgParams","show":false,"title":"gpgParams","type":"simpleInputContainer"},{"_nodes":[{"default":2,"id":"proxyAuthnLevel","title":"proxyAuthnLevel","type":"int"},{"id":"proxyAuthService","title":"proxyAuthService"},{"id":"proxySessionService","title":"proxySessionService"},{"id":"remoteCookieName","title":"remoteCookieName"},{"default":0,"id":"proxyUseSoap","title":"proxyUseSoap","type":"bool"}],"help":"authproxy.html","id":"proxyParams","show":false,"title":"proxyParams","type":"simpleInputContainer"},{"_nodes":[{"default":2,"id":"pamAuthnLevel","title":"pamAuthnLevel","type":"int"},{"default":"login","id":"pamService","title":"pamService"}],"help":"authpam.html","id":"pamParams","show":false,"title":"pamParams","type":"simpleInputContainer"},{"_nodes":[{"default":3,"id":"radiusAuthnLevel","title":"radiusAuthnLevel","type":"int"},{"id":"radiusSecret","title":"radiusSecret"},{"id":"radiusServer","title":"radiusServer"}],"help":"authradius.html","id":"radiusParams","show":false,"title":"radiusParams","type":"simpleInputContainer"},{"_nodes":[{"default":2,"id":"restAuthnLevel","title":"restAuthnLevel","type":"int"},{"id":"restAuthUrl","title":"restAuthUrl"},{"id":"restUserDBUrl","title":"restUserDBUrl"},{"id":"restPwdConfirmUrl","title":"restPwdConfirmUrl"},{"id":"restPwdModifyUrl","title":"restPwdModifyUrl"}],"help":"authrest.html","id":"restParams","show":false,"title":"restParams","type":"simpleInputContainer"},{"_nodes":[{"id":"remotePortal","title":"remotePortal"},{"id":"remoteCookieName","title":"remoteCookieName"},{"default":"Lemonldap::NG::Common::Apache::Session::SOAP","id":"remoteGlobalStorage","title":"remoteGlobalStorage"},{"cnodes":"remoteGlobalStorageOptions","default":[{"data":"http://auth.example.com/Lemonldap/NG/Common/PSGI/SOAPService","id":"remoteGlobalStorageOptions/ns","title":"ns","type":"keyText"},{"data":"http://auth.example.com/sessions","id":"remoteGlobalStorageOptions/proxy","title":"proxy","type":"keyText"}],"id":"remoteGlobalStorageOptions","title":"remoteGlobalStorageOptions","type":"keyTextContainer"}],"help":"authremote.html","id":"remoteParams","show":false,"title":"remoteParams"},{"_nodes":[{"default":2,"id":"slaveAuthnLevel","title":"slaveAuthnLevel","type":"int"},{"id":"slaveUserHeader","title":"slaveUserHeader"},{"id":"slaveMasterIP","title":"slaveMasterIP"},{"id":"slaveHeaderName","title":"slaveHeaderName"},{"id":"slaveHeaderContent","title":"slaveHeaderContent"},{"default":0,"id":"slaveDisplayLogo","title":"slaveDisplayLogo","type":"bool"},{"cnodes":"slaveExportedVars","default":[],"id":"slaveExportedVars","title":"slaveExportedVars","type":"keyTextContainer"}],"help":"authslave.html","id":"slaveParams","show":false,"title":"slaveParams"},{"_nodes":[{"default":5,"id":"SSLAuthnLevel","title":"SSLAuthnLevel","type":"int"},{"default":"SSL_CLIENT_S_DN_Email","id":"SSLVar","title":"SSLVar"},{"cnodes":"SSLVarIf","default":[],"id":"SSLVarIf","title":"SSLVarIf","type":"keyTextContainer"},{"default":0,"id":"sslByAjax","title":"sslByAjax","type":"bool"},{"id":"sslHost","title":"sslHost"}],"help":"authssl.html","id":"sslParams","show":false,"title":"sslParams"},{"_nodes":[{"default":1,"id":"twitterAuthnLevel","title":"twitterAuthnLevel","type":"int"},{"id":"twitterKey","title":"twitterKey"},{"id":"twitterSecret","title":"twitterSecret"},{"id":"twitterAppName","title":"twitterAppName"},{"default":"screen_name","id":"twitterUserField","title":"twitterUserField"}],"help":"authtwitter.html","id":"twitterParams","show":false,"title":"twitterParams","type":"simpleInputContainer"},{"_nodes":[{"default":1,"id":"webIDAuthnLevel","title":"webIDAuthnLevel","type":"int"},{"cnodes":"webIDExportedVars","default":[],"id":"webIDExportedVars","title":"webIDExportedVars","type":"keyTextContainer"},{"id":"webIDWhitelist","title":"webIDWhitelist"}],"help":"authwebid.html","id":"webidParams","show":false,"title":"webidParams"},{"_nodes":[{"id":"customAuth","title":"customAuth"},{"id":"customUserDB","title":"customUserDB"},{"id":"customPassword","title":"customPassword"},{"id":"customRegister","title":"customRegister"},{"id":"customResetCertByMail","title":"customResetCertByMail"},{"cnodes":"customAddParams","id":"customAddParams","title":"customAddParams","type":"keyTextContainer"}],"help":"authcustom.html","id":"customParams","show":false,"title":"customParams"}],"_nodes_filter":"authParams","help":"start.html#authentication-users-and-password-databases","id":"authParams","title":"authParams","type":"authParams"},{"_nodes":[{"_nodes":[{"default":0,"id":"issuerDBSAMLActivation","title":"issuerDBSAMLActivation","type":"bool"},{"default":"^/saml/","id":"issuerDBSAMLPath","title":"issuerDBSAMLPath"},{"default":1,"id":"issuerDBSAMLRule","title":"issuerDBSAMLRule","type":"boolOrExpr"}],"help":"idpsaml.html","id":"issuerDBSAML","title":"issuerDBSAML","type":"simpleInputContainer"},{"_nodes":[{"default":0,"id":"issuerDBCASActivation","title":"issuerDBCASActivation","type":"bool"},{"default":"^/cas/","id":"issuerDBCASPath","title":"issuerDBCASPath"},{"default":1,"id":"issuerDBCASRule","title":"issuerDBCASRule","type":"boolOrExpr"}],"help":"idpcas.html#enabling-cas","id":"issuerDBCAS","title":"issuerDBCAS","type":"simpleInputContainer"},{"_nodes":[{"default":0,"id":"issuerDBOpenIDActivation","title":"issuerDBOpenIDActivation","type":"bool"},{"default":"^/openidserver/","id":"issuerDBOpenIDPath","title":"issuerDBOpenIDPath"},{"default":1,"id":"issuerDBOpenIDRule","title":"issuerDBOpenIDRule","type":"boolOrExpr"},{"_nodes":[{"id":"openIdIssuerSecret","title":"openIdIssuerSecret"},{"id":"openIdAttr","title":"openIdAttr"},{"default":"0;","id":"openIdSPList","title":"openIdSPList","type":"blackWhiteList"},{"_nodes":[{"default":"cn","id":"openIdSreg_fullname","title":"openIdSreg_fullname"},{"default":"uid","id":"openIdSreg_nickname","title":"openIdSreg_nickname"},{"id":"openIdSreg_language","title":"openIdSreg_language"},{"id":"openIdSreg_postcode","title":"openIdSreg_postcode"},{"default":"_timezone","id":"openIdSreg_timezone","title":"openIdSreg_timezone"},{"id":"openIdSreg_country","title":"openIdSreg_country"},{"id":"openIdSreg_gender","title":"openIdSreg_gender"},{"default":"mail","id":"openIdSreg_email","title":"openIdSreg_email"},{"id":"openIdSreg_dob","title":"openIdSreg_dob"}],"id":"openIdSreg","title":"openIdSreg","type":"simpleInputContainer"}],"id":"issuerDBOpenIDOptions","title":"issuerDBOpenIDOptions"}],"help":"idpopenid.html","id":"issuerDBOpenID","title":"issuerDBOpenID"},{"_nodes":[{"default":0,"id":"issuerDBOpenIDConnectActivation","title":"issuerDBOpenIDConnectActivation","type":"bool"},{"default":"^/oauth2/","id":"issuerDBOpenIDConnectPath","title":"issuerDBOpenIDConnectPath"},{"default":1,"id":"issuerDBOpenIDConnectRule","title":"issuerDBOpenIDConnectRule","type":"boolOrExpr"}],"help":"idpopenidconnect.html","id":"issuerDBOpenIDConnect","title":"issuerDBOpenIDConnect","type":"simpleInputContainer"},{"_nodes":[{"default":0,"id":"issuerDBGetActivation","title":"issuerDBGetActivation","type":"bool"},{"default":"^/get/","id":"issuerDBGetPath","title":"issuerDBGetPath"},{"default":1,"id":"issuerDBGetRule","title":"issuerDBGetRule","type":"boolOrExpr"},{"default":[],"id":"issuerDBGetParameters","title":"issuerDBGetParameters","type":"doubleHash"}],"help":"issuerdbget.html","id":"issuerDBGet","title":"issuerDBGet"},{"_nodes":[{"default":120,"id":"issuersTimeout","title":"issuersTimeout","type":"int"}],"help":"start.html#options","id":"issuerOptions","title":"issuerOptions","type":"simpleInputContainer"}],"help":"start.html#identity-provider","id":"issuerParams","title":"issuerParams"},{"_nodes":[{"default":"uid","id":"whatToTrace","title":"whatToTrace"},{"id":"customToTrace","title":"customToTrace"},{"default":"_password _2fDevices","id":"hiddenAttributes","title":"hiddenAttributes"}],"help":"logs.html","id":"logParams","title":"logParams","type":"simpleInputContainer"},{"_nodes":[{"default":"lemonldap","id":"cookieName","title":"cookieName"},{"default":"example.com","id":"domain","title":"domain"},{"default":0,"id":"cda","title":"cda","type":"bool"},{"default":0,"id":"securedCookie","select":[{"k":"0","v":"unsecuredCookie"},{"k":"1","v":"securedCookie"},{"k":"2","v":"doubleCookie"},{"k":"3","v":"doubleCookieForSingleSession"}],"title":"securedCookie","type":"select"},{"default":1,"id":"httpOnly","title":"httpOnly","type":"bool"},{"id":"cookieExpiration","title":"cookieExpiration","type":"int"},{"default":"","id":"sameSite","select":[{"k":"","v":""},{"k":"Strict","v":"Strict"},{"k":"Lax","v":"Lax"},{"k":"None","v":"None"}],"title":"sameSite","type":"select"}],"help":"ssocookie.html","id":"cookieParams","title":"cookieParams","type":"simpleInputContainer"},{"_nodes":[{"default":0,"id":"storePassword","title":"storePassword","type":"bool"},{"default":1,"id":"displaySessionId","title":"displaySessionId","type":"bool"},{"default":72000,"id":"timeout","title":"timeout","type":"int"},{"default":0,"id":"timeoutActivity","title":"timeoutActivity","type":"int"},{"default":60,"id":"timeoutActivityInterval","title":"timeoutActivityInterval","type":"int"},{"cnodes":"grantSessionRules","default":[],"id":"grantSessionRules","title":"grantSessionRules","type":"grantContainer"},{"_nodes":[{"default":"Apache::Session::File","id":"globalStorage","title":"globalStorage"},{"cnodes":"globalStorageOptions","default":[{"data":"/var/lib/lemonldap-ng/sessions/","id":"globalStorageOptions/Directory","title":"Directory","type":"keyText"},{"data":"/var/lib/lemonldap-ng/sessions/lock/","id":"globalStorageOptions/LockDirectory","title":"LockDirectory","type":"keyText"},{"data":"Lemonldap::NG::Common::Apache::Session::Generate::SHA256","id":"globalStorageOptions/generateModule","title":"generateModule","type":"keyText"}],"id":"globalStorageOptions","title":"globalStorageOptions","type":"keyTextContainer"},{"default":"Cache::FileCache","id":"localSessionStorage","title":"localSessionStorage"},{"cnodes":"localSessionStorageOptions","default":[{"data":3,"id":"localSessionStorageOptions/cache_depth","title":"cache_depth","type":"keyText"},{"data":"/var/cache/lemonldap-ng","id":"localSessionStorageOptions/cache_root","title":"cache_root","type":"keyText"},{"data":600,"id":"localSessionStorageOptions/default_expires_in","title":"default_expires_in","type":"keyText"},{"data":"007","id":"localSessionStorageOptions/directory_umask","title":"directory_umask","type":"keyText"},{"data":"lemonldap-ng-sessions","id":"localSessionStorageOptions/namespace","title":"namespace","type":"keyText"}],"id":"localSessionStorageOptions","title":"localSessionStorageOptions","type":"keyTextContainer"}],"help":"start.html#sessions-database","id":"sessionStorage","title":"sessionStorage"},{"_nodes":[{"default":0,"id":"singleSession","title":"singleSession","type":"boolOrExpr"},{"default":0,"id":"singleIP","title":"singleIP","type":"boolOrExpr"},{"default":0,"id":"singleUserByIP","title":"singleUserByIP","type":"boolOrExpr"},{"default":1,"id":"notifyDeleted","title":"notifyDeleted","type":"bool"},{"default":0,"id":"notifyOther","title":"notifyOther","type":"bool"}],"id":"multipleSessions","title":"multipleSessions","type":"simpleInputContainer"},{"_nodes":[{"default":0,"id":"disablePersistentStorage","title":"disablePersistentStorage","type":"bool"},{"id":"persistentStorage","title":"persistentStorage"},{"cnodes":"persistentStorageOptions","id":"persistentStorageOptions","title":"persistentStorageOptions","type":"keyTextContainer"}],"id":"persistentSessions","title":"persistentSessions"}],"help":"sessions.html","id":"sessionParams","title":"sessionParams"},{"_nodes":[{"default":5,"id":"reloadTimeout","title":"reloadTimeout","type":"int"},{"default":0,"id":"compactConf","title":"compactConf","type":"bool"},{"cnodes":"reloadUrls","help":"configlocation.html#configuration-reload","id":"reloadUrls","title":"reloadUrls","type":"keyTextContainer"}],"help":"configlocation.html#configuration-reload","id":"reloadParams","title":"reloadParams"},{"_nodes":[{"default":0,"help":"status.html","id":"portalStatus","title":"portalStatus","type":"bool"},{"default":1,"id":"upgradeSession","title":"upgradeSession","type":"bool"},{"id":"refreshSessions","title":"refreshSessions","type":"bool"},{"cnodes":"adaptativeAuthenticationLevelRules","id":"adaptativeAuthenticationLevelRules","title":"adaptativeAuthenticationLevelRules","type":"keyTextContainer"},{"_nodes":[{"default":0,"id":"stayConnected","title":"stayConnected","type":"bool"},{"default":2592000,"id":"stayConnectedTimeout","title":"stayConnectedTimeout","type":"int"},{"default":"llngconnection","id":"stayConnectedCookieName","title":"stayConnectedCookieName"}],"help":"stayconnected.html","id":"stayConnect","title":"stayConnect","type":"simpleInputContainer"},{"_nodes":[{"id":"exportedAttr","title":"exportedAttr"},{"_nodes":[{"default":0,"id":"restSessionServer","title":"restSessionServer","type":"bool"},{"default":0,"id":"restConfigServer","title":"restConfigServer","type":"bool"},{"default":0,"id":"restAuthServer","title":"restAuthServer","type":"bool"},{"default":0,"id":"restPasswordServer","title":"restPasswordServer","type":"bool"},{"default":0,"id":"restExportSecretKeys","title":"restExportSecretKeys","type":"bool"},{"default":15,"id":"restClockTolerance","title":"restClockTolerance","type":"int"}],"help":"portalservers.html#REST","id":"restServices","title":"restServices","type":"simpleInputContainer"},{"_nodes":[{"default":0,"help":"soapservices.html","id":"soapSessionServer","title":"soapSessionServer","type":"bool"},{"default":0,"help":"soapservices.html","id":"soapConfigServer","title":"soapConfigServer","type":"bool"},{"default":0,"id":"wsdlServer","title":"wsdlServer","type":"bool"}],"help":"portalservers.html#SOAP_(deprecated)","id":"soapServices","title":"soapServices","type":"simpleInputContainer"}],"help":"portalservers.html","id":"portalServers","title":"portalServers"},{"_nodes":[{"default":0,"id":"loginHistoryEnabled","title":"loginHistoryEnabled","type":"bool"},{"default":5,"id":"successLoginNumber","title":"successLoginNumber","type":"int"},{"default":5,"id":"failedLoginNumber","title":"failedLoginNumber","type":"int"},{"cnodes":"sessionDataToRemember","id":"sessionDataToRemember","title":"sessionDataToRemember","type":"keyTextContainer"}],"help":"loginhistory.html","id":"loginHistory","title":"loginHistory"},{"_nodes":[{"default":0,"id":"notification","title":"notification","type":"bool"},{"default":0,"id":"notificationsExplorer","title":"notificationsExplorer","type":"bool"},{"default":"allusers","id":"notificationWildcard","title":"notificationWildcard"},{"default":0,"id":"oldNotifFormat","title":"oldNotifFormat","type":"bool"},{"id":"notificationXSLTfile","title":"notificationXSLTfile"},{"default":"File","id":"notificationStorage","title":"notificationStorage"},{"cnodes":"notificationStorageOptions","default":[{"data":"/var/lib/lemonldap-ng/notifications","id":"notificationStorageOptions/dirName","title":"dirName","type":"keyText"}],"id":"notificationStorageOptions","title":"notificationStorageOptions","type":"keyTextContainer"},{"_nodes":[{"default":0,"id":"notificationServer","title":"notificationServer","type":"bool"},{"default":"","id":"notificationDefaultCond","title":"notificationDefaultCond"},{"default":"uid reference date title subtitle text check","id":"notificationServerSentAttributes","title":"notificationServerSentAttributes"},{"_nodes":[{"default":1,"id":"notificationServerPOST","title":"notificationServerPOST","type":"bool"},{"default":0,"id":"notificationServerGET","title":"notificationServerGET","type":"bool"},{"default":0,"id":"notificationServerDELETE","title":"notificationServerDELETE","type":"bool"}],"id":"notificationServerMethods","title":"notificationServerMethods","type":"simpleInputContainer"}],"help":"notifications.html#notification-server","id":"serverNotification","title":"serverNotification"}],"help":"notifications.html","id":"notifications","title":"notifications"},{"_nodes":[{"_nodes":[{"id":"mailSubject","title":"mailSubject"},{"id":"mailBody","title":"mailBody","type":"longtext"},{"id":"mailConfirmSubject","title":"mailConfirmSubject"},{"id":"mailConfirmBody","title":"mailConfirmBody","type":"longtext"}],"id":"mailContent","title":"mailContent","type":"simpleInputContainer"},{"_nodes":[{"default":"http://auth.example.com/resetpwd","id":"mailUrl","title":"mailUrl"},{"default":0,"id":"mailTimeout","title":"mailTimeout","type":"int"},{"default":1,"id":"portalDisplayGeneratePassword","title":"portalDisplayGeneratePassword","type":"bool"},{"default":"[A-Z]{3}[a-z]{5}.\\d{2}","id":"randomPasswordRegexp","title":"randomPasswordRegexp"}],"id":"mailOther","title":"mailOther","type":"simpleInputContainer"}],"help":"resetpassword.html","id":"passwordManagement","title":"passwordManagement"},{"_nodes":[{"_nodes":[{"id":"certificateResetByMailStep1Subject","title":"certificateResetByMailStep1Subject"},{"id":"certificateResetByMailStep1Body","title":"certificateResetByMailStep1Body","type":"longtext"},{"id":"certificateResetByMailStep2Subject","title":"certificateResetByMailStep2Subject"},{"id":"certificateResetByMailStep2Body","title":"certificateResetByMailStep2Body","type":"longtext"}],"id":"certificateMailContent","title":"certificateMailContent","type":"simpleInputContainer"},{"_nodes":[{"default":"http://auth.example.com/certificateReset","id":"certificateResetByMailURL","title":"certificateResetByMailURL"},{"default":"description","id":"certificateResetByMailCeaAttribute","title":"certificateResetByMailCeaAttribute"},{"default":"userCertificate;binary","id":"certificateResetByMailCertificateAttribute","title":"certificateResetByMailCertificateAttribute"},{"default":0,"id":"certificateResetByMailValidityDelay","title":"certificateResetByMailValidityDelay","type":"int"}],"id":"mailOther","title":"mailOther","type":"simpleInputContainer"}],"help":"resetcertificate.html","id":"certificateResetByMailManagement","title":"certificateResetByMailManagement"},{"_nodes":[{"default":"http://auth.example.com/register","id":"registerUrl","title":"registerUrl"},{"default":0,"id":"registerTimeout","title":"registerTimeout","type":"int"},{"id":"registerConfirmSubject","title":"registerConfirmSubject"},{"id":"registerDoneSubject","title":"registerDoneSubject"}],"help":"register.html","id":"register","title":"register","type":"simpleInputContainer"},{"_nodes":[{"cnodes":"autoSigninRules","id":"autoSigninRules","title":"autoSigninRules","type":"keyTextContainer"}],"help":"autosignin.html","id":"autoSignin","title":"autoSignin"},{"_nodes":[{"default":0,"id":"globalLogoutRule","title":"globalLogoutRule","type":"boolOrExpr"},{"default":1,"id":"globalLogoutTimer","title":"globalLogoutTimer","type":"bool"},{"id":"globalLogoutCustomParam","title":"globalLogoutCustomParam"}],"help":"globallogout.html","id":"globalLogout","title":"globalLogout","type":"simpleInputContainer"},{"_nodes":[{"default":0,"id":"checkState","title":"checkState","type":"bool"},{"id":"checkStateSecret","title":"checkStateSecret"}],"help":"checkstate.html","id":"stateCheck","title":"stateCheck","type":"simpleInputContainer"},{"_nodes":[{"default":0,"id":"checkUser","title":"checkUser","type":"bool"},{"default":1,"id":"checkUserIdRule","title":"checkUserIdRule"},{"id":"checkUserUnrestrictedUsersRule","title":"checkUserUnrestrictedUsersRule"},{"id":"checkUserSearchAttributes","title":"checkUserSearchAttributes"},{"default":"_loginHistory _session_id hGroups","id":"checkUserHiddenAttributes","title":"checkUserHiddenAttributes"},{"cnodes":"checkUserHiddenHeaders","id":"checkUserHiddenHeaders","title":"checkUserHiddenHeaders","type":"keyTextContainer"},{"_nodes":[{"default":1,"id":"checkUserDisplayComputedSession","title":"checkUserDisplayComputedSession","type":"boolOrExpr"},{"default":0,"id":"checkUserDisplayPersistentInfo","title":"checkUserDisplayPersistentInfo","type":"boolOrExpr"},{"default":0,"id":"checkUserDisplayNormalizedHeaders","title":"checkUserDisplayNormalizedHeaders","type":"boolOrExpr"},{"default":0,"id":"checkUserDisplayEmptyHeaders","title":"checkUserDisplayEmptyHeaders","type":"boolOrExpr"},{"default":0,"id":"checkUserDisplayEmptyValues","title":"checkUserDisplayEmptyValues","type":"boolOrExpr"}],"help":"checkuser.html#configuration","id":"checkUserDisplay","title":"checkUserDisplay","type":"simpleInputContainer"}],"help":"checkuser.html","id":"checkUsers","title":"checkUsers"},{"_nodes":[{"default":0,"id":"checkDevOps","title":"checkDevOps","type":"bool"},{"default":1,"id":"checkDevOpsDownload","title":"checkDevOpsDownload","type":"bool"}],"help":"checkdevops.html","id":"devOpsCheck","title":"devOpsCheck","type":"simpleInputContainer"},{"_nodes":[{"default":0,"id":"impersonationRule","title":"impersonationRule","type":"boolOrExpr"},{"default":1,"id":"impersonationIdRule","title":"impersonationIdRule"},{"id":"impersonationUnrestrictedUsersRule","title":"impersonationUnrestrictedUsersRule"},{"default":"_2fDevices _loginHistory","id":"impersonationHiddenAttributes","title":"impersonationHiddenAttributes"},{"default":1,"id":"impersonationSkipEmptyValues","title":"impersonationSkipEmptyValues","type":"bool"},{"default":0,"id":"impersonationMergeSSOgroups","title":"impersonationMergeSSOgroups","type":"boolOrExpr"}],"help":"impersonation.html","id":"impersonation","title":"impersonation","type":"simpleInputContainer"},{"_nodes":[{"default":0,"id":"findUser","title":"findUser","type":"bool"},{"default":"*","id":"findUserWildcard","title":"findUserWildcard"},{"default":"^[*\\w]+$","id":"findUserControl","title":"findUserControl"},{"id":"restFindUserDBUrl","title":"restFindUserDBUrl"},{"cnodes":"findUserSearchingAttributes","id":"findUserSearchingAttributes","title":"findUserSearchingAttributes","type":"keyTextContainer"},{"cnodes":"findUserExcludingAttributes","id":"findUserExcludingAttributes","title":"findUserExcludingAttributes","type":"keyTextContainer"}],"help":"finduser.html","id":"findUsers","title":"findUsers"},{"_nodes":[{"default":0,"id":"contextSwitchingRule","title":"contextSwitchingRule","type":"boolOrExpr"},{"default":1,"id":"contextSwitchingIdRule","title":"contextSwitchingIdRule"},{"id":"contextSwitchingUnrestrictedUsersRule","title":"contextSwitchingUnrestrictedUsersRule"},{"default":0,"id":"contextSwitchingAllowed2fModifications","title":"contextSwitchingAllowed2fModifications","type":"bool"},{"default":1,"id":"contextSwitchingStopWithLogout","title":"contextSwitchingStopWithLogout","type":"bool"}],"help":"contextswitching.html","id":"contextSwitching","title":"contextSwitching","type":"simpleInputContainer"},{"_nodes":[{"default":0,"id":"decryptValueRule","title":"decryptValueRule","type":"boolOrExpr"},{"id":"decryptValueFunctions","title":"decryptValueFunctions"}],"help":"decryptvalue.html","id":"decryptValue","title":"decryptValue","type":"simpleInputContainer"},{"_nodes":[{"id":"customPlugins","title":"customPlugins"},{"cnodes":"customPluginsParams","id":"customPluginsParams","title":"customPluginsParams","type":"keyTextContainer"}],"help":"plugincustom.html","id":"customPluginsNode","title":"customPluginsNode"}],"help":"start.html#plugins","id":"plugins","title":"plugins"},{"_nodes":[{"default":1,"help":"secondfactor.html","id":"sfManagerRule","title":"sfManagerRule","type":"boolOrExpr"},{"default":0,"help":"secondfactor.html","id":"sfRequired","title":"sfRequired","type":"boolOrExpr"},{"help":"secondfactor.html","id":"sfOnlyUpgrade","title":"sfOnlyUpgrade","type":"bool"},{"_nodes":[{"default":0,"id":"utotp2fActivation","title":"utotp2fActivation","type":"boolOrExpr"},{"id":"utotp2fAuthnLevel","title":"utotp2fAuthnLevel","type":"int"},{"id":"utotp2fLabel","title":"utotp2fLabel"},{"id":"utotp2fLogo","title":"utotp2fLogo"}],"help":"utotp2f.html","id":"utotp2f","title":"utotp2f","type":"simpleInputContainer"},{"_nodes":[{"default":0,"id":"totp2fActivation","title":"totp2fActivation","type":"boolOrExpr"},{"default":0,"id":"totp2fSelfRegistration","title":"totp2fSelfRegistration","type":"boolOrExpr"},{"default":1,"id":"totp2fUserCanRemoveKey","title":"totp2fUserCanRemoveKey","type":"bool"},{"default":0,"id":"totp2fUserCanChangeKey","title":"totp2fUserCanChangeKey","type":"bool"},{"id":"totp2fIssuer","title":"totp2fIssuer"},{"default":30,"id":"totp2fInterval","title":"totp2fInterval","type":"int"},{"default":1,"id":"totp2fRange","title":"totp2fRange","type":"int"},{"default":6,"id":"totp2fDigits","title":"totp2fDigits","type":"int"},{"default":0,"id":"totp2fDisplayExistingSecret","title":"totp2fDisplayExistingSecret","type":"bool"},{"id":"totp2fTTL","title":"totp2fTTL","type":"int"},{"id":"totp2fAuthnLevel","title":"totp2fAuthnLevel","type":"int"},{"id":"totp2fLabel","title":"totp2fLabel"},{"id":"totp2fLogo","title":"totp2fLogo"}],"help":"totp2f.html","id":"totp2f","title":"totp2f","type":"simpleInputContainer"},{"_nodes":[{"default":0,"id":"u2fActivation","title":"u2fActivation","type":"boolOrExpr"},{"default":0,"id":"u2fSelfRegistration","title":"u2fSelfRegistration","type":"boolOrExpr"},{"default":1,"id":"u2fUserCanRemoveKey","title":"u2fUserCanRemoveKey","type":"bool"},{"id":"u2fTTL","title":"u2fTTL","type":"int"},{"id":"u2fAuthnLevel","title":"u2fAuthnLevel","type":"int"},{"id":"u2fLabel","title":"u2fLabel"},{"id":"u2fLogo","title":"u2fLogo"}],"help":"u2f.html","id":"u2f","title":"u2f","type":"simpleInputContainer"},{"_nodes":[{"default":0,"id":"yubikey2fActivation","title":"yubikey2fActivation","type":"boolOrExpr"},{"default":0,"id":"yubikey2fSelfRegistration","title":"yubikey2fSelfRegistration","type":"boolOrExpr"},{"default":1,"id":"yubikey2fUserCanRemoveKey","title":"yubikey2fUserCanRemoveKey","type":"bool"},{"id":"yubikey2fClientID","title":"yubikey2fClientID"},{"id":"yubikey2fSecretKey","title":"yubikey2fSecretKey"},{"id":"yubikey2fNonce","title":"yubikey2fNonce"},{"id":"yubikey2fUrl","title":"yubikey2fUrl"},{"default":12,"id":"yubikey2fPublicIDSize","title":"yubikey2fPublicIDSize","type":"int"},{"id":"yubikey2fFromSessionAttribute","title":"yubikey2fFromSessionAttribute"},{"id":"yubikey2fTTL","title":"yubikey2fTTL","type":"int"},{"id":"yubikey2fAuthnLevel","title":"yubikey2fAuthnLevel","type":"int"},{"id":"yubikey2fLabel","title":"yubikey2fLabel"},{"id":"yubikey2fLogo","title":"yubikey2fLogo"}],"help":"yubikey2f.html","id":"yubikey2f","title":"yubikey2f","type":"simpleInputContainer"},{"_nodes":[{"default":0,"id":"mail2fActivation","title":"mail2fActivation","type":"boolOrExpr"},{"default":"\\d{6}","id":"mail2fCodeRegex","title":"mail2fCodeRegex"},{"id":"mail2fTimeout","title":"mail2fTimeout","type":"int"},{"id":"mail2fSubject","title":"mail2fSubject"},{"id":"mail2fBody","title":"mail2fBody","type":"longtext"},{"id":"mail2fAuthnLevel","title":"mail2fAuthnLevel","type":"int"},{"id":"mail2fLabel","title":"mail2fLabel"},{"id":"mail2fLogo","title":"mail2fLogo"},{"id":"mail2fSessionKey","title":"mail2fSessionKey"}],"help":"mail2f.html","id":"mail2f","title":"mail2f","type":"simpleInputContainer"},{"_nodes":[{"default":0,"id":"ext2fActivation","title":"ext2fActivation","type":"boolOrExpr"},{"default":"\\d{6}","id":"ext2fCodeActivation","title":"ext2fCodeActivation"},{"id":"ext2FSendCommand","title":"ext2FSendCommand"},{"id":"ext2FValidateCommand","title":"ext2FValidateCommand"},{"id":"ext2fAuthnLevel","title":"ext2fAuthnLevel","type":"int"},{"id":"ext2fLabel","title":"ext2fLabel"},{"id":"ext2fLogo","title":"ext2fLogo"}],"help":"external2f.html","id":"ext2f","title":"ext2f","type":"simpleInputContainer"},{"_nodes":[{"default":0,"id":"radius2fActivation","title":"radius2fActivation","type":"boolOrExpr"},{"id":"radius2fServer","title":"radius2fServer"},{"id":"radius2fSecret","title":"radius2fSecret"},{"id":"radius2fUsernameSessionKey","title":"radius2fUsernameSessionKey"},{"default":20,"id":"radius2fTimeout","title":"radius2fTimeout","type":"int"},{"id":"radius2fAuthnLevel","title":"radius2fAuthnLevel","type":"int"},{"id":"radius2fLogo","title":"radius2fLogo"},{"id":"radius2fLabel","title":"radius2fLabel"}],"help":"radius2f.html","id":"radius2f","title":"radius2f","type":"simpleInputContainer"},{"_nodes":[{"default":0,"id":"rest2fActivation","title":"rest2fActivation","type":"boolOrExpr"},{"id":"rest2fInitUrl","title":"rest2fInitUrl"},{"cnodes":"rest2fInitArgs","id":"rest2fInitArgs","title":"rest2fInitArgs","type":"keyTextContainer"},{"id":"rest2fVerifyUrl","title":"rest2fVerifyUrl"},{"cnodes":"rest2fVerifyArgs","id":"rest2fVerifyArgs","title":"rest2fVerifyArgs","type":"keyTextContainer"},{"id":"rest2fAuthnLevel","title":"rest2fAuthnLevel","type":"int"},{"id":"rest2fLabel","title":"rest2fLabel"},{"id":"rest2fLogo","title":"rest2fLogo"}],"help":"rest2f.html","id":"rest2f","title":"rest2f"},{"cnodes":"sfExtra","id":"sfExtra","select":[{"k":"Mail2F","v":"E-Mail"},{"k":"REST","v":"REST"},{"k":"Ext2F","v":"External"},{"k":"Radius","v":"Radius"}],"title":"sfExtra","type":"sfExtraContainer"},{"_nodes":[{"default":0,"help":"secondfactor.html","id":"sfRemovedMsgRule","title":"sfRemovedMsgRule","type":"boolOrExpr"},{"default":0,"id":"sfRemovedUseNotif","title":"sfRemovedUseNotif","type":"bool"},{"default":"RemoveSF","help":"secondfactor.html","id":"sfRemovedNotifRef","title":"sfRemovedNotifRef"},{"default":"Second factor notification","help":"secondfactor.html","id":"sfRemovedNotifTitle","title":"sfRemovedNotifTitle"},{"default":"_removedSF_ expired second factor(s) has/have been removed!","help":"secondfactor.html","id":"sfRemovedNotifMsg","title":"sfRemovedNotifMsg"}],"help":"secondfactor.html","id":"sfRemovedNotification","title":"sfRemovedNotification","type":"simpleInputContainer"}],"help":"secondfactor.html","id":"secondFactors","title":"secondFactors"},{"_nodes":[{"help":"customfunctions.html","id":"customFunctions","title":"customFunctions"},{"default":"; ","id":"multiValuesSeparator","title":"multiValuesSeparator","type":"authParamsText"},{"default":0,"id":"groupsBeforeMacros","title":"groupsBeforeMacros","type":"bool"},{"_nodes":[{"default":"mail","id":"mailSessionKey","title":"mailSessionKey"},{"default":"","id":"SMTPServer","title":"SMTPServer"},{"id":"SMTPPort","title":"SMTPPort","type":"int"},{"id":"SMTPAuthUser","title":"SMTPAuthUser"},{"id":"SMTPAuthPass","title":"SMTPAuthPass","type":"password"},{"default":"","id":"SMTPTLS","select":[{"k":"","v":"none"},{"k":"starttls","v":"SMTP + STARTTLS"},{"k":"ssl","v":"SMTPS"}],"title":"SMTPTLS","type":"select"},{"cnodes":"SMTPTLSOpts","id":"SMTPTLSOpts","title":"SMTPTLSOpts","type":"keyTextContainer"},{"_nodes":[{"default":"noreply@example.com","id":"mailFrom","title":"mailFrom"},{"id":"mailReplyTo","title":"mailReplyTo"},{"default":"utf-8","id":"mailCharset","title":"mailCharset"}],"id":"mailHeaders","title":"mailHeaders","type":"simpleInputContainer"}],"help":"smtp.html","id":"SMTP","title":"SMTP","type":"SMTP"},{"_nodes":[{"default":"^[\\w\\.