# Airlock IAM 8.6.1 code map This set contains vendor JARs from an owned 8.6.1 trial and Vineflower output under `decompiled/com/airlock/iam`. `README.txt` records provenance. REST entry points are mainly under `authentication/infrastructure/resource`, `publicselfservice/infrastructure/resource`, `login/rest/infrastructure/resource`, `oauth2/infrastructure/resource`, `saml2/infrastructure/resource`, `techclientreg/infrastructure/resource`, `apipolicyservice/infrastructure/resource`, and `transactionapproval/infrastructure/resource`. Loginapp UI translation requests enter `login/app/infrastructure/web/I18nServlet.java`. It builds `I18nRequest` from `HttpServletRequest.getPathInfo()`. `common/infrastructure/i18n/I18nRequest.java:18-47,62-70` turns that path into default and custom servlet-context resource paths without an explicit containment check. `ServletContextBasedJsonLoader` reads the resource as JSON; `ServletContextBasedPropertiesLoader.java:18-38` changes a terminal `.json` suffix to `.properties`, loads Java properties, and serializes them as JSON. Dynamic UI resource sets are selected in `login/app/misc/servlet/filter/RequestUrlPatternUiResourceSetRuleFilter.java`. Lines 40-47 internally forward matching custom-asset requests. Lines 69-88 prepend `/ui/` to the attacker-derived substring beginning at `/assets`; lines 91-100 check existence after greedily replacing text between the first and last dots, while the original path is forwarded. The existence check and forward can be desynchronized with `manifest.%252f..`, six double-encoded slash/literal-parent segments, and `WEB-INF%252fweb.xml;.json`: the check sees `manifest.json`, while later decoding normalizes the original parents. Loginapp session restoration is in `flow/shared/infrastructure/service/recovery/SessionTicketRestoreImpl.java`. `IAM_FLOW_SESSION_TICKET` first uses `Aes128GcmCipher` and the Loginapp encryption key, then supports a nested A256GCM/HS512 legacy JWT. Flow continuation tokens are 100 random alphanumeric characters; only SHA-512 is stored by `FlowContinuationTokenRepositoryImpl`, with user, target flow, expiry, context, and tenant. The fixed-key legacy ESP codec is under `core/misc/util/ticket/codec/esp`; use is configuration-dependent. Session-less Loginapp APIs beneath `/rest/protected` are assembled by `login/rest/infrastructure/prot/MainProtectedExtension.java`. `RequestAuthenticationFilter.java` requires a configured request-authentication service before the resource runs; supported implementations include Basic, static, SSO-ticket, OAuth bearer-token, and client-certificate authentication. `HttpServletRequestToRequestAdapter.java` obtains certificates from the configured request-information provider. Airlock Gateway extraction reads the case-insensitive `SSL_CLIENT_CERT` environment cookie through `AirlockEnvCookiesInformationServiceImpl` and `AirlockWAFEnvValues`; Microgateway extraction defaults to `X-Forwarded-mTLS-Client-Cert`. Service Container dispatch enters `servicecontainer/app/infrastructure/webapp/StartTaskServlet.java`, mapped to `/startTask/*`. It requires a loopback remote host and selects a configured task by `task`. `ReportExecTask.java` substitutes administrator-defined file variables into an administrator-defined OS command. API Policy Service exposes POST `/rest/resolve-tech-client` in `apipolicyservice/infrastructure/resource/ResolveTechClientResource.java`. `ApiPolicyServiceAuthenticationFilter` requires `X-AL-ApiPolicy-Auth`; `ApiPolicyServiceRequestAuthentication.java` decodes a fixed HS512 JWT whose HMAC key is the configured Base64 `sharedSecret`. `JwtSignatureVerifierImpl` compares the JWT `alg` string to the configured algorithm before MAC verification. Transaction Approval routes are below `/rest/transaction-approval`. `TransactionApprovalAuthenticationFilter.java` authenticates every main request using configured Basic, client-certificate, static, denying, or SSO-ticket request authentication and pins the authenticated user into the flow session. Client-certificate authentication does not establish CA trust itself; certificate extraction is supplied by the configured gateway request-information service. Application parameters and defaults are in `application/parameters/infrastructure/parameter-defaults.properties`. Module paths default to `/${instance.name}-admin`, `-login`, `-transaction-approval`, `-api-policy-service`, `-servicecontainer`, and `-h2`. When `h2` is enabled, `application/webserver/infrastructure/deploy/H2Deployer.java` mounts `org.h2.server.web.JakartaWebServlet` over `/*` with `webAllowOthers`; defaults are JDBC `jdbc:h2:tcp://localhost:9001/iamdb`, user `airlock`, password `password`. The template labels embedded H2 testing-only.