<?xml version="1.0" encoding="UTF-8"?>

<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee
                      http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd"
	version="3.1" metadata-complete="true">

	<absolute-ordering>
		<name>log4j</name>
	</absolute-ordering>

	<!-- Display name of the application packed in the resulting war file. -->
	<display-name>Airlock Login/IAM Loginapp</display-name>

	<!-- Optional name of a subdirectory relative to the configuration directory
		specified by the environment variable MEDUSA_CONF_DIR.
		If this context parameter is defined, the Medusa configuration will be
		loaded from the directory ${MEDUSA_CONF_DIR}/value-of-the-parameter.
		If this context parameter is not defined or empty,the Medusa configuration will be
		loaded from the directory ${MEDUSA_CONF_DIR} (as in earlier versions).
	-->
	<context-param>
		<param-name>MEDUSA_CONF_SUBDIR</param-name>
		<param-value/>
	</context-param>

	<!-- Listener to create one global Injector for Guice modules. -->
	<listener>
		<listener-class>
			com.airlock.iam.base.infrastructure.servlet.GlobalGuiceInjector
		</listener-class>
	</listener>

	<!-- Initializes the configuration of the Medusa Web Authentication Module -->
	<listener>
		<listener-class>com.airlock.iam.login.app.misc.config.ContextListener</listener-class>
	</listener>

	<!-- Filter that uses UTF-8 for request parsing unless the client specified an encoding (this mostly affects POST parameters). -->
	<filter>
		<filter-name>SetCharacterEncoding</filter-name>
		<filter-class>org.apache.catalina.filters.SetCharacterEncodingFilter</filter-class>
		<init-param>
			<param-name>encoding</param-name>
			<param-value>UTF-8</param-value>
		</init-param>
	</filter>

	<!-- Filter that sets UTF-8 as content encoding for all responses of type text not having an explicit encoding. -->
	<filter>
		<filter-name>AddDefaultCharsetFilter</filter-name>
		<filter-class>org.apache.catalina.filters.AddDefaultCharsetFilter</filter-class>
		<init-param>
			<param-name>encoding</param-name>
			<param-value>UTF-8</param-value>
		</init-param>
	</filter>

	<!-- Filter that redirects to 404 error page if this webapp is deactivated. -->
	<filter>
		<filter-name>deactivated-filter</filter-name>
		<filter-class>com.airlock.iam.core.misc.util.tomcat.ModuleDeactivatedFilter</filter-class>
	</filter>

	<!-- Filter that cleans some resources at the end of each request (like ThreadLocals) -->
	<filter>
		<filter-name>request-cleanup</filter-name>
		<filter-class>com.airlock.iam.core.misc.util.tomcat.RequestCleanupFilter</filter-class>
	</filter>

	<!-- Filter that ignores interpretation and prevents setting jsessionid URL parameters -->
	<filter>
		<filter-name>jsessionid-removal</filter-name>
		<filter-class>com.airlock.iam.core.misc.util.tomcat.SessionIdFilter</filter-class>
	</filter>

	<filter>
		<filter-name>guiceFilter</filter-name>
		<filter-class>com.google.inject.servlet.GuiceFilter</filter-class>
	</filter>

	<filter>
		<filter-name>init-filter</filter-name>
		<filter-class>com.airlock.iam.login.app.infrastructure.web.ServletInitializationFilter</filter-class>
	</filter>

	<filter>
		<filter-name>ui-context-extractor-filter</filter-name>
		<filter-class>com.airlock.iam.login.app.infrastructure.filter.LoginappUiContextExtractorFilter</filter-class>
	</filter>

	<filter>
		<filter-name>saml2-filter</filter-name>
		<filter-class>com.airlock.iam.login.app.infrastructure.filter.Saml2BlockLegacyOneShotFilter</filter-class>
	</filter>

	<filter>
		<filter-name>csp-filter</filter-name>
		<filter-class>com.airlock.iam.login.app.infrastructure.filter.LoginappContentSecurityPolicyFilter
		</filter-class>
	</filter>

	<filter>
		<filter-name>no-cache-filter</filter-name>
		<filter-class>com.airlock.iam.common.infrastructure.filter.general.NoCacheServletFilter</filter-class>
	</filter>