\\-@]+$","id":"userControl","title":"userControl"},{"default":0,"id":"browsersDontStorePassword","title":"browsersDontStorePassword","type":"bool"},{"default":0,"help":"forcereauthn.html","id":"portalForceAuthn","title":"portalForceAuthn","type":"bool"},{"default":5,"id":"portalForceAuthnInterval","title":"portalForceAuthnInterval","type":"int"},{"id":"key","title":"key","type":"password"},{"id":"trustedDomains","title":"trustedDomains"},{"default":1,"help":"safejail.html","id":"useSafeJail","title":"useSafeJail","type":"bool"},{"default":0,"help":"safejail.html","id":"avoidAssignment","title":"avoidAssignment","type":"bool"},{"default":1,"id":"checkXSS","title":"checkXSS","type":"bool"},{"default":1,"id":"requireToken","title":"requireToken","type":"boolOrExpr"},{"default":120,"id":"formTimeout","title":"formTimeout","type":"int"},{"default":0,"id":"tokenUseGlobalStorage","title":"tokenUseGlobalStorage","type":"bool"},{"_nodes":[{"id":"crowdsec","title":"crowdsec","type":"bool"},{"default":"reject","id":"crowdsecAction","select":[{"k":"reject","v":"Reject"},{"k":"warn","v":"Warn"}],"title":"crowdsecAction","type":"select"},{"id":"crowdsecUrl","title":"crowdsecUrl"},{"id":"crowdsecKey","title":"crowdsecKey"}],"help":"crowdsec.html","id":"CrowdSecPlugin","title":"CrowdSecPlugin"},{"_nodes":[{"default":0,"help":"bruteforceprotection.html","id":"bruteForceProtection","title":"bruteForceProtection","type":"bool"},{"default":30,"id":"bruteForceProtectionTempo","title":"bruteForceProtectionTempo","type":"int"},{"default":3,"id":"bruteForceProtectionMaxFailed","title":"bruteForceProtectionMaxFailed","type":"int"},{"default":0,"help":"bruteforceprotection.html","id":"bruteForceProtectionIncrementalTempo","title":"bruteForceProtectionIncrementalTempo","type":"bool"},{"default":"15, 30, 60, 300, 600","id":"bruteForceProtectionLockTimes","title":"bruteForceProtectionLockTimes"}],"help":"bruteforceprotection.html","id":"bruteForceAttackProtection","title":"bruteForceAttackProtection","type":"simpleInputContainer"},{"cnodes":"lwpOpts","id":"lwpOpts","title":"lwpOpts","type":"keyTextContainer"},{"cnodes":"lwpSslOpts","id":"lwpSslOpts","title":"lwpSslOpts","type":"keyTextContainer"},{"_nodes":[{"default":"'self'","id":"cspDefault","title":"cspDefault"},{"default":"'self' data:","id":"cspImg","title":"cspImg"},{"default":"'self'","id":"cspScript","title":"cspScript"},{"default":"'self'","id":"cspStyle","title":"cspStyle"},{"default":"'self'","id":"cspFont","title":"cspFont"},{"default":"*","id":"cspFormAction","title":"cspFormAction"},{"default":"'self'","id":"cspConnect","title":"cspConnect"},{"default":"","id":"cspFrameAncestors","title":"cspFrameAncestors"}],"help":"security.html#portal","id":"contentSecurityPolicy","title":"contentSecurityPolicy","type":"simpleInputContainer"},{"_nodes":[{"default":1,"id":"corsEnabled","title":"corsEnabled","type":"bool"},{"default":true,"id":"corsAllow_Credentials","title":"corsAllow_Credentials"},{"default":"*","id":"corsAllow_Headers","title":"corsAllow_Headers"},{"default":"POST,GET","id":"corsAllow_Methods","title":"corsAllow_Methods"},{"default":"*","id":"corsAllow_Origin","title":"corsAllow_Origin"},{"default":"*","id":"corsExpose_Headers","title":"corsExpose_Headers"},{"default":"86400","id":"corsMax_Age","title":"corsMax_Age"}],"help":"security.html#portal","id":"crossOrigineResourceSharing","title":"crossOrigineResourceSharing","type":"simpleInputContainer"}],"help":"security.html#configure-security-settings","id":"security","title":"security"},{"_nodes":[{"default":-1,"id":"https","title":"https","type":"trool"},{"default":-1,"id":"port","title":"port","type":"int"},{"default":0,"id":"useRedirectOnForbidden","title":"useRedirectOnForbidden","type":"bool"},{"default":1,"id":"useRedirectOnError","title":"useRedirectOnError","type":"bool"},{"default":0,"id":"maintenance","title":"maintenance","type":"bool"}],"help":"redirections.html","id":"redirection","title":"redirection","type":"simpleInputContainer"},{"_nodes":[{"default":0,"id":"jsRedirect","title":"jsRedirect","type":"boolOrExpr"},{"default":0,"id":"noAjaxHook","title":"noAjaxHook","type":"bool"},{"default":0,"id":"skipRenewConfirmation","title":"skipRenewConfirmation","type":"bool"},{"default":0,"id":"skipUpgradeConfirmation","title":"skipUpgradeConfirmation","type":"bool"}],"help":"redirections.html#portal-redirections","id":"portalRedirection","title":"portalRedirection","type":"simpleInputContainer"},{"cnodes":"nginxCustomHandlers","help":"handlerarch.html","id":"nginxCustomHandlers","title":"nginxCustomHandlers","type":"keyTextContainer"},{"cnodes":"logoutServices","default":[],"help":"logoutforward.html","id":"logoutServices","title":"logoutServices","type":"keyTextContainer"},{"_nodes":[{"default":"get","id":"infoFormMethod","select":[{"k":"get","v":"GET"},{"k":"post","v":"POST"}],"title":"infoFormMethod","type":"select"},{"default":"post","id":"confirmFormMethod","select":[{"k":"get","v":"GET"},{"k":"post","v":"POST"}],"title":"confirmFormMethod","type":"select"},{"default":"get","id":"redirectFormMethod","select":[{"k":"get","v":"GET"},{"k":"post","v":"POST"}],"title":"redirectFormMethod","type":"select"},{"default":1,"id":"activeTimer","title":"activeTimer","type":"bool"}],"id":"forms","title":"forms","type":"simpleInputContainer"}],"help":"start.html#advanced-features","id":"advancedParams","title":"advancedParams"}],"id":"generalParameters","title":"generalParameters"},{"_nodes":[{"cnodes":"exportedVars","default":[{"data":"HTTP_USER_AGENT","id":"exportedVars/UA","title":"UA","type":"keyText"}],"help":"exportedvars.html","id":"exportedVars","title":"exportedVars","type":"keyTextContainer"},{"cnodes":"macros","default":[],"help":"exportedvars.html#extend-variables-using-macros-and-groups","id":"macros","title":"macros","type":"keyTextContainer"},{"cnodes":"groups","default":[],"help":"exportedvars.html#extend-variables-using-macros-and-groups","id":"groups","title":"groups","type":"keyTextContainer"}],"help":"variables.html","id":"variables","title":"variables"},{"cnodes":"virtualHosts","help":"configvhost.html","id":"virtualHosts","template":"virtualHost","title":"virtualHosts","type":"virtualHostContainer"},{"_nodes":[{"default":"#PORTAL#/saml/metadata","id":"samlEntityID","title":"samlEntityID"},{"_nodes":[{"get":["samlServicePrivateKeySig","samlServicePrivateKeySigPwd","samlServicePublicKeySig"],"id":"samlServiceSecuritySig","title":"samlServiceSecuritySig","type":"RSACertKey"},{"get":["samlServicePrivateKeyEnc","samlServicePrivateKeyEncPwd","samlServicePublicKeyEnc"],"id":"samlServiceSecurityEnc","title":"samlServiceSecurityEnc","type":"RSACertKey"},{"default":0,"id":"samlServiceUseCertificateInResponse","title":"samlServiceUseCertificateInResponse","type":"bool"},{"default":"RSA_SHA256","id":"samlServiceSignatureMethod","select":[{"k":"RSA_SHA1","v":"RSA SHA1"},{"k":"RSA_SHA256","v":"RSA SHA256"},{"k":"RSA_SHA384","v":"RSA SHA384"},{"k":"RSA_SHA512","v":"RSA SHA512"}],"title":"samlServiceSignatureMethod","type":"select"}],"help":"samlservice.html#security-parameters","id":"samlServiceSecurity","title":"samlServiceSecurity"},{"_nodes":[{"default":"mail","id":"samlNameIDFormatMapEmail","title":"samlNameIDFormatMapEmail"},{"default":"mail","id":"samlNameIDFormatMapX509","title":"samlNameIDFormatMapX509"},{"default":"uid","id":"samlNameIDFormatMapWindows","title":"samlNameIDFormatMapWindows"},{"default":"uid","id":"samlNameIDFormatMapKerberos","title":"samlNameIDFormatMapKerberos"}],"help":"samlservice.html#nameid-formats","id":"samlNameIDFormatMap","title":"samlNameIDFormatMap","type":"simpleInputContainer"},{"_nodes":[{"default":2,"id":"samlAuthnContextMapPassword","title":"samlAuthnContextMapPassword","type":"int"},{"default":3,"id":"samlAuthnContextMapPasswordProtectedTransport","title":"samlAuthnContextMapPasswordProtectedTransport","type":"int"},{"default":5,"id":"samlAuthnContextMapTLSClient","title":"samlAuthnContextMapTLSClient","type":"int"},{"default":4,"id":"samlAuthnContextMapKerberos","title":"samlAuthnContextMapKerberos","type":"int"}],"help":"samlservice.html#authentication-contexts","id":"samlAuthnContextMap","title":"samlAuthnContextMap","type":"simpleInputContainer"},{"_nodes":[{"default":"Example","id":"samlOrganizationDisplayName","title":"samlOrganizationDisplayName"},{"default":"Example","id":"samlOrganizationName","title":"samlOrganizationName"},{"default":"http://www.example.com","id":"samlOrganizationURL","title":"samlOrganizationURL"}],"help":"samlservice.html#organization","id":"samlOrganization","title":"samlOrganization","type":"simpleInputContainer"},{"_nodes":[{"default":1,"id":"samlSPSSODescriptorAuthnRequestsSigned","title":"samlSPSSODescriptorAuthnRequestsSigned","type":"bool"},{"default":1,"id":"samlSPSSODescriptorWantAssertionsSigned","title":"samlSPSSODescriptorWantAssertionsSigned","type":"bool"},{"_nodes":[{"default":"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect;#PORTAL#/saml/proxySingleLogout;#PORTAL#/saml/proxySingleLogoutReturn","id":"samlSPSSODescriptorSingleLogoutServiceHTTPRedirect","title":"samlSPSSODescriptorSingleLogoutServiceHTTPRedirect","type":"samlService"},{"default":"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST;#PORTAL#/saml/proxySingleLogout;#PORTAL#/saml/proxySingleLogoutReturn","id":"samlSPSSODescriptorSingleLogoutServiceHTTPPost","title":"samlSPSSODescriptorSingleLogoutServiceHTTPPost","type":"samlService"},{"default":"urn:oasis:names:tc:SAML:2.0:bindings:SOAP;#PORTAL#/saml/proxySingleLogoutSOAP;","id":"samlSPSSODescriptorSingleLogoutServiceSOAP","title":"samlSPSSODescriptorSingleLogoutServiceSOAP","type":"samlService"}],"id":"samlSPSSODescriptorSingleLogoutService","title":"samlSPSSODescriptorSingleLogoutService"},{"_nodes":[{"default":"1;0;urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact;#PORTAL#/saml/proxySingleSignOnArtifact","id":"samlSPSSODescriptorAssertionConsumerServiceHTTPArtifact","title":"samlSPSSODescriptorAssertionConsumerServiceHTTPArtifact","type":"samlAssertion"},{"default":"0;1;urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST;#PORTAL#/saml/proxySingleSignOnPost","id":"samlSPSSODescriptorAssertionConsumerServiceHTTPPost","title":"samlSPSSODescriptorAssertionConsumerServiceHTTPPost","type":"samlAssertion"}],"id":"samlSPSSODescriptorAssertionConsumerService","title":"samlSPSSODescriptorAssertionConsumerService"},{"_nodes":[{"default":"1;0;urn:oasis:names:tc:SAML:2.0:bindings:SOAP;#PORTAL#/saml/artifact","id":"samlSPSSODescriptorArtifactResolutionServiceArtifact","title":"samlSPSSODescriptorArtifactResolutionServiceArtifact","type":"samlAssertion"}],"id":"samlSPSSODescriptorArtifactResolutionService","title":"samlSPSSODescriptorArtifactResolutionService"}],"help":"samlservice.html#service-provider","id":"samlSPSSODescriptor","title":"samlSPSSODescriptor"},{"_nodes":[{"default":1,"id":"samlIDPSSODescriptorWantAuthnRequestsSigned","title":"samlIDPSSODescriptorWantAuthnRequestsSigned","type":"bool"},{"_nodes":[{"default":"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect;#PORTAL#/saml/singleSignOn;","id":"samlIDPSSODescriptorSingleSignOnServiceHTTPRedirect","title":"samlIDPSSODescriptorSingleSignOnServiceHTTPRedirect","type":"samlService"},{"default":"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST;#PORTAL#/saml/singleSignOn;","id":"samlIDPSSODescriptorSingleSignOnServiceHTTPPost","title":"samlIDPSSODescriptorSingleSignOnServiceHTTPPost","type":"samlService"},{"default":"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact;#PORTAL#/saml/singleSignOnArtifact;","id":"samlIDPSSODescriptorSingleSignOnServiceHTTPArtifact","title":"samlIDPSSODescriptorSingleSignOnServiceHTTPArtifact","type":"samlService"}],"id":"samlIDPSSODescriptorSingleSignOnService","title":"samlIDPSSODescriptorSingleSignOnService"},{"_nodes":[{"default":"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect;#PORTAL#/saml/singleLogout;#PORTAL#/saml/singleLogoutReturn","id":"samlIDPSSODescriptorSingleLogoutServiceHTTPRedirect","title":"samlIDPSSODescriptorSingleLogoutServiceHTTPRedirect","type":"samlService"},{"default":"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST;#PORTAL#/saml/singleLogout;#PORTAL#/saml/singleLogoutReturn","id":"samlIDPSSODescriptorSingleLogoutServiceHTTPPost","title":"samlIDPSSODescriptorSingleLogoutServiceHTTPPost","type":"samlService"},{"default":"urn:oasis:names:tc:SAML:2.0:bindings:SOAP;#PORTAL#/saml/singleLogoutSOAP;","id":"samlIDPSSODescriptorSingleLogoutServiceSOAP","title":"samlIDPSSODescriptorSingleLogoutServiceSOAP","type":"samlService"}],"id":"samlIDPSSODescriptorSingleLogoutService","title":"samlIDPSSODescriptorSingleLogoutService"},{"_nodes":[{"default":"1;0;urn:oasis:names:tc:SAML:2.0:bindings:SOAP;#PORTAL#/saml/artifact","id":"samlIDPSSODescriptorArtifactResolutionServiceArtifact","title":"samlIDPSSODescriptorArtifactResolutionServiceArtifact","type":"samlAssertion"}],"id":"samlIDPSSODescriptorArtifactResolutionService","title":"samlIDPSSODescriptorArtifactResolutionService"}],"help":"samlservice.html#identity-provider","id":"samlIDPSSODescriptor","title":"samlIDPSSODescriptor"},{"_nodes":[{"_nodes":[{"default":"urn:oasis:names:tc:SAML:2.0:bindings:SOAP;#PORTAL#/saml/AA/SOAP;","id":"samlAttributeAuthorityDescriptorAttributeServiceSOAP","title":"samlAttributeAuthorityDescriptorAttributeServiceSOAP","type":"samlService"}],"id":"samlAttributeAuthorityDescriptorAttributeService","title":"samlAttributeAuthorityDescriptorAttributeService"}],"help":"samlservice.html#attribute-authority","id":"samlAttributeAuthorityDescriptor","title":"samlAttributeAuthorityDescriptor"},{"_nodes":[{"default":1,"id":"samlMetadataForceUTF8","title":"samlMetadataForceUTF8","type":"bool"},{"default":600,"id":"samlRelayStateTimeout","title":"samlRelayStateTimeout","type":"int"},{"default":0,"id":"samlUseQueryStringSpecific","title":"samlUseQueryStringSpecific","type":"bool"},{"default":"","id":"samlOverrideIDPEntityID","title":"samlOverrideIDPEntityID"},{"id":"samlStorage","title":"samlStorage"},{"cnodes":"samlStorageOptions","id":"samlStorageOptions","title":"samlStorageOptions","type":"keyTextContainer"},{"_nodes":[{"default":0,"id":"samlCommonDomainCookieActivation","title":"samlCommonDomainCookieActivation","type":"bool"},{"id":"samlCommonDomainCookieDomain","title":"samlCommonDomainCookieDomain"},{"id":"samlCommonDomainCookieReader","title":"samlCommonDomainCookieReader"},{"id":"samlCommonDomainCookieWriter","title":"samlCommonDomainCookieWriter"}],"id":"samlCommonDomainCookie","title":"samlCommonDomainCookie","type":"simpleInputContainer"},{"_nodes":[{"default":0,"id":"samlDiscoveryProtocolActivation","title":"samlDiscoveryProtocolActivation","type":"bool"},{"id":"samlDiscoveryProtocolURL","title":"samlDiscoveryProtocolURL"},{"id":"samlDiscoveryProtocolPolicy","title":"samlDiscoveryProtocolPolicy"},{"default":0,"id":"samlDiscoveryProtocolIsPassive","title":"samlDiscoveryProtocolIsPassive","type":"bool"}],"id":"samlDiscoveryProtocol","title":"samlDiscoveryProtocol","type":"simpleInputContainer"}],"help":"samlservice.html#advanced","id":"samlAdvanced","title":"samlAdvanced"}],"help":"samlservice.html","id":"samlServiceMetaData","title":"samlServiceMetaData"},{"cnodes":"samlIDPMetaDataNodes","help":"authsaml.html","id":"samlIDPMetaDataNodes","template":"samlIDPMetaDataNode","title":"samlIDPMetaDataNodes","type":"samlIDPMetaDataNodeContainer"},{"cnodes":"samlSPMetaDataNodes","help":"idpsaml.html","id":"samlSPMetaDataNodes","template":"samlSPMetaDataNode","title":"samlSPMetaDataNodes","type":"samlSPMetaDataNodeContainer"},{"_nodes":[{"id":"oidcServiceMetaDataIssuer","title":"oidcServiceMetaDataIssuer"},{"_nodes":[{"default":"authorize","id":"oidcServiceMetaDataAuthorizeURI","title":"oidcServiceMetaDataAuthorizeURI"},{"default":"token","id":"oidcServiceMetaDataTokenURI","title":"oidcServiceMetaDataTokenURI"},{"default":"userinfo","id":"oidcServiceMetaDataUserInfoURI","title":"oidcServiceMetaDataUserInfoURI"},{"default":"jwks","id":"oidcServiceMetaDataJWKSURI","title":"oidcServiceMetaDataJWKSURI"},{"default":"register","id":"oidcServiceMetaDataRegistrationURI","title":"oidcServiceMetaDataRegistrationURI"},{"default":"introspect","id":"oidcServiceMetaDataIntrospectionURI","title":"oidcServiceMetaDataIntrospectionURI"},{"default":"logout","id":"oidcServiceMetaDataEndSessionURI","title":"oidcServiceMetaDataEndSessionURI"},{"default":"checksession.html","id":"oidcServiceMetaDataCheckSessionURI","title":"oidcServiceMetaDataCheckSessionURI"},{"default":"flogout","id":"oidcServiceMetaDataFrontChannelURI","title":"oidcServiceMetaDataFrontChannelURI"},{"default":"blogout","id":"oidcServiceMetaDataBackChannelURI","title":"oidcServiceMetaDataBackChannelURI"}],"id":"oidcServiceMetaDataEndPoints","title":"oidcServiceMetaDataEndPoints","type":"simpleInputContainer"},{"cnodes":"oidcServiceMetaDataAuthnContext","default":[{"data":1,"id":"oidcServiceMetaDataAuthnContext/loa-1","title":"loa-1","type":"keyText"},{"data":2,"id":"oidcServiceMetaDataAuthnContext/loa-2","title":"loa-2","type":"keyText"},{"data":3,"id":"oidcServiceMetaDataAuthnContext/loa-3","title":"loa-3","type":"keyText"},{"data":4,"id":"oidcServiceMetaDataAuthnContext/loa-4","title":"loa-4","type":"keyText"},{"data":5,"id":"oidcServiceMetaDataAuthnContext/loa-5","title":"loa-5","type":"keyText"}],"id":"oidcServiceMetaDataAuthnContext","title":"oidcServiceMetaDataAuthnContext","type":"keyTextContainer"},{"_nodes":[{"get":["oidcServicePrivateKeySig","oidcServicePublicKeySig","oidcServiceKeyIdSig"],"id":"oidcServiceMetaDataKeys","title":"oidcServiceMetaDataKeys","type":"RSAKeyNoPassword"},{"default":0,"id":"oidcServiceAllowDynamicRegistration","title":"oidcServiceAllowDynamicRegistration","type":"bool"},{"default":1,"id":"oidcServiceAllowAuthorizationCodeFlow","title":"oidcServiceAllowAuthorizationCodeFlow","type":"bool"},{"default":0,"id":"oidcServiceAllowImplicitFlow","title":"oidcServiceAllowImplicitFlow","type":"bool"},{"default":0,"id":"oidcServiceAllowHybridFlow","title":"oidcServiceAllowHybridFlow","type":"bool"},{"default":60,"id":"oidcServiceAuthorizationCodeExpiration","title":"oidcServiceAuthorizationCodeExpiration","type":"int"},{"default":3600,"id":"oidcServiceAccessTokenExpiration","title":"oidcServiceAccessTokenExpiration","type":"int"},{"default":3600,"id":"oidcServiceIDTokenExpiration","title":"oidcServiceIDTokenExpiration","type":"int"},{"default":2592000,"id":"oidcServiceOfflineSessionExpiration","title":"oidcServiceOfflineSessionExpiration","type":"int"}],"id":"oidcServiceMetaDataSecurity","title":"oidcServiceMetaDataSecurity"},{"_nodes":[{"id":"oidcStorage","title":"oidcStorage"},{"cnodes":"oidcStorageOptions","id":"oidcStorageOptions","title":"oidcStorageOptions","type":"keyTextContainer"}],"id":"oidcServiceMetaDataSessions","title":"oidcServiceMetaDataSessions"},{"cnodes":"oidcServiceDynamicRegistrationExportedVars","id":"oidcServiceDynamicRegistrationExportedVars","title":"oidcServiceDynamicRegistrationExportedVars","type":"keyTextContainer"},{"cnodes":"oidcServiceDynamicRegistrationExtraClaims","id":"oidcServiceDynamicRegistrationExtraClaims","title":"oidcServiceDynamicRegistrationExtraClaims","type":"keyTextContainer"}],"help":"openidconnectservice.html#service-configuration","id":"oidcServiceMetaData","title":"oidcServiceMetaData"},{"cnodes":"oidcOPMetaDataNodes","help":"authopenidconnect.html#declare-the-openid-connect-provider-in-ll-ng","id":"oidcOPMetaDataNodes","title":"oidcOPMetaDataNodes","type":"oidcOPMetaDataNodeContainer"},{"cnodes":"oidcRPMetaDataNodes","help":"idpopenidconnect.html#configuration-of-relying-party-in-ll-ng","id":"oidcRPMetaDataNodes","title":"oidcRPMetaDataNodes","type":"oidcRPMetaDataNodeContainer"},{"_nodes":[{"id":"casAttr","title":"casAttr"},{"default":"none","id":"casAccessControlPolicy","select":[{"k":"none","v":"None"},{"k":"error","v":"Display error on portal"},{"k":"faketicket","v":"Send a fake service ticket"}],"title":"casAccessControlPolicy","type":"select"},{"id":"casStorage","title":"casStorage"},{"cnodes":"casStorageOptions","id":"casStorageOptions","title":"casStorageOptions","type":"keyTextContainer"},{"cnodes":"casAttributes","id":"casAttributes","title":"casAttributes","type":"keyTextContainer"},{"default":0,"id":"casStrictMatching","title":"casStrictMatching","type":"bool"}],"help":"idpcas.html#configuring-the-cas-service","id":"casServiceMetadata","title":"casServiceMetadata"},{"cnodes":"casSrvMetaDataNodes","help":"authcas.html","id":"casSrvMetaDataNodes","template":"casSrvMetaDataNode","title":"casSrvMetaDataNodes","type":"casSrvMetaDataNodeContainer"},{"cnodes":"casAppMetaDataNodes","help":"idpcas.html#configuring-cas-applications","id":"casAppMetaDataNodes","template":"casAppMetaDataNode","title":"casAppMetaDataNodes","type":"casAppMetaDataNodeContainer"}]
\ No newline at end of file
+[{"_nodes":[{"_nodes":[{"default":"http://auth.example.com/","id":"portal","title":"portal"},{"_nodes":[{"_nodes":[{"default":1,"id":"portalDisplayLogout","title":"portalDisplayLogout","type":"boolOrExpr"},{"default":"$_auth =~ /^(LDAP|DBI|Demo)$/","id":"portalDisplayChangePassword","title":"portalDisplayChangePassword","type":"boolOrExpr"},{"default":1,"id":"portalDisplayAppslist","title":"portalDisplayAppslist","type":"boolOrExpr"},{"default":1,"id":"portalDisplayLoginHistory","title":"portalDisplayLoginHistory","type":"boolOrExpr"},{"default":"$_oidcConsents && $_oidcConsents =~ /\\w+/","id":"portalDisplayOidcConsents","title":"portalDisplayOidcConsents","type":"boolOrExpr"}],"id":"portalModules","title":"portalModules","type":"simpleInputContainer"},{"cnodes":"applicationList","default":[{"data":{"catname":"Default category","type":"category"},"id":"applicationList/default","title":"default","type":"catAndAppList"}],"help":"portalmenu.html#categories-and-applications","id":"applicationList","title":"applicationList","type":"catAndAppList"}],"help":"portalmenu.html","id":"portalMenu","title":"portalMenu"},{"_nodes":[{"default":"common/logos/logo_llng_400px.png","id":"portalMainLogo","title":"portalMainLogo"},{"default":1,"id":"showLanguages","title":"showLanguages","type":"bool"},{"id":"portalCustomCss","title":"portalCustomCss"},{"default":"bootstrap","id":"portalSkin","select":[{"k":"bootstrap","v":"Bootstrap"}],"title":"portalSkin","type":"portalskin"},{"id":"portalSkinBackground","select":[{"k":"","v":"None"},{"k":"1280px-Anse_Source_d'Argent_2-La_Digue.jpg","v":"Anse"},{"k":"1280px-Autumn-clear-water-waterfall-landscape_-_Virginia_-_ForestWander.jpg","v":"Waterfall"},{"k":"1280px-BrockenSnowedTrees.jpg","v":"Snowed Trees"},{"k":"1280px-Cedar_Breaks_National_Monument_partially.jpg","v":"National Monument"},{"k":"1280px-Parry_Peak_from_Winter_Park.jpg","v":"Winter"},{"k":"Aletschgletscher_mit_Pinus_cembra1.jpg","v":"Pinus"}],"title":"portalSkinBackground","type":"portalskinbackground"},{"cnodes":"portalSkinRules","help":"portalcustom.html","id":"portalSkinRules","title":"portalSkinRules","type":"keyTextContainer"},{"_nodes":[{"default":1,"id":"portalCheckLogins","title":"portalCheckLogins","type":"bool"},{"default":0,"id":"portalDisplayResetPassword","title":"portalDisplayResetPassword","type":"bool"},{"default":3,"id":"passwordResetAllowedRetries","title":"passwordResetAllowedRetries","type":"int"},{"default":1,"id":"portalDisplayRegister","title":"portalDisplayRegister","type":"bool"},{"default":0,"id":"portalDisplayCertificateResetByMail","title":"portalDisplayCertificateResetByMail","type":"bool"}],"help":"portalcustom.html#buttons","id":"portalButtons","title":"portalButtons","type":"simpleInputContainer"},{"_nodes":[{"default":1,"id":"portalRequireOldPassword","title":"portalRequireOldPassword","type":"boolOrExpr"},{"default":0,"id":"hideOldPassword","title":"hideOldPassword","type":"bool"},{"default":0,"id":"mailOnPasswordChange","title":"mailOnPasswordChange","type":"bool"}],"help":"portalcustom.html#password-management","id":"passwordManagement","title":"passwordManagement","type":"simpleInputContainer"},{"_nodes":[{"default":1,"id":"passwordPolicyActivation","title":"passwordPolicyActivation","type":"boolOrExpr"},{"default":0,"id":"portalDisplayPasswordPolicy","title":"portalDisplayPasswordPolicy","type":"bool"},{"default":0,"id":"passwordPolicyMinSize","title":"passwordPolicyMinSize","type":"int"},{"default":0,"id":"passwordPolicyMinLower","title":"passwordPolicyMinLower","type":"int"},{"default":0,"id":"passwordPolicyMinUpper","title":"passwordPolicyMinUpper","type":"int"},{"default":0,"id":"passwordPolicyMinDigit","title":"passwordPolicyMinDigit","type":"int"},{"default":0,"id":"passwordPolicyMinSpeChar","title":"passwordPolicyMinSpeChar","type":"int"},{"default":"__ALL__","id":"passwordPolicySpecialChar","title":"passwordPolicySpecialChar"}],"help":"portalcustom.html#password-policy","id":"passwordPolicy","title":"passwordPolicy","type":"simpleInputContainer"},{"_nodes":[{"default":"_user","id":"portalUserAttr","title":"portalUserAttr"},{"default":0,"id":"portalOpenLinkInNewWindow","title":"portalOpenLinkInNewWindow","type":"bool"},{"default":1,"id":"portalAntiFrame","title":"portalAntiFrame","type":"bool"},{"default":60000,"id":"portalPingInterval","title":"portalPingInterval","type":"int"},{"default":1,"id":"portalErrorOnExpiredSession","title":"portalErrorOnExpiredSession","type":"bool"},{"default":0,"id":"portalErrorOnMailNotFound","title":"portalErrorOnMailNotFound","type":"bool"},{"default":1,"id":"portalDisplayRefreshMyRights","title":"portalDisplayRefreshMyRights","type":"bool"}],"help":"portalcustom.html#other-parameters","id":"portalOther","title":"portalOther","type":"simpleInputContainer"}],"help":"portalcustom.html","id":"portalCustomization","title":"portalCustomization"},{"_nodes":[{"default":0,"id":"captcha_login_enabled","title":"captcha_login_enabled","type":"bool"},{"default":1,"id":"captcha_mail_enabled","title":"captcha_mail_enabled","type":"bool"},{"default":1,"id":"captcha_register_enabled","title":"captcha_register_enabled","type":"bool"},{"default":6,"id":"captcha_size","title":"captcha_size","type":"int"}],"help":"captcha.html","id":"portalCaptcha","title":"portalCaptcha","type":"simpleInputContainer"}],"help":"portal.html","id":"portalParams","title":"portalParams"},{"_nodes":[{"default":"Demo","id":"authentication","select":[{"k":"Apache","v":"Apache"},{"k":"AD","v":"Active Directory"},{"k":"DBI","v":"Database (DBI)"},{"k":"Facebook","v":"Facebook"},{"k":"GitHub","v":"GitHub"},{"k":"GPG","v":"GPG"},{"k":"Kerberos","v":"Kerberos"},{"k":"LDAP","v":"LDAP"},{"k":"LinkedIn","v":"LinkedIn"},{"k":"PAM","v":"PAM"},{"k":"Radius","v":"Radius"},{"k":"REST","v":"REST"},{"k":"SSL","v":"SSL"},{"k":"Twitter","v":"Twitter"},{"k":"WebID","v":"WebID"},{"k":"Demo","v":"Demonstration"},{"k":"Choice","v":"authChoice"},{"k":"Combination","v":"combineMods"},{"k":"CAS","v":"Central Authentication Service (CAS)"},{"k":"OpenID","v":"OpenID"},{"k":"OpenIDConnect","v":"OpenID Connect"},{"k":"SAML","v":"SAML v2"},{"k":"Proxy","v":"Proxy"},{"k":"Remote","v":"Remote"},{"k":"Slave","v":"Slave"},{"k":"Null","v":"None"},{"k":"Custom","v":"customModule"}],"title":"authentication","type":"select"},{"default":"Same","id":"userDB","select":[{"k":"Same","v":"Same"},{"k":"AD","v":"Active Directory"},{"k":"DBI","v":"Database (DBI)"},{"k":"LDAP","v":"LDAP"},{"k":"REST","v":"REST"},{"k":"Null","v":"None"},{"k":"Custom","v":"customModule"}],"title":"userDB","type":"select"},{"default":"Demo","id":"passwordDB","select":[{"k":"AD","v":"Active Directory"},{"k":"Choice","v":"authChoice"},{"k":"DBI","v":"Database (DBI)"},{"k":"Demo","v":"Demonstration"},{"k":"LDAP","v":"LDAP"},{"k":"REST","v":"REST"},{"k":"Null","v":"None"},{"k":"Combination","v":"combineMods"},{"k":"Custom","v":"customModule"}],"title":"passwordDB","type":"select"},{"default":"Null","id":"registerDB","select":[{"k":"AD","v":"Active Directory"},{"k":"Demo","v":"Demonstration"},{"k":"LDAP","v":"LDAP"},{"k":"Null","v":"None"},{"k":"Custom","v":"customModule"}],"title":"registerDB","type":"select"}],"_nodes_cond":[{"_nodes":[{"default":0,"id":"ADPwdMaxAge","title":"ADPwdMaxAge","type":"int"},{"default":0,"id":"ADPwdExpireWarning","title":"ADPwdExpireWarning","type":"int"}],"help":"authad.html","id":"adParams","show":false,"title":"adParams","type":"simpleInputContainer"},{"_nodes":[{"default":"lmAuth","id":"authChoiceParam","title":"authChoiceParam"},{"cnodes":"authChoiceModules","id":"authChoiceModules","select":[[{"k":"Apache","v":"Apache"},{"k":"AD","v":"Active