IdP configuration

IdP Metadata XML*

</div>
                    </div>
                </div>

<h3>SP configuration</h3>

<div class="control-group">
                    <label for="samlSPParams.entityId" class="control-label">SP entity ID*</label>
                    <div class="controls">
                        <input id="samlSPParams.entityId" type="text" class="input-xxlarge" ng-model="generalSettings.ssoSettings.samlSPParams.entityId" required/>
                        <span class="help-inline">Service provider EntityId (mandatory)</span>
                    </div>
                </div>

<div class="control-group">
                    <label for="samlSPParams.acsURL" class="control-label">SP ACS URL*</label>
                    <div class="controls">
                        <input id="samlSPParams.acsURL" type="text" class="input-xxlarge" ng-model="generalSettings.ssoSettings.samlSPParams.acsURL" required/>
                        <span class="help-inline">Service provider Attribute Consume Service Endpoint (mandatory)</span>
                    </div>
                </div>

<div class="control-group">
                    <label for="samlSPParams.signRequests" class="control-label">Sign requests</label>
                    <div class="controls" >
                        <input id="samlSPParams.signRequests" type="checkbox" ng-model="generalSettings.ssoSettings.samlSPParams.signRequests" />
                        <span class="help-inline">Sign SAML requests</span>
                    </div>
                </div>

<fieldset ng-if="generalSettings.ssoSettings.samlSPParams.signRequests">
                    <div class="control-group">
                        <label for="samlSPParams.keystoreFile" class="control-label">Keystore file*</label>
                        <div class="controls">
                            <input id="samlSPParams.keystoreFile" type="text" class="input-xxlarge" ng-model="generalSettings.ssoSettings.samlSPParams.keystoreFile" required/>
                            <span class="help-inline">PKCS#12 file containing signing key and certificate (mandatory)</span>
                        </div>
                    </div>

<div class="control-group">
                        <label for="samlSPParams.keystorePassword" class="control-label">Keystore password</label>
                        <div class="controls">
                            <input id="samlSPParams.keystorePassword" type="password" ng-model="generalSettings.ssoSettings.samlSPParams.keystorePassword" />
                            <span class="help-inline">Keystore file password</span>
                        </div>
                    </div>

<div class="control-group">
                        <label for="samlSPParams.keyAlias" class="control-label">Key alias in keystore</label>
                        <div class="controls">
                            <input id="samlSPParams.keyAlias" type="text"  ng-model="generalSettings.ssoSettings.samlSPParams.keyAlias" />
                            <span class="help-inline">Signing key alias (required if keystore contains multiple keys)</span>
                        </div>
                    </div>

<div class="control-group">
                        <label for="samlSPParams.hashingAlgorithm" class="control-label">Hashing algorithm*</label>
                        <div class="controls">
                            <select ng-model="generalSettings.ssoSettings.samlSPParams.hashingAlgorithm" id="samlSPParams.hashingAlgorithm" required>
                                <option value="SHA1">SHA-1</option>
                                <option value="SHA256">SHA-256</option>
                            </select>
                            <span class="help-inline">Algorithm used to hash the SAML request. SHA-256 is recommended, if your IdP support it.</span>
                        </div>
                    </div>
                </fieldset>

<h3>Users mapping</h3>

<div class="control-group">
                    <label for="saml-login-attribute" class="control-label">Login attribute</label>
                    <div class="controls">
                        <input id="saml-login-attribute" type="text" ng-model="generalSettings.ssoSettings.samlLoginAttribute" />
                        <span class="help-inline">Attribute of the assertion to use as user's login</span>
                    </div>
                </div>
                <div class="control-group">
                    <label for="" class="control-label">Login remapping rules</label>
                    <div class="controls" >
                        <ng2-key-values-list
                            [(items)]="generalSettings.ssoSettings.remappingRules"
                            add-label="Add Remapping Rule"
                            key-placeholder="Regexp"
                            value-placeholder="Replacement string"
                            key-identifier="ruleFrom"
                            value-identifier="ruleTo">
                        </ng2-key-values-list>
                        <span class="help-inline">Remapping from the assertion attribute value to the DSS login. Regular expressions are expressed in Java syntax. Use '()' to capture a substring and '$1' in the replacement string to retrieve it</span>
                    </div>
                </div>

