version: "1.6"
source: "APPSBACL_Fiche_projet_detaillée_1.14.pdf"
version_minimale_playbook: "2.8.4"

appList:

        
  # DMZ
  - path: '/APPSBACL'
    spList: [ 'APPSBACL_agr', 'APPSBACL_rac', 'APPSBACL_dmz' ]
    authn: 'mdp'
    accessControl:
      - and:
        - or:
          # Niveau d'authentification
          - rule: { require: 'authnContextClassRef', value: 'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport' }
          - rule: { require: 'authnContextClassRef', value: 'urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken' }
        # Regles d'acces
        - or:
          - rule: { require: 'ATTRIBUTGROUPES', value: 'SAPP_NAT_AUTO' }
          - rule: { require: 'ATTRIBUTGROUPES', value: 'SAPP1D_NAT_AUTO' }
          - rule: { require: 'ATTRIBUTGROUPES', value: 'SAPP_NAT' }
          - rule: { require: 'ATTRIBUTGROUPES', value: 'SAPP1D_NAT' }        
          - rule: { require: 'ATTRIBUTGROUPES', value: 'SAPP_ACAD_AUTO' }   
          - rule: { require: 'ATTRIBUTGROUPES', value: 'SAPP1D_ACAD_AUTO' }   
          - rule: { require: 'ATTRIBUTGROUPES', value: 'SAPP_ACAD' }   
          - rule: { require: 'ATTRIBUTGROUPES', value: 'SAPP1D_ACAD' }   
          - rule: { require: 'ATTRIBUTGROUPES', value: 'SAPP_ADMIN_ACAD' }
          - rule: { require: 'ATTRIBUTGROUPES', value: 'SAPP1D_ADMIN_ACAD' }
          - rule: { require: 'ATTRIBUTGROUPES', value: 'SAPP_ADMIN_NAT' }
          - rule: { require: 'ATTRIBUTGROUPES', value: 'SAPP1D_ADMIN_NAT' }
          - ruleRegex: { require: 'FrEduGestResp', value: '805[$]SAPP1D_ACAD$'} 
          - ruleRegex: { require: 'FrEduGestResp', value: '805[$]SAPP1D_ACAD_AUTO$'} 
          - rule: { require: 'fonction', value: 'DIR' }
          - ruleRegex: { require: 'delegation', value: '^APPSBACL\|/redirectionhub/redirect.jsp\?applicationname=APPSBACL.*$' }
          - ruleRegex: { require: 'delegation', value: '^APPSBACL\|/mdp/redirectionhub/redirect.jsp\?applicationname=APPSBACL.*$' }
          - rule: { require: 'fonction', value: 'IEN1D' }
          - rule: { require: 'fonction', value: 'DIO' }
          - rule: { require: 'poste', value: 'INS' }
            

  # APPSBACL DMZ (AGRI)  
  - path: '/APPSBACL'
    spList: [ 'APPSBACL_ext' ]
    authn: 'mdp'
    accessControl:       
      - and:
        - or:
          # Niveau d'authentification          
          - rule: { require: 'authnContextClassRef', value: 'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport' }
          - rule: { require: 'authnContextClassRef', value: 'urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken' }          
        # Regles d'acces
        - or:
          - and:
            - rule: { require: 'typensi', value: 'EXT-AGRI' }
            - rule: { require: 'fonction', value: 'DIR' }
          # Délégué du chef d’établissement AGRI   
          - ruleRegex: { require: 'delegation', value: '^APPSBACL\|/redirectionhub/redirect.jsp\?applicationname=APPSBACL.*$' }
          - ruleRegex: { require: 'delegation', value: '^APPSBACL\|/mdp/redirectionhub/redirect.jsp\?applicationname=APPSBACL.*$' }


attrSpList: [ 'APPSBACL_agr', 'APPSBACL_rac', 'APPSBACL_dmz', 'APPSBACL_ext' ]

attrList:
  - name: 'adressem'
    aliases:
      - 'login'
  - name: 'ATTRIBUTGROUPES'
    filterValuesRegex:
      - '^SAPP.*$'       
  - name: 'commonname'
  - name: 'codacademique'
  - name: 'civilite'
  - name: 'familyname'
  - name: 'lname'
  - name: 'domaineaca'
  - name: 'uaiex'
  - name: 'uairesp'
  - name: 'travail'
  - name: 'delegation'
    multivalueConvertAxM: 'true'
    filterValuesRegex:
      - '^APPSBACL\|.*$'
  - name: 'uairesp'
  - name: 'poste'
  - name: 'typeinterne'