	<filter>
		<filter-name>RequestUrlPatternUiResourceSetRuleFilter</filter-name>
		<filter-class>com.airlock.iam.login.app.misc.servlet.filter.RequestUrlPatternUiResourceSetRuleFilter
		</filter-class>
	</filter>

	<filter>
		<filter-name>UrlRewriteFilter</filter-name>
		<filter-class>org.tuckey.web.filters.urlrewrite.UrlRewriteFilter</filter-class>
		<init-param>
			<param-name>statusEnabled</param-name>
			<param-value>false</param-value>
		</init-param>
	</filter>

	<filter>
		<filter-name>NoAccessLogFilter</filter-name>
		<filter-class>com.airlock.iam.common.infrastructure.filter.general.NoAccessLogFilter</filter-class>
	</filter>
	<filter>
		<filter-name>OpenIdConnectPromptNoneFilter</filter-name>
		<filter-class>com.airlock.iam.login.app.misc.servlet.filter.OpenIdConnectPromptNoneServletForwardFilter
		</filter-class>
	</filter>

	<filter>
		<filter-name>saml2-legacy-servlet-forward-filter</filter-name>
		<filter-class>com.airlock.iam.login.app.misc.servlet.filter.saml2.Saml2LegacyServletForwardFilter</filter-class>
	</filter>

	<filter-mapping>
		<filter-name>SetCharacterEncoding</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>

	<filter-mapping>
		<filter-name>AddDefaultCharsetFilter</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>

	<filter-mapping>
		<filter-name>deactivated-filter</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>

	<filter-mapping>
		<filter-name>request-cleanup</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>

	<filter-mapping>
		<filter-name>jsessionid-removal</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>

	<filter-mapping>
		<filter-name>guiceFilter</filter-name>
		<url-pattern>/*</url-pattern>
		<dispatcher>REQUEST</dispatcher>
		<dispatcher>FORWARD</dispatcher>
	</filter-mapping>

	<filter-mapping>
		<filter-name>init-filter</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>

	<filter-mapping>
		<filter-name>csp-filter</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>

	<filter-mapping>
		<filter-name>no-cache-filter</filter-name>
		<url-pattern>/ui/app/*</url-pattern>
	</filter-mapping>

	<filter-mapping>
		<filter-name>ui-context-extractor-filter</filter-name>
		<url-pattern>/ui/app/*</url-pattern>
	</filter-mapping>

	<filter-mapping>
		<filter-name>saml2-filter</filter-name>
		<url-pattern>/login-oneshot</url-pattern>
	</filter-mapping>

	<filter-mapping>
		<filter-name>RequestUrlPatternUiResourceSetRuleFilter</filter-name>
		<url-pattern>/ui/*</url-pattern>
	</filter-mapping>

	<filter-mapping>
		<filter-name>UrlRewriteFilter</filter-name>
		<url-pattern>/*</url-pattern>
		<dispatcher>REQUEST</dispatcher>
		<dispatcher>FORWARD</dispatcher>
	</filter-mapping>

	<filter-mapping>
		<filter-name>NoAccessLogFilter</filter-name>
		<url-pattern>/rest/health/*</url-pattern>
	</filter-mapping>

	<filter-mapping>
		<filter-name>OpenIdConnectPromptNoneFilter</filter-name>
		<url-pattern>/oauth2/v3/*</url-pattern>
	</filter-mapping>

	<filter-mapping>
		<filter-name>saml2-legacy-servlet-forward-filter</filter-name>
		<url-pattern>/SSOPOST/*</url-pattern>
		<url-pattern>/SSORedirect/*</url-pattern>
		<url-pattern>/IDPSloRedirect/*</url-pattern>
		<url-pattern>/ArtifactResolver/*</url-pattern>
		<url-pattern>/SPSloResponder/*</url-pattern>
		<url-pattern>/SPAcs/*</url-pattern>
	</filter-mapping>