<div class="control-group">
                    <label for="saml-display-name-attribute" class="control-label">Display name attribute</label>
                    <div class="controls">
                        <input id="saml-display-name-attribute" type="text"  ng-model="generalSettings.ssoSettings.samlSPParams.displayNameAttribute" />
                        <span class="help-inline">Attribute of the assertion to use as user's display name</span>
                    </div>
                </div>
                <div class="control-group">
                    <label for="saml-email-attribute" class="control-label">Email attribute</label>
                    <div class="controls">
                        <input id="saml-email-attribute" type="text"  ng-model="generalSettings.ssoSettings.samlSPParams.emailAttribute" />
                        <span class="help-inline">Attribute of the assertion to use as user's email</span>
                    </div>
                </div>

<div class="control-group">
                    <label for="ssoSettings.samlSPParams.enableGroups" class="control-label">Enable group support</label>
                    <div class="controls" >
                        <input id="ssoSettings.samlSPParams.enableGroups" type="checkbox" ng-model="generalSettings.ssoSettings.samlSPParams.enableGroups"/>
                    </div>
                </div>
                <div class="alert alert-warning" ng-if="generalSettings.ssoSettings.autoSyncUsersAtLoginTime && !generalSettings.ssoSettings.samlSPParams.enableGroups && generalSettings.authSyncSettings.syncUserProfile">
                    Synchronization of profile at login time is enabled, but group support is not. This implies that the profile of users using SSO to log in will always be set to the default profile of your license ({{ appConfig.licensing.fallbackProfile }}), which is probably not the desired behavior.
                    It is recommended to disable the "Synchronize user profile" option in the "User synchronization" section, or to enable group support.
                </div>

<div ng-if="generalSettings.ssoSettings.samlSPParams.enableGroups">
                    <div class="control-group">
                        <label for="saml-groups-attribute" class="control-label">Groups attribute</label>
                        <div class="controls">
                            <input id="saml-groups-attribute" type="text"  ng-model="generalSettings.ssoSettings.samlSPParams.groupsAttribute" />
                            <span class="help-inline">Attribute of the assertion to use as user's groups set. The mapping of SAML group names to DSS groups can be defined in each DSS group settings</span>
                        </div>
                    </div>
                    <div class="control-group">
                        <label class="control-label">Groups restriction</label>
                        <div class="controls">
                            <ng2-values-list
                                    [(items)]="generalSettings.ssoSettings.authorizedGroups"
                                    value-placeholder="group name"
                                    add-label="Add group">
                            </ng2-values-list>
                            <span class="help-inline">
                                Optional list of SSO group names that are allowed to login to DSS. If empty, all SSO users are allowed to login
                            </span>
                        </div>
                    </div>
                </div>
            </div>

<div ng-if="generalSettings.ssoSettings.enabled && generalSettings.ssoSettings.protocol == 'OPENID'">
                <h3>IDP configuration</h3>

<div class="control-group">
                    <label for="openid-wellknown" class="control-label">Well-known URL</label>
                    <div class="controls">
                        <input id="openid-wellknown" type="text" class="input-xxlarge" placeholder="Your IdP config URI (ex: https://my-idp/.well-known/openid-configuration)" ng-model="openIdWellKnown" ng-init="computeWellKnowFromIssuer()"/>
                        <button class="btn btn--contained btn--primary" ng-click="fetchOpenIDConfig(openIdWellKnown)" ng-disabled="!openIdWellKnown">
                            <i class="icon-sync-file"></i> Fetch IdP configuration
                        </button>
                        <span class="help-inline">If you have a well-known URL, enter it here, and click the button in order to automatically fill the next 4 fields</span>

</div>
                </div>

<div class="control-group">
                    <label for="openid-issuer" class="control-label">Issuer*</label>
                    <div class="controls">
                        <input id="openid-issuer" type="text" class="input-xxlarge" ng-model="generalSettings.ssoSettings.openIDParams.issuer" ng-change="computeWellKnowFromIssuer()" required/>
                    </div>
                </div>

<div class="control-group">
                    <label for="openid-auth-endpoint" class="control-label">Authorization endpoint*</label>
                    <div class="controls">
                        <input id="openid-auth-endpoint" type="text" class="input-xxlarge" ng-model="generalSettings.ssoSettings.openIDParams.authorizationEndpoint" required/>
                        <span class="help-inline"></span>
                    </div>
                </div>

<div class="control-group">
                    <label for="openid-token-endpoint" class="control-label">Token endpoint*</label>
                    <div class="controls">
                        <input id="openid-token-endpoint" type="text" class="input-xxlarge" ng-model="generalSettings.ssoSettings.openIDParams.tokenEndpoint" required/>
                        <span class="help-inline"></span>
                    </div>
                </div>