Directory"},{"k":"CAS","v":"Central Authentication Service (CAS)"},{"k":"DBI","v":"Database (DBI)"},{"k":"Demo","v":"Demo"},{"k":"Facebook","v":"Facebook"},{"k":"GitHub","v":"GitHub"},{"k":"GPG","v":"GPG"},{"k":"Kerberos","v":"Kerberos"},{"k":"LDAP","v":"LDAP"},{"k":"LinkedIn","v":"LinkedIn"},{"k":"PAM","v":"PAM"},{"k":"Null","v":"None"},{"k":"OpenID","v":"OpenID"},{"k":"OpenIDConnect","v":"OpenID Connect"},{"k":"Proxy","v":"Proxy"},{"k":"Radius","v":"Radius"},{"k":"REST","v":"REST"},{"k":"Remote","v":"Remote"},{"k":"SAML","v":"SAML v2"},{"k":"Slave","v":"Slave"},{"k":"SSL","v":"SSL"},{"k":"Twitter","v":"Twitter"},{"k":"WebID","v":"WebID"},{"k":"Custom","v":"customModule"}],[{"k":"AD","v":"Active Directory"},{"k":"CAS","v":"Central Authentication Service (CAS)"},{"k":"DBI","v":"Database (DBI)"},{"k":"Demo","v":"Demo"},{"k":"Facebook","v":"Facebook"},{"k":"LDAP","v":"LDAP"},{"k":"Null","v":"None"},{"k":"OpenID","v":"OpenID"},{"k":"OpenIDConnect","v":"OpenID Connect"},{"k":"Proxy","v":"Proxy"},{"k":"REST","v":"REST"},{"k":"Remote","v":"Remote"},{"k":"SAML","v":"SAML v2"},{"k":"Slave","v":"Slave"},{"k":"WebID","v":"WebID"},{"k":"Custom","v":"customModule"}],[{"k":"AD","v":"Active Directory"},{"k":"DBI","v":"Database (DBI)"},{"k":"Demo","v":"Demo"},{"k":"LDAP","v":"LDAP"},{"k":"REST","v":"REST"},{"k":"Null","v":"None"},{"k":"Custom","v":"customModule"}]],"title":"authChoiceModules","type":"authChoiceContainer"},{"id":"authChoiceAuthBasic","title":"authChoiceAuthBasic"},{"id":"authChoiceFindUser","title":"authChoiceFindUser"}],"help":"authchoice.html","id":"choiceParams","show":false,"title":"choiceParams"},{"_nodes":[{"default":3,"id":"apacheAuthnLevel","title":"apacheAuthnLevel","type":"int"}],"help":"authapache.html","id":"apacheParams","show":false,"title":"apacheParams","type":"simpleInputContainer"},{"_nodes":[{"default":1,"id":"casAuthnLevel","title":"casAuthnLevel","type":"int"}],"help":"authcas.html","id":"casParams","show":false,"title":"casParams","type":"simpleInputContainer"},{"_nodes":[{"default":2,"id":"dbiAuthnLevel","title":"dbiAuthnLevel","type":"int"},{"cnodes":"dbiExportedVars","default":[],"id":"dbiExportedVars","title":"dbiExportedVars","type":"keyTextContainer"},{"_nodes":[{"_nodes":[{"id":"dbiAuthChain","title":"dbiAuthChain"},{"id":"dbiAuthUser","title":"dbiAuthUser"},{"id":"dbiAuthPassword","title":"dbiAuthPassword","type":"password"}],"id":"dbiConnectionAuth","title":"dbiConnectionAuth","type":"simpleInputContainer"},{"_nodes":[{"id":"dbiUserChain","title":"dbiUserChain"},{"id":"dbiUserUser","title":"dbiUserUser"},{"id":"dbiUserPassword","title":"dbiUserPassword","type":"password"}],"id":"dbiConnectionUser","title":"dbiConnectionUser","type":"simpleInputContainer"}],"help":"authdbi.html#connection","id":"dbiConnection","title":"dbiConnection"},{"_nodes":[{"id":"dbiAuthTable","title":"dbiAuthTable"},{"id":"dbiUserTable","title":"dbiUserTable"},{"id":"dbiAuthLoginCol","title":"dbiAuthLoginCol"},{"id":"dbiAuthPasswordCol","title":"dbiAuthPasswordCol"},{"id":"dbiPasswordMailCol","title":"dbiPasswordMailCol"},{"id":"userPivot","title":"userPivot"}],"help":"authdbi.html#schema","id":"dbiSchema","title":"dbiSchema","type":"simpleInputContainer"},{"_nodes":[{"help":"authdbi.html#password","id":"dbiAuthPasswordHash","title":"dbiAuthPasswordHash"},{"_nodes":[{"help":"authdbi.html#password","id":"dbiDynamicHashEnabled","title":"dbiDynamicHashEnabled","type":"bool"},{"help":"authdbi.html#password","id":"dbiDynamicHashValidSchemes","title":"dbiDynamicHashValidSchemes"},{"help":"authdbi.html#password","id":"dbiDynamicHashValidSaltedSchemes","title":"dbiDynamicHashValidSaltedSchemes"},{"help":"authdbi.html#password","id":"dbiDynamicHashNewPasswordScheme","title":"dbiDynamicHashNewPasswordScheme"}],"help":"authdbi.html#password","id":"dbiDynamicHash","title":"dbiDynamicHash","type":"simpleInputContainer"}],"help":"authdbi.html#password","id":"dbiPassword","title":"dbiPassword"}],"help":"authdbi.html","id":"dbiParams","show":false,"title":"dbiParams"},{"_nodes":[{"cnodes":"demoExportedVars","default":[{"data":"cn","id":"demoExportedVars/cn","title":"cn","type":"keyText"},{"data":"mail","id":"demoExportedVars/mail","title":"mail","type":"keyText"},{"data":"uid","id":"demoExportedVars/uid","title":"uid","type":"keyText"}],"id":"demoExportedVars","title":"demoExportedVars","type":"keyTextContainer"}],"help":"authdemo.html","id":"demoParams","show":false,"title":"demoParams"},{"_nodes":[{"default":1,"id":"facebookAuthnLevel","title":"facebookAuthnLevel","type":"int"},{"cnodes":"facebookExportedVars","default":[],"id":"facebookExportedVars","title":"facebookExportedVars","type":"keyTextContainer"},{"id":"facebookAppId","title":"facebookAppId"},{"id":"facebookAppSecret","title":"facebookAppSecret"},{"default":"id","id":"facebookUserField","title":"facebookUserField"}],"help":"authfacebook.html","id":"facebookParams","show":false,"title":"facebookParams"},{"_nodes":[{"default":3,"id":"krbAuthnLevel","title":"krbAuthnLevel","type":"int"},{"id":"krbKeytab","title":"krbKeytab"},{"default":0,"id":"krbByJs","title":"krbByJs","type":"bool"},{"default":1,"id":"krbRemoveDomain","title":"krbRemoveDomain","type":"bool"},{"id":"krbAllowedDomains","title":"krbAllowedDomains"}],"help":"authkerberos.html","id":"kerberosParams","show":false,"title":"kerberosParams","type":"simpleInputContainer"},{"_nodes":[{"default":2,"id":"ldapAuthnLevel","title":"ldapAuthnLevel","type":"int"},{"cnodes":"ldapExportedVars","default":[{"data":"cn","id":"ldapExportedVars/cn","title":"cn","type":"keyText"},{"data":"mail","id":"ldapExportedVars/mail","title":"mail","type":"keyText"},{"data":"uid","id":"ldapExportedVars/uid","title":"uid","type":"keyText"}],"id":"ldapExportedVars","title":"ldapExportedVars","type":"keyTextContainer"},{"_nodes":[{"default":"ldap://localhost","id":"ldapServer","title":"ldapServer"},{"id":"ldapPort","title":"ldapPort","type":"int"},{"default":"require","id":"ldapVerify","select":[{"k":"none","v":"None"},{"k":"optional","v":"Optional"},{"k":"require","v":"Require"}],"title":"ldapVerify","type":"select"},{"default":"dc=example,dc=com","id":"ldapBase","title":"ldapBase"},{"default":"","id":"managerDn","title":"managerDn"},{"default":"","id":"managerPassword","title":"managerPassword","type":"password"},{"default":10,"id":"ldapTimeout","title":"ldapTimeout","type":"int"},{"default":10,"id":"ldapIOTimeout","title":"ldapIOTimeout","type":"int"},{"default":3,"id":"ldapVersion","title":"ldapVersion","type":"int"},{"id":"ldapRaw","title":"ldapRaw"},{"id":"ldapCAFile","title":"ldapCAFile"},{"id":"ldapCAPath","title":"ldapCAPath"}],"help":"authldap.html#connection","id":"ldapConnection","title":"ldapConnection","type":"simpleInputContainer"},{"_nodes":[{"id":"LDAPFilter","title":"LDAPFilter"},{"id":"AuthLDAPFilter","title":"AuthLDAPFilter"},{"id":"mailLDAPFilter","title":"mailLDAPFilter"},{"default":"find","id":"ldapSearchDeref","select":[{"k":"never","v":"never"},{"k":"search","v":"search"},{"k":"find","v":"find"},{"k":"always","v":"always"}],"title":"ldapSearchDeref","type":"select"}],"help":"authldap.html#filters","id":"ldapFilters","title":"ldapFilters","type":"simpleInputContainer"},{"_nodes":[{"id":"ldapGroupBase","title":"ldapGroupBase"},{"default":"groupOfNames","id":"ldapGroupObjectClass","title":"ldapGroupObjectClass"},{"default":"member","id":"ldapGroupAttributeName","title":"ldapGroupAttributeName"},{"default":"dn","id":"ldapGroupAttributeNameUser","title":"ldapGroupAttributeNameUser"},{"default":"cn","id":"ldapGroupAttributeNameSearch","title":"ldapGroupAttributeNameSearch"},{"default":0,"id":"ldapGroupDecodeSearchedValue","title":"ldapGroupDecodeSearchedValue","type":"bool"},{"default":0,"id":"ldapGroupRecursive","title":"ldapGroupRecursive","type":"bool"},{"default":"dn","id":"ldapGroupAttributeNameGroup","title":"ldapGroupAttributeNameGroup"}],"help":"authldap.html#groups","id":"ldapGroups","title":"ldapGroups","type":"simpleInputContainer"},{"_nodes":[{"default":0,"id":"ldapPpolicyControl","title":"ldapPpolicyControl","type":"bool"},{"default":0,"id":"ldapSetPassword","title":"ldapSetPassword","type":"bool"},{"default":0,"id":"ldapChangePasswordAsUser","title":"ldapChangePasswordAsUser","type":"bool"},{"default":"utf-8","id":"ldapPwdEnc","title":"ldapPwdEnc"},{"default":1,"id":"ldapUsePasswordResetAttribute","title":"ldapUsePasswordResetAttribute","type":"bool"},{"default":"pwdReset","id":"ldapPasswordResetAttribute","title":"ldapPasswordResetAttribute"},{"default":"TRUE","id":"ldapPasswordResetAttributeValue","title":"ldapPasswordResetAttributeValue"},{"default":0,"id":"ldapAllowResetExpiredPassword","title":"ldapAllowResetExpiredPassword","type":"bool"},{"default":0,"id":"ldapGetUserBeforePasswordChange","title":"ldapGetUserBeforePasswordChange","type":"bool"},{"default":0,"id":"ldapITDS","title":"ldapITDS","type":"bool"}],"help":"authldap.html#password","id":"ldapPassword","title":"ldapPassword","type":"simpleInputContainer"}],"help":"authldap.html","id":"ldapParams","show":false,"title":"ldapParams"},{"_nodes":[{"default":1,"id":"linkedInAuthnLevel","title":"linkedInAuthnLevel","type":"int"},{"id":"linkedInClientID","title":"linkedInClientID"},{"id":"linkedInClientSecret","title":"linkedInClientSecret","type":"password"},{"default":"id,first-name,last-name,email-address","id":"linkedInFields","title":"linkedInFields"},{"default":"emailAddress","id":"linkedInUserField","title":"linkedInUserField"},{"default":"r_liteprofile r_emailaddress","id":"linkedInScope","title":"linkedInScope"}],"help":"authlinkedin.html","id":"linkedinParams","show":false,"title":"linkedinParams","type":"simpleInputContainer"},{"_nodes":[{"default":1,"id":"githubAuthnLevel","title":"githubAuthnLevel","type":"int"},{"id":"githubClientID","title":"githubClientID"},{"id":"githubClientSecret","title":"githubClientSecret","type":"password"},{"default":"login","id":"githubUserField","title":"githubUserField"},{"default":"user:email","id":"githubScope","title":"githubScope"}],"help":"authgithub.html","id":"githubParams","show":false,"title":"githubParams","type":"simpleInputContainer"},{"_nodes":[{"id":"combination","title":"combination"},{"cnodes":"combModules","id":"combModules","select":[{"k":"Apache","v":"Apache"},{"k":"AD","v":"Active Directory"},{"k":"DBI","v":"Database (DBI)"},{"k":"Facebook","v":"Facebook"},{"k":"GitHub","v":"GitHub"},{"k":"GPG","v":"GPG"},{"k":"Kerberos","v":"Kerberos"},{"k":"LDAP","v":"LDAP"},{"k":"LinkedIn","v":"LinkedIn"},{"k":"PAM","v":"PAM"},{"k":"Radius","v":"Radius"},{"k":"REST","v":"REST"},{"k":"SSL","v":"SSL"},{"k":"Twitter","v":"Twitter"},{"k":"WebID","v":"WebID"},{"k":"Demo","v":"Demonstration"},{"k":"CAS","v":"Central Authentication Service (CAS)"},{"k":"OpenID","v":"OpenID"},{"k":"OpenIDConnect","v":"OpenID Connect"},{"k":"SAML","v":"SAML v2"},{"k":"Proxy","v":"Proxy"},{"k":"Remote","v":"Remote"},{"k":"Slave","v":"Slave"},{"k":"Null","v":"None"},{"k":"Custom","v":"customModule"}],"title":"combModules","type":"cmbModuleContainer"}],"help":"authcombination.html","id":"combinationParams","show":false,"title":"combinationParams"},{"_nodes":[{"default":0,"id":"nullAuthnLevel","title":"nullAuthnLevel","type":"int"}],"help":"authnull.html","id":"nullParams","show":false,"title":"nullParams","type":"simpleInputContainer"},{"_nodes":[{"default":1,"id":"openIdAuthnLevel","title":"openIdAuthnLevel","type":"int"},{"cnodes":"openIdExportedVars","default":[],"id":"openIdExportedVars","title":"openIdExportedVars","type":"keyTextContainer"},{"id":"openIdSecret","title":"openIdSecret"},{"default":"0;","id":"openIdIDPList","title":"openIdIDPList","type":"blackWhiteList"}],"help":"authopenid.html","id":"openidParams","show":false,"title":"openidParams"},{"_nodes":[{"default":1,"id":"oidcAuthnLevel","title":"oidcAuthnLevel","type":"int"},{"default":"openidconnectcallback","id":"oidcRPCallbackGetParam","title":"oidcRPCallbackGetParam"},{"default":600,"id":"oidcRPStateTimeout","title":"oidcRPStateTimeout","type":"int"}],"help":"authopenidconnect.html","id":"oidcParams","show":false,"title":"oidcParams","type":"simpleInputContainer"},{"_nodes":[{"default":5,"id":"gpgAuthnLevel","title":"gpgAuthnLevel","type":"int"},{"default":"","id":"gpgDb","title":"gpgDb"}],"help":"authgpg.html","id":"gpgParams","show":false,"title":"gpgParams","type":"simpleInputContainer"},{"_nodes":[{"default":2,"id":"proxyAuthnLevel","title":"proxyAuthnLevel","type":"int"},{"id":"proxyAuthService","title":"proxyAuthService"},{"id":"proxySessionService","title":"proxySessionService"},{"id":"remoteCookieName","title":"remoteCookieName"},{"default":0,"id":"proxyUseSoap","title":"proxyUseSoap","type":"bool"}],"help":"authproxy.html","id":"proxyParams","show":false,"title":"proxyParams","type":"simpleInputContainer"},{"_nodes":[{"default":2,"id":"pamAuthnLevel","title":"pamAuthnLevel","type":"int"},{"default":"login","id":"pamService","title":"pamService"}],"help":"authpam.html","id":"pamParams","show":false,"title":"pamParams","type":"simpleInputContainer"},{"_nodes":[{"default":3,"id":"radiusAuthnLevel","title":"radiusAuthnLevel","type":"int"},{"id":"radiusSecret","title":"radiusSecret"},{"id":"radiusServer","title":"radiusServer"}],"help":"authradius.html","id":"radiusParams","show":false,"title":"radiusParams","type":"simpleInputContainer"},{"_nodes":[{"default":2,"id":"restAuthnLevel","title":"restAuthnLevel","type":"int"},{"id":"restAuthUrl","title":"restAuthUrl"},{"id":"restUserDBUrl","title":"restUserDBUrl"},{"id":"restPwdConfirmUrl","title":"restPwdConfirmUrl"},{"id":"restPwdModifyUrl","title":"restPwdModifyUrl"}],"help":"authrest.html","id":"restParams","show":false,"title":"restParams","type":"simpleInputContainer"},{"_nodes":[{"id":"remotePortal","title":"remotePortal"},{"id":"remoteCookieName","title":"remoteCookieName"},{"default":"Lemonldap::NG::Common::Apache::Session::SOAP","id":"remoteGlobalStorage","title":"remoteGlobalStorage"},{"cnodes":"remoteGlobalStorageOptions","default":[{"data":"http://auth.example.com/Lemonldap/NG/Common/PSGI/SOAPService","id":"remoteGlobalStorageOptions/ns","title":"ns","type":"keyText"},{"data":"http://auth.example.com/sessions","id":"remoteGlobalStorageOptions/proxy","title":"proxy","type":"keyText"}],"id":"remoteGlobalStorageOptions","title":"remoteGlobalStorageOptions","type":"keyTextContainer"}],"help":"authremote.html","id":"remoteParams","show":false,"title":"remoteParams"},{"_nodes":[{"default":2,"id":"slaveAuthnLevel","title":"slaveAuthnLevel","type":"int"},{"id":"slaveUserHeader","title":"slaveUserHeader"},{"id":"slaveMasterIP","title":"slaveMasterIP"},{"id":"slaveHeaderName","title":"slaveHeaderName"},{"id":"slaveHeaderContent","title":"slaveHeaderContent"},{"default":0,"id":"slaveDisplayLogo","title":"slaveDisplayLogo","type":"bool"},{"cnodes":"slaveExportedVars","default":[],"id":"slaveExportedVars","title":"slaveExportedVars","type":"keyTextContainer"}],"help":"authslave.html","id":"slaveParams","show":false,"title":"slaveParams"},{"_nodes":[{"default":5,"id":"SSLAuthnLevel","title":"SSLAuthnLevel","type":"int"},{"default":"SSL_CLIENT_S_DN_Email","id":"SSLVar","title":"SSLVar"},{"cnodes":"SSLVarIf","default":[],"id":"SSLVarIf","title":"SSLVarIf","type":"keyTextContainer"},{"default":0,"id":"sslByAjax","title":"sslByAjax","type":"bool"},{"id":"sslHost","title":"sslHost"}],"help":"authssl.html","id":"sslParams","show":false,"title":"sslParams"},{"_nodes":[{"default":1,"id":"twitterAuthnLevel","title":"twitterAuthnLevel","type":"int"},{"id":"twitterKey","title":"twitterKey"},{"id":"twitterSecret","title":"twitterSecret"},{"id":"twitterAppName","title":"twitterAppName"},{"default":"screen_name","id":"twitterUserField","title":"twitterUserField"}],"help":"authtwitter.html","id":"twitterParams","show":false,"title":"twitterParams","type":"simpleInputContainer"},{"_nodes":[{"default":1,"id":"webIDAuthnLevel","title":"webIDAuthnLevel","type":"int"},{"cnodes":"webIDExportedVars","default":[],"id":"webIDExportedVars","title":"webIDExportedVars","type":"keyTextContainer"},{"id":"webIDWhitelist","title":"webIDWhitelist"}],"help":"authwebid.html","id":"webidParams","show":false,"title":"webidParams"},{"_nodes":[{"id":"customAuth","title":"customAuth"},{"id":"customUserDB","title":"customUserDB"},{"id":"customPassword","title":"customPassword"},{"id":"customRegister","title":"customRegister"},{"id":"customResetCertByMail","title":"customResetCertByMail"},{"cnodes":"customAddParams","id":"customAddParams","title":"customAddParams","type":"keyTextContainer"}],"help":"authcustom.html","id":"customParams","show":false,"title":"customParams"}],"_nodes_filter":"authParams","help":"start.html#authentication-users-and-password-databases","id":"authParams","title":"authParams","type":"authParams"},{"_nodes":[{"_nodes":[{"default":0,"id":"issuerDBSAMLActivation","title":"issuerDBSAMLActivation","type":"bool"},{"default":"^/saml/","id":"issuerDBSAMLPath","title":"issuerDBSAMLPath"},{"default":1,"id":"issuerDBSAMLRule","title":"issuerDBSAMLRule","type":"boolOrExpr"}],"help":"idpsaml.html","id":"issuerDBSAML","title":"issuerDBSAML","type":"simpleInputContainer"},{"_nodes":[{"default":0,"id":"issuerDBCASActivation","title":"issuerDBCASActivation","type":"bool"},{"default":"^/cas/","id":"issuerDBCASPath","title":"issuerDBCASPath"},{"default":1,"id":"issuerDBCASRule","title":"issuerDBCASRule","type":"boolOrExpr"}],"help":"idpcas.html#enabling-cas","id":"issuerDBCAS","title":"issuerDBCAS","type":"simpleInputContainer"},{"_nodes":[{"default":0,"id":"issuerDBOpenIDActivation","title":"issuerDBOpenIDActivation","type":"bool"},{"default":"^/openidserver/","id":"issuerDBOpenIDPath","title":"issuerDBOpenIDPath"},{"default":1,"id":"issuerDBOpenIDRule","title":"issuerDBOpenIDRule","type":"boolOrExpr"},{"_nodes":[{"id":"openIdIssuerSecret","title":"openIdIssuerSecret"},{"id":"openIdAttr","title":"openIdAttr"},{"default":"0;","id":"openIdSPList","title":"openIdSPList","type":"blackWhiteList"},{"_nodes":[{"default":"cn","id":"openIdSreg_fullname","title":"openIdSreg_fullname"},{"default":"uid","id":"openIdSreg_nickname","title":"openIdSreg_nickname"},{"id":"openIdSreg_language","title":"openIdSreg_language"},{"id":"openIdSreg_postcode","title":"openIdSreg_postcode"},{"default":"_timezone","id":"openIdSreg_timezone","title":"openIdSreg_timezone"},{"id":"openIdSreg_country","title":"openIdSreg_country"},{"id":"openIdSreg_gender","title":"openIdSreg_gender"},{"default":"mail","id":"openIdSreg_email","title":"openIdSreg_email"},{"id":"openIdSreg_dob","title":"openIdSreg_dob"}],"id":"openIdSreg","title":"openIdSreg","type":"simpleInputContainer"}],"id":"issuerDBOpenIDOptions","title":"issuerDBOpenIDOptions"}],"help":"idpopenid.html","id":"issuerDBOpenID","title":"issuerDBOpenID"},{"_nodes":[{"default":0,"id":"issuerDBOpenIDConnectActivation","title":"issuerDBOpenIDConnectActivation","type":"bool"},{"default":"^/oauth2/","id":"issuerDBOpenIDConnectPath","title":"issuerDBOpenIDConnectPath"},{"default":1,"id":"issuerDBOpenIDConnectRule","title":"issuerDBOpenIDConnectRule","type":"boolOrExpr"}],"help":"idpopenidconnect.html","id":"issuerDBOpenIDConnect","title":"issuerDBOpenIDConnect","type":"simpleInputContainer"},{"_nodes":[{"default":0,"id":"issuerDBGetActivation","title":"issuerDBGetActivation","type":"bool"},{"default":"^/get/","id":"issuerDBGetPath","title":"issuerDBGetPath"},{"default":1,"id":"issuerDBGetRule","title":"issuerDBGetRule","type":"boolOrExpr"},{"default":[],"id":"issuerDBGetParameters","title":"issuerDBGetParameters","type":"doubleHash"}],"help":"issuerdbget.html","id":"issuerDBGet","title":"issuerDBGet"},{"_nodes":[{"default":120,"id":"issuersTimeout","title":"issuersTimeout","type":"int"}],"help":"start.html#options","id":"issuerOptions","title":"issuerOptions","type":"simpleInputContainer"}],"help":"start.html#identity-provider","id":"issuerParams","title":"issuerParams"},{"_nodes":[{"default":"uid","id":"whatToTrace","title":"whatToTrace"},{"id":"customToTrace","title":"customToTrace"},{"default":"_password _2fDevices","id":"hiddenAttributes","title":"hiddenAttributes"}],"help":"logs.html","id":"logParams","title":"logParams","type":"simpleInputContainer"},{"_nodes":[{"default":"lemonldap","id":"cookieName","title":"cookieName"},{"default":"example.com","id":"domain","title":"domain"},{"default":0,"id":"cda","title":"cda","type":"bool"},{"default":0,"id":"securedCookie","select":[{"k":"0","v":"unsecuredCookie"},{"k":"1","v":"securedCookie"},{"k":"2","v":"doubleCookie"},{"k":"3","v":"doubleCookieForSingleSession"}],"title":"securedCookie","type":"select"},{"default":1,"id":"httpOnly","title":"httpOnly","type":"bool"},{"id":"cookieExpiration","title":"cookieExpiration","type":"int"},{"default":"","id":"sameSite","select":[{"k":"","v":""},{"k":"Strict","v":"Strict"},{"k":"Lax","v":"Lax"},{"k":"None","v":"None"}],"title":"sameSite","type":"select"}],"help":"ssocookie.html","id":"cookieParams","title":"cookieParams","type":"simpleInputContainer"},{"_nodes":[{"default":0,"id":"storePassword","title":"storePassword","type":"bool"},{"default":1,"id":"displaySessionId","title":"displaySessionId","type":"bool"},{"default":72000,"id":"timeout","title":"timeout","type":"int"},{"default":0,"id":"timeoutActivity","title":"timeoutActivity","type":"int"},{"default":60,"id":"timeoutActivityInterval","title":"timeoutActivityInterval","type":"int"},{"cnodes":"grantSessionRules","default":[],"id":"grantSessionRules","title":"grantSessionRules","type":"grantContainer"},{"_nodes":[{"default":"Apache::Session::File","id":"globalStorage","title":"globalStorage"},{"cnodes":"globalStorageOptions","default":[{"data":"/var/lib/lemonldap-ng/sessions/","id":"globalStorageOptions/Directory","title":"Directory","type":"keyText"},{"data":"/var/lib/lemonldap-ng/sessions/lock/","id":"globalStorageOptions/LockDirectory","title":"LockDirectory","type":"keyText"},{"data":"Lemonldap::NG::Common::Apache::Session::Generate::SHA256","id":"globalStorageOptions/generateModule","title":"generateModule","type":"keyText"}],"id":"globalStorageOptions","title":"globalStorageOptions","type":"keyTextContainer"},{"default":"Cache::FileCache","id":"localSessionStorage","title":"localSessionStorage"},{"cnodes":"localSessionStorageOptions","default":[{"data":3,"id":"localSessionStorageOptions/cache_depth","title":"cache_depth","type":"keyText"},{"data":"/var/cache/lemonldap-ng","id":"localSessionStorageOptions/cache_root","title":"cache_root","type":"keyText"},{"data":600,"id":"localSessionStorageOptions/default_expires_in","title":"default_expires_in","type":"keyText"},{"data":"007","id":"localSessionStorageOptions/directory_umask","title":"directory_umask","type":"keyText"},{"data":"lemonldap-ng-sessions","id":"localSessionStorageOptions/namespace","title":"namespace","type":"keyText"}],"id":"localSessionStorageOptions","title":"localSessionStorageOptions","type":"keyTextContainer"}],"help":"start.html#sessions-database","id":"sessionStorage","title":"sessionStorage"},{"_nodes":[{"default":0,"id":"singleSession","title":"singleSession","type":"boolOrExpr"},{"default":0,"id":"singleIP","title":"singleIP","type":"boolOrExpr"},{"default":0,"id":"singleUserByIP","title":"singleUserByIP","type":"boolOrExpr"},{"default":1,"id":"notifyDeleted","title":"notifyDeleted","type":"bool"},{"default":0,"id":"notifyOther","title":"notifyOther","type":"bool"}],"id":"multipleSessions","title":"multipleSessions","type":"simpleInputContainer"},{"_nodes":[{"default":0,"id":"disablePersistentStorage","title":"disablePersistentStorage","type":"bool"},{"id":"persistentStorage","title":"persistentStorage"},{"cnodes":"persistentStorageOptions","id":"persistentStorageOptions","title":"persistentStorageOptions","type":"keyTextContainer"}],"id":"persistentSessions","title":"persistentSessions"}],"help":"sessions.html","id":"sessionParams","title":"sessionParams"},{"_nodes":[{"default":5,"id":"reloadTimeout","title":"reloadTimeout","type":"int"},{"default":0,"id":"compactConf","title":"compactConf","type":"bool"},{"cnodes":"reloadUrls","help":"configlocation.html#configuration-reload","id":"reloadUrls","title":"reloadUrls","type":"keyTextContainer"}],"help":"configlocation.html#configuration-reload","id":"reloadParams","title":"reloadParams"},{"_nodes":[{"default":0,"help":"status.html","id":"portalStatus","title":"portalStatus","type":"bool"},{"default":1,"id":"upgradeSession","title":"upgradeSession","type":"bool"},{"id":"refreshSessions","title":"refreshSessions","type":"bool"},{"cnodes":"adaptativeAuthenticationLevelRules","id":"adaptativeAuthenticationLevelRules","title":"adaptativeAuthenticationLevelRules","type":"keyTextContainer"},{"_nodes":[{"default":0,"id":"stayConnected","title":"stayConnected","type":"bool"},{"default":2592000,"id":"stayConnectedTimeout","title":"stayConnectedTimeout","type":"int"},{"default":"llngconnection","id":"stayConnectedCookieName","title":"stayConnectedCookieName"}],"help":"stayconnected.html","id":"stayConnect","title":"stayConnect","type":"simpleInputContainer"},{"_nodes":[{"id":"exportedAttr","title":"exportedAttr"},{"_nodes":[{"default":0,"id":"restSessionServer","title":"restSessionServer","type":"bool"},{"default":0,"id":"restConfigServer","title":"restConfigServer","type":"bool"},{"default":0,"id":"restAuthServer","title":"restAuthServer","type":"bool"},{"default":0,"id":"restPasswordServer","title":"restPasswordServer","type":"bool"},{"default":0,"id":"restExportSecretKeys","title":"restExportSecretKeys","type":"bool"},{"default":15,"id":"restClockTolerance","title":"restClockTolerance","type":"int"}],"help":"portalservers.html#REST","id":"restServices","title":"restServices","type":"simpleInputContainer"},{"_nodes":[{"default":0,"help":"soapservices.html","id":"soapSessionServer","title":"soapSessionServer","type":"bool"},{"default":0,"help":"soapservices.html","id":"soapConfigServer","title":"soapConfigServer","type":"bool"},{"default":0,"id":"wsdlServer","title":"wsdlServer","type":"bool"}],"help":"portalservers.html#SOAP_(deprecated)","id":"soapServices","title":"soapServices","type":"simpleInputContainer"}],"help":"portalservers.html","id":"portalServers","title":"portalServers"},{"_nodes":[{"default":0,"id":"loginHistoryEnabled","title":"loginHistoryEnabled","type":"bool"},{"default":5,"id":"successLoginNumber","title":"successLoginNumber","type":"int"},{"default":5,"id":"failedLoginNumber","title":"failedLoginNumber","type":"int"},{"cnodes":"sessionDataToRemember","id":"sessionDataToRemember","title":"sessionDataToRemember","type":"keyTextContainer"}],"help":"loginhistory.html","id":"loginHistory","title":"loginHistory"},{"_nodes":[{"default":0,"id":"notification","title":"notification","type":"bool"},{"default":0,"id":"notificationsExplorer","title":"notificationsExplorer","type":"bool"},{"default":"allusers","id":"notificationWildcard","title":"notificationWildcard"},{"default":0,"id":"oldNotifFormat","title":"oldNotifFormat","type":"bool"},{"id":"notificationXSLTfile","title":"notificationXSLTfile"},{"default":"File","id":"notificationStorage","title":"notificationStorage"},{"cnodes":"notificationStorageOptions","default":[{"data":"/var/lib/lemonldap-ng/notifications","id":"notificationStorageOptions/dirName","title":"dirName","type":"keyText"}],"id":"notificationStorageOptions","title":"notificationStorageOptions","type":"keyTextContainer"},{"_nodes":[{"default":0,"id":"notificationServer","title":"notificationServer","type":"bool"},{"default":"","id":"notificationDefaultCond","title":"notificationDefaultCond"},{"default":"uid reference date title subtitle text check","id":"notificationServerSentAttributes","title":"notificationServerSentAttributes"},{"_nodes":[{"default":1,"id":"notificationServerPOST","title":"notificationServerPOST","type":"bool"},{"default":0,"id":"notificationServerGET","title":"notificationServerGET","type":"bool"},{"default":0,"id":"notificationServerDELETE","title":"notificationServerDELETE","type":"bool"}],"id":"notificationServerMethods","title":"notificationServerMethods","type":"simpleInputContainer"}],"help":"notifications.html#notification-server","id":"serverNotification","title":"serverNotification"}],"help":"notifications.html","id":"notifications","title":"notifications"},{"_nodes":[{"_nodes":[{"id":"mailSubject","title":"mailSubject"},{"id":"mailBody","title":"mailBody","type":"longtext"},{"id":"mailConfirmSubject","title":"mailConfirmSubject"},{"id":"mailConfirmBody","title":"mailConfirmBody","type":"longtext"}],"id":"mailContent","title":"mailContent","type":"simpleInputContainer"},{"_nodes":[{"default":"http://auth.example.com/resetpwd","id":"mailUrl","title":"mailUrl"},{"default":0,"id":"mailTimeout","title":"mailTimeout","type":"int"},{"default":1,"id":"portalDisplayGeneratePassword","title":"portalDisplayGeneratePassword","type":"bool"},{"default":"[A-Z]{3}[a-z]{5}.