<?xml version="1.0" encoding="UTF-8"?>
<wsp:Policy xmlns:L7p="http://www.layer7tech.com/ws/policy" xmlns:wsp="http://schemas.xmlsoap.org/ws/2002/12/policy">
    <wsp:All wsp:Usage="Required">
        <wsp:OneOrMore wsp:Usage="Required">
            <wsp:All wsp:Usage="Required">
                <L7p:SslAssertion/>
                <L7p:CookieCredentialSource>
                    <L7p:CookieName stringValue="L7SSGID"/>
                </L7p:CookieCredentialSource>
                <L7p:OAuth2Introspection>
                    <L7p:Token stringValue="${cookie.L7SSGID}"/>
                    <L7p:TrustGatewayAsIssuer booleanValue="true"/>
                </L7p:OAuth2Introspection>
                <L7p:SetVariable>
                    <L7p:Base64Expression stringValue="dHJ1ZQ=="/>
                    <L7p:VariableToSet stringValue="oauth2i.validated"/>
                </L7p:SetVariable>
                <L7p:assertionComment>
                    <L7p:Properties mapValue="included">
                        <L7p:entry>
                            <L7p:key stringValue="RIGHT.COMMENT"/>
                            <L7p:value stringValue="Cookie based credentials"/>
                        </L7p:entry>
                    </L7p:Properties>
                </L7p:assertionComment>
            </wsp:All>
            <L7p:SslAssertion>
                <L7p:RequireClientAuthentication booleanValue="true"/>
            </L7p:SslAssertion>
            <wsp:All wsp:Usage="Required">
                <L7p:ComparisonAssertion>
                    <L7p:CaseSensitive booleanValue="false"/>
                    <L7p:Expression1 stringValue="${cookie.L7SSGID}"/>
                    <L7p:ExpressionIsVariable booleanValue="false"/>
                    <L7p:Operator operatorNull="null"/>
                    <L7p:Predicates predicates="included">
                        <L7p:item dataType="included">
                            <L7p:Type variableDataType="string"/>
                        </L7p:item>
                        <L7p:item binary="included">
                            <L7p:CaseSensitive booleanValue="false"/>
                            <L7p:Operator operator="EMPTY"/>
                            <L7p:RightValue stringValue="token_not_found"/>
                        </L7p:item>
                    </L7p:Predicates>
                </L7p:ComparisonAssertion>
                <L7p:SslAssertion/>
                <L7p:OAuth2Introspection>
                    <L7p:TrustGatewayAsIssuer booleanValue="true"/>
                </L7p:OAuth2Introspection>
                <L7p:SetVariable>
                    <L7p:Base64Expression stringValue="dHJ1ZQ=="/>
                    <L7p:VariableToSet stringValue="oauth2i.validated"/>
                </L7p:SetVariable>
                <L7p:assertionComment>
                    <L7p:Properties mapValue="included">
                        <L7p:entry>
                            <L7p:key stringValue="RIGHT.COMMENT"/>
                            <L7p:value stringValue="Bearer token credentials"/>
                        </L7p:entry>
                    </L7p:Properties>
                </L7p:assertionComment>
            </wsp:All>
            <wsp:All wsp:Usage="Required">
                <L7p:ComparisonAssertion>
                    <L7p:CaseSensitive booleanValue="false"/>
                    <L7p:Expression1 stringValue="${oauth2i.error}"/>
                    <L7p:ExpressionIsVariable booleanValue="false"/>
                    <L7p:Operator operatorNull="null"/>
                    <L7p:Predicates predicates="included">
                        <L7p:item dataType="included">
                            <L7p:Type variableDataType="string"/>
                        </L7p:item>
                        <L7p:item binary="included">
                            <L7p:CaseSensitive booleanValue="false"/>
                            <L7p:RightValue stringValue="token_not_found"/>
                        </L7p:item>
                    </L7p:Predicates>
                </L7p:ComparisonAssertion>
                <L7p:SslAssertion/>
                <L7p:HttpBasic/>
                <L7p:assertionComment>
                    <L7p:Properties mapValue="included">
                        <L7p:entry>
                            <L7p:key stringValue="RIGHT.COMMENT"/>
                            <L7p:value stringValue="Basic credentials"/>
                        </L7p:entry>
                    </L7p:Properties>
                </L7p:assertionComment>
            </wsp:All>
            <wsp:All wsp:Usage="Required">
                <L7p:SetVariable>
                    <L7p:Base64Expression stringValue="QXV0aGVudGljYXRpb24gZmFpbGVkLg=="/>
                    <L7p:VariableToSet stringValue="error_description"/>
                </L7p:SetVariable>
                <wsp:OneOrMore wsp:Usage="Required">