<div class="control-group">
                    <label for="openid-jwk-uri" class="control-label">JWKs URI*</label>
                    <div class="controls">
                        <input id="openid-jwk-uri" type="text" class="input-xxlarge" ng-model="generalSettings.ssoSettings.openIDParams.jwksUri" required/>
                        <span class="help-inline">URL of the identity provider's JSON Web Key Set</span>
                    </div>
                </div>

<h3>OIDC Client configuration</h3>

<div class="control-group">
                    <label for="oidc-client-auth-method" class="control-label">Token endpoint auth method</label>
                    <div class="controls">
                        <select ng-model="generalSettings.ssoSettings.openIDParams.tokenEndpointAuthMethod" id="oidc-client-auth-method">
                            <option value="CLIENT_SECRET_BASIC">HTTP basic auth</option>
                            <option value="CLIENT_SECRET_POST">HTTP POST params</option>
                        </select>
                    </div>
                </div>

<div class="control-group">
                    <label for="openid-client-id" class="control-label">Client ID*</label>
                    <div class="controls">
                        <input id="openid-client-id" type="text" class="input-xxlarge" ng-model="generalSettings.ssoSettings.openIDParams.clientId" required/>
                        <span class="help-inline">The OIDC Client ID (mandatory)</span>
                    </div>
                </div>

<div class="control-group">
                    <label for="openid-client-secret" class="control-label">Client secret*</label>
                    <div class="controls">
                        <input id="openid-client-secret" type="password" class="input-xxlarge" ng-model="generalSettings.ssoSettings.openIDParams.clientSecret" required/>
                        <span class="help-inline">The OIDC Client secret (mandatory)</span>
                    </div>
                </div>

<div class="control-group">
                    <label for="openid-scope" class="control-label">Scope*</label>
                    <div class="controls">
                        <input id="openid-scope" type="text" class="input-xxlarge" placeholder="openid email" ng-model="generalSettings.ssoSettings.openIDParams.scope" required/>
                        <span class="help-inline">The OIDC scope for this client (mandatory). The 'openid' scope is mandatory. Scopes are separated by spaces.</span>
                    </div>
                </div>

<div class="control-group">
                    <label for="useGlobalProxy" class="control-label">Use global proxy settings</label>
                    <div class="controls">
                        <input id="useGlobalProxy" type="checkbox" ng-model="generalSettings.ssoSettings.openIDParams.useGlobalProxy" />
                    </div>
                </div>
                <div class="control-group">
                    <label for="usePKCE" class="control-label">Enable PKCE</label>
                    <div class="controls">
                        <input id="usePKCE" type="checkbox" ng-model="generalSettings.ssoSettings.openIDParams.usePKCE" />
                        <span class="help-inline">PKCE is a security feature made mandatory since OAuth 2.1. It is recommended to always have PKCE enabled, unless the IDP doesn't support it yet.</span>
                    </div>
                </div>
                <div class="control-group">
                    <label for="openid-prompt" class="control-label">Prompt</label>
                    <div class="controls">
                        <input id="openid-prompt" type="text" ng-model="generalSettings.ssoSettings.openIDParams.prompt" />
                        <span class="help-inline">Optional - Space delimited string values that specify whether the Authorization Server prompts the End-User for re-authentication and consent. Possible values: 'none', 'login', 'consent', 'select_account'</span>
                    </div>
                </div>

<h3>Users mapping</h3>

<div class="control-group">
                    <label for="openid-claim-key-username" class="control-label">Identifier claim key*</label>
                    <div class="controls">
                        <input id="openid-claim-key-username" type="text" placeholder="email" ng-model="generalSettings.ssoSettings.openIDParams.claimKeyIdentifier" required/>
                        <span class="help-inline">The ID Token claim to find the identifier (username or email)</span>
                    </div>
                </div>

<div class="control-group">
                    <label for="lowercaseIdentifier" class="control-label">Lowercase identifier</label>
                    <div class="controls">
                        <input id="lowercaseIdentifier" type="checkbox" ng-model="generalSettings.ssoSettings.openIDParams.lowercaseIdentifier" />
                        <span class="help-inline">
                            Ensures the OpenID identifier (e.g. email) is always converted to lowercase. 
                            Default is False.
                        </span>
                    </div>
                </div>