\\d{2}","id":"randomPasswordRegexp","title":"randomPasswordRegexp"}],"id":"mailOther","title":"mailOther","type":"simpleInputContainer"}],"help":"resetpassword.html","id":"passwordManagement","title":"passwordManagement"},{"_nodes":[{"_nodes":[{"id":"certificateResetByMailStep1Subject","title":"certificateResetByMailStep1Subject"},{"id":"certificateResetByMailStep1Body","title":"certificateResetByMailStep1Body","type":"longtext"},{"id":"certificateResetByMailStep2Subject","title":"certificateResetByMailStep2Subject"},{"id":"certificateResetByMailStep2Body","title":"certificateResetByMailStep2Body","type":"longtext"}],"id":"certificateMailContent","title":"certificateMailContent","type":"simpleInputContainer"},{"_nodes":[{"default":"http://auth.example.com/certificateReset","id":"certificateResetByMailURL","title":"certificateResetByMailURL"},{"default":"description","id":"certificateResetByMailCeaAttribute","title":"certificateResetByMailCeaAttribute"},{"default":"userCertificate;binary","id":"certificateResetByMailCertificateAttribute","title":"certificateResetByMailCertificateAttribute"},{"default":0,"id":"certificateResetByMailValidityDelay","title":"certificateResetByMailValidityDelay","type":"int"}],"id":"mailOther","title":"mailOther","type":"simpleInputContainer"}],"help":"resetcertificate.html","id":"certificateResetByMailManagement","title":"certificateResetByMailManagement"},{"_nodes":[{"default":"http://auth.example.com/register","id":"registerUrl","title":"registerUrl"},{"default":0,"id":"registerTimeout","title":"registerTimeout","type":"int"},{"id":"registerConfirmSubject","title":"registerConfirmSubject"},{"id":"registerDoneSubject","title":"registerDoneSubject"}],"help":"register.html","id":"register","title":"register","type":"simpleInputContainer"},{"_nodes":[{"cnodes":"autoSigninRules","id":"autoSigninRules","title":"autoSigninRules","type":"keyTextContainer"}],"help":"autosignin.html","id":"autoSignin","title":"autoSignin"},{"_nodes":[{"default":0,"id":"globalLogoutRule","title":"globalLogoutRule","type":"boolOrExpr"},{"default":1,"id":"globalLogoutTimer","title":"globalLogoutTimer","type":"bool"},{"id":"globalLogoutCustomParam","title":"globalLogoutCustomParam"}],"help":"globallogout.html","id":"globalLogout","title":"globalLogout","type":"simpleInputContainer"},{"_nodes":[{"default":0,"id":"checkState","title":"checkState","type":"bool"},{"id":"checkStateSecret","title":"checkStateSecret"}],"help":"checkstate.html","id":"stateCheck","title":"stateCheck","type":"simpleInputContainer"},{"_nodes":[{"default":0,"id":"checkUser","title":"checkUser","type":"bool"},{"default":1,"id":"checkUserIdRule","title":"checkUserIdRule"},{"id":"checkUserUnrestrictedUsersRule","title":"checkUserUnrestrictedUsersRule"},{"id":"checkUserSearchAttributes","title":"checkUserSearchAttributes"},{"default":"_loginHistory _session_id hGroups","id":"checkUserHiddenAttributes","title":"checkUserHiddenAttributes"},{"cnodes":"checkUserHiddenHeaders","id":"checkUserHiddenHeaders","title":"checkUserHiddenHeaders","type":"keyTextContainer"},{"_nodes":[{"default":1,"id":"checkUserDisplayComputedSession","title":"checkUserDisplayComputedSession","type":"boolOrExpr"},{"default":0,"id":"checkUserDisplayPersistentInfo","title":"checkUserDisplayPersistentInfo","type":"boolOrExpr"},{"default":0,"id":"checkUserDisplayNormalizedHeaders","title":"checkUserDisplayNormalizedHeaders","type":"boolOrExpr"},{"default":0,"id":"checkUserDisplayEmptyHeaders","title":"checkUserDisplayEmptyHeaders","type":"boolOrExpr"},{"default":0,"id":"checkUserDisplayEmptyValues","title":"checkUserDisplayEmptyValues","type":"boolOrExpr"}],"help":"checkuser.html#configuration","id":"checkUserDisplay","title":"checkUserDisplay","type":"simpleInputContainer"}],"help":"checkuser.html","id":"checkUsers","title":"checkUsers"},{"_nodes":[{"default":0,"id":"checkDevOps","title":"checkDevOps","type":"bool"},{"default":1,"id":"checkDevOpsDownload","title":"checkDevOpsDownload","type":"bool"}],"help":"checkdevops.html","id":"devOpsCheck","title":"devOpsCheck","type":"simpleInputContainer"},{"_nodes":[{"default":0,"id":"impersonationRule","title":"impersonationRule","type":"boolOrExpr"},{"default":1,"id":"impersonationIdRule","title":"impersonationIdRule"},{"id":"impersonationUnrestrictedUsersRule","title":"impersonationUnrestrictedUsersRule"},{"default":"_2fDevices _loginHistory","id":"impersonationHiddenAttributes","title":"impersonationHiddenAttributes"},{"default":1,"id":"impersonationSkipEmptyValues","title":"impersonationSkipEmptyValues","type":"bool"},{"default":0,"id":"impersonationMergeSSOgroups","title":"impersonationMergeSSOgroups","type":"boolOrExpr"}],"help":"impersonation.html","id":"impersonation","title":"impersonation","type":"simpleInputContainer"},{"_nodes":[{"default":0,"id":"findUser","title":"findUser","type":"bool"},{"default":"*","id":"findUserWildcard","title":"findUserWildcard"},{"default":"^[*\\w]+$","id":"findUserControl","title":"findUserControl"},{"id":"restFindUserDBUrl","title":"restFindUserDBUrl"},{"cnodes":"findUserSearchingAttributes","id":"findUserSearchingAttributes","title":"findUserSearchingAttributes","type":"keyTextContainer"},{"cnodes":"findUserExcludingAttributes","id":"findUserExcludingAttributes","title":"findUserExcludingAttributes","type":"keyTextContainer"}],"help":"finduser.html","id":"findUsers","title":"findUsers"},{"_nodes":[{"default":0,"id":"contextSwitchingRule","title":"contextSwitchingRule","type":"boolOrExpr"},{"default":1,"id":"contextSwitchingIdRule","title":"contextSwitchingIdRule"},{"id":"contextSwitchingUnrestrictedUsersRule","title":"contextSwitchingUnrestrictedUsersRule"},{"default":0,"id":"contextSwitchingAllowed2fModifications","title":"contextSwitchingAllowed2fModifications","type":"bool"},{"default":1,"id":"contextSwitchingStopWithLogout","title":"contextSwitchingStopWithLogout","type":"bool"}],"help":"contextswitching.html","id":"contextSwitching","title":"contextSwitching","type":"simpleInputContainer"},{"_nodes":[{"default":0,"id":"decryptValueRule","title":"decryptValueRule","type":"boolOrExpr"},{"id":"decryptValueFunctions","title":"decryptValueFunctions"}],"help":"decryptvalue.html","id":"decryptValue","title":"decryptValue","type":"simpleInputContainer"},{"_nodes":[{"id":"customPlugins","title":"customPlugins"},{"cnodes":"customPluginsParams","id":"customPluginsParams","title":"customPluginsParams","type":"keyTextContainer"}],"help":"plugincustom.html","id":"customPluginsNode","title":"customPluginsNode"}],"help":"start.html#plugins","id":"plugins","title":"plugins"},{"_nodes":[{"default":1,"help":"secondfactor.html","id":"sfManagerRule","title":"sfManagerRule","type":"boolOrExpr"},{"default":0,"help":"secondfactor.html","id":"sfRequired","title":"sfRequired","type":"boolOrExpr"},{"help":"secondfactor.html","id":"sfOnlyUpgrade","title":"sfOnlyUpgrade","type":"bool"},{"_nodes":[{"default":0,"id":"utotp2fActivation","title":"utotp2fActivation","type":"boolOrExpr"},{"id":"utotp2fAuthnLevel","title":"utotp2fAuthnLevel","type":"int"},{"id":"utotp2fLabel","title":"utotp2fLabel"},{"id":"utotp2fLogo","title":"utotp2fLogo"}],"help":"utotp2f.html","id":"utotp2f","title":"utotp2f","type":"simpleInputContainer"},{"_nodes":[{"default":0,"id":"totp2fActivation","title":"totp2fActivation","type":"boolOrExpr"},{"default":0,"id":"totp2fSelfRegistration","title":"totp2fSelfRegistration","type":"boolOrExpr"},{"default":1,"id":"totp2fUserCanRemoveKey","title":"totp2fUserCanRemoveKey","type":"bool"},{"default":0,"id":"totp2fUserCanChangeKey","title":"totp2fUserCanChangeKey","type":"bool"},{"id":"totp2fIssuer","title":"totp2fIssuer"},{"default":30,"id":"totp2fInterval","title":"totp2fInterval","type":"int"},{"default":1,"id":"totp2fRange","title":"totp2fRange","type":"int"},{"default":6,"id":"totp2fDigits","title":"totp2fDigits","type":"int"},{"default":0,"id":"totp2fDisplayExistingSecret","title":"totp2fDisplayExistingSecret","type":"bool"},{"id":"totp2fTTL","title":"totp2fTTL","type":"int"},{"id":"totp2fAuthnLevel","title":"totp2fAuthnLevel","type":"int"},{"id":"totp2fLabel","title":"totp2fLabel"},{"id":"totp2fLogo","title":"totp2fLogo"}],"help":"totp2f.html","id":"totp2f","title":"totp2f","type":"simpleInputContainer"},{"_nodes":[{"default":0,"id":"u2fActivation","title":"u2fActivation","type":"boolOrExpr"},{"default":0,"id":"u2fSelfRegistration","title":"u2fSelfRegistration","type":"boolOrExpr"},{"default":1,"id":"u2fUserCanRemoveKey","title":"u2fUserCanRemoveKey","type":"bool"},{"id":"u2fTTL","title":"u2fTTL","type":"int"},{"id":"u2fAuthnLevel","title":"u2fAuthnLevel","type":"int"},{"id":"u2fLabel","title":"u2fLabel"},{"id":"u2fLogo","title":"u2fLogo"}],"help":"u2f.html","id":"u2f","title":"u2f","type":"simpleInputContainer"},{"_nodes":[{"default":0,"id":"yubikey2fActivation","title":"yubikey2fActivation","type":"boolOrExpr"},{"default":0,"id":"yubikey2fSelfRegistration","title":"yubikey2fSelfRegistration","type":"boolOrExpr"},{"default":1,"id":"yubikey2fUserCanRemoveKey","title":"yubikey2fUserCanRemoveKey","type":"bool"},{"id":"yubikey2fClientID","title":"yubikey2fClientID"},{"id":"yubikey2fSecretKey","title":"yubikey2fSecretKey"},{"id":"yubikey2fNonce","title":"yubikey2fNonce"},{"id":"yubikey2fUrl","title":"yubikey2fUrl"},{"default":12,"id":"yubikey2fPublicIDSize","title":"yubikey2fPublicIDSize","type":"int"},{"id":"yubikey2fFromSessionAttribute","title":"yubikey2fFromSessionAttribute"},{"id":"yubikey2fTTL","title":"yubikey2fTTL","type":"int"},{"id":"yubikey2fAuthnLevel","title":"yubikey2fAuthnLevel","type":"int"},{"id":"yubikey2fLabel","title":"yubikey2fLabel"},{"id":"yubikey2fLogo","title":"yubikey2fLogo"}],"help":"yubikey2f.html","id":"yubikey2f","title":"yubikey2f","type":"simpleInputContainer"},{"_nodes":[{"default":0,"id":"mail2fActivation","title":"mail2fActivation","type":"boolOrExpr"},{"default":"\\d{6}","id":"mail2fCodeRegex","title":"mail2fCodeRegex"},{"id":"mail2fTimeout","title":"mail2fTimeout","type":"int"},{"id":"mail2fSubject","title":"mail2fSubject"},{"id":"mail2fBody","title":"mail2fBody","type":"longtext"},{"id":"mail2fAuthnLevel","title":"mail2fAuthnLevel","type":"int"},{"id":"mail2fLabel","title":"mail2fLabel"},{"id":"mail2fLogo","title":"mail2fLogo"},{"id":"mail2fSessionKey","title":"mail2fSessionKey"}],"help":"mail2f.html","id":"mail2f","title":"mail2f","type":"simpleInputContainer"},{"_nodes":[{"default":0,"id":"ext2fActivation","title":"ext2fActivation","type":"boolOrExpr"},{"default":"\\d{6}","id":"ext2fCodeActivation","title":"ext2fCodeActivation"},{"id":"ext2FSendCommand","title":"ext2FSendCommand"},{"id":"ext2FValidateCommand","title":"ext2FValidateCommand"},{"id":"ext2fAuthnLevel","title":"ext2fAuthnLevel","type":"int"},{"id":"ext2fLabel","title":"ext2fLabel"},{"id":"ext2fLogo","title":"ext2fLogo"}],"help":"external2f.html","id":"ext2f","title":"ext2f","type":"simpleInputContainer"},{"_nodes":[{"default":0,"id":"radius2fActivation","title":"radius2fActivation","type":"boolOrExpr"},{"id":"radius2fServer","title":"radius2fServer"},{"id":"radius2fSecret","title":"radius2fSecret"},{"id":"radius2fUsernameSessionKey","title":"radius2fUsernameSessionKey"},{"default":20,"id":"radius2fTimeout","title":"radius2fTimeout","type":"int"},{"id":"radius2fAuthnLevel","title":"radius2fAuthnLevel","type":"int"},{"id":"radius2fLogo","title":"radius2fLogo"},{"id":"radius2fLabel","title":"radius2fLabel"}],"help":"radius2f.html","id":"radius2f","title":"radius2f","type":"simpleInputContainer"},{"_nodes":[{"default":0,"id":"rest2fActivation","title":"rest2fActivation","type":"boolOrExpr"},{"id":"rest2fInitUrl","title":"rest2fInitUrl"},{"cnodes":"rest2fInitArgs","id":"rest2fInitArgs","title":"rest2fInitArgs","type":"keyTextContainer"},{"id":"rest2fVerifyUrl","title":"rest2fVerifyUrl"},{"cnodes":"rest2fVerifyArgs","id":"rest2fVerifyArgs","title":"rest2fVerifyArgs","type":"keyTextContainer"},{"id":"rest2fAuthnLevel","title":"rest2fAuthnLevel","type":"int"},{"id":"rest2fLabel","title":"rest2fLabel"},{"id":"rest2fLogo","title":"rest2fLogo"}],"help":"rest2f.html","id":"rest2f","title":"rest2f"},{"cnodes":"sfExtra","id":"sfExtra","select":[{"k":"Mail2F","v":"E-Mail"},{"k":"REST","v":"REST"},{"k":"Ext2F","v":"External"},{"k":"Radius","v":"Radius"}],"title":"sfExtra","type":"sfExtraContainer"},{"_nodes":[{"default":0,"help":"secondfactor.html","id":"sfRemovedMsgRule","title":"sfRemovedMsgRule","type":"boolOrExpr"},{"default":0,"id":"sfRemovedUseNotif","title":"sfRemovedUseNotif","type":"bool"},{"default":"RemoveSF","help":"secondfactor.html","id":"sfRemovedNotifRef","title":"sfRemovedNotifRef"},{"default":"Second factor notification","help":"secondfactor.html","id":"sfRemovedNotifTitle","title":"sfRemovedNotifTitle"},{"default":"_removedSF_ expired second factor(s) has/have been removed!","help":"secondfactor.html","id":"sfRemovedNotifMsg","title":"sfRemovedNotifMsg"}],"help":"secondfactor.html","id":"sfRemovedNotification","title":"sfRemovedNotification","type":"simpleInputContainer"}],"help":"secondfactor.html","id":"secondFactors","title":"secondFactors"},{"_nodes":[{"help":"customfunctions.html","id":"customFunctions","title":"customFunctions"},{"default":"; ","id":"multiValuesSeparator","title":"multiValuesSeparator","type":"authParamsText"},{"default":0,"id":"groupsBeforeMacros","title":"groupsBeforeMacros","type":"bool"},{"_nodes":[{"default":"mail","id":"mailSessionKey","title":"mailSessionKey"},{"default":"","id":"SMTPServer","title":"SMTPServer"},{"id":"SMTPPort","title":"SMTPPort","type":"int"},{"id":"SMTPAuthUser","title":"SMTPAuthUser"},{"id":"SMTPAuthPass","title":"SMTPAuthPass","type":"password"},{"default":"","id":"SMTPTLS","select":[{"k":"","v":"none"},{"k":"starttls","v":"SMTP + STARTTLS"},{"k":"ssl","v":"SMTPS"}],"title":"SMTPTLS","type":"select"},{"cnodes":"SMTPTLSOpts","id":"SMTPTLSOpts","title":"SMTPTLSOpts","type":"keyTextContainer"},{"_nodes":[{"default":"noreply@example.com","id":"mailFrom","title":"mailFrom"},{"id":"mailReplyTo","title":"mailReplyTo"},{"default":"utf-8","id":"mailCharset","title":"mailCharset"}],"id":"mailHeaders","title":"mailHeaders","type":"simpleInputContainer"}],"help":"smtp.html","id":"SMTP","title":"SMTP","type":"SMTP"},{"_nodes":[{"default":"^[\\w\\.\\-@]+$","id":"userControl","title":"userControl"},{"default":0,"id":"browsersDontStorePassword","title":"browsersDontStorePassword","type":"bool"},{"default":0,"help":"forcereauthn.html","id":"portalForceAuthn","title":"portalForceAuthn","type":"bool"},{"default":5,"id":"portalForceAuthnInterval","title":"portalForceAuthnInterval","type":"int"},{"id":"key","title":"key","type":"password"},{"id":"trustedDomains","title":"trustedDomains"},{"default":1,"help":"safejail.html","id":"useSafeJail","title":"useSafeJail","type":"bool"},{"default":0,"help":"safejail.html","id":"avoidAssignment","title":"avoidAssignment","type":"bool"},{"default":1,"id":"checkXSS","title":"checkXSS","type":"bool"},{"default":1,"id":"requireToken","title":"requireToken","type":"boolOrExpr"},{"default":120,"id":"formTimeout","title":"formTimeout","type":"int"},{"default":0,"id":"tokenUseGlobalStorage","title":"tokenUseGlobalStorage","type":"bool"},{"_nodes":[{"id":"crowdsec","title":"crowdsec","type":"bool"},{"default":"reject","id":"crowdsecAction","select":[{"k":"reject","v":"Reject"},{"k":"warn","v":"Warn"}],"title":"crowdsecAction","type":"select"},{"id":"crowdsecUrl","title":"crowdsecUrl"},{"id":"crowdsecKey","title":"crowdsecKey"}],"help":"crowdsec.html","id":"CrowdSecPlugin","title":"CrowdSecPlugin"},{"_nodes":[{"default":0,"help":"bruteforceprotection.html","id":"bruteForceProtection","title":"bruteForceProtection","type":"bool"},{"default":30,"id":"bruteForceProtectionTempo","title":"bruteForceProtectionTempo","type":"int"},{"default":3,"id":"bruteForceProtectionMaxFailed","title":"bruteForceProtectionMaxFailed","type":"int"},{"default":0,"help":"bruteforceprotection.html","id":"bruteForceProtectionIncrementalTempo","title":"bruteForceProtectionIncrementalTempo","type":"bool"},{"default":"15, 30, 60, 300, 600","id":"bruteForceProtectionLockTimes","title":"bruteForceProtectionLockTimes"}],"help":"bruteforceprotection.html","id":"bruteForceAttackProtection","title":"bruteForceAttackProtection","type":"simpleInputContainer"},{"cnodes":"lwpOpts","id":"lwpOpts","title":"lwpOpts","type":"keyTextContainer"},{"cnodes":"lwpSslOpts","id":"lwpSslOpts","title":"lwpSslOpts","type":"keyTextContainer"},{"_nodes":[{"default":"'self'","id":"cspDefault","title":"cspDefault"},{"default":"'self' data:","id":"cspImg","title":"cspImg"},{"default":"'self'","id":"cspScript","title":"cspScript"},{"default":"'self'","id":"cspStyle","title":"cspStyle"},{"default":"'self'","id":"cspFont","title":"cspFont"},{"default":"*","id":"cspFormAction","title":"cspFormAction"},{"default":"'self'","id":"cspConnect","title":"cspConnect"},{"default":"","id":"cspFrameAncestors","title":"cspFrameAncestors"}],"help":"security.html#portal","id":"contentSecurityPolicy","title":"contentSecurityPolicy","type":"simpleInputContainer"},{"_nodes":[{"default":1,"id":"corsEnabled","title":"corsEnabled","type":"bool"},{"default":true,"id":"corsAllow_Credentials","title":"corsAllow_Credentials"},{"default":"*","id":"corsAllow_Headers","title":"corsAllow_Headers"},{"default":"POST,GET","id":"corsAllow_Methods","title":"corsAllow_Methods"},{"default":"*","id":"corsAllow_Origin","title":"corsAllow_Origin"},{"default":"*","id":"corsExpose_Headers","title":"corsExpose_Headers"},{"default":"86400","id":"corsMax_Age","title":"corsMax_Age"}],"help":"security.html#portal","id":"crossOrigineResourceSharing","title":"crossOrigineResourceSharing","type":"simpleInputContainer"}],"help":"security.html#configure-security-settings","id":"security","title":"security"},{"_nodes":[{"default":-1,"id":"https","title":"https","type":"trool"},{"default":-1,"id":"port","title":"port","type":"int"},{"default":0,"id":"useRedirectOnForbidden","title":"useRedirectOnForbidden","type":"bool"},{"default":1,"id":"useRedirectOnError","title":"useRedirectOnError","type":"bool"},{"default":0,"id":"maintenance","title":"maintenance","type":"bool"}],"help":"redirections.html","id":"redirection","title":"redirection","type":"simpleInputContainer"},{"_nodes":[{"default":0,"id":"jsRedirect","title":"jsRedirect","type":"boolOrExpr"},{"default":0,"id":"noAjaxHook","title":"noAjaxHook","type":"bool"},{"default":0,"id":"skipRenewConfirmation","title":"skipRenewConfirmation","type":"bool"},{"default":0,"id":"skipUpgradeConfirmation","title":"skipUpgradeConfirmation","type":"bool"}],"help":"redirections.html#portal-redirections","id":"portalRedirection","title":"portalRedirection","type":"simpleInputContainer"},{"cnodes":"nginxCustomHandlers","help":"handlerarch.html","id":"nginxCustomHandlers","title":"nginxCustomHandlers","type":"keyTextContainer"},{"cnodes":"logoutServices","default":[],"help":"logoutforward.html","id":"logoutServices","title":"logoutServices","type":"keyTextContainer"},{"_nodes":[{"default":"get","id":"infoFormMethod","select":[{"k":"get","v":"GET"},{"k":"post","v":"POST"}],"title":"infoFormMethod","type":"select"},{"default":"post","id":"confirmFormMethod","select":[{"k":"get","v":"GET"},{"k":"post","v":"POST"}],"title":"confirmFormMethod","type":"select"},{"default":"get","id":"redirectFormMethod","select":[{"k":"get","v":"GET"},{"k":"post","v":"POST"}],"title":"redirectFormMethod","type":"select"},{"default":1,"id":"activeTimer","title":"activeTimer","type":"bool"}],"id":"forms","title":"forms","type":"simpleInputContainer"}],"help":"start.html#advanced-features","id":"advancedParams","title":"advancedParams"}],"id":"generalParameters","title":"generalParameters"},{"_nodes":[{"cnodes":"exportedVars","default":[{"data":"HTTP_USER_AGENT","id":"exportedVars/UA","title":"UA","type":"keyText"}],"help":"exportedvars.html","id":"exportedVars","title":"exportedVars","type":"keyTextContainer"},{"cnodes":"macros","default":[],"help":"exportedvars.html#extend-variables-using-macros-and-groups","id":"macros","title":"macros","type":"keyTextContainer"},{"cnodes":"groups","default":[],"help":"exportedvars.html#extend-variables-using-macros-and-groups","id":"groups","title":"groups","type":"keyTextContainer"}],"help":"variables.html","id":"variables","title":"variables"},{"cnodes":"virtualHosts","help":"configvhost.html","id":"virtualHosts","template":"virtualHost","title":"virtualHosts","type":"virtualHostContainer"},{"_nodes":[{"default":"#PORTAL#/saml/metadata","id":"samlEntityID","title":"samlEntityID"},{"_nodes":[{"get":["samlServicePrivateKeySig","samlServicePrivateKeySigPwd","samlServicePublicKeySig"],"id":"samlServiceSecuritySig","title":"samlServiceSecuritySig","type":"RSACertKey"},{"get":["samlServicePrivateKeyEnc","samlServicePrivateKeyEncPwd","samlServicePublicKeyEnc"],"id":"samlServiceSecurityEnc","title":"samlServiceSecurityEnc","type":"RSACertKey"},{"default":0,"id":"samlServiceUseCertificateInResponse","title":"samlServiceUseCertificateInResponse","type":"bool"},{"default":"RSA_SHA256","id":"samlServiceSignatureMethod","select":[{"k":"RSA_SHA1","v":"RSA SHA1"},{"k":"RSA_SHA256","v":"RSA SHA256"},{"k":"RSA_SHA384","v":"RSA SHA384"},{"k":"RSA_SHA512","v":"RSA SHA512"}],"title":"samlServiceSignatureMethod","type":"select"}],"help":"samlservice.html#security-parameters","id":"samlServiceSecurity","title":"samlServiceSecurity"},{"_nodes":[{"default":"mail","id":"samlNameIDFormatMapEmail","title":"samlNameIDFormatMapEmail"},{"default":"mail","id":"samlNameIDFormatMapX509","title":"samlNameIDFormatMapX509"},{"default":"uid","id":"samlNameIDFormatMapWindows","title":"samlNameIDFormatMapWindows"},{"default":"uid","id":"samlNameIDFormatMapKerberos","title":"samlNameIDFormatMapKerberos"}],"help":"samlservice.html#nameid-formats","id":"samlNameIDFormatMap","title":"samlNameIDFormatMap","type":"simpleInputContainer"},{"_nodes":[{"default":2,"id":"samlAuthnContextMapPassword","title":"samlAuthnContextMapPassword","type":"int"},{"default":3,"id":"samlAuthnContextMapPasswordProtectedTransport","title":"samlAuthnContextMapPasswordProtectedTransport","type":"int"},{"default":5,"id":"samlAuthnContextMapTLSClient","title":"samlAuthnContextMapTLSClient","type":"int"},{"default":4,"id":"samlAuthnContextMapKerberos","title":"samlAuthnContextMapKerberos","type":"int"}],"help":"samlservice.html#authentication-contexts","id":"samlAuthnContextMap","title":"samlAuthnContextMap","type":"simpleInputContainer"},{"_nodes":[{"default":"Example","id":"samlOrganizationDisplayName","title":"samlOrganizationDisplayName"},{"default":"Example","id":"samlOrganizationName","title":"samlOrganizationName"},{"default":"http://www.example.com","id":"samlOrganizationURL","title":"samlOrganizationURL"}],"help":"samlservice.html#organization","id":"samlOrganization","title":"samlOrganization","type":"simpleInputContainer"},{"_nodes":[{"default":1,"id":"samlSPSSODescriptorAuthnRequestsSigned","title":"samlSPSSODescriptorAuthnRequestsSigned","type":"bool"},{"default":1,"id":"samlSPSSODescriptorWantAssertionsSigned","title":"samlSPSSODescriptorWantAssertionsSigned","type":"bool"},{"_nodes":[{"default":"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect;#PORTAL#/saml/proxySingleLogout;#PORTAL#/saml/proxySingleLogoutReturn","id":"samlSPSSODescriptorSingleLogoutServiceHTTPRedirect","title":"samlSPSSODescriptorSingleLogoutServiceHTTPRedirect","type":"samlService"},{"default":"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST;#PORTAL#/saml/proxySingleLogout;#PORTAL#/saml/proxySingleLogoutReturn","id":"samlSPSSODescriptorSingleLogoutServiceHTTPPost","title":"samlSPSSODescriptorSingleLogoutServiceHTTPPost","type":"samlService"},{"default":"urn:oasis:names:tc:SAML:2.0:bindings:SOAP;#PORTAL#/saml/proxySingleLogoutSOAP;","id":"samlSPSSODescriptorSingleLogoutServiceSOAP","title":"samlSPSSODescriptorSingleLogoutServiceSOAP","type":"samlService"}],"id":"samlSPSSODescriptorSingleLogoutService","title":"samlSPSSODescriptorSingleLogoutService"},{"_nodes":[{"default":"1;0;urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact;#PORTAL#/saml/proxySingleSignOnArtifact","id":"samlSPSSODescriptorAssertionConsumerServiceHTTPArtifact","title":"samlSPSSODescriptorAssertionConsumerServiceHTTPArtifact","type":"samlAssertion"},{"default":"0;1;urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST;#PORTAL#/saml/proxySingleSignOnPost","id":"samlSPSSODescriptorAssertionConsumerServiceHTTPPost","title":"samlSPSSODescriptorAssertionConsumerServiceHTTPPost","type":"samlAssertion"}],"id":"samlSPSSODescriptorAssertionConsumerService","title":"samlSPSSODescriptorAssertionConsumerService"},{"_nodes":[{"default":"1;0;urn:oasis:names:tc:SAML:2.0:bindings:SOAP;#PORTAL#/saml/artifact","id":"samlSPSSODescriptorArtifactResolutionServiceArtifact","title":"samlSPSSODescriptorArtifactResolutionServiceArtifact","type":"samlAssertion"}],"id":"samlSPSSODescriptorArtifactResolutionService","title":"samlSPSSODescriptorArtifactResolutionService"}],"help":"samlservice.html#service-provider","id":"samlSPSSODescriptor","title":"samlSPSSODescriptor"},{"_nodes":[{"default":1,"id":"samlIDPSSODescriptorWantAuthnRequestsSigned","title":"samlIDPSSODescriptorWantAuthnRequestsSigned","type":"bool"},{"_nodes":[{"default":"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect;#PORTAL#/saml/singleSignOn;","id":"samlIDPSSODescriptorSingleSignOnServiceHTTPRedirect","title":"samlIDPSSODescriptorSingleSignOnServiceHTTPRedirect","type":"samlService"},{"default":"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST;#PORTAL#/saml/singleSignOn;","id":"samlIDPSSODescriptorSingleSignOnServiceHTTPPost","title":"samlIDPSSODescriptorSingleSignOnServiceHTTPPost","type":"samlService"},{"default":"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact;#PORTAL#/saml/singleSignOnArtifact;","id":"samlIDPSSODescriptorSingleSignOnServiceHTTPArtifact","title":"samlIDPSSODescriptorSingleSignOnServiceHTTPArtifact","type":"samlService"}],"id":"samlIDPSSODescriptorSingleSignOnService","title":"samlIDPSSODescriptorSingleSignOnService"},{"_nodes":[{"default":"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect;#PORTAL#/saml/singleLogout;#PORTAL#/saml/singleLogoutReturn","id":"samlIDPSSODescriptorSingleLogoutServiceHTTPRedirect","title":"samlIDPSSODescriptorSingleLogoutServiceHTTPRedirect","type":"samlService"},{"default":"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST;#PORTAL#/saml/singleLogout;#PORTAL#/saml/singleLogoutReturn","id":"samlIDPSSODescriptorSingleLogoutServiceHTTPPost","title":"samlIDPSSODescriptorSingleLogoutServiceHTTPPost","type":"samlService"},{"default":"urn:oasis:names:tc:SAML:2.0:bindings:SOAP;#PORTAL#/saml/singleLogoutSOAP;","id":"samlIDPSSODescriptorSingleLogoutServiceSOAP","title":"samlIDPSSODescriptorSingleLogoutServiceSOAP","type":"samlService"}],"id":"samlIDPSSODescriptorSingleLogoutService","title":"samlIDPSSODescriptorSingleLogoutService"},{"_nodes":[{"default":"1;0;urn:oasis:names:tc:SAML:2.0:bindings:SOAP;#PORTAL#/saml/artifact","id":"samlIDPSSODescriptorArtifactResolutionServiceArtifact","title":"samlIDPSSODescriptorArtifactResolutionServiceArtifact","type":"samlAssertion"}],"id":"samlIDPSSODescriptorArtifactResolutionService","title":"samlIDPSSODescriptorArtifactResolutionService"}],"help":"samlservice.html#identity-provider","id":"samlIDPSSODescriptor","title":"samlIDPSSODescriptor"},{"_nodes":[{"_nodes":[{"default":"urn:oasis:names:tc:SAML:2.0:bindings:SOAP;#PORTAL#/saml/AA/SOAP;","id":"samlAttributeAuthorityDescriptorAttributeServiceSOAP","title":"samlAttributeAuthorityDescriptorAttributeServiceSOAP","type":"samlService"}],"id":"samlAttributeAuthorityDescriptorAttributeService","title":"samlAttributeAuthorityDescriptorAttributeService"}],"help":"samlservice.html#attribute-authority","id":"samlAttributeAuthorityDescriptor","title":"samlAttributeAuthorityDescriptor"},{"_nodes":[{"default":1,"id":"samlMetadataForceUTF8","title":"samlMetadataForceUTF8","type":"bool"},{"default":600,"id":"samlRelayStateTimeout","title":"samlRelayStateTimeout","type":"int"},{"default":0,"id":"samlUseQueryStringSpecific","title":"samlUseQueryStringSpecific","type":"bool"},{"default":"","id":"samlOverrideIDPEntityID","title":"samlOverrideIDPEntityID"},{"id":"samlStorage","title":"samlStorage"},{"cnodes":"samlStorageOptions","id":"samlStorageOptions","title":"samlStorageOptions","type":"keyTextContainer"},{"_nodes":[{"default":0,"id":"samlCommonDomainCookieActivation","title":"samlCommonDomainCookieActivation","type":"bool"},{"id":"samlCommonDomainCookieDomain","title":"samlCommonDomainCookieDomain"},{"id":"samlCommonDomainCookieReader","title":"samlCommonDomainCookieReader"},{"id":"samlCommonDomainCookieWriter","title":"samlCommonDomainCookieWriter"}],"id":"samlCommonDomainCookie","title":"samlCommonDomainCookie","type":"simpleInputContainer"},{"_nodes":[{"default":0,"id":"samlDiscoveryProtocolActivation","title":"samlDiscoveryProtocolActivation","type":"bool"},{"id":"samlDiscoveryProtocolURL","title":"samlDiscoveryProtocolURL"},{"id":"samlDiscoveryProtocolPolicy","title":"samlDiscoveryProtocolPolicy"},{"default":0,"id":"samlDiscoveryProtocolIsPassive","title":"samlDiscoveryProtocolIsPassive","type":"bool"}],"id":"samlDiscoveryProtocol","title":"samlDiscoveryProtocol","type":"simpleInputContainer"}],"help":"samlservice.html#advanced","id":"samlAdvanced","title":"samlAdvanced"}],"help":"samlservice.html","id":"samlServiceMetaData","title":"samlServiceMetaData"},{"cnodes":"samlIDPMetaDataNodes","help":"authsaml.html","id":"samlIDPMetaDataNodes","template":"samlIDPMetaDataNode","title":"samlIDPMetaDataNodes","type":"samlIDPMetaDataNodeContainer"},{"cnodes":"samlSPMetaDataNodes","help":"idpsaml.html","id":"samlSPMetaDataNodes","template":"samlSPMetaDataNode","title":"samlSPMetaDataNodes","type":"samlSPMetaDataNodeContainer"},{"_nodes":[{"id":"oidcServiceMetaDataIssuer","title":"oidcServiceMetaDataIssuer"},{"_nodes":[{"default":"authorize","id":"oidcServiceMetaDataAuthorizeURI","title":"oidcServiceMetaDataAuthorizeURI"},{"default":"token","id":"oidcServiceMetaDataTokenURI","title":"oidcServiceMetaDataTokenURI"},{"default":"userinfo","id":"oidcServiceMetaDataUserInfoURI","title":"oidcServiceMetaDataUserInfoURI"},{"default":"jwks","id":"oidcServiceMetaDataJWKSURI","title":"oidcServiceMetaDataJWKSURI"},{"default":"register","id":"oidcServiceMetaDataRegistrationURI","title":"oidcServiceMetaDataRegistrationURI"},{"default":"introspect","id":"oidcServiceMetaDataIntrospectionURI","title":"oidcServiceMetaDataIntrospectionURI"},{"default":"logout","id":"oidcServiceMetaDataEndSessionURI","title":"oidcServiceMetaDataEndSessionURI"},{"default":"checksession.html","id":"oidcServiceMetaDataCheckSessionURI","title":"oidcServiceMetaDataCheckSessionURI"},{"default":"flogout","id":"oidcServiceMetaDataFrontChannelURI","title":"oidcServiceMetaDataFrontChannelURI"},{"default":"blogout","id":"oidcServiceMetaDataBackChannelURI","title":"oidcServiceMetaDataBackChannelURI"}],"id":"oidcServiceMetaDataEndPoints","title":"oidcServiceMetaDataEndPoints","type":"simpleInputContainer"},{"cnodes":"oidcServiceMetaDataAuthnContext","default":[{"data":1,"id":"oidcServiceMetaDataAuthnContext/loa-1","title":"loa-1","type":"keyText"},{"data":2,"id":"oidcServiceMetaDataAuthnContext/loa-2","title":"loa-2","type":"keyText"},{"data":3,"id":"oidcServiceMetaDataAuthnContext/loa-3","title":"loa-3","type":"keyText"},{"data":4,"id":"oidcServiceMetaDataAuthnContext/loa-4","title":"loa-4","type":"keyText"},{"data":5,"id":"oidcServiceMetaDataAuthnContext/loa-5","title":"loa-5","type":"keyText"}],"id":"oidcServiceMetaDataAuthnContext","title":"oidcServiceMetaDataAuthnContext","type":"keyTextContainer"},{"_nodes":[{"get":["oidcServicePrivateKeySig","oidcServicePublicKeySig","oidcServiceKeyIdSig"],"id":"oidcServiceMetaDataKeys","title":"oidcServiceMetaDataKeys","type":"RSAKeyNoPassword"},{"default":0,"id":"oidcServiceAllowDynamicRegistration","title":"oidcServiceAllowDynamicRegistration","type":"bool"},{"default":0,"id":"oidcServiceAllowOnlyDeclaredScopes","title":"oidcServiceAllowOnlyDeclaredScopes","type":"bool"},{"default":1,"id":"oidcServiceAllowAuthorizationCodeFlow","title":"oidcServiceAllowAuthorizationCodeFlow","type":"bool"},{"default":0,"id":"oidcServiceAllowImplicitFlow","title":"oidcServiceAllowImplicitFlow","type":"bool"},{"default":0,"id":"oidcServiceAllowHybridFlow","title":"oidcServiceAllowHybridFlow","type":"bool"},{"default":60,"id":"oidcServiceAuthorizationCodeExpiration","title":"oidcServiceAuthorizationCodeExpiration","type":"int"},{"default":3600,"id":"oidcServiceAccessTokenExpiration","title":"oidcServiceAccessTokenExpiration","type":"int"},{"default":3600,"id":"oidcServiceIDTokenExpiration","title":"oidcServiceIDTokenExpiration","type":"int"},{"default":2592000,"id":"oidcServiceOfflineSessionExpiration","title":"oidcServiceOfflineSessionExpiration","type":"int"}],"id":"oidcServiceMetaDataSecurity","title":"oidcServiceMetaDataSecurity"},{"_nodes":[{"id":"oidcStorage","title":"oidcStorage"},{"cnodes":"oidcStorageOptions","id":"oidcStorageOptions","title":"oidcStorageOptions","type":"keyTextContainer"}],"id":"oidcServiceMetaDataSessions","title":"oidcServiceMetaDataSessions"},{"cnodes":"oidcServiceDynamicRegistrationExportedVars","id":"oidcServiceDynamicRegistrationExportedVars","title":"oidcServiceDynamicRegistrationExportedVars","type":"keyTextContainer"},{"cnodes":"oidcServiceDynamicRegistrationExtraClaims","id":"oidcServiceDynamicRegistrationExtraClaims","title":"oidcServiceDynamicRegistrationExtraClaims","type":"keyTextContainer"}],"help":"openidconnectservice.html#service-configuration","id":"oidcServiceMetaData","title":"oidcServiceMetaData"},{"cnodes":"oidcOPMetaDataNodes","help":"authopenidconnect.html#declare-the-openid-connect-provider-in-ll-ng","id":"oidcOPMetaDataNodes","title":"oidcOPMetaDataNodes","type":"oidcOPMetaDataNodeContainer"},{"cnodes":"oidcRPMetaDataNodes","help":"idpopenidconnect.html#configuration-of-relying-party-in-ll-ng","id":"oidcRPMetaDataNodes","title":"oidcRPMetaDataNodes","type":"oidcRPMetaDataNodeContainer"},{"_nodes":[{"id":"casAttr","title":"casAttr"},{"default":"none","id":"casAccessControlPolicy","select":[{"k":"none","v":"None"},{"k":"error","v":"Display