<?xml version="1.0" encoding="UTF-8"?>
<settings prefix="modules.appkit.auth." xmlns="http://agavi.org/agavi/config/parts/module/1.0" xmlns:ae="http://agavi.org/agavi/config/global/envelope/1.0">

    <!--

        **********************************************************************


        auth.xml - authentication and authorisation for icinga-web

        * After changes please clear the cache (rm -rf app/cache/config/*.php)
        * All provider writes massive output to debug log (app/data/log/debug-*)

        **********************************************************************


    -->

    <!--
       This is how group-inheritance works. Top-down is like
       class inheritance: The deepest group gets all credentials.

       Setting this to 'false' its more like group management
       systems like LDAP/AD: The group on top will get all
       credentials
    -->
    <setting name="behaviour.group_topdown">true</setting>

    <!-- Allow silent providers (like HTTPBasicAuthentication) -->
    <setting name="behaviour.enable_silent">true</setting>

    <!--
        Allow dialog based authentication
        * Are both settings enabled, the dialog will be displayed as fallback
    -->
    <setting name="behaviour.enable_dialog">true</setting>

    <!--
        Enable store of login name into cookie and provide
        this as default username for the login mask
    -->
    <setting name="behaviour.store_loginname">true</setting>

    <!-- Provider default settings -->
    <setting name="defaults">
        <!--
            * auth_create
            Try to import the user profile on initial creation
        -->
        <ae:parameter name="auth_create">false</ae:parameter>

        <!--
            * auth_update
            Update changes in the userprofile
        -->
        <ae:parameter name="auth_update">false</ae:parameter>

        <!--
            * auth_resume
            Do not stop if a provider has knows the user, but cat not authorize

            If auth_authoritative is disabled and auth_import / auth_update is enabled the
            provider can create the user profile and delegates the authentication to other
            providers (Cool thing for HTTPBasicAuth with Apache2/Kerberos and LDAP to
            import users).


        -->

        <ae:parameter name="auth_resume">true</ae:parameter>

        <!--
            * auth_groups
            Comma seperated list of icinga group name a new user will be
            added to
        -->
        <ae:parameter name="auth_groups">icinga_user</ae:parameter>

        <!--
            * auth_enable
            If the provider is enabled or not
        -->
        <ae:parameter name="auth_enable">false</ae:parameter>

        <!--
            * auth_authoritative
            Use this provider to authenticate users
        -->
        <ae:parameter name="auth_authoritative">false</ae:parameter>

        <!--
            * auth_lowercase_username
            Convert every username to lowercase
        -->
        <ae:parameter name="auth_lowercase_username">true</ae:parameter>


        <!-- Just including your configuration -->
        <xi:include
            xmlns:xi="http://www.w3.org/2001/XInclude"
            href="/var/www/icinga-web/etc/conf.d/auth.xml"
            xpointer="xpointer(//settings/setting[@name='defaults']/node())">
            <xi:fallback></xi:fallback>
        </xi:include>
    </setting>

    <!--
        * provider
        List of providers used for this installation.
    -->
    <setting name="provider">
        <!--
            * internal database authentication
            Better to change nothing here
        -->

        <ae:parameter name="internal">
            <ae:parameter name="auth_module">AppKit</ae:parameter>
            <ae:parameter name="auth_provider">Auth.Provider.Database</ae:parameter>

            <ae:parameter name="auth_enable">true</ae:parameter>
            <ae:parameter name="auth_authoritative">true</ae:parameter>
        </ae:parameter>

        <!--
            * api key
            Providing user defined api key in the url to authenticate as fast as possible
            Also please change anything ;-)
        -->
        <ae:parameter name="auth_key">
            <ae:parameter name="auth_module">AppKit</ae:parameter>
            <ae:parameter name="auth_provider">Auth.Provider.AuthKey</ae:parameter>
            <ae:parameter name="auth_enable">true</ae:parameter>
            <ae:parameter name="auth_authoritative">true</ae:parameter>
        </ae:parameter>

        <!--
            * LDAP
            Just an example for MSAD
        -->

        <!--
            <ae:parameter name="msad-ldap1">
            <ae:parameter name="auth_module">AppKit</ae:parameter>
            <ae:parameter name="auth_provider">Auth.Provider.LDAP</ae:parameter>
            <ae:parameter name="auth_enable">true</ae:parameter>
            <ae:parameter name="auth_authoritative">true</ae:parameter>
            <ae:parameter name="auth_create">true</ae:parameter>
            <ae:parameter name="auth_update">true</ae:parameter>

            <ae:parameter name="auth_map">
                <ae:parameter name="user_firstname">givenName</ae:parameter>
                <ae:parameter name="user_lastname">sn</ae:parameter>
                <ae:parameter name="user_email">mail</ae:parameter>
            </ae:parameter>