<div class="control-group">
                    <label for="" class="control-label">Login remapping rules</label>
                    <div class="controls" >
                        <ng2-key-values-list
                                [(items)]="generalSettings.ssoSettings.remappingRules"
                                add-label="Add Remapping Rule"
                                key-placeholder="Regexp"
                                value-placeholder="Replacement string"
                                key-identifier="ruleFrom"
                                value-identifier="ruleTo">
                        </ng2-key-values-list>
                        <span class="help-inline">Remapping from the assertion attribute value to the DSS login. Regular expressions are expressed in Java syntax. Use '()' to capture a substring and '$1' in the replacement string to retrieve it</span>
                    </div>
                </div>

<div class="control-group">
                    <label for="openid-claim-key-display-name" class="control-label">Display name attribute</label>
                    <div class="controls">
                        <input id="openid-claim-key-display-name" type="text" ng-model="generalSettings.ssoSettings.openIDParams.claimKeyDisplayName" />
                        <span class="help-inline">The ID Token claim to use as the user's display name (defaults to the identifier if not defined)</span>
                    </div>
                </div>

<div class="control-group">
                    <label for="openid-claim-key-email" class="control-label">Email attribute</label>
                    <div class="controls">
                        <input id="openid-claim-key-email" type="text" ng-model="generalSettings.ssoSettings.openIDParams.claimKeyEmail" />
                        <span class="help-inline">The ID Token claim to use as the user's email</span>
                    </div>
                </div>

<div class="control-group">
                    <label for="ssoSettings.openIDParams.enableGroups" class="control-label">Enable group support</label>
                    <div class="controls" >
                        <input id="ssoSettings.openIDParams.enableGroups" type="checkbox" ng-model="generalSettings.ssoSettings.openIDParams.enableGroups"/>
                    </div>
                </div>
                <div class="alert alert-warning" ng-if="generalSettings.ssoSettings.autoSyncUsersAtLoginTime && !generalSettings.ssoSettings.openIDParams.enableGroups && generalSettings.authSyncSettings.syncUserProfile">
                    Synchronization of profile at login time is enabled, but group support is not. This implies that the profile of users using SSO to log in will always be set to the default profile of your license ({{ appConfig.licensing.fallbackProfile }}), which is probably not the desired behavior.
                    It is recommended to disable the "Synchronize user profile" option in the "User synchronization" section, or to enable group support.
                </div>

<div ng-if="generalSettings.ssoSettings.openIDParams.enableGroups">
                    <div class="control-group" ng-if="generalSettings.ssoSettings.openIDParams.enableGroups">
                        <label for="openid-claim-key-groups" class="control-label">Groups attribute</label>
                        <div class="controls">
                            <input id="openid-claim-key-groups" type="text" ng-model="generalSettings.ssoSettings.openIDParams.claimKeyGroups" />
                            <span class="help-inline">The ID Token claim to use as the user's groups. The mapping of ID Token group names to DSS groups can be defined in each DSS group settings</span>
                        </div>
                    </div>

<div class="control-group" ng-if="generalSettings.ssoSettings.openIDParams.claimKeyGroups">
                        <label class="control-label">Groups restriction</label>
                        <div class="controls">
                            <ng2-values-list
                                    [(items)]="generalSettings.ssoSettings.authorizedGroups"
                                    value-placeholder="group name"
                                    add-label="Add group">
                            </ng2-values-list>
                            <span class="help-inline">
                                Optional list of SSO group names that are allowed to login to DSS. If empty, all SSO users are allowed to login
                            </span>
                        </div>
                    </div>
                </div>
            </div>

<fieldset ng-if="generalSettings.ssoSettings.enabled && generalSettings.ssoSettings.protocol == 'SPNEGO'">
                <h3>SPNEGO configuration</h3>

<div class="control-group">
                    <label for="ssoSettings.spnegoMode" class="control-label">Setup mode*</label>
                    <div class="controls">
                        <select id="ssoSettings.spnegoMode" dku-bs-select ng-model="generalSettings.ssoSettings.spnegoMode" ng-options="x[0] as x[1] for x in [['PREAUTH_KEYTAB', 'Service keytab'],['CUSTOM_LOGIN_CONF', 'Custom JAAS login.conf']]" required/>
                    </div>
                </div>

<div ng-if="generalSettings.ssoSettings.spnegoMode === 'PREAUTH_KEYTAB'">
                    <div class="control-group">
                        <label for="ssoSettings.spnegoPreauthKeytab" class="control-label">Keytab location*</label>
                        <div class="controls">
                            <input id="ssoSettings.spnegoPreauthKeytab" type="text" ng-model="generalSettings.ssoSettings.spnegoPreauthKeytab" placeholder="Absolute path" required/>
                        </div>
                    </div>
                    <div class="control-group">
                        <label for="ssoSettings.spnegoPreauthPrincipal" class="control-label">Principal*</label>
                        <div class="controls">
                            <input id="ssoSettings.spnegoPreauthPrincipal" type="text" ng-model="generalSettings.ssoSettings.spnegoPreauthPrincipal" placeholder="Generally: HTTP/host@REALM" required/>
                        </div>
                    </div>
                </div>