error on portal"},{"k":"faketicket","v":"Send a fake service ticket"}],"title":"casAccessControlPolicy","type":"select"},{"id":"casStorage","title":"casStorage"},{"cnodes":"casStorageOptions","id":"casStorageOptions","title":"casStorageOptions","type":"keyTextContainer"},{"cnodes":"casAttributes","id":"casAttributes","title":"casAttributes","type":"keyTextContainer"},{"default":0,"id":"casStrictMatching","title":"casStrictMatching","type":"bool"}],"help":"idpcas.html#configuring-the-cas-service","id":"casServiceMetadata","title":"casServiceMetadata"},{"cnodes":"casSrvMetaDataNodes","help":"authcas.html","id":"casSrvMetaDataNodes","template":"casSrvMetaDataNode","title":"casSrvMetaDataNodes","type":"casSrvMetaDataNodeContainer"},{"cnodes":"casAppMetaDataNodes","help":"idpcas.html#configuring-cas-applications","id":"casAppMetaDataNodes","template":"casAppMetaDataNode","title":"casAppMetaDataNodes","type":"casAppMetaDataNodeContainer"}]
\ No newline at end of file
diff --git a/lemonldap-ng-portal/site/htdocs/static/common/js/portal.js b/lemonldap-ng-portal/site/htdocs/static/common/js/portal.js
index 8dab4261a..b32b11d3c 100644
--- a/lemonldap-ng-portal/site/htdocs/static/common/js/portal.js
+++ b/lemonldap-ng-portal/site/htdocs/static/common/js/portal.js
@@ -600,7 +600,7 @@ LemonLDAP::NG Portal jQuery scripts
       event.preventDefault();
       document.body.style.cursor = 'progress';
       str = $("#finduserForm").serialize();
-      console.log('Send findUser request with', str);
+      console.log('Send findUser request with parameters', str);
       return $.ajax({
         type: "POST",
         url: portal + "finduser",
@@ -610,7 +610,7 @@ LemonLDAP::NG Portal jQuery scripts
           var user;
           document.body.style.cursor = 'default';
           user = data.user;
-          console.log('Suggested spoofId', user);
+          console.log('Suggested spoofId=', user);
           $('#spoofIdfield').attr('value', user);
           if (data.captcha) {
             $('#captcha').attr('src', data.captcha);
diff --git a/lemonldap-ng-portal/site/htdocs/static/common/js/portal.min.js b/lemonldap-ng-portal/site/htdocs/static/common/js/portal.min.js
index c14378bcc..92452684f 100644
--- a/lemonldap-ng-portal/site/htdocs/static/common/js/portal.min.js
+++ b/lemonldap-ng-portal/site/htdocs/static/common/js/portal.min.js
@@ -1 +1 @@
-(function(){var G,a,D,R,N,U,V,_,J,e,M,g,F,q,r,H=[].indexOf||function(e){for(var a=0,t=this.length;a<t;a++)if(a in this&&this[a]===e)return a;return-1};r={},q=function(s){return $.getJSON(window.staticPrefix+"languages/"+s+".json",function(e){var a,t,n,o;for(a in r=e,t=window.datas.trOver.all)o=t[a],r[a]=o;if(window.datas.trOver[s])for(a in n=window.datas.trOver[s])o=n[a],r[a]=o;return $("[trspan]").each(function(){var e,a,t,n;for(e=$(this).attr("trspan").split(","),n=F(e.shift()),a=0,t=e.length;a<t;a++)o=e[a],n=n.replace(/%[sd]/,o);return $(this).html(n)}),$("[trmsg]").each(function(){if($(this).html(F("PE"+$(this).attr("trmsg"))),F("PE"+$(this).attr("trmsg")).match(/_hide_/))return $(this).parent().hide()}),$("[trplaceholder]").each(function(){return $(this).attr("placeholder",F($(this).attr("trplaceholder")))}),$("[localtime]").each(function(){var e;return e=new Date(1e3*$(this).attr("localtime")),$(this).text(e.toLocaleString())})})},F=function(e){return r[e]?r[e]:e},window.translate=F,N=function(){var o;return o={},$("script[type='application/init']").each(function(){var a,e,t,n;try{for(e in n=JSON.parse($(this).text()),t=[],n)t.push(o[e]=n[e]);return t}catch(e){return a=e,console.log("Parsing error",a),console.log("JSON",$(this).text())}}),console.log(o),o},R=function(e){var a;return(a=RegExp("[?&]"+e+"=([^&]*)").exec(window.location.search))?decodeURIComponent(a[1].replace(/\+/g," ")):null},g="#appslist",M=function(){return e("_appsListOrder",$(g).sortable("toArray").join())},V=function(e){return a("_oidcConsents",e,function(){return $("[partner='"+e+"']").hide()},function(e,a,t){return alert(a+" "+t)})},e=function(t,n,o,s){return $.ajax({type:"GET",url:G.scriptname+"/mysession/?gettoken",dataType:"json",error:s,success:function(e){var a;return(a={token:e.token})[t]=n,$.ajax({type:"PUT",url:G.scriptname+"/mysession/persistent",dataType:"json",data:a,success:o,error:s})}})},a=function(a,t,n,o){return $.ajax({type:"GET",url:G.scriptname+"/mysession/?gettoken",dataType:"json",error:o,success:function(e){return $.ajax({type:"DELETE",url:G.scriptname+"/mysession/persistent/"+a+"?sub="+t+"&token="+e.token,dataType:"json",success:n,error:o})}})},_=function(){var e,a,t,n,o,s,r,i,l,c,d,p,u;if(null==(l=$(g))||!G.appslistorder)return null;for(e=G.appslistorder.split(","),d=[],s=0,r=(o=l.sortable("toArray")).length;s<r;s++)d[u=o[s]]=u;for(c=0,i=e.length;c<i;c++)d[n=e[c]]&&(t=d[n],a=$(g+".ui-sortable").children("#"+t),p=$(g+".ui-sortable").children("#"+n),a.remove(),$(g+".ui-sortable").filter(":first").append(p));return 1},U=function(){return $.ajax({type:"POST",url:G.scriptname,data:{ping:1},dataType:"json",success:function(e){return null!=e.result&&1===e.result?setTimeout(U,G.pingInterval):location.reload(!0)},error:function(e,a,t){return location.reload(!0)}})},window.ping=U,D=function(e){var a,t,n,o,s;for(e+"=",t=decodeURIComponent(document.cookie).split(";"),s=new RegExp("^ *"+e+"="),n=0,o=t.length;n<o;n++)if((a=t[n]).match(s))return a=a.replace(s,"");return""},J=function(e,a,t){var n;return(n=new Date).setTime(n.getTime()+864e5*t),document.cookie=e+"="+a+"; expires="+n.toUTCString()+"; path=/"},G={},$(window).on("load",function(){var e,a,t,n,o,s,r,i,u,l,c,d,p,g,f,h,w,m,y,v,b,k,x,C,T,O,L,S,j,E,P,z,A,I;if(G=N(),"datas"in window&&"choicetab"in window.datas&&(G.choicetab=window.datas.choicetab),window.datas=G,$("#appslist").sortable({axis:"y",cursor:"move",opacity:.5,revert:!0,items:"> div.category",update:function(){return M()}}),_(),$("div.message").fadeIn("slow"),$("input[name=timezone]").val(-(new Date).getTimezoneOffset()/60),k=$("#menu").tabs({active:0}),(b=$('#menu a[href="#'+G.displaytab+'"]').parent().index())<0&&(b=0),k.tabs("option","active",b),n=$("#authMenu").tabs({active:0}),(t=$('#authMenu a[href="#'+G.displaytab+'"]').parent().index())<0&&(t=0),n.tabs("option","active",t),G.choicetab&&n.tabs("option","active",$('#authMenu a[href="#'+G.choicetab+'"]').parent().index()),G.login?$("input[type=password]:first").focus():0===$("input[autofocus]").length&&$("input[type!=hidden]:first").focus(),G.newwindow&&$("#appslist a").attr("target","_blank"),$("p.removeOther").length&&(e=$("#form").attr("action"),x=$("#form").attr("method"),console.log("method=",x),i="",$("#form input[type=hidden]")&&(console.log("Parse hidden values"),$("#form input[type=hidden]").each(function(e){return console.log(" ->",$(this).attr("name"),$(this).val()),i+="&"+$(this).attr("name")+"="+$(this).val()})),o="",e&&(console.log("action=",e),-1!==e.indexOf("?")?e.substring(0,e.indexOf("?")):o=e+"?",o+=i,i=""),y=$("p.removeOther a").attr("href")+"&method="+x+i,o&&(y+="&url="+btoa(o)),$("p.removeOther a").attr("href",y)),window.location.search&&((S=R("llnglanguage"))&&console.log("Get lang from parameter"),1===(A=R("setCookieLang"))&&console.log("Set lang cookie")),c||(c=D("llnglanguage"))&&!S&&console.log("Get lang from cookie"),c)H.call(window.availableLanguages,c)<0&&(c=window.availableLanguages[0],S||console.log("Lang not available -> Get default lang"));else if(navigator){for(p=[],g=[],O=[navigator.language],navigator.languages&&(O=navigator.languages),l=0,f=(E=window.availableLanguages).length;l<f;l++)a=E[l],d+='<img class="langicon" src="'+window.staticPrefix+"common/"+a+'.png" title="'+a+'" alt="['+a+']"> ';for(v=0,h=O.length;v<h;v++)for(T=O[v],console.log("Navigator lang",T),C=0,w=(P=window.availableLanguages).length;C<w;C++)a=P[C],console.log(" Available lang",a),j=new RegExp("^"+a+"-?"),T.match(j)?(console.log("  Matching lang =",a),p.push(a)):a.substring(0,1)===T.substring(0,1)&&g.push(a);(c=p[0]?p[0]:g[0]?g[0]:window.availableLanguages[0])&&!S&&console.log("Get lang from navigator")}else(c=window.availableLanguages[0])&&!S&&console.log("Get lang from window");for(S?(H.call(window.availableLanguages,S)<0&&(console.log("Lang not available -> Get default lang"),S=window.availableLanguages[0]),console.log("Selected lang ->",S),A&&(console.log("Set cookie lang ->",S),J("llnglanguage",S)),q(S)):(console.log("Selected lang ->",c),J("llnglanguage",c),q(c)),d="",L=0,m=(z=window.availableLanguages).length;L<m;L++)a=z[L],d+='<img class="langicon" src="'+window.staticPrefix+"common/"+a+'.png" title="'+a+'" alt="['+a+']"> ';return $("#languages").html(d),$(".langicon").on("click",function(){return c=$(this).attr("title"),J("llnglanguage",c),q(c)}),u=function(e){var a;return 47<(a=e.charCodeAt(0))&&a<58||64<a&&a<91||96<a&&a<123},s=function(e){var a,t,n,o,s,r,i,l,c,d,p;if(d=!0,0<window.datas.ppolicy.minsize&&(e.length>=window.datas.ppolicy.minsize?($("#ppolicy-minsize-feedback").addClass("fa-check text-success"),$("#ppolicy-minsize-feedback").removeClass("fa-times text-danger")):($("#ppolicy-minsize-feedback").removeClass("fa-check text-success"),$("#ppolicy-minsize-feedback").addClass("fa-times text-danger"),d=!1)),0<window.datas.ppolicy.minupper&&((p=e.match(/[A-Z]/g))&&p.length>=window.datas.ppolicy.minupper?($("#ppolicy-minupper-feedback").addClass("fa-check text-success"),$("#ppolicy-minupper-feedback").removeClass("fa-times text-danger")):($("#ppolicy-minupper-feedback").removeClass("fa-check text-success"),$("#ppolicy-minupper-feedback").addClass("fa-times text-danger"),d=!1)),0<window.datas.ppolicy.minlower&&((s=e.match(/[a-z]/g))&&s.length>=window.datas.ppolicy.minlower?($("#ppolicy-minlower-feedback").addClass("fa-check text-success"),$("#ppolicy-minlower-feedback").removeClass("fa-times text-danger")):($("#ppolicy-minlower-feedback").removeClass("fa-check text-success"),$("#ppolicy-minlower-feedback").addClass("fa-times text-danger"),d=!1)),0<window.datas.ppolicy.mindigit&&((a=e.match(/[0-9]/g))&&a.length>=window.datas.ppolicy.mindigit?($("#ppolicy-mindigit-feedback").addClass("fa-check text-success"),$("#ppolicy-mindigit-feedback").removeClass("fa-times text-danger")):($("#ppolicy-mindigit-feedback").removeClass("fa-check text-success"),$("#ppolicy-mindigit-feedback").addClass("fa-times text-danger"),d=!1)),window.datas.ppolicy.allowedspechar){for(r=window.datas.ppolicy.allowedspechar.replace(/\s/g,""),t=!1,n=0,o=e.length;n<o;)u(e.charAt(n))||r.indexOf(e.charAt(n))<0&&(t=!0),n++;!1===t?($("#ppolicy-allowedspechar-feedback").addClass("fa-check text-success"),$("#ppolicy-allowedspechar-feedback").removeClass("fa-times text-danger")):($("#ppolicy-allowedspechar-feedback").removeClass("fa-check text-success"),$("#ppolicy-allowedspechar-feedback").addClass("fa-times text-danger"),d=!1)}if(0<window.datas.ppolicy.minspechar&&window.datas.ppolicy.allowedspechar){for(i=0,r=window.datas.ppolicy.allowedspechar.replace(/\s/g,""),n=0;n<e.length;)0<=r.indexOf(e.charAt(n))&&i++,n++;i>=window.datas.ppolicy.minspechar?($("#ppolicy-minspechar-feedback").addClass("fa-check text-success"),$("#ppolicy-minspechar-feedback").removeClass("fa-times text-danger")):($("#ppolicy-minspechar-feedback").removeClass("fa-check text-success"),$("#ppolicy-minspechar-feedback").addClass("fa-times text-danger"),d=!1)}if(0<window.datas.ppolicy.minspechar&&!window.datas.ppolicy.allowedspechar){for(n=i=0;n<e.length;)u(e.charAt(n))||i++,n++;i>=window.datas.ppolicy.minspechar?($("#ppolicy-minspechar-feedback").addClass("fa-check text-success"),$("#ppolicy-minspechar-feedback").removeClass("fa-times text-danger")):($("#ppolicy-minspechar-feedback").removeClass("fa-check text-success"),$("#ppolicy-minspechar-feedback").addClass("fa-times text-danger"),d=!1)}d?($(".ppolicy").removeClass("border-danger").addClass("border-success"),null!=(l=$("#newpassword").get(0))&&l.setCustomValidity("")):($(".ppolicy").removeClass("border-success").addClass("border-danger"),null!=(c=$("#newpassword").get(0))&&c.setCustomValidity(F("PE28")))},null!=window.datas.ppolicy&&$("#newpassword").length&&(s(""),$("#newpassword").keyup(function(e){s(e.target.value)})),I=function(e){var a;return e.target.checked?($("#newpassword").off("keyup"),null!=(a=$("#newpassword").get(0))?a.setCustomValidity(""):void 0):($("#newpassword").keyup(function(e){s(e.target.value)}),s(""))},r=function(){var e,a,t,n;return(null!=(e=$("#confirmpassword").get(0))?e.value:void 0)===(null!=(a=$("#newpassword").get(0))?a.value:void 0)?(null!=(t=$("#confirmpassword").get(0))&&t.setCustomValidity(""),!0):(null!=(n=$("#confirmpassword").get(0))&&n.setCustomValidity(F("PE34")),!1)},$("#newpassword").change(r),$("#confirmpassword").change(r),null!=window.datas.ppolicy&&$("#newpassword").length&&$("#reset").change(I),G.pingInterval&&0<G.pingInterval&&window.setTimeout(U,G.pingInterval),$(".localeDate").each(function(){var e;return e=new Date(1e3*$(this).attr("val")),$(this).text(e.toLocaleString())}),$(".oidcConsent").on("click",function(){return V($(this).attr("partner"))}),$("#show-hide-button").on("click",function(){return"password"===$("#newpassword").attr("type")?(console.log("Show passwords"),$("#newpassword").attr("type","input"),$("#confirmpassword").attr("type","input"),$("#show-hide-icon-button").removeClass("fa-eye"),$("#show-hide-icon-button").addClass("fa-eye-slash")):(console.log("Hide passwords"),$("#newpassword").attr("type","password"),$("#confirmpassword").attr("type","password"),$("#show-hide-icon-button").removeClass("fa-eye-slash"),$("#show-hide-icon-button").addClass("fa-eye"))}),$("#resetfinduserform").on("click",function(){return console.log("Reset form"),$("#finduserForm").trigger("reset")}),$("#closefinduserform").on("click",function(){return console.log("Clear modal"),$("#finduserForm").trigger("reset")}),$("#finduserbutton").on("click",function(e){var a;return e.preventDefault(),document.body.style.cursor="progress",a=$("#finduserForm").serialize(),console.log("Send findUser request with",a),$.ajax({type:"POST",url:portal+"finduser",dataType:"json",data:a,success:function(e){var a;if(document.body.style.cursor="default",a=e.user,console.log("Suggested spoofId",a),$("#spoofIdfield").attr("value",a),e.captcha&&$("#captcha").attr("src",e.captcha),e.token)return $("#finduserToken").attr("value",e.token),$("#token").attr("value",e.token)},error:function(e,a,t){var n;if(document.body.style.cursor="default",t&&console.log("Error",t),e&&(n=JSON.parse(e.responseText)),n&&n.error)return console.log("Returned error",n)}})})})}).call(this);
\ No newline at end of file
+(function(){var G,a,D,R,N,U,V,_,J,e,M,g,F,q,r,H=[].indexOf||function(e){for(var a=0,t=this.length;a<t;a++)if(a in this&&this[a]===e)return a;return-1};r={},q=function(s){return $.getJSON(window.staticPrefix+"languages/"+s+".json",function(e){var a,t,n,o;for(a in r=e,t=window.datas.trOver.all)o=t[a],r[a]=o;if(window.datas.trOver[s])for(a in n=window.datas.trOver[s])o=n[a],r[a]=o;return $("[trspan]").each(function(){var e,a,t,n;for(e=$(this).attr("trspan").split(","),n=F(e.shift()),a=0,t=e.length;a<t;a++)o=e[a],n=n.replace(/%[sd]/,o);return $(this).html(n)}),$("[trmsg]").each(function(){if($(this).html(F("PE"+$(this).attr("trmsg"))),F("PE"+$(this).attr("trmsg")).match(/_hide_/))return $(this).parent().hide()}),$("[trplaceholder]").each(function(){return $(this).attr("placeholder",F($(this).attr("trplaceholder")))}),$("[localtime]").each(function(){var e;return e=new Date(1e3*$(this).attr("localtime")),$(this).text(e.toLocaleString())})})},F=function(e){return r[e]?r[e]:e},window.translate=F,N=function(){var o;return o={},$("script[type='application/init']").each(function(){var a,e,t,n;try{for(e in n=JSON.parse($(this).text()),t=[],n)t.push(o[e]=n[e]);return t}catch(e){return a=e,console.log("Parsing error",a),console.log("JSON",$(this).text())}}),console.log(o),o},R=function(e){var a;return(a=RegExp("[?&]"+e+"=([^&]*)").exec(window.location.search))?decodeURIComponent(a[1].replace(/\+/g," ")):null},g="#appslist",M=function(){return e("_appsListOrder",$(g).sortable("toArray").join())},V=function(e){return a("_oidcConsents",e,function(){return $("[partner='"+e+"']").hide()},function(e,a,t){return alert(a+" "+t)})},e=function(t,n,o,s){return $.ajax({type:"GET",url:G.scriptname+"/mysession/?gettoken",dataType:"json",error:s,success:function(e){var a;return(a={token:e.token})[t]=n,$.ajax({type:"PUT",url:G.scriptname+"/mysession/persistent",dataType:"json",data:a,success:o,error:s})}})},a=function(a,t,n,o){return $.ajax({type:"GET",url:G.scriptname+"/mysession/?gettoken",dataType:"json",error:o,success:function(e){return $.ajax({type:"DELETE",url:G.scriptname+"/mysession/persistent/"+a+"?sub="+t+"&token="+e.token,dataType:"json",success:n,error:o})}})},_=function(){var e,a,t,n,o,s,r,i,l,c,d,p,u;if(null==(l=$(g))||!G.appslistorder)return null;for(e=G.appslistorder.split(","),d=[],s=0,r=(o=l.sortable("toArray")).length;s<r;s++)d[u=o[s]]=u;for(c=0,i=e.length;c<i;c++)d[n=e[c]]&&(t=d[n],a=$(g+".ui-sortable").children("#"+t),p=$(g+".ui-sortable").children("#"+n),a.remove(),$(g+".ui-sortable").filter(":first").append(p));return 1},U=function(){return $.ajax({type:"POST",url:G.scriptname,data:{ping:1},dataType:"json",success:function(e){return null!=e.result&&1===e.result?setTimeout(U,G.pingInterval):location.reload(!0)},error:function(e,a,t){return location.reload(!0)}})},window.ping=U,D=function(e){var a,t,n,o,s;for(e+"=",t=decodeURIComponent(document.cookie).split(";"),s=new RegExp("^ *"+e+"="),n=0,o=t.length;n<o;n++)if((a=t[n]).match(s))return a=a.replace(s,"");return""},J=function(e,a,t){var n;return(n=new Date).setTime(n.getTime()+864e5*t),document.cookie=e+"="+a+"; expires="+n.toUTCString()+"; path=/"},G={},$(window).on("load",function(){var e,a,t,n,o,s,r,i,u,l,c,d,p,g,f,h,w,m,y,v,b,k,x,C,T,O,L,S,j,E,P,z,A,I;if(G=N(),"datas"in window&&"choicetab"in window.datas&&(G.choicetab=window.datas.choicetab),window.datas=G,$("#appslist").sortable({axis:"y",cursor:"move",opacity:.5,revert:!0,items:"> div.category",update:function(){return M()}}),_(),$("div.message").fadeIn("slow"),$("input[name=timezone]").val(-(new Date).getTimezoneOffset()/60),k=$("#menu").tabs({active:0}),(b=$('#menu a[href="#'+G.displaytab+'"]').parent().index())<0&&(b=0),k.tabs("option","active",b),n=$("#authMenu").tabs({active:0}),(t=$('#authMenu a[href="#'+G.displaytab+'"]').parent().index())<0&&(t=0),n.tabs("option","active",t),G.choicetab&&n.tabs("option","active",$('#authMenu a[href="#'+G.choicetab+'"]').parent().index()),G.login?$("input[type=password]:first").focus():0===$("input[autofocus]").length&&$("input[type!=hidden]:first").focus(),G.newwindow&&$("#appslist a").attr("target","_blank"),$("p.removeOther").length&&(e=$("#form").attr("action"),x=$("#form").attr("method"),console.log("method=",x),i="",$("#form input[type=hidden]")&&(console.log("Parse hidden values"),$("#form input[type=hidden]").each(function(e){return console.log(" ->",$(this).attr("name"),$(this).val()),i+="&"+$(this).attr("name")+"="+$(this).val()})),o="",e&&(console.log("action=",e),-1!==e.indexOf("?")?e.substring(0,e.indexOf("?")):o=e+"?",o+=i,i=""),y=$("p.removeOther a").attr("href")+"&method="+x+i,o&&(y+="&url="+btoa(o)),$("p.removeOther a").attr("href",y)),window.location.search&&((S=R("llnglanguage"))&&console.log("Get lang from parameter"),1===(A=R("setCookieLang"))&&console.log("Set lang cookie")),c||(c=D("llnglanguage"))&&!S&&console.log("Get lang from cookie"),c)H.call(window.availableLanguages,c)<0&&(c=window.availableLanguages[0],S||console.log("Lang not available -> Get default lang"));else if(navigator){for(p=[],g=[],O=[navigator.language],navigator.languages&&(O=navigator.languages),l=0,f=(E=window.availableLanguages).length;l<f;l++)a=E[l],d+='<img class="langicon" src="'+window.staticPrefix+"common/"+a+'.png" title="'+a+'" alt="['+a+']"> ';for(v=0,h=O.length;v<h;v++)for(T=O[v],console.log("Navigator lang",T),C=0,w=(P=window.availableLanguages).length;C<w;C++)a=P[C],console.log(" Available lang",a),j=new RegExp("^"+a+"-?"),T.match(j)?(console.log("  Matching lang =",a),p.push(a)):a.substring(0,1)===T.substring(0,1)&&g.push(a);(c=p[0]?p[0]:g[0]?g[0]:window.availableLanguages[0])&&!S&&console.log("Get lang from navigator")}else(c=window.availableLanguages[0])&&!S&&console.log("Get lang from window");for(S?(H.call(window.availableLanguages,S)<0&&(console.log("Lang not available -> Get default lang"),S=window.availableLanguages[0]),console.log("Selected lang ->",S),A&&(console.log("Set cookie lang ->",S),J("llnglanguage",S)),q(S)):(console.log("Selected lang ->",c),J("llnglanguage",c),q(c)),d="",L=0,m=(z=window.availableLanguages).length;L<m;L++)a=z[L],d+='<img class="langicon" src="'+window.staticPrefix+"common/"+a+'.png" title="'+a+'" alt="['+a+']"> ';return $("#languages").html(d),$(".langicon").on("click",function(){return c=$(this).attr("title"),J("llnglanguage",c),q(c)}),u=function(e){var a;return 47<(a=e.charCodeAt(0))&&a<58||64<a&&a<91||96<a&&a<123},s=function(e){var a,t,n,o,s,r,i,l,c,d,p;if(d=!0,0<window.datas.ppolicy.minsize&&(e.length>=window.datas.ppolicy.minsize?($("#ppolicy-minsize-feedback").addClass("fa-check text-success"),$("#ppolicy-minsize-feedback").removeClass("fa-times text-danger")):($("#ppolicy-minsize-feedback").removeClass("fa-check text-success"),$("#ppolicy-minsize-feedback").addClass("fa-times text-danger"),d=!1)),0<window.datas.ppolicy.minupper&&((p=e.match(/[A-Z]/g))&&p.length>=window.datas.ppolicy.minupper?($("#ppolicy-minupper-feedback").addClass("fa-check text-success"),$("#ppolicy-minupper-feedback").removeClass("fa-times text-danger")):($("#ppolicy-minupper-feedback").removeClass("fa-check text-success"),$("#ppolicy-minupper-feedback").addClass("fa-times text-danger"),d=!1)),0<window.datas.ppolicy.minlower&&((s=e.match(/[a-z]/g))&&s.length>=window.datas.ppolicy.minlower?($("#ppolicy-minlower-feedback").addClass("fa-check text-success"),$("#ppolicy-minlower-feedback").removeClass("fa-times text-danger")):($("#ppolicy-minlower-feedback").removeClass("fa-check text-success"),$("#ppolicy-minlower-feedback").addClass("fa-times text-danger"),d=!1)),0<window.datas.ppolicy.mindigit&&((a=e.match(/[0-9]/g))&&a.length>=window.datas.ppolicy.mindigit?($("#ppolicy-mindigit-feedback").addClass("fa-check text-success"),$("#ppolicy-mindigit-feedback").removeClass("fa-times text-danger")):($("#ppolicy-mindigit-feedback").removeClass("fa-check text-success"),$("#ppolicy-mindigit-feedback").addClass("fa-times text-danger"),d=!1)),window.datas.ppolicy.allowedspechar){for(r=window.datas.ppolicy.allowedspechar.replace(/\s/g,""),t=!1,n=0,o=e.length;n<o;)u(e.charAt(n))||r.indexOf(e.charAt(n))<0&&(t=!0),n++;!1===t?($("#ppolicy-allowedspechar-feedback").addClass("fa-check text-success"),$("#ppolicy-allowedspechar-feedback").removeClass("fa-times text-danger")):($("#ppolicy-allowedspechar-feedback").removeClass("fa-check text-success"),$("#ppolicy-allowedspechar-feedback").addClass("fa-times text-danger"),d=!1)}if(0<window.datas.ppolicy.minspechar&&window.datas.ppolicy.allowedspechar){for(i=0,r=window.datas.ppolicy.allowedspechar.replace(/\s/g,""),n=0;n<e.length;)0<=r.indexOf(e.charAt(n))&&i++,n++;i>=window.datas.ppolicy.minspechar?($("#ppolicy-minspechar-feedback").addClass("fa-check text-success"),$("#ppolicy-minspechar-feedback").removeClass("fa-times text-danger")):($("#ppolicy-minspechar-feedback").removeClass("fa-check text-success"),$("#ppolicy-minspechar-feedback").addClass("fa-times text-danger"),d=!1)}if(0<window.datas.ppolicy.minspechar&&!window.datas.ppolicy.allowedspechar){for(n=i=0;n<e.length;)u(e.charAt(n))||i++,n++;i>=window.datas.ppolicy.minspechar?($("#ppolicy-minspechar-feedback").addClass("fa-check text-success"),$("#ppolicy-minspechar-feedback").removeClass("fa-times text-danger")):($("#ppolicy-minspechar-feedback").removeClass("fa-check text-success"),$("#ppolicy-minspechar-feedback").addClass("fa-times text-danger"),d=!1)}d?($(".ppolicy").removeClass("border-danger").addClass("border-success"),null!=(l=$("#newpassword").get(0))&&l.setCustomValidity("")):($(".ppolicy").removeClass("border-success").addClass("border-danger"),null!=(c=$("#newpassword").get(0))&&c.setCustomValidity(F("PE28")))},null!=window.datas.ppolicy&&$("#newpassword").length&&(s(""),$("#newpassword").keyup(function(e){s(e.target.value)})),I=function(e){var a;return e.target.checked?($("#newpassword").off("keyup"),null!=(a=$("#newpassword").get(0))?a.setCustomValidity(""):void 0):($("#newpassword").keyup(function(e){s(e.target.value)}),s(""))},r=function(){var e,a,t,n;return(null!=(e=$("#confirmpassword").get(0))?e.value:void 0)===(null!=(a=$("#newpassword").get(0))?a.value:void 0)?(null!=(t=$("#confirmpassword").get(0))&&t.setCustomValidity(""),!0):(null!=(n=$("#confirmpassword").get(0))&&n.setCustomValidity(F("PE34")),!1)},$("#newpassword").change(r),$("#confirmpassword").change(r),null!=window.datas.ppolicy&&$("#newpassword").length&&$("#reset").change(I),G.pingInterval&&0<G.pingInterval&&window.setTimeout(U,G.pingInterval),$(".localeDate").each(function(){var e;return e=new Date(1e3*$(this).attr("val")),$(this).text(e.toLocaleString())}),$(".oidcConsent").on("click",function(){return V($(this).attr("partner"))}),$("#show-hide-button").on("click",function(){return"password"===$("#newpassword").attr("type")?(console.log("Show passwords"),$("#newpassword").attr("type","input"),$("#confirmpassword").attr("type","input"),$("#show-hide-icon-button").removeClass("fa-eye"),$("#show-hide-icon-button").addClass("fa-eye-slash")):(console.log("Hide passwords"),$("#newpassword").attr("type","password"),$("#confirmpassword").attr("type","password"),$("#show-hide-icon-button").removeClass("fa-eye-slash"),$("#show-hide-icon-button").addClass("fa-eye"))}),$("#resetfinduserform").on("click",function(){return console.log("Reset form"),$("#finduserForm").trigger("reset")}),$("#closefinduserform").on("click",function(){return console.log("Clear modal"),$("#finduserForm").trigger("reset")}),$("#finduserbutton").on("click",function(e){var a;return e.preventDefault(),document.body.style.cursor="progress",a=$("#finduserForm").serialize(),console.log("Send findUser request with parameters",a),$.ajax({type:"POST",url:portal+"finduser",dataType:"json",data:a,success:function(e){var a;if(document.body.style.cursor="default",a=e.user,console.log("Suggested spoofId=",a),$("#spoofIdfield").attr("value",a),e.captcha&&$("#captcha").attr("src",e.captcha),e.token)return $("#finduserToken").attr("value",e.token),$("#token").attr("value",e.token)},error:function(e,a,t){var n;if(document.body.style.cursor="default",t&&console.log("Error",t),e&&(n=JSON.parse(e.responseText)),n&&n.error)return console.log("Returned error",n)}})})})}).call(this);