	<!-- Servlet definitions -->

	<servlet>
		<servlet-name>LoginServlet</servlet-name>
		<servlet-class>com.airlock.iam.login.app.misc.LoginServlet</servlet-class>
	</servlet>
	<servlet>
		<servlet-name>CheckLoginServlet</servlet-name>
		<servlet-class>com.airlock.iam.login.app.misc.CheckLoginServlet</servlet-class>
	</servlet>
	<servlet>
		<servlet-name>LogoutServlet</servlet-name>
		<servlet-class>com.airlock.iam.login.app.misc.LogoutServlet</servlet-class>
	</servlet>
	<servlet>
		<servlet-name>CrontoOnlineValidationServlet</servlet-name>
		<servlet-class>com.airlock.iam.login.app.misc.CrontoOnlineValidationServlet</servlet-class>
	</servlet>
	<servlet>
		<servlet-name>CrontoOnlinePostActivationServlet</servlet-name>
		<servlet-class>com.airlock.iam.login.app.misc.CrontoOnlinePostActivationServlet</servlet-class>
	</servlet>
	<servlet>
		<servlet-name>CrontoOnlineInstanceActivationServlet</servlet-name>
		<servlet-class>com.airlock.iam.login.app.misc.CrontoOnlineInstanceActivationServlet</servlet-class>
	</servlet>
	<servlet>
		<servlet-name>CrontoPushNotificationIdRegistrationServlet</servlet-name>
		<servlet-class>com.airlock.iam.login.app.misc.CrontoPushNotificationIdRegistrationServlet</servlet-class>
	</servlet>
	<servlet>
		<servlet-name>CrontoTransactionListServlet</servlet-name>
		<servlet-class>com.airlock.iam.login.app.misc.CrontoTransactionListServlet</servlet-class>
	</servlet>
	<servlet>
		<servlet-name>CrontoSignSwissOnlineValidationServlet</servlet-name>
		<servlet-class>com.airlock.iam.login.app.misc.CrontoSignSwissOnlineValidationServlet</servlet-class>
	</servlet>
	<servlet>
		<servlet-name>OAuth2ConfirmAuthServlet</servlet-name>
		<servlet-class>com.airlock.iam.login.app.misc.oauth2.provider.servlet.OAuth2ConfirmAuthServlet</servlet-class>
	</servlet>
	<servlet>
		<servlet-name>OAuth2ClientServlet</servlet-name>
		<servlet-class>com.airlock.iam.login.app.misc.oauth2.client.OAuth2ClientServlet</servlet-class>
	</servlet>
	<servlet>
		<servlet-name>SuccessServlet</servlet-name>
		<servlet-class>com.airlock.iam.login.app.misc.SuccessServlet</servlet-class>
	</servlet>
	<servlet>
		<servlet-name>AirlockOneShotLoginServlet</servlet-name>
		<servlet-class>com.airlock.iam.login.app.misc.OneShotLoginServlet</servlet-class>
	</servlet>
	<servlet>
		<servlet-name>AirlockOneShotLogoutServlet</servlet-name>
		<servlet-class>com.airlock.iam.login.app.misc.OneShotLogoutServlet</servlet-class>
	</servlet>
	<servlet>
		<servlet-name>ProtectedRestServlet</servlet-name>
		<servlet-class>org.glassfish.jersey.servlet.ServletContainer</servlet-class>
		<init-param>
			<param-name>jakarta.ws.rs.Application</param-name>
			<param-value>com.airlock.iam.login.rest.infrastructure.prot.ProtectedLoginRestApplication
			</param-value>
		</init-param>
		<load-on-startup>0</load-on-startup>
	</servlet>
	<servlet>
		<servlet-name>SelfServiceRestServlet</servlet-name>
		<servlet-class>org.glassfish.jersey.servlet.ServletContainer</servlet-class>
		<init-param>
			<param-name>jakarta.ws.rs.Application</param-name>
			<param-value>com.airlock.iam.selfservice.infrastructure.SelfServiceRestApplication
			</param-value>
		</init-param>
		<load-on-startup>0</load-on-startup>
	</servlet>
	<servlet>
		<servlet-name>PublicRestServlet</servlet-name>
		<servlet-class>org.glassfish.jersey.servlet.ServletContainer</servlet-class>
		<init-param>
			<param-name>jakarta.ws.rs.Application</param-name>
			<param-value>com.airlock.iam.login.rest.infrastructure.pub.PublicLoginRestApplication</param-value>