<div ng-if="generalSettings.ssoSettings.spnegoMode === 'CUSTOM_LOGIN_CONF'">
                    <div class="control-group">
                        <label for="ssoSettings.spnegoLoginConfFile" class="control-label">login.conf location*</label>
                        <div class="controls">
                            <input id="ssoSettings.spnegoLoginConfFile" type="text" ng-model="generalSettings.ssoSettings.spnegoLoginConfFile" placeholder="Absolute path" required/>
                        </div>
                    </div>
                    <div class="control-group">
                        <label for="ssoSettings.spnegoPreauthLogin" class="control-label">Preauth username</label>
                        <div class="controls">
                            <input id="ssoSettings.spnegoPreauthLogin" type="text" ng-model="generalSettings.ssoSettings.spnegoPreauthLogin" placeholder="Can be empty" />
                        </div>
                    </div>
                    <div class="control-group">
                        <label for="ssoSettings.spnegoPreauthPassword" class="control-label">Preauth password</label>
                        <div class="controls">
                            <input id="ssoSettings.spnegoPreauthPassword" type="text" ng-model="generalSettings.ssoSettings.spnegoPreauthPassword" placeholder="Can be empty" />
                        </div>
                    </div>
                </div>

<div class="control-group">
                    <label for="ssoSettings.spnegoKrb5File" class="control-label">krb5.conf file location</label>
                    <div class="controls">
                        <input id="ssoSettings.spnegoKrb5File" type="text" ng-model="generalSettings.ssoSettings.spnegoKrb5File" placeholder="Absolute path" />
                        <span class="help-inline">Optional, defaults to system location</span>
                    </div>
                </div>

<h3>Users mapping</h3>

<div class="control-group">
                    <label for="ssoSettings.spnegoStripRealm" class="control-label">Strip realm</label>
                    <div class="controls" >
                        <input id="ssoSettings.spnegoStripRealm" type="checkbox" ng-model="generalSettings.ssoSettings.spnegoStripRealm" />
                        <span class="help-inline">Strip @REALM from principal to get login name</span>
                    </div>
                </div>

</fieldset>

<fieldset ng-if="generalSettings.ssoSettings.enabled ">
                <h3>User profiles</h3>

<div class="control-group" ng-if="(generalSettings.ssoSettings.protocol == 'SAML' && generalSettings.ssoSettings.samlSPParams.enableGroups) || (generalSettings.ssoSettings.protocol == 'OPENID' && generalSettings.ssoSettings.openIDParams.enableGroups)">
                    <label for="" class="control-label">Group → profile mapping</label>
                    <table style="background: none;" class="controls">
                        <tr ng-repeat="elem in generalSettings.ssoSettings.groupProfiles">
                            <td >
                                <input type="text" ng-model="elem.group" placeholder="my-sso-group" required >
                            </td>
                            <td>
                                <select dku-bs-select ng-model="elem.profile" ng-options="x as x|niceProfileName for x in appConfig.licensing.userProfiles" required />
                            </td>
                            <td full-click>
                                <a main-click ng-click="deleteSSOGroupProfile($index)"> <i class="icon-trash" /></a>
                            </td>
                        </tr>
                    </table>
                    <div class="controls">
                        <button class="btn btn--secondary" ng-click="addSSOGroupProfile()" >
                            + Group defined profile
                        </button>
                        <span class="help-inline">
                            Defines a mapping from SSO group names to DSS user profile. When users match multiple profiles, the highest profile will be assigned.
                        </span>

</div>
                </div>

<div class="control-group">
                    <label for="ssoSettings.defaultUserProfile" class="control-label">Default user profile</label>
                    <div class="controls">
                        <select id="ssoSettings.defaultUserProfile" dku-bs-select ng-model="generalSettings.ssoSettings.defaultUserProfile" ng-options="x as x|niceProfileName for x in appConfig.licensing.userProfiles"/>
                        <span class="help-inline">
                            Default user profile to apply upon provisioning and resync.
                            <span ng-if="(generalSettings.ssoSettings.protocol == 'SAML' && generalSettings.ssoSettings.samlSPParams.groupsAttribute) || (generalSettings.ssoSettings.protocol == 'OPENID' && generalSettings.ssoSettings.openIDParams.claimKeyGroups)">Applies if no group → profile mapping rule matched.</span>
                        </span>
                    </div>
                </div>
            </fieldset>