\ No newline at end of file
diff --git a/lemonldap-ng-portal/site/htdocs/static/common/js/portal.min.js.map b/lemonldap-ng-portal/site/htdocs/static/common/js/portal.min.js.map
index 532175714..0d48d6f33 100644
--- a/lemonldap-ng-portal/site/htdocs/static/common/js/portal.min.js.map
+++ b/lemonldap-ng-portal/site/htdocs/static/common/js/portal.min.js.map
@@ -1 +1 @@
-{"version":3,"sources":["portal.js"],"names":["datas","delKey","getCookie","getQueryParam","getValues","ping","removeOidcConsent","restoreOrder","setCookie","setKey","setOrder","setSelector","translate","translatePage","translationFields","indexOf","item","i","l","this","length","lang","$","getJSON","window","staticPrefix","data","k","ref","ref1","v","trOver","all","each","args","len1","txt","attr","split","shift","replace","html","match","parent","hide","d","Date","text","toLocaleString","str","values","e","results","tmp","JSON","parse","push","error1","console","log","name","RegExp","exec","location","search","decodeURIComponent","sortable","join","partner","j","s","alert","key","val","success","error","ajax","type","url","dataType","token","sub","IDs","child","itemID","items","len2","list","m","rebuild","savedOrd","children","remove","filter","append","result","setTimeout","reload","t","cname","c","ca","re","document","cookie","value","exdays","setTime","getTime","toUTCString","on","action","al","authMenuIndex","authMenuTabs","back_url","checkpassword","checksamepass","hiddenParams","isAlphaNumeric","langdiv","langs","langs2","len3","len4","link","menuIndex","menuTabs","method","n","nl","nlangs","o","queryLang","ref2","setCookieLang","togglecheckpassword","choicetab","axis","cursor","opacity","revert","update","fadeIn","getTimezoneOffset","tabs","active","index","focus","substring","btoa","call","availableLanguages","navigator","language","languages","chr","code","charCodeAt","password","digit","hasforbidden","len","lower","nonwhitespechar","numspechar","ref3","ref4","upper","ppolicy","minsize","addClass","removeClass","minupper","minlower","mindigit","allowedspechar","charAt","minspechar","get","setCustomValidity","keyup","target","checked","off","ref5","ref6","change","trigger","event","preventDefault","body","style","serialize","portal","user","captcha","status","err","res","responseText"],"mappings":"CAMA,WACE,IAAIA,EAAOC,EAAQC,EAAWC,EAAeC,EAAiCC,EAAMC,EAAmBC,EAAcC,EAAWC,EAAQC,EAAUC,EAAaC,EAAWC,EAAeC,EACvLC,EAAU,GAAGA,SAAW,SAASC,GAAQ,IAAK,IAAIC,EAAI,EAAGC,EAAIC,KAAKC,OAAQH,EAAIC,EAAGD,IAAO,GAAIA,KAAKE,MAAQA,KAAKF,KAAOD,EAAM,OAAOC,EAAK,OAAQ,GAEjJH,EAAoB,GAEpBD,EAAgB,SAASQ,GACvB,OAAOC,EAAEC,QAAQC,OAAOC,aAAe,aAAeJ,EAAO,QAAS,SAASK,GAC7E,IAAIC,EAAGC,EAAKC,EAAMC,EAGlB,IAAKH,KAFLb,EAAoBY,EACpBE,EAAMJ,OAAOxB,MAAM+B,OAAOC,IAExBF,EAAIF,EAAID,GACRb,EAAkBa,GAAKG,EAEzB,GAAIN,OAAOxB,MAAM+B,OAAOV,GAEtB,IAAKM,KADLE,EAAOL,OAAOxB,MAAM+B,OAAOV,GAEzBS,EAAID,EAAKF,GACTb,EAAkBa,GAAKG,EAwB3B,OArBAR,EAAE,YAAYW,KAAK,WACjB,IAAIC,EAAMhB,EAAGiB,EAAMC,EAGnB,IAFAF,EAAOZ,EAAEH,MAAMkB,KAAK,UAAUC,MAAM,KACpCF,EAAMxB,EAAUsB,EAAKK,SAChBrB,EAAI,EAAGiB,EAAOD,EAAKd,OAAQF,EAAIiB,EAAMjB,IACxCY,EAAII,EAAKhB,GACTkB,EAAMA,EAAII,QAAQ,QAASV,GAE7B,OAAOR,EAAEH,MAAMsB,KAAKL,KAEtBd,EAAE,WAAWW,KAAK,WAIhB,GAFAX,EAAEH,MAAMsB,KAAK7B,EAAU,KAAQU,EAAEH,MAAMkB,KAAK,WACtCzB,EAAU,KAAQU,EAAEH,MAAMkB,KAAK,UAC7BK,MAAM,UACZ,OAAOpB,EAAEH,MAAMwB,SAASC,SAG5BtB,EAAE,mBAAmBW,KAAK,WACxB,OAAOX,EAAEH,MAAMkB,KAAK,cAAezB,EAAUU,EAAEH,MAAMkB,KAAK,qBAErDf,EAAE,eAAeW,KAAK,WAC3B,IAAIY,EAEJ,OADAA,EAAI,IAAIC,KAAiC,IAA5BxB,EAAEH,MAAMkB,KAAK,cACnBf,EAAEH,MAAM4B,KAAKF,EAAEG,uBAK5BpC,EAAY,SAASqC,GACnB,OAAInC,EAAkBmC,GACbnC,EAAkBmC,GAElBA,GAIXzB,OAAOZ,UAAYA,EAEnBR,EAAY,WACV,IAAI8C,EAkBJ,OAjBAA,EAAS,GACT5B,EAAE,mCAAmCW,KAAK,WACxC,IAAIkB,EAAGxB,EAAGyB,EAASC,EACnB,IAGE,IAAK1B,KAFL0B,EAAMC,KAAKC,MAAMjC,EAAEH,MAAM4B,QACzBK,EAAU,GACAC,EACRD,EAAQI,KAAKN,EAAOvB,GAAK0B,EAAI1B,IAE/B,OAAOyB,EACP,MAAOK,GAGP,OAFAN,EAAIM,EACJC,QAAQC,IAAI,gBAAiBR,GACtBO,QAAQC,IAAI,OAAQrC,EAAEH,MAAM4B,WAGvCW,QAAQC,IAAIT,GACLA,GAGT/C,EAAgB,SAASyD,GACvB,IAAIlB,EAEJ,OADAA,EAAQmB,OAAO,OAASD,EAAO,YAAYE,KAAKtC,OAAOuC,SAASC,SAEvDC,mBAAmBvB,EAAM,GAAGF,QAAQ,MAAO,MAE3C,MAIX7B,EAAc,YAEdD,EAAW,WACT,OAAOD,EAAO,iBAAkBa,EAAEX,GAAauD,SAAS,WAAWC,SAGrE7D,EAAoB,SAAS8D,GAK3B,OAAOnE,EAAO,gBAAiBmE,EAAS,WACtC,OAAO9C,EAAE,aAAe8C,EAAU,MAAMxB,QAJtC,SAASyB,EAAGC,EAAGnB,GACjB,OAAOoB,MAAMD,EAAI,IAAMnB,MAO3B1C,EAAS,SAAS+D,EAAKC,EAAKC,EAASC,GACnC,OAAOrD,EAAEsD,KAAK,CACZC,KAAM,MACNC,IAAK9E,EAAkB,WAAI,uBAC3B+E,SAAU,OACVJ,MAAOA,EACPD,QAAS,SAAShD,GAChB,IAAImB,EAKJ,OAJAA,EAAI,CACFmC,MAAOtD,EAAKsD,QAEZR,GAAOC,EACFnD,EAAEsD,KAAK,CACZC,KAAM,MACNC,IAAK9E,EAAkB,WAAI,wBAC3B+E,SAAU,OACVrD,KAAMmB,EACN6B,QAASA,EACTC,MAAOA,QAMf1E,EAAS,SAASuE,EAAKS,EAAKP,EAASC,GACnC,OAAOrD,EAAEsD,KAAK,CACZC,KAAM,MACNC,IAAK9E,EAAkB,WAAI,uBAC3B+E,SAAU,OACVJ,MAAOA,EACPD,QAAS,SAAShD,GAChB,OAAOJ,EAAEsD,KAAK,CACZC,KAAM,SACNC,IAAK9E,EAAkB,WAAI,yBAA2BwE,EAAM,QAAUS,EAAM,UAAYvD,EAAKsD,MAC7FD,SAAU,OACVL,QAASA,EACTC,MAAOA,QAMfpE,EAAe,WACb,IAAI2E,EAAKC,EAAOnE,EAAMoE,EAAQC,EAAOnE,EAAGiB,EAAMmD,EAAMC,EAAMC,EAAGC,EAASC,EAAU5D,EAEhF,GAAe,OADfyD,EAAOjE,EAAEX,MACeX,EAAqB,cAC3C,OAAO,KAKT,IAHAkF,EAAMlF,EAAqB,cAAEsC,MAAM,KAEnCmD,EAAU,GACLvE,EAAI,EAAGiB,GAFZkD,EAAQE,EAAKrB,SAAS,YAEG9C,OAAQF,EAAIiB,EAAMjB,IAEzCuE,EADA3D,EAAIuD,EAAMnE,IACGY,EAEf,IAAK0D,EAAI,EAAGF,EAAOJ,EAAI9D,OAAQoE,EAAIF,EAAME,IAEnCC,EADJL,EAASF,EAAIM,MAEXxE,EAAOyE,EAAQL,GACfD,EAAQ7D,EAAEX,EAAc,gBAAgBgF,SAAS,IAAM3E,GACvD0E,EAAWpE,EAAEX,EAAc,gBAAgBgF,SAAS,IAAMP,GAC1DD,EAAMS,SACNtE,EAAEX,EAAc,gBAAgBkF,OAAO,UAAUC,OAAOJ,IAG5D,OAAO,GAOTrF,EAAO,WACL,OAAOiB,EAAEsD,KAAK,CACZC,KAAM,OACNC,IAAK9E,EAAkB,WACvB0B,KAAM,CACJrB,KAAM,GAER0E,SAAU,OACVL,QAAS,SAAShD,GAChB,OAAoB,MAAfA,EAAKqE,QAAmC,IAAhBrE,EAAKqE,OACzBC,WAAW3F,EAAML,EAAoB,cAErC+D,SAASkC,QAAO,IAG3BtB,MAAO,SAASN,EAAG6B,EAAG/C,GACpB,OAAOY,SAASkC,QAAO,OAK7BzE,OAAOnB,KAAOA,EAEdH,EAAY,SAASiG,GACnB,IAAIC,EAAGC,EAAInF,EAAGiB,EAAYmE,EAI1B,IAHOH,EAAQ,IACfE,EAAKpC,mBAAmBsC,SAASC,QAAQlE,MAAM,KAC/CgE,EAAK,IAAIzC,OAAO,MAAQsC,EAAQ,KAC3BjF,EAAI,EAAGiB,EAAOkE,EAAGjF,OAAQF,EAAIiB,EAAMjB,IAEtC,IADAkF,EAAIC,EAAGnF,IACDwB,MAAM4D,GAEV,OADAF,EAAIA,EAAE5D,QAAQ8D,EAAI,IAItB,MAAO,IAGT9F,EAAY,SAASoD,EAAM6C,EAAOC,GAChC,IAAI7D,EAGJ,OAFAA,EAAI,IAAIC,MACN6D,QAAQ9D,EAAE+D,UAAqB,MAATF,GACjBH,SAASC,OAAS5C,EAAO,IAAM6C,EAAQ,aAAgB5D,EAAEgE,cAAiB,YAGnF7G,EAAQ,GAERsB,EAAEE,QAAQsF,GAAG,OAAQ,WACnB,IAAIC,EAAQC,EAAIC,EAAeC,EAAcC,EAAUC,EAAeC,EAAeC,EAAcC,EAAgBrG,EAAGG,EAAMmG,EAASC,EAAOC,EAAQvF,EAAMmD,EAAMqC,EAAMC,EAAMC,EAAMrC,EAAGsC,EAAWC,EAAUC,EAAQC,EAAGC,EAAIC,EAAQC,EAAGC,EAAW/B,EAAI1E,EAAKC,EAAMyG,EAAMC,EAAeC,EA6FnR,GA5FAxI,EAAQI,IACJ,UAAWoB,QAAU,cAAeA,OAAOxB,QAC7CA,EAAMyI,UAAYjH,OAAOxB,MAAMyI,WAEjCjH,OAAOxB,MAAQA,EACfsB,EAAE,aAAa4C,SAAS,CACtBwE,KAAM,IACNC,OAAQ,OACRC,QAAS,GACTC,QAAQ,EACRxD,MAAO,iBACPyD,OAAQ,WACN,OAAOpI,OAGXH,IACAe,EAAE,eAAeyH,OAAO,QACxBzH,EAAE,wBAAwBmD,MAAM,IAAI3B,MAAOkG,oBAAsB,IACjEjB,EAAWzG,EAAE,SAAS2H,KAAK,CACzBC,OAAQ,KAEVpB,EAAYxG,EAAE,kBAAoBtB,EAAkB,WAAI,MAAM2C,SAASwG,SACvD,IACdrB,EAAY,GAEdC,EAASkB,KAAK,SAAU,SAAUnB,GAClCZ,EAAe5F,EAAE,aAAa2H,KAAK,CACjCC,OAAQ,KAEVjC,EAAgB3F,EAAE,sBAAwBtB,EAAkB,WAAI,MAAM2C,SAASwG,SAC3D,IAClBlC,EAAgB,GAElBC,EAAa+B,KAAK,SAAU,SAAUhC,GAClCjH,EAAiB,WACnBkH,EAAa+B,KAAK,SAAU,SAAU3H,EAAE,sBAAwBtB,EAAiB,UAAI,MAAM2C,SAASwG,SAElGnJ,EAAa,MACfsB,EAAE,8BAA8B8H,QAEK,IAAjC9H,EAAE,oBAAoBF,QACxBE,EAAE,6BAA6B8H,QAG/BpJ,EAAiB,WACnBsB,EAAE,eAAee,KAAK,SAAU,UAE9Bf,EAAE,iBAAiBF,SACrB2F,EAASzF,EAAE,SAASe,KAAK,UACzB2F,EAAS1G,EAAE,SAASe,KAAK,UACzBqB,QAAQC,IAAI,UAAWqE,GACvBV,EAAe,GACXhG,EAAE,8BACJoC,QAAQC,IAAI,uBACZrC,EAAE,4BAA4BW,KAAK,SAASkH,GAE1C,OADAzF,QAAQC,IAAI,MAAOrC,EAAEH,MAAMkB,KAAK,QAASf,EAAEH,MAAMsD,OAC1C6C,GAAgB,IAAMhG,EAAEH,MAAMkB,KAAK,QAAU,IAAMf,EAAEH,MAAMsD,SAGtE0C,EAAW,GACPJ,IACFrD,QAAQC,IAAI,UAAWoD,IACM,IAAzBA,EAAOhG,QAAQ,KACjBgG,EAAOsC,UAAU,EAAGtC,EAAOhG,QAAQ,MAEnCoG,EAAWJ,EAAS,IAEtBI,GAAYG,EACZA,EAAe,IAEjBO,EAAOvG,EAAE,mBAAmBe,KAAK,QAAU,WAAa2F,EAASV,EAC7DH,IACFU,GAAQ,QAAUyB,KAAKnC,IAEzB7F,EAAE,mBAAmBe,KAAK,OAAQwF,IAEhCrG,OAAOuC,SAASC,UAClBqE,EAAYlI,EAAc,kBAExBuD,QAAQC,IAAI,2BAGQ,KADtB4E,EAAgBpI,EAAc,mBAE5BuD,QAAQC,IAAI,oBAGXtC,IACHA,EAAOnB,EAAU,mBACJmI,GACX3E,QAAQC,IAAI,wBAGXtC,EAuCMN,EAAQwI,KAAK/H,OAAOgI,mBAAoBnI,GAAQ,IACzDA,EAAOG,OAAOgI,mBAAmB,GAC5BnB,GACH3E,QAAQC,IAAI,gDAzCd,GAAI8F,UAAW,CAQb,IAPAhC,EAAQ,GACRC,EAAS,GACTS,EAAS,CAACsB,UAAUC,UAChBD,UAAUE,YACZxB,EAASsB,UAAUE,WAGhBzI,EAAI,EAAGiB,GADZP,EAAMJ,OAAOgI,oBACUpI,OAAQF,EAAIiB,EAAMjB,IACvC8F,EAAKpF,EAAIV,GACTsG,GAAW,8BAAmChG,OAAOC,aAAe,UAAYuF,EAAK,gBAAoBA,EAAK,WAAeA,EAAK,OAEpI,IAAKxB,EAAI,EAAGF,EAAO6C,EAAO/G,OAAQoE,EAAIF,EAAME,IAI1C,IAHA0C,EAAKC,EAAO3C,GACZ9B,QAAQC,IAAI,iBAAkBuE,GAEzBD,EAAI,EAAGN,GADZ9F,EAAOL,OAAOgI,oBACUpI,OAAQ6G,EAAIN,EAAMM,IACxCjB,EAAKnF,EAAKoG,GACVvE,QAAQC,IAAI,kBAAmBqD,GAC/BV,EAAK,IAAIzC,OAAO,IAAMmD,EAAK,MACvBkB,EAAGxF,MAAM4D,IACX5C,QAAQC,IAAI,oBAAqBqD,GACjCS,EAAMjE,KAAKwD,IACFA,EAAGqC,UAAU,EAAG,KAAOnB,EAAGmB,UAAU,EAAG,IAChD3B,EAAOlE,KAAKwD,IAIlB3F,EAAOoG,EAAM,GAAKA,EAAM,GAAKC,EAAO,GAAKA,EAAO,GAAKlG,OAAOgI,mBAAmB,MAClEnB,GACX3E,QAAQC,IAAI,gCAGdtC,EAAOG,OAAOgI,mBAAmB,MACpBnB,GACX3E,QAAQC,IAAI,wBA2BlB,IAlBI0E,GACEtH,EAAQwI,KAAK/H,OAAOgI,mBAAoBnB,GAAa,IACvD3E,QAAQC,IAAI,0CACZ0E,EAAY7G,OAAOgI,mBAAmB,IAExC9F,QAAQC,IAAI,mBAAoB0E,GAC5BE,IACF7E,QAAQC,IAAI,qBAAsB0E,GAClC7H,EAAU,eAAgB6H,IAE5BxH,EAAcwH,KAEd3E,QAAQC,IAAI,mBAAoBtC,GAChCb,EAAU,eAAgBa,GAC1BR,EAAcQ,IAEhBmG,EAAU,GAELY,EAAI,EAAGR,GADZU,EAAO9G,OAAOgI,oBACUpI,OAAQgH,EAAIR,EAAMQ,IACxCpB,EAAKsB,EAAKF,GACVZ,GAAW,8BAAmChG,OAAOC,aAAe,UAAYuF,EAAK,gBAAoBA,EAAK,WAAeA,EAAK,OA4MpI,OA1MA1F,EAAE,cAAcmB,KAAK+E,GACrBlG,EAAE,aAAawF,GAAG,QAAS,WAGzB,OAFAzF,EAAOC,EAAEH,MAAMkB,KAAK,SACpB7B,EAAU,eAAgBa,GACnBR,EAAcQ,KAEvBkG,EAAiB,SAASqC,GACxB,IAAIC,EAEJ,OAAW,IADXA,EAAOD,EAAIE,WAAW,KACLD,EAAO,IAAa,GAAPA,GAAaA,EAAO,IAAa,GAAPA,GAAaA,EAAO,KAK9EzC,EAAgB,SAAS2C,GACvB,IAAIC,EAAOC,EAAchJ,EAAGiJ,EAAKC,EAAOC,EAAiBC,EAAYC,EAAMC,EAAMxE,EAAQyE,EA6CzF,GA5CAzE,GAAS,EAC0B,EAA/BvE,OAAOxB,MAAMyK,QAAQC,UACnBX,EAAS3I,QAAUI,OAAOxB,MAAMyK,QAAQC,SAC1CpJ,EAAE,6BAA6BqJ,SAAS,yBACxCrJ,EAAE,6BAA6BsJ,YAAY,0BAE3CtJ,EAAE,6BAA6BsJ,YAAY,yBAC3CtJ,EAAE,6BAA6BqJ,SAAS,wBACxC5E,GAAS,IAGuB,EAAhCvE,OAAOxB,MAAMyK,QAAQI,YACvBL,EAAQT,EAASrH,MAAM,YACV8H,EAAMpJ,QAAUI,OAAOxB,MAAMyK,QAAQI,UAChDvJ,EAAE,8BAA8BqJ,SAAS,yBACzCrJ,EAAE,8BAA8BsJ,YAAY,0BAE5CtJ,EAAE,8BAA8BsJ,YAAY,yBAC5CtJ,EAAE,8BAA8BqJ,SAAS,wBACzC5E,GAAS,IAGuB,EAAhCvE,OAAOxB,MAAMyK,QAAQK,YACvBX,EAAQJ,EAASrH,MAAM,YACVyH,EAAM/I,QAAUI,OAAOxB,MAAMyK,QAAQK,UAChDxJ,EAAE,8BAA8BqJ,SAAS,yBACzCrJ,EAAE,8BAA8BsJ,YAAY,0BAE5CtJ,EAAE,8BAA8BsJ,YAAY,yBAC5CtJ,EAAE,8BAA8BqJ,SAAS,wBACzC5E,GAAS,IAGuB,EAAhCvE,OAAOxB,MAAMyK,QAAQM,YACvBf,EAAQD,EAASrH,MAAM,YACVsH,EAAM5I,QAAUI,OAAOxB,MAAMyK,QAAQM,UAChDzJ,EAAE,8BAA8BqJ,SAAS,yBACzCrJ,EAAE,8BAA8BsJ,YAAY,0BAE5CtJ,EAAE,8BAA8BsJ,YAAY,yBAC5CtJ,EAAE,8BAA8BqJ,SAAS,wBACzC5E,GAAS,IAGTvE,OAAOxB,MAAMyK,QAAQO,eAAgB,CAKvC,IAJAZ,EAAkB5I,OAAOxB,MAAMyK,QAAQO,eAAexI,QAAQ,MAAO,IACrEyH,GAAe,EACfhJ,EAAI,EACJiJ,EAAMH,EAAS3I,OACRH,EAAIiJ,GACJ3C,EAAewC,EAASkB,OAAOhK,KAC9BmJ,EAAgBrJ,QAAQgJ,EAASkB,OAAOhK,IAAM,IAChDgJ,GAAe,GAGnBhJ,KAEmB,IAAjBgJ,GACF3I,EAAE,oCAAoCqJ,SAAS,yBAC/CrJ,EAAE,oCAAoCsJ,YAAY,0BAElDtJ,EAAE,oCAAoCsJ,YAAY,yBAClDtJ,EAAE,oCAAoCqJ,SAAS,wBAC/C5E,GAAS,GAGb,GAAsC,EAAlCvE,OAAOxB,MAAMyK,QAAQS,YAAkB1J,OAAOxB,MAAMyK,QAAQO,eAAgB,CAI9E,IAHAX,EAAa,EACbD,EAAkB5I,OAAOxB,MAAMyK,QAAQO,eAAexI,QAAQ,MAAO,IACrEvB,EAAI,EACGA,EAAI8I,EAAS3I,QACiC,GAA/CgJ,EAAgBrJ,QAAQgJ,EAASkB,OAAOhK,KAC1CoJ,IAEFpJ,IAEEoJ,GAAc7I,OAAOxB,MAAMyK,QAAQS,YACrC5J,EAAE,gCAAgCqJ,SAAS,yBAC3CrJ,EAAE,gCAAgCsJ,YAAY,0BAE9CtJ,EAAE,gCAAgCsJ,YAAY,yBAC9CtJ,EAAE,gCAAgCqJ,SAAS,wBAC3C5E,GAAS,GAGb,GAAsC,EAAlCvE,OAAOxB,MAAMyK,QAAQS,aAAmB1J,OAAOxB,MAAMyK,QAAQO,eAAgB,CAG/E,IADA/J,EADAoJ,EAAa,EAENpJ,EAAI8I,EAAS3I,QACbmG,EAAewC,EAASkB,OAAOhK,KAClCoJ,IAEFpJ,IAEEoJ,GAAc7I,OAAOxB,MAAMyK,QAAQS,YACrC5J,EAAE,gCAAgCqJ,SAAS,yBAC3CrJ,EAAE,gCAAgCsJ,YAAY,0BAE9CtJ,EAAE,gCAAgCsJ,YAAY,yBAC9CtJ,EAAE,gCAAgCqJ,SAAS,wBAC3C5E,GAAS,GAGTA,GACFzE,EAAE,YAAYsJ,YAAY,iBAAiBD,SAAS,kBACX,OAApCL,EAAOhJ,EAAE,gBAAgB6J,IAAI,KAChCb,EAAKc,kBAAkB,MAGzB9J,EAAE,YAAYsJ,YAAY,kBAAkBD,SAAS,iBACZ,OAApCJ,EAAOjJ,EAAE,gBAAgB6J,IAAI,KAChCZ,EAAKa,kBAAkBxK,EAAU,WAIV,MAAxBY,OAAOxB,MAAMyK,SAAoBnJ,EAAE,gBAAgBF,SACtDgG,EAAc,IACd9F,EAAE,gBAAgB+J,MAAM,SAASlI,GAC/BiE,EAAcjE,EAAEmI,OAAO7E,UAG3B+B,EAAsB,SAASrF,GAC7B,IAAImH,EACJ,OAAInH,EAAEmI,OAAOC,SACXjK,EAAE,gBAAgBkK,IAAI,SACsB,OAApClB,EAAOhJ,EAAE,gBAAgB6J,IAAI,IAAcb,EAAKc,kBAAkB,SAAM,IAEhF9J,EAAE,gBAAgB+J,MAAM,SAASlI,GAC/BiE,EAAcjE,EAAEmI,OAAO7E,SAElBW,EAAc,MAGzBC,EAAgB,WACd,IAAIiD,EAAMC,EAAMkB,EAAMC,EACtB,OAA8C,OAAxCpB,EAAOhJ,EAAE,oBAAoB6J,IAAI,IAAcb,EAAK7D,WAAQ,MAAkD,OAApC8D,EAAOjJ,EAAE,gBAAgB6J,IAAI,IAAcZ,EAAK9D,WAAQ,IACzF,OAAxCgF,EAAOnK,EAAE,oBAAoB6J,IAAI,KACpCM,EAAKL,kBAAkB,KAElB,IAEsC,OAAxCM,EAAOpK,EAAE,oBAAoB6J,IAAI,KACpCO,EAAKN,kBAAkBxK,EAAU,UAE5B,IAGXU,EAAE,gBAAgBqK,OAAOtE,GACzB/F,EAAE,oBAAoBqK,OAAOtE,GACA,MAAxB7F,OAAOxB,MAAMyK,SAAoBnJ,EAAE,gBAAgBF,QACtDE,EAAE,UAAUqK,OAAOnD,GAEjBxI,EAAoB,cAA6B,EAAxBA,EAAoB,cAC/CwB,OAAOwE,WAAW3F,EAAML,EAAoB,cAE9CsB,EAAE,eAAeW,KAAK,WACpB,IAAIqC,EAEJ,OADAA,EAAI,IAAIxB,KAA2B,IAAtBxB,EAAEH,MAAMkB,KAAK,QACnBf,EAAEH,MAAM4B,KAAKuB,EAAEtB,oBAExB1B,EAAE,gBAAgBwF,GAAG,QAAS,WAC5B,OAAOxG,EAAkBgB,EAAEH,MAAMkB,KAAK,cAExCf,EAAE,qBAAqBwF,GAAG,QAAS,WACjC,MAAuC,aAAnCxF,EAAE,gBAAgBe,KAAK,SACzBqB,QAAQC,IAAI,kBACZrC,EAAE,gBAAgBe,KAAK,OAAQ,SAC/Bf,EAAE,oBAAoBe,KAAK,OAAQ,SACnCf,EAAE,0BAA0BsJ,YAAY,UACjCtJ,EAAE,0BAA0BqJ,SAAS,kBAE5CjH,QAAQC,IAAI,kBACZrC,EAAE,gBAAgBe,KAAK,OAAQ,YAC/Bf,EAAE,oBAAoBe,KAAK,OAAQ,YACnCf,EAAE,0BAA0BsJ,YAAY,gBACjCtJ,EAAE,0BAA0BqJ,SAAS,aAGhDrJ,EAAE,sBAAsBwF,GAAG,QAAS,WAElC,OADApD,QAAQC,IAAI,cACLrC,EAAE,iBAAiBsK,QAAQ,WAEpCtK,EAAE,sBAAsBwF,GAAG,QAAS,WAElC,OADApD,QAAQC,IAAI,eACLrC,EAAE,iBAAiBsK,QAAQ,WAE7BtK,EAAE,mBAAmBwF,GAAG,QAAS,SAAS+E,GAC/C,IAAI5I,EAKJ,OAJA4I,EAAMC,iBACNvF,SAASwF,KAAKC,MAAMrD,OAAS,WAC7B1F,EAAM3B,EAAE,iBAAiB2K,YACzBvI,QAAQC,IAAI,6BAA8BV,GACnC3B,EAAEsD,KAAK,CACZC,KAAM,OACNC,IAAKoH,OAAS,WACdnH,SAAU,OACVrD,KAAMuB,EACNyB,QAAS,SAAShD,GAChB,IAAIyK,EAQJ,GAPA5F,SAASwF,KAAKC,MAAMrD,OAAS,UAC7BwD,EAAOzK,EAAKyK,KACZzI,QAAQC,IAAI,oBAAqBwI,GACjC7K,EAAE,iBAAiBe,KAAK,QAAS8J,GAC7BzK,EAAK0K,SACP9K,EAAE,YAAYe,KAAK,MAAOX,EAAK0K,SAE7B1K,EAAKsD,MAEP,OADA1D,EAAE,kBAAkBe,KAAK,QAASX,EAAKsD,OAChC1D,EAAE,UAAUe,KAAK,QAASX,EAAKsD,QAG1CL,MAAO,SAASN,EAAGgI,EAAQC,GACzB,IAAIC,EAQJ,GAPAhG,SAASwF,KAAKC,MAAMrD,OAAS,UACzB2D,GACF5I,QAAQC,IAAI,QAAS2I,GAEnBjI,IACFkI,EAAMjJ,KAAKC,MAAMc,EAAEmI,eAEjBD,GAAOA,EAAI5H,MACb,OAAOjB,QAAQC,IAAI,iBAAkB4I,YAO9ChD,KAAKpI"}
\ No newline at end of file
+{"version":3,"sources":["portal.js"],"names":["datas","delKey","getCookie","getQueryParam","getValues","ping","removeOidcConsent","restoreOrder","setCookie","setKey","setOrder","setSelector","translate","translatePage","translationFields","indexOf","item","i","l","this","length","lang","$","getJSON","window","staticPrefix","data","k","ref","ref1","v","trOver","all","each","args","len1","txt","attr","split","shift","replace","html","match","parent","hide","d","Date","text","toLocaleString","str","values","e","results","tmp","JSON","parse","push","error1","console","log","name","RegExp","exec","location","search","decodeURIComponent","sortable","join","partner","j","s","alert","key","val","success","error","ajax","type","url","dataType","token","sub","IDs","child","itemID","items","len2","list","m","rebuild","savedOrd","children","remove","filter","append","result","setTimeout","reload","t","cname","c","ca","re","document","cookie","value","exdays","setTime","getTime","toUTCString","on","action","al","authMenuIndex","authMenuTabs","back_url","checkpassword","checksamepass","hiddenParams","isAlphaNumeric","langdiv","langs","langs2","len3","len4","link","menuIndex","menuTabs","method","n","nl","nlangs","o","queryLang","ref2","setCookieLang","togglecheckpassword","choicetab","axis","cursor","opacity","revert","update","fadeIn","getTimezoneOffset","tabs","active","index","focus","substring","btoa","call","availableLanguages","navigator","language","languages","chr","code","charCodeAt","password","digit","hasforbidden","len","lower","nonwhitespechar","numspechar","ref3","ref4","upper","ppolicy","minsize","addClass","removeClass","minupper","minlower","mindigit","allowedspechar","charAt","minspechar","get","setCustomValidity","keyup","target","checked","off","ref5","ref6","change","trigger","event","preventDefault","body","style","serialize","portal","user","captcha","status","err","res","responseText"],"mappings":"CAMA,WACE,IAAIA,EAAOC,EAAQC,EAAWC,EAAeC,EAAiCC,EAAMC,EAAmBC,EAAcC,EAAWC,EAAQC,EAAUC,EAAaC,EAAWC,EAAeC,EACvLC,EAAU,GAAGA,SAAW,SAASC,GAAQ,IAAK,IAAIC,EAAI,EAAGC,EAAIC,KAAKC,OAAQH,EAAIC,EAAGD,IAAO,GAAIA,KAAKE,MAAQA,KAAKF,KAAOD,EAAM,OAAOC,EAAK,OAAQ,GAEjJH,EAAoB,GAEpBD,EAAgB,SAASQ,GACvB,OAAOC,EAAEC,QAAQC,OAAOC,aAAe,aAAeJ,EAAO,QAAS,SAASK,GAC7E,IAAIC,EAAGC,EAAKC,EAAMC,EAGlB,IAAKH,KAFLb,EAAoBY,EACpBE,EAAMJ,OAAOxB,MAAM+B,OAAOC,IAExBF,EAAIF,EAAID,GACRb,EAAkBa,GAAKG,EAEzB,GAAIN,OAAOxB,MAAM+B,OAAOV,GAEtB,IAAKM,KADLE,EAAOL,OAAOxB,MAAM+B,OAAOV,GAEzBS,EAAID,EAAKF,GACTb,EAAkBa,GAAKG,EAwB3B,OArBAR,EAAE,YAAYW,KAAK,WACjB,IAAIC,EAAMhB,EAAGiB,EAAMC,EAGnB,IAFAF,EAAOZ,EAAEH,MAAMkB,KAAK,UAAUC,MAAM,KACpCF,EAAMxB,EAAUsB,EAAKK,SAChBrB,EAAI,EAAGiB,EAAOD,EAAKd,OAAQF,EAAIiB,EAAMjB,IACxCY,EAAII,EAAKhB,GACTkB,EAAMA,EAAII,QAAQ,QAASV,GAE7B,OAAOR,EAAEH,MAAMsB,KAAKL,KAEtBd,EAAE,WAAWW,KAAK,WAIhB,GAFAX,EAAEH,MAAMsB,KAAK7B,EAAU,KAAQU,EAAEH,MAAMkB,KAAK,WACtCzB,EAAU,KAAQU,EAAEH,MAAMkB,KAAK,UAC7BK,MAAM,UACZ,OAAOpB,EAAEH,MAAMwB,SAASC,SAG5BtB,EAAE,mBAAmBW,KAAK,WACxB,OAAOX,EAAEH,MAAMkB,KAAK,cAAezB,EAAUU,EAAEH,MAAMkB,KAAK,qBAErDf,EAAE,eAAeW,KAAK,WAC3B,IAAIY,EAEJ,OADAA,EAAI,IAAIC,KAAiC,IAA5BxB,EAAEH,MAAMkB,KAAK,cACnBf,EAAEH,MAAM4B,KAAKF,EAAEG,uBAK5BpC,EAAY,SAASqC,GACnB,OAAInC,EAAkBmC,GACbnC,EAAkBmC,GAElBA,GAIXzB,OAAOZ,UAAYA,EAEnBR,EAAY,WACV,IAAI8C,EAkBJ,OAjBAA,EAAS,GACT5B,EAAE,mCAAmCW,KAAK,WACxC,IAAIkB,EAAGxB,EAAGyB,EAASC,EACnB,IAGE,IAAK1B,KAFL0B,EAAMC,KAAKC,MAAMjC,EAAEH,MAAM4B,QACzBK,EAAU,GACAC,EACRD,EAAQI,KAAKN,EAAOvB,GAAK0B,EAAI1B,IAE/B,OAAOyB,EACP,MAAOK,GAGP,OAFAN,EAAIM,EACJC,QAAQC,IAAI,gBAAiBR,GACtBO,QAAQC,IAAI,OAAQrC,EAAEH,MAAM4B,WAGvCW,QAAQC,IAAIT,GACLA,GAGT/C,EAAgB,SAASyD,GACvB,IAAIlB,EAEJ,OADAA,EAAQmB,OAAO,OAASD,EAAO,YAAYE,KAAKtC,OAAOuC,SAASC,SAEvDC,mBAAmBvB,EAAM,GAAGF,QAAQ,MAAO,MAE3C,MAIX7B,EAAc,YAEdD,EAAW,WACT,OAAOD,EAAO,iBAAkBa,EAAEX,GAAauD,SAAS,WAAWC,SAGrE7D,EAAoB,SAAS8D,GAK3B,OAAOnE,EAAO,gBAAiBmE,EAAS,WACtC,OAAO9C,EAAE,aAAe8C,EAAU,MAAMxB,QAJtC,SAASyB,EAAGC,EAAGnB,GACjB,OAAOoB,MAAMD,EAAI,IAAMnB,MAO3B1C,EAAS,SAAS+D,EAAKC,EAAKC,EAASC,GACnC,OAAOrD,EAAEsD,KAAK,CACZC,KAAM,MACNC,IAAK9E,EAAkB,WAAI,uBAC3B+E,SAAU,OACVJ,MAAOA,EACPD,QAAS,SAAShD,GAChB,IAAImB,EAKJ,OAJAA,EAAI,CACFmC,MAAOtD,EAAKsD,QAEZR,GAAOC,EACFnD,EAAEsD,KAAK,CACZC,KAAM,MACNC,IAAK9E,EAAkB,WAAI,wBAC3B+E,SAAU,OACVrD,KAAMmB,EACN6B,QAASA,EACTC,MAAOA,QAMf1E,EAAS,SAASuE,EAAKS,EAAKP,EAASC,GACnC,OAAOrD,EAAEsD,KAAK,CACZC,KAAM,MACNC,IAAK9E,EAAkB,WAAI,uBAC3B+E,SAAU,OACVJ,MAAOA,EACPD,QAAS,SAAShD,GAChB,OAAOJ,EAAEsD,KAAK,CACZC,KAAM,SACNC,IAAK9E,EAAkB,WAAI,yBAA2BwE,EAAM,QAAUS,EAAM,UAAYvD,EAAKsD,MAC7FD,SAAU,OACVL,QAASA,EACTC,MAAOA,QAMfpE,EAAe,WACb,IAAI2E,EAAKC,EAAOnE,EAAMoE,EAAQC,EAAOnE,EAAGiB,EAAMmD,EAAMC,EAAMC,EAAGC,EAASC,EAAU5D,EAEhF,GAAe,OADfyD,EAAOjE,EAAEX,MACeX,EAAqB,cAC3C,OAAO,KAKT,IAHAkF,EAAMlF,EAAqB,cAAEsC,MAAM,KAEnCmD,EAAU,GACLvE,EAAI,EAAGiB,GAFZkD,EAAQE,EAAKrB,SAAS,YAEG9C,OAAQF,EAAIiB,EAAMjB,IAEzCuE,EADA3D,EAAIuD,EAAMnE,IACGY,EAEf,IAAK0D,EAAI,EAAGF,EAAOJ,EAAI9D,OAAQoE,EAAIF,EAAME,IAEnCC,EADJL,EAASF,EAAIM,MAEXxE,EAAOyE,EAAQL,GACfD,EAAQ7D,EAAEX,EAAc,gBAAgBgF,SAAS,IAAM3E,GACvD0E,EAAWpE,EAAEX,EAAc,gBAAgBgF,SAAS,IAAMP,GAC1DD,EAAMS,SACNtE,EAAEX,EAAc,gBAAgBkF,OAAO,UAAUC,OAAOJ,IAG5D,OAAO,GAOTrF,EAAO,WACL,OAAOiB,EAAEsD,KAAK,CACZC,KAAM,OACNC,IAAK9E,EAAkB,WACvB0B,KAAM,CACJrB,KAAM,GAER0E,SAAU,OACVL,QAAS,SAAShD,GAChB,OAAoB,MAAfA,EAAKqE,QAAmC,IAAhBrE,EAAKqE,OACzBC,WAAW3F,EAAML,EAAoB,cAErC+D,SAASkC,QAAO,IAG3BtB,MAAO,SAASN,EAAG6B,EAAG/C,GACpB,OAAOY,SAASkC,QAAO,OAK7BzE,OAAOnB,KAAOA,EAEdH,EAAY,SAASiG,GACnB,IAAIC,EAAGC,EAAInF,EAAGiB,EAAYmE,EAI1B,IAHOH,EAAQ,IACfE,EAAKpC,mBAAmBsC,SAASC,QAAQlE,MAAM,KAC/CgE,EAAK,IAAIzC,OAAO,MAAQsC,EAAQ,KAC3BjF,EAAI,EAAGiB,EAAOkE,EAAGjF,OAAQF,EAAIiB,EAAMjB,IAEtC,IADAkF,EAAIC,EAAGnF,IACDwB,MAAM4D,GAEV,OADAF,EAAIA,EAAE5D,QAAQ8D,EAAI,IAItB,MAAO,IAGT9F,EAAY,SAASoD,EAAM6C,EAAOC,GAChC,IAAI7D,EAGJ,OAFAA,EAAI,IAAIC,MACN6D,QAAQ9D,EAAE+D,UAAqB,MAATF,GACjBH,SAASC,OAAS5C,EAAO,IAAM6C,EAAQ,aAAgB5D,EAAEgE,cAAiB,YAGnF7G,EAAQ,GAERsB,EAAEE,QAAQsF,GAAG,OAAQ,WACnB,IAAIC,EAAQC,EAAIC,EAAeC,EAAcC,EAAUC,EAAeC,EAAeC,EAAcC,EAAgBrG,EAAGG,EAAMmG,EAASC,EAAOC,EAAQvF,EAAMmD,EAAMqC,EAAMC,EAAMC,EAAMrC,EAAGsC,EAAWC,EAAUC,EAAQC,EAAGC,EAAIC,EAAQC,EAAGC,EAAW/B,EAAI1E,EAAKC,EAAMyG,EAAMC,EAAeC,EA6FnR,GA5FAxI,EAAQI,IACJ,UAAWoB,QAAU,cAAeA,OAAOxB,QAC7CA,EAAMyI,UAAYjH,OAAOxB,MAAMyI,WAEjCjH,OAAOxB,MAAQA,EACfsB,EAAE,aAAa4C,SAAS,CACtBwE,KAAM,IACNC,OAAQ,OACRC,QAAS,GACTC,QAAQ,EACRxD,MAAO,iBACPyD,OAAQ,WACN,OAAOpI,OAGXH,IACAe,EAAE,eAAeyH,OAAO,QACxBzH,EAAE,wBAAwBmD,MAAM,IAAI3B,MAAOkG,oBAAsB,IACjEjB,EAAWzG,EAAE,SAAS2H,KAAK,CACzBC,OAAQ,KAEVpB,EAAYxG,EAAE,kBAAoBtB,EAAkB,WAAI,MAAM2C,SAASwG,SACvD,IACdrB,EAAY,GAEdC,EAASkB,KAAK,SAAU,SAAUnB,GAClCZ,EAAe5F,EAAE,aAAa2H,KAAK,CACjCC,OAAQ,KAEVjC,EAAgB3F,EAAE,sBAAwBtB,EAAkB,WAAI,MAAM2C,SAASwG,SAC3D,IAClBlC,EAAgB,GAElBC,EAAa+B,KAAK,SAAU,SAAUhC,GAClCjH,EAAiB,WACnBkH,EAAa+B,KAAK,SAAU,SAAU3H,EAAE,sBAAwBtB,EAAiB,UAAI,MAAM2C,SAASwG,SAElGnJ,EAAa,MACfsB,EAAE,8BAA8B8H,QAEK,IAAjC9H,EAAE,oBAAoBF,QACxBE,EAAE,6BAA6B8H,QAG/BpJ,EAAiB,WACnBsB,EAAE,eAAee,KAAK,SAAU,UAE9Bf,EAAE,iBAAiBF,SACrB2F,EAASzF,EAAE,SAASe,KAAK,UACzB2F,EAAS1G,EAAE,SAASe,KAAK,UACzBqB,QAAQC,IAAI,UAAWqE,GACvBV,EAAe,GACXhG,EAAE,8BACJoC,QAAQC,IAAI,uBACZrC,EAAE,4BAA4BW,KAAK,SAASkH,GAE1C,OADAzF,QAAQC,IAAI,MAAOrC,EAAEH,MAAMkB,KAAK,QAASf,EAAEH,MAAMsD,OAC1C6C,GAAgB,IAAMhG,EAAEH,MAAMkB,KAAK,QAAU,IAAMf,EAAEH,MAAMsD,SAGtE0C,EAAW,GACPJ,IACFrD,QAAQC,IAAI,UAAWoD,IACM,IAAzBA,EAAOhG,QAAQ,KACjBgG,EAAOsC,UAAU,EAAGtC,EAAOhG,QAAQ,MAEnCoG,EAAWJ,EAAS,IAEtBI,GAAYG,EACZA,EAAe,IAEjBO,EAAOvG,EAAE,mBAAmBe,KAAK,QAAU,WAAa2F,EAASV,EAC7DH,IACFU,GAAQ,QAAUyB,KAAKnC,IAEzB7F,EAAE,mBAAmBe,KAAK,OAAQwF,IAEhCrG,OAAOuC,SAASC,UAClBqE,EAAYlI,EAAc,kBAExBuD,QAAQC,IAAI,2BAGQ,KADtB4E,EAAgBpI,EAAc,mBAE5BuD,QAAQC,IAAI,oBAGXtC,IACHA,EAAOnB,EAAU,mBACJmI,GACX3E,QAAQC,IAAI,wBAGXtC,EAuCMN,EAAQwI,KAAK/H,OAAOgI,mBAAoBnI,GAAQ,IACzDA,EAAOG,OAAOgI,mBAAmB,GAC5BnB,GACH3E,QAAQC,IAAI,gDAzCd,GAAI8F,UAAW,CAQb,IAPAhC,EAAQ,GACRC,EAAS,GACTS,EAAS,CAACsB,UAAUC,UAChBD,UAAUE,YACZxB,EAASsB,UAAUE,WAGhBzI,EAAI,EAAGiB,GADZP,EAAMJ,OAAOgI,oBACUpI,OAAQF,EAAIiB,EAAMjB,IACvC8F,EAAKpF,EAAIV,GACTsG,GAAW,8BAAmChG,OAAOC,aAAe,UAAYuF,EAAK,gBAAoBA,EAAK,WAAeA,EAAK,OAEpI,IAAKxB,EAAI,EAAGF,EAAO6C,EAAO/G,OAAQoE,EAAIF,EAAME,IAI1C,IAHA0C,EAAKC,EAAO3C,GACZ9B,QAAQC,IAAI,iBAAkBuE,GAEzBD,EAAI,EAAGN,GADZ9F,EAAOL,OAAOgI,oBACUpI,OAAQ6G,EAAIN,EAAMM,IACxCjB,EAAKnF,EAAKoG,GACVvE,QAAQC,IAAI,kBAAmBqD,GAC/BV,EAAK,IAAIzC,OAAO,IAAMmD,EAAK,MACvBkB,EAAGxF,MAAM4D,IACX5C,QAAQC,IAAI,oBAAqBqD,GACjCS,EAAMjE,KAAKwD,IACFA,EAAGqC,UAAU,EAAG,KAAOnB,EAAGmB,UAAU,EAAG,IAChD3B,EAAOlE,KAAKwD,IAIlB3F,EAAOoG,EAAM,GAAKA,EAAM,GAAKC,EAAO,GAAKA,EAAO,GAAKlG,OAAOgI,mBAAmB,MAClEnB,GACX3E,QAAQC,IAAI,gCAGdtC,EAAOG,OAAOgI,mBAAmB,MACpBnB,GACX3E,QAAQC,IAAI,wBA2BlB,IAlBI0E,GACEtH,EAAQwI,KAAK/H,OAAOgI,mBAAoBnB,GAAa,IACvD3E,QAAQC,IAAI,0CACZ0E,EAAY7G,OAAOgI,mBAAmB,IAExC9F,QAAQC,IAAI,mBAAoB0E,GAC5BE,IACF7E,QAAQC,IAAI,qBAAsB0E,GAClC7H,EAAU,eAAgB6H,IAE5BxH,EAAcwH,KAEd3E,QAAQC,IAAI,mBAAoBtC,GAChCb,EAAU,eAAgBa,GAC1BR,EAAcQ,IAEhBmG,EAAU,GAELY,EAAI,EAAGR,GADZU,EAAO9G,OAAOgI,oBACUpI,OAAQgH,EAAIR,EAAMQ,IACxCpB,EAAKsB,EAAKF,GACVZ,GAAW,8BAAmChG,OAAOC,aAAe,UAAYuF,EAAK,gBAAoBA,EAAK,WAAeA,EAAK,OA4MpI,OA1MA1F,EAAE,cAAcmB,KAAK+E,GACrBlG,EAAE,aAAawF,GAAG,QAAS,WAGzB,OAFAzF,EAAOC,EAAEH,MAAMkB,KAAK,SACpB7B,EAAU,eAAgBa,GACnBR,EAAcQ,KAEvBkG,EAAiB,SAASqC,GACxB,IAAIC,EAEJ,OAAW,IADXA,EAAOD,EAAIE,WAAW,KACLD,EAAO,IAAa,GAAPA,GAAaA,EAAO,IAAa,GAAPA,GAAaA,EAAO,KAK9EzC,EAAgB,SAAS2C,GACvB,IAAIC,EAAOC,EAAchJ,EAAGiJ,EAAKC,EAAOC,EAAiBC,EAAYC,EAAMC,EAAMxE,EAAQyE,EA6CzF,GA5CAzE,GAAS,EAC0B,EAA/BvE,OAAOxB,MAAMyK,QAAQC,UACnBX,EAAS3I,QAAUI,OAAOxB,MAAMyK,QAAQC,SAC1CpJ,EAAE,6BAA6BqJ,SAAS,yBACxCrJ,EAAE,6BAA6BsJ,YAAY,0BAE3CtJ,EAAE,6BAA6BsJ,YAAY,yBAC3CtJ,EAAE,6BAA6BqJ,SAAS,wBACxC5E,GAAS,IAGuB,EAAhCvE,OAAOxB,MAAMyK,QAAQI,YACvBL,EAAQT,EAASrH,MAAM,YACV8H,EAAMpJ,QAAUI,OAAOxB,MAAMyK,QAAQI,UAChDvJ,EAAE,8BAA8BqJ,SAAS,yBACzCrJ,EAAE,8BAA8BsJ,YAAY,0BAE5CtJ,EAAE,8BAA8BsJ,YAAY,yBAC5CtJ,EAAE,8BAA8BqJ,SAAS,wBACzC5E,GAAS,IAGuB,EAAhCvE,OAAOxB,MAAMyK,QAAQK,YACvBX,EAAQJ,EAASrH,MAAM,YACVyH,EAAM/I,QAAUI,OAAOxB,MAAMyK,QAAQK,UAChDxJ,EAAE,8BAA8BqJ,SAAS,yBACzCrJ,EAAE,8BAA8BsJ,YAAY,0BAE5CtJ,EAAE,8BAA8BsJ,YAAY,yBAC5CtJ,EAAE,8BAA8BqJ,SAAS,wBACzC5E,GAAS,IAGuB,EAAhCvE,OAAOxB,MAAMyK,QAAQM,YACvBf,EAAQD,EAASrH,MAAM,YACVsH,EAAM5I,QAAUI,OAAOxB,MAAMyK,QAAQM,UAChDzJ,EAAE,8BAA8BqJ,SAAS,yBACzCrJ,EAAE,8BAA8BsJ,YAAY,0BAE5CtJ,EAAE,8BAA8BsJ,YAAY,yBAC5CtJ,EAAE,8BAA8BqJ,SAAS,wBACzC5E,GAAS,IAGTvE,OAAOxB,MAAMyK,QAAQO,eAAgB,CAKvC,IAJAZ,EAAkB5I,OAAOxB,MAAMyK,QAAQO,eAAexI,QAAQ,MAAO,IACrEyH,GAAe,EACfhJ,EAAI,EACJiJ,EAAMH,EAAS3I,OACRH,EAAIiJ,GACJ3C,EAAewC,EAASkB,OAAOhK,KAC9BmJ,EAAgBrJ,QAAQgJ,EAASkB,OAAOhK,IAAM,IAChDgJ,GAAe,GAGnBhJ,KAEmB,IAAjBgJ,GACF3I,EAAE,oCAAoCqJ,SAAS,yBAC/CrJ,EAAE,oCAAoCsJ,YAAY,0BAElDtJ,EAAE,oCAAoCsJ,YAAY,yBAClDtJ,EAAE,oCAAoCqJ,SAAS,wBAC/C5E,GAAS,GAGb,GAAsC,EAAlCvE,OAAOxB,MAAMyK,QAAQS,YAAkB1J,OAAOxB,MAAMyK,QAAQO,eAAgB,CAI9E,IAHAX,EAAa,EACbD,EAAkB5I,OAAOxB,MAAMyK,QAAQO,eAAexI,QAAQ,MAAO,IACrEvB,EAAI,EACGA,EAAI8I,EAAS3I,QACiC,GAA/CgJ,EAAgBrJ,QAAQgJ,EAASkB,OAAOhK,KAC1CoJ,IAEFpJ,IAEEoJ,GAAc7I,OAAOxB,MAAMyK,QAAQS,YACrC5J,EAAE,gCAAgCqJ,SAAS,yBAC3CrJ,EAAE,gCAAgCsJ,YAAY,0BAE9CtJ,EAAE,gCAAgCsJ,YAAY,yBAC9CtJ,EAAE,gCAAgCqJ,SAAS,wBAC3C5E,GAAS,GAGb,GAAsC,EAAlCvE,OAAOxB,MAAMyK,QAAQS,aAAmB1J,OAAOxB,MAAMyK,QAAQO,eAAgB,CAG/E,IADA/J,EADAoJ,EAAa,EAENpJ,EAAI8I,EAAS3I,QACbmG,EAAewC,EAASkB,OAAOhK,KAClCoJ,IAEFpJ,IAEEoJ,GAAc7I,OAAOxB,MAAMyK,QAAQS,YACrC5J,EAAE,gCAAgCqJ,SAAS,yBAC3CrJ,EAAE,gCAAgCsJ,YAAY,0BAE9CtJ,EAAE,gCAAgCsJ,YAAY,yBAC9CtJ,EAAE,gCAAgCqJ,SAAS,wBAC3C5E,GAAS,GAGTA,GACFzE,EAAE,YAAYsJ,YAAY,iBAAiBD,SAAS,kBACX,OAApCL,EAAOhJ,EAAE,gBAAgB6J,IAAI,KAChCb,EAAKc,kBAAkB,MAGzB9J,EAAE,YAAYsJ,YAAY,kBAAkBD,SAAS,iBACZ,OAApCJ,EAAOjJ,EAAE,gBAAgB6J,IAAI,KAChCZ,EAAKa,kBAAkBxK,EAAU,WAIV,MAAxBY,OAAOxB,MAAMyK,SAAoBnJ,EAAE,gBAAgBF,SACtDgG,EAAc,IACd9F,EAAE,gBAAgB+J,MAAM,SAASlI,GAC/BiE,EAAcjE,EAAEmI,OAAO7E,UAG3B+B,EAAsB,SAASrF,GAC7B,IAAImH,EACJ,OAAInH,EAAEmI,OAAOC,SACXjK,EAAE,gBAAgBkK,IAAI,SACsB,OAApClB,EAAOhJ,EAAE,gBAAgB6J,IAAI,IAAcb,EAAKc,kBAAkB,SAAM,IAEhF9J,EAAE,gBAAgB+J,MAAM,SAASlI,GAC/BiE,EAAcjE,EAAEmI,OAAO7E,SAElBW,EAAc,MAGzBC,EAAgB,WACd,IAAIiD,EAAMC,EAAMkB,EAAMC,EACtB,OAA8C,OAAxCpB,EAAOhJ,EAAE,oBAAoB6J,IAAI,IAAcb,EAAK7D,WAAQ,MAAkD,OAApC8D,EAAOjJ,EAAE,gBAAgB6J,IAAI,IAAcZ,EAAK9D,WAAQ,IACzF,OAAxCgF,EAAOnK,EAAE,oBAAoB6J,IAAI,KACpCM,EAAKL,kBAAkB,KAElB,IAEsC,OAAxCM,EAAOpK,EAAE,oBAAoB6J,IAAI,KACpCO,EAAKN,kBAAkBxK,EAAU,UAE5B,IAGXU,EAAE,gBAAgBqK,OAAOtE,GACzB/F,EAAE,oBAAoBqK,OAAOtE,GACA,MAAxB7F,OAAOxB,MAAMyK,SAAoBnJ,EAAE,gBAAgBF,QACtDE,EAAE,UAAUqK,OAAOnD,GAEjBxI,EAAoB,cAA6B,EAAxBA,EAAoB,cAC/CwB,OAAOwE,WAAW3F,EAAML,EAAoB,cAE9CsB,EAAE,eAAeW,KAAK,WACpB,IAAIqC,EAEJ,OADAA,EAAI,IAAIxB,KAA2B,IAAtBxB,EAAEH,MAAMkB,KAAK,QACnBf,EAAEH,MAAM4B,KAAKuB,EAAEtB,oBAExB1B,EAAE,gBAAgBwF,GAAG,QAAS,WAC5B,OAAOxG,EAAkBgB,EAAEH,MAAMkB,KAAK,cAExCf,EAAE,qBAAqBwF,GAAG,QAAS,WACjC,MAAuC,aAAnCxF,EAAE,gBAAgBe,KAAK,SACzBqB,QAAQC,IAAI,kBACZrC,EAAE,gBAAgBe,KAAK,OAAQ,SAC/Bf,EAAE,oBAAoBe,KAAK,OAAQ,SACnCf,EAAE,0BAA0BsJ,YAAY,UACjCtJ,EAAE,0BAA0BqJ,SAAS,kBAE5CjH,QAAQC,IAAI,kBACZrC,EAAE,gBAAgBe,KAAK,OAAQ,YAC/Bf,EAAE,oBAAoBe,KAAK,OAAQ,YACnCf,EAAE,0BAA0BsJ,YAAY,gBACjCtJ,EAAE,0BAA0BqJ,SAAS,aAGhDrJ,EAAE,sBAAsBwF,GAAG,QAAS,WAElC,OADApD,QAAQC,IAAI,cACLrC,EAAE,iBAAiBsK,QAAQ,WAEpCtK,EAAE,sBAAsBwF,GAAG,QAAS,WAElC,OADApD,QAAQC,IAAI,eACLrC,EAAE,iBAAiBsK,QAAQ,WAE7BtK,EAAE,mBAAmBwF,GAAG,QAAS,SAAS+E,GAC/C,IAAI5I,EAKJ,OAJA4I,EAAMC,iBACNvF,SAASwF,KAAKC,MAAMrD,OAAS,WAC7B1F,EAAM3B,EAAE,iBAAiB2K,YACzBvI,QAAQC,IAAI,wCAAyCV,GAC9C3B,EAAEsD,KAAK,CACZC,KAAM,OACNC,IAAKoH,OAAS,WACdnH,SAAU,OACVrD,KAAMuB,EACNyB,QAAS,SAAShD,GAChB,IAAIyK,EAQJ,GAPA5F,SAASwF,KAAKC,MAAMrD,OAAS,UAC7BwD,EAAOzK,EAAKyK,KACZzI,QAAQC,IAAI,qBAAsBwI,GAClC7K,EAAE,iBAAiBe,KAAK,QAAS8J,GAC7BzK,EAAK0K,SACP9K,EAAE,YAAYe,KAAK,MAAOX,EAAK0K,SAE7B1K,EAAKsD,MAEP,OADA1D,EAAE,kBAAkBe,KAAK,QAASX,EAAKsD,OAChC1D,EAAE,UAAUe,KAAK,QAASX,EAAKsD,QAG1CL,MAAO,SAASN,EAAGgI,EAAQC,GACzB,IAAIC,EAQJ,GAPAhG,SAASwF,KAAKC,MAAMrD,OAAS,UACzB2D,GACF5I,QAAQC,IAAI,QAAS2I,GAEnBjI,IACFkI,EAAMjJ,KAAKC,MAAMc,EAAEmI,eAEjBD,GAAOA,EAAI5H,MACb,OAAOjB,QAAQC,IAAI,iBAAkB4I,YAO9ChD,KAAKpI"}
\ No newline at end of file

