kimai:
  saml:
    provider: keycloak
    activate: true
    title: Login with SAML
    mapping:
      - { saml: $Email, kimai: email }
      - { saml: $FirstName $LastName, kimai: alias }
    roles:
      resetOnLogin: true
      attribute: Groups
      mapping:
        - { saml: Admin, kimai: ROLE_SUPER_ADMIN }
        - { saml: Manager, kimai: ROLE_ADMIN }
        - { saml: Teamlead, kimai: ROLE_TEAMLEAD }
    connection:
        idp:
            entityId: 'https://access.frecure.de/realms/master'
            singleSignOnService:
                url: 'https://access.frecure.de/realms/master/protocol/saml'
                binding: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect'
            x509cert: 'MIICmzCCAYMCBgGWSsGKHjANBgkqhkiG9w0BAQsFADARMQ8wDQYDVQQDDAZtYXN0ZXIwHhcNMjUwNDE4MjExMzM5WhcNMzUwNDE4MjExNTE5WjARMQ8wDQYDVQQDDAZtYXN0ZXIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDZIJldPGKd9i3UVe+S0M5D3IHvxtMJSrS0/jqAbtDOzALimoEN0RD364ugCGu+UjYrrHr+YxrMTvHSYwFqHK5Bfw260MFVXovltu5dJa5GDYIbfQCsdYO+WqXFdMyweshkPLMCuNffeA+/mdfr9iWUURSbtb6rQfQBpiBmklwb1gRYfCqBYwbNR8Tbs49puG6sOnwegfIHQQU4aRAxq3hm1CJSetk8+yosWSdvz6+mF03TcII1eTkE/IC+Fr1P0vcK3ysNxzB+pIejpOUGkztAkycoPFQXsglieH5zd6AA3VZCdNRfQOzY32Df5gs5BbDBYDHRhQH1SrUsrgH78jPlAgMBAAEwDQYJKoZIhvcNAQELBQADggEBALL8BJ7B7FCEgXC9VdNmeLI0+LTAj1pr0aIrsDcrfxGvSUPysPUeXiijAMmB2pcbEYUoPacta7A+7PEm9WVI4+oTZzD9eIoP/1duO87y2h1QalWQr+xGlcCHy0RNDWn75zjeJlAxOM2ketdhz7K+Jyu0Ve/wXHXvZkMoaJMOzSf1qga0rslLRJLdJ5srtLWaiACMbzP2uV/FW4Abo4bAH1CB5vZsq3SykCFY32F63Nc/GzbfNANDC5Ye2Z74qBCr1gAQVDPb3MWmGkw8QMx7CdJfRc5eqxE3gMbWllnPCNxBzqDZn8Fb7yoig2jGy5hVZT9MOhx5IqCOqPtfx/PPPM0='
        sp:
            entityId: 'https://traniso.kaabarerp.com/public/auth/saml/metadata'
            assertionConsumerService:
                url: 'https://traniso.kaabarerp.com/public/auth/saml/acs'
                binding: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST'
            singleLogoutService:
                url: 'https://traniso.kaabarerp.com/public/auth/saml/logout'
                binding: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect'
        strict: true
        debug: false
        # Security settings
        security:
            nameIdEncrypted: false
            authnRequestsSigned: false
            logoutRequestSigned: false
            logoutResponseSigned: false
            wantMessagesSigned: false
            wantAssertionsSigned: false
            wantNameIdEncrypted: false
            requestedAuthnContext: true
            signMetadata: false
            wantXMLValidation: true
            signatureAlgorithm: 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256'
            digestAlgorithm: 'http://www.w3.org/2001/04/xmlenc#sha256'
        contactPerson:
            technical:
                givenName: 'Kimai Admin'
                emailAddress: 'admin@example.com'
            support:
                givenName: 'Kimai Support'
                emailAddress: 'support@example.com'
        organization:
            en:
                name: 'Kimai'
                displayname: 'Kimai'
                url: 'https://traniso.kaabarerp.com/public'