</form>
    </div>

<div class="alert alert-error" ng-if="!appConfig.licensedFeatures.ldapAllowed" >
            <i class="icon-dku-error" />Your license does not allow you to enable LDAP authentication
        </div>

<div class="control-group">
                <label for="ldapSettings.enabled" class="control-label">Enable</label>
                <div class="controls" >
                    <input id="ldapSettings.enabled" type="checkbox" ng-model="generalSettings.ldapSettings.enabled" />
                    <span class="help-inline">Import users and groups from an external LDAP server</span>
                </div>
            </div>

<fieldset ng-if="generalSettings.ldapSettings.enabled">
                <div class="control-group">
                    <label for="ldapSettings.authenticationEnabled" class="control-label">Allow user authentication</label>
                    <div class="controls">
                        <input id="ldapSettings.authenticationEnabled" type="checkbox"
                               ng-model="generalSettings.ldapSettings.authenticationEnabled" />
                        <span class="help-inline">Allow users to authenticate with LDAP. Note: If SSO is enabled and users must authenticate via SSO but be imported via LDAP, disable this option and enable login-time provisioning.</span>
                    </div>
                </div>
                <div class="control-group">
                    <label for="ldapSettings.autoImportUsers" class="control-label">Login-time provisioning</label>
                    <div class="controls">
                        <input id="ldapSettings.autoImportUsers" type="checkbox"
                               ng-model="generalSettings.ldapSettings.autoImportUsers" />
                        <span class="help-inline">Automatically provision users from LDAP at login time</span>
                    </div>
                </div>
                <div class="control-group">
                    <label for="ldapSettings.autoSyncUsersAtLoginTime" class="control-label">Login-time resync</label>
                    <div class="controls">
                        <input id="ldapSettings.autoSyncUsersAtLoginTime" type="checkbox"
                               ng-model="generalSettings.ldapSettings.autoSyncUsersAtLoginTime" />
                        <span class="help-inline">Automatically resynchronize user properties at login time</span>
                    </div>
                </div>
                <div class="control-group">
                    <label for="ldapSettings.allowOnDemandUsersSync" class="control-label">Allow on-demand resync</label>
                    <div class="controls">
                        <input id="ldapSettings.allowOnDemandUsersSync" type="checkbox"
                               ng-model="generalSettings.ldapSettings.allowOnDemandUsersSync" />
                        <span class="help-inline">Allow resynchronization of user properties independently from login</span>
                    </div>
                </div>

<h3 id="ldap-connection">Connection</h3>
                <div class="control-group">
                    <label for="ldapSettings.url" class="control-label">LDAP server URL*</label>
                    <div class="controls">
                        <input id="ldapSettings.url" type="text" ng-model="generalSettings.ldapSettings.url" class="input-xxlarge" required/>
                        <span class="help-inline">ldap[s]://HOST[:PORT]/BASE (mandatory)</span>
                    </div>
                </div>
                <div class="control-group">
                    <label for="ldapSettings.useTls" class="control-label">Use TLS</label>
                    <div class="controls">
                        <input id="ldapSettings.useTls" type="checkbox" ng-model="generalSettings.ldapSettings.useTls" />
                        <span class="help-inline">Use Transport Layer Security</span>
                    </div>
                </div>
                <div class="control-group">
                    <label for="ldapSettings.trustAllCertificates" class="control-label">Trust all certificates</label>
                    <div class="controls">
                        <input id="ldapSettings.trustAllCertificates" type="checkbox" ng-model="generalSettings.ldapSettings.trustAllCertificates" />
                        <span class="help-inline">Accept all SSL/TLS certificates</span>
                    </div>
                </div>
                <div class="control-group">
                    <label for="ldapSettings.bindDN" class="control-label">Bind DN</label>
                    <div class="controls">
                        <input id="ldapSettings.bindDN" type="text" ng-model="generalSettings.ldapSettings.bindDN" class="input-xxlarge" />
                        <span class="help-inline">Authentication DN for LDAP queries</span>
                    </div>
                </div>
                <div class="control-group">
                    <label for="ldapSettings.bindPassword" class="control-label">Bind password</label>
                    <div class="controls">
                        <input id="ldapSettings.bindPassword" type="password" ng-model="generalSettings.ldapSettings.bindPassword" autocomplete="new-password"/>
                        <span class="help-inline">Authentication password for LDAP queries</span>
                    </div>
                </div>