		</init-param>
		<load-on-startup>0</load-on-startup>
	</servlet>
	<servlet>
		<servlet-name>UserSelfRegRestServlet</servlet-name>
		<servlet-class>org.glassfish.jersey.servlet.ServletContainer</servlet-class>
		<init-param>
			<param-name>jakarta.ws.rs.Application</param-name>
			<param-value>com.airlock.iam.userselfreg.infrastructure.UserSelfRegRestApplication
			</param-value>
		</init-param>
		<load-on-startup>0</load-on-startup>
	</servlet>
	<servlet>
		<servlet-name>TechClientRegRestServlet</servlet-name>
		<servlet-class>org.glassfish.jersey.servlet.ServletContainer</servlet-class>
		<init-param>
			<param-name>jakarta.ws.rs.Application</param-name>
			<param-value>com.airlock.iam.techclientreg.infrastructure.TechClientRegRestApplication
			</param-value>
		</init-param>
		<load-on-startup>0</load-on-startup>
	</servlet>
	<servlet>
		<servlet-name>PublicSelfServiceRestServlet</servlet-name>
		<servlet-class>org.glassfish.jersey.servlet.ServletContainer</servlet-class>
		<init-param>
			<param-name>jakarta.ws.rs.Application</param-name>
			<param-value>com.airlock.iam.publicselfservice.infrastructure.PublicSelfServiceRestApplication
			</param-value>
		</init-param>
		<load-on-startup>0</load-on-startup>
	</servlet>
	<servlet>
		<servlet-name>AuthenticationRestServlet</servlet-name>
		<servlet-class>org.glassfish.jersey.servlet.ServletContainer</servlet-class>
		<init-param>
			<param-name>jakarta.ws.rs.Application</param-name>
			<param-value>
				com.airlock.iam.authentication.infrastructure.AuthenticationLoginRestApplication
			</param-value>
		</init-param>
		<load-on-startup>0</load-on-startup>
	</servlet>
	<servlet>
		<servlet-name>LoginHealthRestServlet</servlet-name>
		<servlet-class>org.glassfish.jersey.servlet.ServletContainer</servlet-class>
		<init-param>
			<param-name>jakarta.ws.rs.Application</param-name>
			<param-value>
				com.airlock.iam.login.health.rest.infrastructure.LoginHealthRestApplication
			</param-value>
		</init-param>
		<!-- The health check servlet should be started as late as possible. This prevents declaring the system as
		running before it actually is. -->
		<load-on-startup>2147483647</load-on-startup>
	</servlet>
	<servlet>
		<servlet-name>OAuth2JerseyServlet</servlet-name>
		<servlet-class>org.glassfish.jersey.servlet.ServletContainer</servlet-class>
		<init-param>
			<param-name>jakarta.ws.rs.Application</param-name>
			<param-value>com.airlock.iam.oauth2.infrastructure.OAuth2V3Application
			</param-value>
		</init-param>
		<load-on-startup>0</load-on-startup>
	</servlet>
	<servlet>
		<servlet-name>OAuth2RestServlet</servlet-name>
		<servlet-class>org.glassfish.jersey.servlet.ServletContainer</servlet-class>
		<init-param>
			<param-name>jakarta.ws.rs.Application</param-name>
			<param-value>com.airlock.iam.oauth2.infrastructure.OAuth2RestApplication
			</param-value>
		</init-param>
		<load-on-startup>0</load-on-startup>
	</servlet>
	<servlet>
		<servlet-name>Saml2RestServlet</servlet-name>
		<servlet-class>org.glassfish.jersey.servlet.ServletContainer</servlet-class>
		<init-param>
			<param-name>jakarta.ws.rs.Application</param-name>
			<param-value>com.airlock.iam.saml2.infrastructure.jersey.Saml2JerseyApplication
			</param-value>
		</init-param>
		<load-on-startup>0</load-on-startup>
	</servlet>
	<servlet>
		<servlet-name>ErrorPageServlet</servlet-name>
		<servlet-class>com.airlock.iam.common.infrastructure.servlet.ErrorPageServlet</servlet-class>
	</servlet>