                    <wsp:All wsp:Usage="Required">
                        <L7p:ComparisonAssertion>
                            <L7p:CaseSensitive booleanValue="false"/>
                            <L7p:Expression1 stringValue="${oauth2i.error}"/>
                            <L7p:ExpressionIsVariable booleanValue="false"/>
                            <L7p:Operator operatorNull="null"/>
                            <L7p:Predicates predicates="included">
                                <L7p:item dataType="included">
                                    <L7p:Type variableDataType="string"/>
                                </L7p:item>
                                <L7p:item binary="included">
                                    <L7p:Negated booleanValue="true"/>
                                    <L7p:Operator operator="EMPTY"/>
                                    <L7p:RightValue stringValue=""/>
                                </L7p:item>
                                <L7p:item binary="included">
                                    <L7p:Negated booleanValue="true"/>
                                    <L7p:RightValue stringValue="token_not_found"/>
                                </L7p:item>
                            </L7p:Predicates>
                        </L7p:ComparisonAssertion>
                        <L7p:CustomizeErrorResponse>
                            <L7p:Content stringValue="${error_description}"/>
                            <L7p:ExtraHeaders nameValuePairArray="included"/>
                            <L7p:HttpStatus stringValue="401"/>
                        </L7p:CustomizeErrorResponse>
                    </wsp:All>
                    <L7p:TrueAssertion/>
                </wsp:OneOrMore>
                <L7p:FalseAssertion/>
                <L7p:assertionComment>
                    <L7p:Properties mapValue="included">
                        <L7p:entry>
                            <L7p:key stringValue="RIGHT.COMMENT"/>
                            <L7p:value stringValue="No credentials"/>
                        </L7p:entry>
                    </L7p:Properties>
                </L7p:assertionComment>
            </wsp:All>
        </wsp:OneOrMore>
        <wsp:OneOrMore wsp:Usage="Required">
            <L7p:ComparisonAssertion>
                <L7p:CaseSensitive booleanValue="false"/>
                <L7p:Expression1 stringValue="${oauth2i.validated}"/>
                <L7p:ExpressionIsVariable booleanValue="false"/>
                <L7p:Operator operatorNull="null"/>
                <L7p:Predicates predicates="included">
                    <L7p:item dataType="included">
                        <L7p:Type variableDataType="string"/>
                    </L7p:item>
                    <L7p:item binary="included">
                        <L7p:RightValue stringValue="true"/>
                    </L7p:item>
                </L7p:Predicates>
            </L7p:ComparisonAssertion>
            <L7p:Authentication>
                <L7p:IdentityProviderOid goidValue="0000000000000000fffffffffffffffe"/>
            </L7p:Authentication>
            <wsp:All wsp:Usage="Required">
                <L7p:CustomizeErrorResponse>
                    <L7p:Content stringValue="${error_description}"/>
                    <L7p:ExtraHeaders nameValuePairArray="included">
                        <L7p:item nameValuePair="included">
                            <L7p:Key stringValue="WWW-Authenticate"/>
                            <L7p:Value stringValue="Basic realm=&quot;L7SSGBasicRealm&quot;"/>
                        </L7p:item>
                    </L7p:ExtraHeaders>
                    <L7p:HttpStatus stringValue="401"/>
                </L7p:CustomizeErrorResponse>
                <L7p:AddHeader>
                    <L7p:HeaderName stringValue="WWW-Authenticate"/>
                    <L7p:HeaderValue stringValue="Basic realm=&quot;L7SSGBasicRealm&quot;"/>
                    <L7p:Target target="RESPONSE"/>
                </L7p:AddHeader>
                <L7p:FalseAssertion/>
            </wsp:All>
        </wsp:OneOrMore>
        <L7p:SetVariable>
            <L7p:Base64Expression stringValue="RXJyb3IgZW5jb3VudGVyZWQgaW4gcHJvY2Vzc2luZyB0aGUgcmVxdWVzdC4gUGxlYXNlIGNoZWNrIHRoZSBTU0cgYXVkaXRzL2xvZ3MvYWRtaW5pc3RyYXRvciBmb3IgbW9yZSBpbmZvcm1hdGlvbiBhYm91dCB0aGUgcHJvYmxlbS4="/>
            <L7p:VariableToSet stringValue="error_description"/>
        </L7p:SetVariable>
        <L7p:CustomizeErrorResponse>
            <L7p:Content stringValue="{ &quot;errors&quot;: [ { &quot;message&quot;: &quot;${error_description}&quot; } ] }"/>
            <L7p:ContentType stringValue="application/json; charset=UTF-8"/>
            <L7p:ExtraHeaders nameValuePairArray="included"/>
            <L7p:HttpStatus stringValue="200"/>
        </L7p:CustomizeErrorResponse>
        <L7p:GatewayGraphQL/>
    </wsp:All>
</wsp:Policy>