<h3 id="ldap-user-mapping">Users mapping</h3>

<div class="control-group">
                    <label for="ldapSettings.userFilter" class="control-label">User filter by username*</label>
                    <div class="controls">
                        <input id="ldapSettings.userFilter" type="text" ng-model="generalSettings.ldapSettings.userFilter" class="input-xxlarge" required/>
                        <span class="help-inline">User search filter, with {USERNAME} placeholder (mandatory)</span>
                    </div>
                </div>
                <div class="control-group">
                    <label for="ldapSettings.displayNameAttribute" class="control-label">Display name attribute</label>
                    <div class="controls">
                        <input id="ldapSettings.displayNameAttribute" type="text" ng-model="generalSettings.ldapSettings.displayNameAttribute" />
                        <span class="help-inline">User attribute : display name (optional)</span>
                    </div>
                </div>
                <div class="control-group">
                    <label for="ldapSettings.emailAttribute" class="control-label">Email attribute</label>
                    <div class="controls">
                        <input id="ldapSettings.emailAttribute" type="text" ng-model="generalSettings.ldapSettings.emailAttribute" />
                        <span class="help-inline">User attribute : email (optional)</span>
                    </div>
                </div>
                <div class="control-group">
                    <label for="ldapSettings.enableGroups" class="control-label">Enable group support</label>
                    <div class="controls" >
                        <input id="ldapSettings.enableGroups" type="checkbox" ng-model="generalSettings.ldapSettings.enableGroups"
                        ng-disabled="appConfig.communityEdition" />
                        <span class="help-inline">Query groups for LDAP users</span>
                    </div>
                </div>
                <div class="alert alert-warning" ng-if="generalSettings.ldapSettings.autoSyncUsersAtLoginTime && !generalSettings.ldapSettings.enableGroups && generalSettings.authSyncSettings.syncUserProfile">
                    Synchronization of profile at login time is enabled, but group support is not. This implies that the profile of users using LDAP to log in will always be set to the default profile of your license ({{ appConfig.licensing.fallbackProfile }}), which is probably not the desired behavior.
                    It is recommended to disable the "Synchronize user profile" option in the "User synchronization" section, or to enable group support.
                </div>
                <div ng-if="generalSettings.ldapSettings.enableGroups">
                    <div class="control-group">
                        <label for="ldapSettings.groupFilter" class="control-label">Group filter by username*</label>
                        <div class="controls">
                            <input id="ldapSettings.groupFilter" type="text" ng-model="generalSettings.ldapSettings.groupFilter" class="input-xxlarge" required/>
                            <span class="help-inline">Group search filter, with {USERNAME} or {USERDN} placeholder (mandatory)</span>
                        </div>
                    </div>
                    <div class="control-group">
                        <label for="ldapSettings.groupNameAttribute" class="control-label">Group name attribute*</label>
                        <div class="controls">
                            <input id="ldapSettings.groupNameAttribute" type="text" ng-model="generalSettings.ldapSettings.groupNameAttribute" required/>
                            <span class="help-inline">Group attribute : group name (mandatory)</span>
                        </div>
                    </div>
                    <div class="control-group" ng-if="generalSettings.ldapSettings.groupNameAttribute">
                        <label class="control-label">Groups restriction</label>
                        <div class="controls">
                            <ng2-values-list
                                    [(items)]="generalSettings.ldapSettings.authorizedGroups"
                                    value-placeholder="group name"
                                    add-label="Add group">
                            </ng2-values-list>
                            <span class="help-inline">
                                Optional list of LDAP group names that are allowed to login to DSS. If empty, all LDAP users are allowed to login
                            </span>
                        </div>
                    </div>
                </div>

<h3 id="ldap-user-provisioning">On-demand provisioning</h3>

<div class="control-group">
                    <label for="ldapSettings.allowOnDemandUsersProvisioning" class="control-label">Allow on-demand provisioning</label>
                    <div class="controls">
                        <input id="ldapSettings.allowOnDemandUsersProvisioning" type="checkbox" ng-model="generalSettings.ldapSettings.allowOnDemandUsersProvisioning" />
                        <span class="help-inline">Allow provisioning of users independently from login</span>
                    </div>
                </div>