	<!-- Used for the loginapp single page application -->
	<servlet>
		<servlet-name>I18nServlet</servlet-name>
		<servlet-class>com.airlock.iam.login.app.infrastructure.web.I18nServlet</servlet-class>
	</servlet>
	<servlet>
		<servlet-name>StaticServlet</servlet-name>
		<jsp-file>/ui/app/index.jsp</jsp-file>
	</servlet>

	<!-- Servlet mappings -->

	<servlet-mapping>
		<servlet-name>SuccessServlet</servlet-name>
		<url-pattern>/msofba-success</url-pattern>
	</servlet-mapping>

	<servlet-mapping>
		<servlet-name>LoginServlet</servlet-name>
		<url-pattern>/login</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>CheckLoginServlet</servlet-name>
		<url-pattern>/check-login</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>LogoutServlet</servlet-name>
		<url-pattern>/logout</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>CrontoOnlineValidationServlet</servlet-name>
		<url-pattern>/cronto-response</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>CrontoOnlinePostActivationServlet</servlet-name>
		<url-pattern>/vasco/post-activation</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>CrontoOnlineInstanceActivationServlet</servlet-name>
		<url-pattern>/vasco/instance-activation</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>CrontoPushNotificationIdRegistrationServlet</servlet-name>
		<url-pattern>/cronto-notification-id-registration</url-pattern> <!-- for Vasco Digipass app -->
		<url-pattern>/cronto/notification</url-pattern> <!-- for CrontoSign Swiss app using Cronto stack -->
		<url-pattern>/vasco/notification</url-pattern> <!-- for CrontoSign Swiss app using Vasco stack -->
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>CrontoTransactionListServlet</servlet-name>
		<url-pattern>/cronto-transaction-list</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>CrontoSignSwissOnlineValidationServlet</servlet-name>
		<url-pattern>/cronto/transaction</url-pattern> <!-- defined by CrontoSign Swiss app using Cronto stack -->
		<url-pattern>/vasco/transaction</url-pattern> <!-- defined by CrontoSign Swiss app using Vasco stack -->
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>OAuth2JerseyServlet</servlet-name>
		<url-pattern>/oauth2/v3/*</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>OAuth2ConfirmAuthServlet</servlet-name>
		<url-pattern>/oauth2-confirm</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>OAuth2ClientServlet</servlet-name>
		<url-pattern>/oauth2-client/*</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>Saml2RestServlet</servlet-name>
		<url-pattern>/saml2/*</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>AirlockOneShotLoginServlet</servlet-name>
		<url-pattern>/login-oneshot</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>AirlockOneShotLogoutServlet</servlet-name>
		<url-pattern>/logout-oneshot</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>PublicRestServlet</servlet-name>
		<url-pattern>/rest/public/*</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>AuthenticationRestServlet</servlet-name>
		<url-pattern>/rest/public/authentication/*</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>LoginHealthRestServlet</servlet-name>
		<url-pattern>/rest/health/*</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>OAuth2RestServlet</servlet-name>
		<url-pattern>/rest/oauth2/*</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>UserSelfRegRestServlet</servlet-name>
		<url-pattern>/rest/public/user-self-registration/*</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>TechClientRegRestServlet</servlet-name>
		<url-pattern>/rest/public/tech-client-registration/*</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>PublicSelfServiceRestServlet</servlet-name>
		<url-pattern>/rest/public/self-service/*</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>ProtectedRestServlet</servlet-name>
		<url-pattern>/rest/protected/*</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>SelfServiceRestServlet</servlet-name>
		<url-pattern>/rest/protected/self-service/*</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>ErrorPageServlet</servlet-name>
		<url-pattern>/errorPage</url-pattern>
	</servlet-mapping>

	<!-- Used for the loginapp single page application -->
	<servlet-mapping>
		<servlet-name>I18nServlet</servlet-name>
		<url-pattern>/ui/assets/airlock/i18n/*</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>StaticServlet</servlet-name>
		<url-pattern>/ui/app/*</url-pattern>
	</servlet-mapping>

	<!-- Welcome Files-->
	<welcome-file-list>
		<welcome-file>welcome.jsp</welcome-file>
	</welcome-file-list>

	<!-- Dispatch between static error pages and empty REST response -->
	<!--
		According to servlet spec 3, it should be possible to define error-page
		without exception-type or error-code. It doesn't seem to work though.
		Additional error-page elements for default cases are therefore defined
		as fallback.
		-->
	<error-page>
		<location>/errorPage</location>
	</error-page>
	<error-page>
		<exception-type>java.lang.Exception</exception-type>
		<location>/errorPage</location>
	</error-page>
	<error-page>
		<error-code>401</error-code>
		<location>/errorPage</location>
	</error-page>
	<error-page>
		<error-code>403</error-code>
		<location>/errorPage</location>
	</error-page>
	<error-page>
		<error-code>404</error-code>
		<location>/errorPage</location>
	</error-page>
	<error-page>
		<error-code>500</error-code>
		<location>/errorPage</location>
	</error-page>

</web-app>