From b8e8bbcedda4229f7c079bd286f6ce9810bd9f89 Mon Sep 17 00:00:00 2001
From: Maxime Besson <maxime.besson@worteks.com>
Date: Thu, 3 Jun 2021 18:24:55 +0200
Subject: [PATCH 20/24] Ignore unknown scopes (#2496)

---
 .../Lemonldap/NG/Portal/Lib/OpenIDConnect.pm  | 26 +++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Lib/OpenIDConnect.pm b/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Lib/OpenIDConnect.pm
index a2aa61cb9..c6cfc3df1 100644
--- a/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Lib/OpenIDConnect.pm
+++ b/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Lib/OpenIDConnect.pm
@@ -34,6 +34,8 @@ use constant ADDRESS =>
   [qw/formatted street_address locality region postal_code country/];
 use constant PHONE => [qw/phone_number phone_number_verified/];
 
+use constant OIDC_SCOPES => [qw/openid profile email address phone/];
+
 # PROPERTIES
 
 has oidcOPList   => ( is => 'rw', default => sub { {} }, );
@@ -1487,6 +1489,30 @@ sub getScope {
 
     my @scope_values = split( /\s+/, $scope );
 
+    # Clean up unknown scopes
+    if ( $self->conf->{oidcServiceAllowOnlyDeclaredScopes} ) {
+        my @known_scopes = (
+            keys( %{ $self->spScopeRules->{$rp} || {} } ),
+            @{ OIDC_SCOPES() },
+            keys(
+                %{
+                    $self->conf->{oidcRPMetaDataOptionsExtraClaims}->{$rp} || {}
+                }
+            )
+        );
+        my @scope_values_tmp;
+        for my $scope_value (@scope_values) {
+            if ( grep { $_ eq $scope_value } @known_scopes ) {
+                push @scope_values_tmp, $scope_value;
+            }
+            else {
+                $self->logger->warn(
+                    "Unknown scope $scope_value requested for service $rp");
+            }
+        }
+        @scope_values = @scope_values_tmp;
+    }
+
     # If this RP has dynamic scopes
     if ( $self->spScopeRules->{$rp} ) {
 