            <ae:parameter name="ldap_allow_anonymous">false</ae:parameter>
            <ae:parameter name="ldap_dsn">ldap://ad.icinga.foo</ae:parameter>
            <ae:parameter name="ldap_start_tls">false</ae:parameter>
            <ae:parameter name="ldap_basedn">DC=ad,DC=icinga,DC=foo</ae:parameter>
            <ae:parameter name="ldap_binddn">serviceuser@AD.ICINGA.FOO</ae:parameter>
            <ae:parameter name="ldap_bindpw"><![CDATA[XXXXXXXX]]></ae:parameter>
            <ae:parameter name="ldap_filter_user"><![CDATA[(&(sAMAccountName=__USERNAME__))]]></ae:parameter>
        </ae:parameter>
        -->

        <!--
            * LDAP (Again)
            Authenticate against OpenLdap
        -->
        <!--
        <ae:parameter name="openldap-ldap1">
            <ae:parameter name="auth_module">AppKit</ae:parameter>
            <ae:parameter name="auth_provider">Auth.Provider.LDAP</ae:parameter>
            <ae:parameter name="auth_enable">true</ae:parameter>
            <ae:parameter name="auth_authoritative">false</ae:parameter>
            <ae:parameter name="auth_create">true</ae:parameter>
            <ae:parameter name="auth_update">true</ae:parameter>

            <ae:parameter name="auth_map">
                <ae:parameter name="user_firstname">givenName</ae:parameter>
                <ae:parameter name="user_lastname">sn</ae:parameter>
                <ae:parameter name="user_email">mail</ae:parameter>
            </ae:parameter>
            <ae:parameter name="ldap_allow_anonymous">false</ae:parameter>
            <ae:parameter name="ldap_dsn">ldap://ldap.myopenldap.foo/</ae:parameter>
            <ae:parameter name="ldap_start_tls">false</ae:parameter>
            <ae:parameter name="ldap_basedn">dc=myopenldap,dc=foo</ae:parameter>
            <ae:parameter name="ldap_binddn">cn=user,ou=authusers,dc=myopenldap,dc=foo</ae:parameter>
            <ae:parameter name="ldap_bindpw"><![CDATA[XXXXXXXXX]]></ae:parameter>
            <ae:parameter name="ldap_filter_user"><![CDATA[(&(uid=__USERNAME__))]]></ae:parameter>
        </ae:parameter>
        -->

        <!--
            * HTTP basic authentication
            Passes through any server environment variables to authenticate based on usernames only

            !! Keep in mind that this provider says always yes if suitable user found!

        -->
        <ae:parameter name="http-basic-authentication">
            <ae:parameter name="auth_module">AppKit</ae:parameter>
            <ae:parameter name="auth_provider">Auth.Provider.HTTPBasicAuthentication</ae:parameter>


            <!--

                HTTPBasicAuth allows authentication requests made by
                the webserver. To enable the provider please:

                * Activate the whole thing by setting auth_enable to true
                * Allow authenticate requests, set auth_authoritative true
            -->

            <ae:parameter name="auth_enable">true</ae:parameter>
            <ae:parameter name="auth_authoritative">true</ae:parameter>

            <!--
                This provider can create dummy users
                * Not really a good idea, let other providers to for you
                * Or create the user manually
            -->
            <!-- <ae:parameter name="auth_create">true</ae:parameter> -->

            <!-- Fields to search for the username -->
            <ae:parameter name="http_uservar">REMOTE_USER,PHP_AUTH_USER,REDIRECT_REMOTE_USER</ae:parameter>

            <!-- Field to search for the authtype -->
            <ae:parameter name="http_typevar">AUTH_TYPE</ae:parameter>

            <!-- Source for the data (_SERVER == $_SERVER == 'only one') -->
            <ae:parameter name="http_source">_SERVER</ae:parameter>

            <!--
                Set realm to the same as your apache AuthName to send
                the right headers at logout
            -->
            <ae:parameter name="http_realm">Icinga Access</ae:parameter>
        </ae:parameter>

        <!-- Just including your configuration -->
        <xi:include
            xmlns:xi="http://www.w3.org/2001/XInclude"
            href="/var/www/icinga-web/etc/conf.d/auth.xml"
            xpointer="xpointer(//settings/setting[@name='provider']/node())">
            <xi:fallback></xi:fallback>
        </xi:include>
    </setting>

    <setting name="message">
        <ae:parameter name="show">true</ae:parameter>
        <ae:parameter name="title">Welcome</ae:parameter>

        <ae:parameter name="text"><![CDATA[]]></ae:parameter>
        <ae:parameter name="include_file"><![CDATA[%core.share_dir%/login_message.html]]></ae:parameter>
        <ae:parameter name="expand_first">false</ae:parameter>

        <!-- Just including your configuration -->
        <xi:include
            xmlns:xi="http://www.w3.org/2001/XInclude"
            href="/var/www/icinga-web/etc/conf.d/auth.xml"
            xpointer="xpointer(//settings/setting[@name='message']/node())">
            <xi:fallback></xi:fallback>
        </xi:include>
    </setting>

</settings>