From 275567436ec010a8885fd23bdcd6ee4bd4bdc8f5 Mon Sep 17 00:00:00 2001
From: Maxime Besson <maxime.besson@worteks.com>
Date: Thu, 3 Jun 2021 18:31:38 +0200
Subject: [PATCH 21/24] Unit test for #2496

---
 .../t/32-OIDC-Token-Introspection.t           | 51 ++++++++++++-------
 1 file changed, 33 insertions(+), 18 deletions(-)

diff --git a/lemonldap-ng-portal/t/32-OIDC-Token-Introspection.t b/lemonldap-ng-portal/t/32-OIDC-Token-Introspection.t
index b1523ce4a..ab89c84c9 100644
--- a/lemonldap-ng-portal/t/32-OIDC-Token-Introspection.t
+++ b/lemonldap-ng-portal/t/32-OIDC-Token-Introspection.t
@@ -17,13 +17,14 @@ my $debug = 'error';
 # Initialization
 my $op = LLNG::Manager::Test->new( {
         ini => {
-            logLevel                        => $debug,
-            domain                          => 'op.com',
-            portal                          => 'http://auth.op.com',
-            authentication                  => 'Demo',
-            userDB                          => 'Same',
-            issuerDBOpenIDConnectActivation => 1,
-            oidcRPMetaDataExportedVars      => {
+            logLevel                           => $debug,
+            domain                             => 'op.com',
+            portal                             => 'http://auth.op.com',
+            authentication                     => 'Demo',
+            userDB                             => 'Same',
+            issuerDBOpenIDConnectActivation    => 1,
+            oidcServiceAllowOnlyDeclaredScopes => 1,
+            oidcRPMetaDataExportedVars         => {
                 rp => {
                     email       => "mail",
                     family_name => "cn",
@@ -37,13 +38,18 @@ my $op = LLNG::Manager::Test->new( {
             },
             oidcRPMetaDataScopeRules => {
                 rp => {
-                    "read" => '$requested and $uid eq "french"',
-                    "write" => '$uid eq "russian"',
+                    "read"        => '$requested and $uid eq "french"',
+                    "write"       => '$uid eq "russian"',
                     "ifrequested" => '$requested and $uid eq "french"',
-                    "always" => '$uid eq "french"',
+                    "always"      => '$uid eq "french"',
                 },
             },
-            oidcRPMetaDataOptions                 => {
+            oidcRPMetaDataOptionsExtraClaims => {
+                rp => {
+                    extrascope => "dummy",
+                },
+            },
+            oidcRPMetaDataOptions => {
                 rp => {
                     oidcRPMetaDataOptionsDisplayName           => "RP",
                     oidcRPMetaDataOptionsIDTokenExpiration     => 3600,
@@ -73,7 +79,7 @@ my $code = authorize(
     $op, $idpId,
     {
         response_type => "code",
-        scope => "openid profile email read write",
+        scope         => "openid profile email read write extrascope unknown",
         client_id     => "rpid",
         state         => "af0ifjsldkj",
         redirect_uri  => "http://rp2.com/"
@@ -85,7 +91,7 @@ my $json = expectJSON( codeGrant( $op, "rpid", $code, "http://rp2.com/" ) );
 my $token = $json->{access_token};
 ok( $token, 'Access token present' );
 my $token_resp_scope = $json->{scope};
-ok ($token_resp_scope, 'Token response returned granted scopes');
+ok( $token_resp_scope, 'Token response returned granted scopes' );
 
 my ( $res, $query );
 
@@ -126,11 +132,20 @@ is( $json->{client_id}, "rpid", "Response contains the correct client id" );
 like( $json->{scope}, qr/\bopenid\b/,  "Response contains the default scopes" );
 like( $json->{scope}, qr/\bprofile\b/, "Response contains the default scopes" );
 like( $json->{scope}, qr/\bemail\b/,   "Response contains the default scopes" );
-unlike( $json->{scope}, qr/\bwrite\b/,   "Response omits a dynamic scope that evaluates to false" );
-unlike( $json->{scope}, qr/\bifrequested\b/,   "Response omits a dynamic scope that was not requested" );
-like( $json->{scope}, qr/\bread\b/,   "Response contains a dynamic scope that is sent only when requested" );
-like( $json->{scope}, qr/\balways\b/,   "Response contains a dynamic scope that is not requested but always sent" );
-is ($token_resp_scope, $json->{scope}, "Token response scope matches token scope");
+unlike( $json->{scope}, qr/\bwrite\b/,
+    "Response omits a dynamic scope that evaluates to false" );
+unlike( $json->{scope}, qr/\bifrequested\b/,
+    "Response omits a dynamic scope that was not requested" );
+like( $json->{scope}, qr/\bread\b/,
+    "Response contains a dynamic scope that is sent only when requested" );
+like( $json->{scope}, qr/\balways\b/,
+    "Response contains a dynamic scope that is not requested but always sent" );
+unlike( $json->{scope}, qr/\bunknown\b/,
+    "Response omits a scope that is not declared anywhere" );
+like( $json->{scope}, qr/\bextrascope\b/,
+    "Response contains scope coming from extra claims definition" );
+is( $token_resp_scope, $json->{scope},
+    "Token response scope matches token scope" );
 
 # Check status after expiration
 Time::Fake->offset("+2h");

From 1d35a5dc84b8cecb724437e91576282f4ddce35d Mon Sep 17 00:00:00 2001
From: Maxime Besson <maxime.besson@worteks.com>
Date: Thu, 3 Jun 2021 18:40:36 +0200
Subject: [PATCH 22/24] Documentation for #2496

---
 doc/sources/admin/idpopenidconnect.rst     | 4 ++++
 doc/sources/admin/openidconnectservice.rst | 6 ++++++
 2 files changed, 10 insertions(+)

diff --git a/doc/sources/admin/idpopenidconnect.rst b/doc/sources/admin/idpopenidconnect.rst
index 2688e7bfd..e130c9198 100644
--- a/doc/sources/admin/idpopenidconnect.rst
+++ b/doc/sources/admin/idpopenidconnect.rst
@@ -186,6 +186,8 @@ For each OpenID Connect claim you want to release to applications, you can defin
     in User attribute parameter (see below).
 
 
+.. _oidcextraclaims:
+
 Extra Claims
 ^^^^^^^^^^^^
 
@@ -216,6 +218,8 @@ Userinfo endpoint.
     LemonLDAP::NG session attribute in the **Exported Attributes**
     section
 
+.. _oidcscoperules:
+
 Scope Rules
 ^^^^^^^^^^^
 
diff --git a/doc/sources/admin/openidconnectservice.rst b/doc/sources/admin/openidconnectservice.rst
index cf1362286..f9e20b581 100644
--- a/doc/sources/admin/openidconnectservice.rst
+++ b/doc/sources/admin/openidconnectservice.rst
@@ -48,6 +48,12 @@ Security
    configuration in the backend per registration request. You can limit
    this by protecting in the WebServer the registration end point with
    an authentication module, and give the credentials to clients.
+-  **Only allow declared scopes**: By default, LemonLDAP::NG will grant all requested scopes. When this option is in use, LemonLDAP will only grant:
+
+   - Standard OIDC scopes (``openid`` ``profile`` ``email`` ``address`` ``phone``)
+   - Scopes declared in :ref:`Extra Claims <oidcextraclaims>`
+   - Scopes declared in :ref:`Scope Rules <oidcscoperules>` (if they match the rule)
+
 -  **Authorization Code flow**: Set to 1 to allow Authorization Code
    flow
 -  **Implicit flow**: Set to 1 to allow Implicit flow

From 87295178e0ee49a38d55d7f2a668f0d7341fd480 Mon Sep 17 00:00:00 2001
From: Maxime Besson <maxime.besson@worteks.com>
Date: Fri, 4 Jun 2021 16:17:18 +0200
Subject: [PATCH 23/24] optimize SingleSession to avoid unneeded session
 fetches (#2536)

---
 .../NG/Portal/Plugins/SingleSession.pm        | 72 +++++++++++--------
 1 file changed, 42 insertions(+), 30 deletions(-)

diff --git a/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Plugins/SingleSession.pm b/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Plugins/SingleSession.pm
index 8455c83b8..b5313c84d 100644
--- a/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Plugins/SingleSession.pm
+++ b/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Plugins/SingleSession.pm
@@ -65,38 +65,50 @@ sub run {
     my $moduleOptions = $self->conf->{globalStorageOptions} || {};
     $moduleOptions->{backend} = $self->conf->{globalStorage};
 
-    my $sessions = $self->module->searchOn(
-        $moduleOptions,
-        $self->conf->{whatToTrace},
-        $req->{sessionInfo}->{ $self->conf->{whatToTrace} }
-    );
+    my $singleSessionRuleMatched =
+      $self->singleSessionRule->( $req, $req->sessionInfo );
+    my $singleIPRuleMatched = $self->singleIPRule->( $req, $req->sessionInfo );
+    my $singleUserByIPRuleMatched =
+      $self->singleUserByIPRule->( $req, $req->sessionInfo );
 
-    if ( $self->conf->{securedCookie} == 2 ) {
-        $self->logger->debug("Looking for double sessions...");
-        $linkedSessionId = $sessions->{ $req->id }->{_httpSession};
-        my $msg =
-          $linkedSessionId
-          ? "Linked session found -> $linkedSessionId / " . $req->id
-          : "NO linked session found!";
-        $self->logger->debug($msg);
-    }
+    if (   $singleSessionRuleMatched
+        or $singleIPRuleMatched
+        or $self->conf->{notifyOther} )
+    {
+        my $sessions = $self->module->searchOn(
+            $moduleOptions,
+            $self->conf->{whatToTrace},
+            $req->{sessionInfo}->{ $self->conf->{whatToTrace} }
+        );
 
-    foreach my $id ( keys %$sessions ) {
-        next if ( $req->id eq $id );
-        next if ( $linkedSessionId and $id eq $linkedSessionId );
-        my $session = $self->p->getApacheSession($id) or next;
-        if (
-            $self->singleSessionRule->( $req, $req->sessionInfo )
-            or (    $self->singleIPRule->( $req, $req->sessionInfo )
-                and $req->{sessionInfo}->{ipAddr} ne $session->data->{ipAddr} )
-          )
-        {
-            push @$deleted, $self->p->_sumUpSession( $session->data );
-            $self->p->_deleteSession( $req, $session, 1 );
+        if ( $self->conf->{securedCookie} == 2 ) {
+            $self->logger->debug("Looking for double sessions...");
+            $linkedSessionId = $sessions->{ $req->id }->{_httpSession};
+            my $msg =
+              $linkedSessionId
+              ? "Linked session found -> $linkedSessionId / " . $req->id
+              : "NO linked session found!";
+            $self->logger->debug($msg);
         }
-        else {
-            push @$otherSessions,  $self->p->_sumUpSession( $session->data );
-            push @otherSessionsId, $id;
+
+        foreach my $id ( keys %$sessions ) {
+            next if ( $req->id eq $id );
+            next if ( $linkedSessionId and $id eq $linkedSessionId );
+            my $session = $self->p->getApacheSession($id) or next;
+            if (
+                $self->singleSessionRule->( $req, $req->sessionInfo )
+                or (    $self->singleIPRule->( $req, $req->sessionInfo )
+                    and $req->{sessionInfo}->{ipAddr} ne
+                    $session->data->{ipAddr} )
+              )
+            {
+                push @$deleted, $self->p->_sumUpSession( $session->data );
+                $self->p->_deleteSession( $req, $session, 1 );
+            }
+            else {
+                push @$otherSessions, $self->p->_sumUpSession( $session->data );
+                push @otherSessionsId, $id;
+            }
         }
     }
 
@@ -106,7 +118,7 @@ sub run {
         }
     ) if @otherSessionsId;
 
-    if ( $self->singleUserByIPRule->( $req, $req->sessionInfo ) ) {
+    if ($singleUserByIPRuleMatched) {
         my $sessions =
           $self->module->searchOn( $moduleOptions, 'ipAddr',
             $req->sessionInfo->{ipAddr} );

From 5fc0b6f002cfc554fb023a438f405fd57c50f235 Mon Sep 17 00:00:00 2001
From: Yadd <yadd@debian.org>
Date: Mon, 7 Jun 2021 18:34:06 +0200
Subject: [PATCH 24/24] Update tr translation from transifex

---
 lemonldap-ng-manager/site/htdocs/static/languages/ar.json   | 2 +-
 lemonldap-ng-manager/site/htdocs/static/languages/de.json   | 2 +-
 lemonldap-ng-manager/site/htdocs/static/languages/es.json   | 2 +-
 lemonldap-ng-manager/site/htdocs/static/languages/it.json   | 2 +-
 lemonldap-ng-manager/site/htdocs/static/languages/pl.json   | 2 +-
 lemonldap-ng-manager/site/htdocs/static/languages/tr.json   | 6 +++---
 lemonldap-ng-manager/site/htdocs/static/languages/vi.json   | 2 +-
 lemonldap-ng-manager/site/htdocs/static/languages/zh.json   | 2 +-
 .../site/htdocs/static/languages/zh_TW.json                 | 2 +-
 lemonldap-ng-portal/site/htdocs/static/languages/tr.json    | 4 ++--
 10 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/lemonldap-ng-manager/site/htdocs/static/languages/ar.json b/lemonldap-ng-manager/site/htdocs/static/languages/ar.json
index da711c87d..15bedc786 100644
--- a/lemonldap-ng-manager/site/htdocs/static/languages/ar.json
+++ b/lemonldap-ng-manager/site/htdocs/static/languages/ar.json
@@ -1206,4 +1206,4 @@
 "yubikey2fUrl":"خدمة أل يو أر ل",
 "yubikey2fUserCanRemoveKey":"Allow user to remove Yubikey",
 "zeroConfExplanations":"لا يحتوي الخادم على إعدادات. استخدام قالب لحفظ الأول"
-}
+}
\ No newline at end of file
diff --git a/lemonldap-ng-manager/site/htdocs/static/languages/de.json b/lemonldap-ng-manager/site/htdocs/static/languages/de.json
index 909375892..cfc6fcf46 100644
--- a/lemonldap-ng-manager/site/htdocs/static/languages/de.json
+++ b/lemonldap-ng-manager/site/htdocs/static/languages/de.json
@@ -1206,4 +1206,4 @@
 "yubikey2fUrl":"Service URL",
 "yubikey2fUserCanRemoveKey":"Allow user to remove Yubikey",
 "zeroConfExplanations":"Server has no configuration. Use template to save the first."
-}
+}
\ No newline at end of file
diff --git a/lemonldap-ng-manager/site/htdocs/static/languages/es.json b/lemonldap-ng-manager/site/htdocs/static/languages/es.json
index 35bcb696a..af5d228cf 100644
--- a/lemonldap-ng-manager/site/htdocs/static/languages/es.json
+++ b/lemonldap-ng-manager/site/htdocs/static/languages/es.json
@@ -1206,4 +1206,4 @@
 "yubikey2fUrl":"Service URL",
 "yubikey2fUserCanRemoveKey":"Allow user to remove Yubikey",
 "zeroConfExplanations":"Server has no configuration. Use template to save the first."
-}
+}
\ No newline at end of file
diff --git a/lemonldap-ng-manager/site/htdocs/static/languages/it.json b/lemonldap-ng-manager/site/htdocs/static/languages/it.json
index 167c1f637..ef156ead0 100644
--- a/lemonldap-ng-manager/site/htdocs/static/languages/it.json
+++ b/lemonldap-ng-manager/site/htdocs/static/languages/it.json
@@ -1206,4 +1206,4 @@
 "yubikey2fUrl":"URL del servizio",
 "yubikey2fUserCanRemoveKey":"Autorizza l'utente a rimuovere la Yubikey",
 "zeroConfExplanations":"Il server non ha alcuna configurazione. Utilizza il modello per salvare il primo."
-}
+}
\ No newline at end of file
diff --git a/lemonldap-ng-manager/site/htdocs/static/languages/pl.json b/lemonldap-ng-manager/site/htdocs/static/languages/pl.json
index a2e20812f..519999644 100644
--- a/lemonldap-ng-manager/site/htdocs/static/languages/pl.json
+++ b/lemonldap-ng-manager/site/htdocs/static/languages/pl.json
@@ -1206,4 +1206,4 @@
 "yubikey2fUrl":"URL usługi",
 "yubikey2fUserCanRemoveKey":"Pozwól użytkownikowi usunąć Yubikey",
 "zeroConfExplanations":"Serwer nie ma konfiguracji. Użyj szablonu, aby zapisać pierwszy."
-}
+}
\ No newline at end of file
diff --git a/lemonldap-ng-manager/site/htdocs/static/languages/tr.json b/lemonldap-ng-manager/site/htdocs/static/languages/tr.json
index 7f48f00fd..c27af6984 100644
--- a/lemonldap-ng-manager/site/htdocs/static/languages/tr.json
+++ b/lemonldap-ng-manager/site/htdocs/static/languages/tr.json
@@ -242,7 +242,7 @@
 "crowdsec":"Aktivasyon",
 "crowdsecAction":"Eylem",
 "crowdsecKey":"API anahtarı",
-"crowdsecUrl":"Base URL of local API",
+"crowdsecUrl":"Yerel API'nin temel URL'si",
 "cspConnect":"Ajax hedefleri",
 "cspDefault":"Varsayılan değer",
 "cspFont":"Font kaynağı",
@@ -308,7 +308,7 @@
 "demoParams":"Gösterim parametreleri",
 "description":"Açıklama",
 "dest":"Alıcı",
-"devOpsCheck":"Check DevOps handler file",
+"devOpsCheck":"DevOps eğitici dosyasını kontrol edin",
 "diffViewer":"Fark görüntüleyici",
 "diffWithPrevious":"önceki ile farkı",
 "disablePersistentStorage":"Depolamayı devre dışı bırak",
@@ -1206,4 +1206,4 @@
 "yubikey2fUrl":"Servis URL'si",
 "yubikey2fUserCanRemoveKey":"Yubikey'i kaldırmak için kullanıcıya izin ver",
 "zeroConfExplanations":"Sunucunun yapılandırması yok. Şimdi bir tane kaydetmek için şablonu kullanın."
-}
+}
\ No newline at end of file
diff --git a/lemonldap-ng-manager/site/htdocs/static/languages/vi.json b/lemonldap-ng-manager/site/htdocs/static/languages/vi.json
index 291717b65..3d03a470a 100644
--- a/lemonldap-ng-manager/site/htdocs/static/languages/vi.json
+++ b/lemonldap-ng-manager/site/htdocs/static/languages/vi.json
@@ -1206,4 +1206,4 @@
 "yubikey2fUrl":"Dịch vụ URL",
 "yubikey2fUserCanRemoveKey":"Allow user to remove Yubikey",
 "zeroConfExplanations":"Máy chủ không có cấu hình. Sử dụng mẫu để lưu đầu tiên. "
-}
+}
\ No newline at end of file
diff --git a/lemonldap-ng-manager/site/htdocs/static/languages/zh.json b/lemonldap-ng-manager/site/htdocs/static/languages/zh.json
index 03f1bfd5e..c3aa3751f 100644
--- a/lemonldap-ng-manager/site/htdocs/static/languages/zh.json
+++ b/lemonldap-ng-manager/site/htdocs/static/languages/zh.json
@@ -1206,4 +1206,4 @@
 "yubikey2fUrl":"Service URL",
 "yubikey2fUserCanRemoveKey":"Allow user to remove Yubikey",
 "zeroConfExplanations":"Server has no configuration. Use template to save the first."
-}
+}
\ No newline at end of file
diff --git a/lemonldap-ng-manager/site/htdocs/static/languages/zh_TW.json b/lemonldap-ng-manager/site/htdocs/static/languages/zh_TW.json
index 27ae63374..a15e662dc 100644
--- a/lemonldap-ng-manager/site/htdocs/static/languages/zh_TW.json
+++ b/lemonldap-ng-manager/site/htdocs/static/languages/zh_TW.json
@@ -1206,4 +1206,4 @@
 "yubikey2fUrl":"服務 URL",
 "yubikey2fUserCanRemoveKey":"允許使用者移除 Yubikey",
 "zeroConfExplanations":"伺服器未設定。使用飯本來儲存第一個。"
-}
+}
\ No newline at end of file
diff --git a/lemonldap-ng-portal/site/htdocs/static/languages/tr.json b/lemonldap-ng-portal/site/htdocs/static/languages/tr.json
index 600aa0591..7ad728046 100644
--- a/lemonldap-ng-portal/site/htdocs/static/languages/tr.json
+++ b/lemonldap-ng-portal/site/htdocs/static/languages/tr.json
@@ -8,7 +8,7 @@
 "PE101":"Parola izin verilmeyen karakterler içeriyor",
 "PE102":"Oturum yükseltilmeli",
 "PE103":"Hesabınız için ikinci faktör kullanılabilir değil",
-"PE104":"Bad DevOps handler file",
+"PE104":"Kötü DevOps eğitici dosyası",
 "PE105":"Dosya bulunamadı",
 "PE2":"Kullanıcı adı ve parola alanları doldurulmalı",
 "PE20":"Parola back-end'i tanımlanmadı",
@@ -128,7 +128,7 @@
 "certificateReset":"Sertifikamı sıfırla",
 "changeKey":"Yeni anahtar üret",
 "changePwd":"Parolanı değiştir",
-"checkDevOps":"Check DevOps handler file",
+"checkDevOps":"DevOps eğitici dosyasını kontrol edin",
 "checkLastLogins":"Son girişlerimi kontrol et",
 "checkUser":"Kullanıcı TOA profilini kontrol et",
 "checkUserComputedSession":"TOA oturumu bulunamadı. Hesaplanan veri!",