<div ng-if="generalSettings.ldapSettings.allowOnDemandUsersProvisioning">
                    <div class="control-group">
                        <label for="ldapSettings.allUsersFilter" class="control-label">All users filter*</label>
                        <div class="controls">
                            <input id="ldapSettings.allUsersFilter" type="text" ng-model="generalSettings.ldapSettings.allUsersFilter" class="input-xxlarge" required/>
                            <span class="help-inline">Filter to search all users - used to fetch and display LDAP users (mandatory)</span>
                        </div>
                    </div>
                    <div class="control-group">
                        <label for="ldapSettings.usernameAttribute" class="control-label">Username attribute*</label>
                        <div class="controls">
                            <input id="ldapSettings.usernameAttribute" type="text" ng-model="generalSettings.ldapSettings.usernameAttribute" />
                            <span class="help-inline">User attribute: username - used to select the LDAP attribute that will be applied as the username in DSS (mandatory)</span>
                        </div>
                    </div>
                    <div class="control-group">
                        <label class="control-label">Login remapping rules</label>
                        <div class="controls" >
                            <ng2-key-values-list
                                    [(items)]="generalSettings.ldapSettings.remappingRules"
                                    add-label="Add Remapping Rule"
                                    key-placeholder="Regexp"
                                    value-placeholder="Replacement string"
                                    key-identifier="ruleFrom"
                                    value-identifier="ruleTo">
                            </ng2-key-values-list>
                            <span class="help-inline">Remapping from the username user attribute value to the DSS login. Regular expressions are expressed in Java syntax. Use '()' to capture a substring and '$1' in the replacement string to retrieve it.
                            Note that you must be able to look up the resulting username in the LDAP with the above 'user filter by username'.</span>
                        </div>
                    </div>
                    <div ng-if="generalSettings.ldapSettings.enableGroups">
                        <div class="control-group" >
                            <label for="ldapSettings.allGroupsFilter" class="control-label">All groups filter*</label>
                            <div class="controls">
                                <input id="ldapSettings.allGroupsFilter" type="text" ng-model="generalSettings.ldapSettings.allGroupsFilter" class="input-xxlarge" required/>
                                <span class="help-inline">Filter to search all groups - used to fetch and display LDAP groups (mandatory)</span>
                            </div>
                        </div>
                        <div class="control-group">
                            <label for="ldapSettings.groupMembershipAttribute" class="control-label">Group membership attribute*</label>
                            <div class="controls">
                                <input id="ldapSettings.groupMembershipAttribute" type="text" ng-model="generalSettings.ldapSettings.groupMembershipAttribute" required/>
                                <span class="help-inline">Group attribute: group membership - used to select the LDAP attribute that contains the members of a group (mandatory)</span>
                            </div>
                        </div>
                        <div class="control-group">
                            <label for="ldapSettings.groupMembershipUserAttribute" class="control-label">Group membership user attribute*</label>
                            <div class="controls">
                                <select id="ldapSettings.groupMembershipUserAttribute" dku-bs-select ng-model="generalSettings.ldapSettings.groupMembershipUserAttribute" ng-options="x as x for x in ['UID', 'CN', 'DN']" required></select>
                                <span class="help-inline">User attribute used in the group membership attribute to specify the user (mandatory)</span>
                            </div>
                        </div>
                    </div>
                </div>

<h3 id="ldap-profiles-mapping" class="settings-section-subtitle">User profiles</h3>

<div class="control-group" ng-if="generalSettings.ldapSettings.enableGroups && generalSettings.ldapSettings.groupNameAttribute">
                    <label class="control-label">Group → profile mapping</label>
                    <table style="background: none;" class="controls">
                        <tr ng-repeat="elem in generalSettings.ldapSettings.groupProfiles">
                            <td >
                                <input type="text" ng-model="elem.group" placeholder="my-ldap-group" required >
                            </td>
                            <td>
                                <select dku-bs-select ng-model="elem.profile" ng-options="x as x|niceProfileName for x in appConfig.licensing.userProfiles" required/>
                            </td>
                            <td full-click>
                                <a main-click ng-click="deleteLDAPGroupProfile($index)"> <i class="icon-trash" /></a>
                            </td>
                        </tr>
                    </table>
                    <div class="controls">
                        <button class="btn btn--secondary" ng-click="addLDAPGroupProfile()" >
                            + Group defined profile
                        </button>
                        <span class="help-inline">
                            Defines a mapping from LDAP group names to DSS user profiles. When users match multiple profiles, the highest profile will be assigned.
                        </span>
                    </div>
                </div>

<div class="control-group">
                    <label for="ldapSettings.defaultUserProfile" class="control-label">Default user profile</label>
                    <div class="controls">
                        <select id="ldapSettings.defaultUserProfile" dku-bs-select ng-model="generalSettings.ldapSettings.defaultUserProfile" ng-options="x as x|niceProfileName for x in appConfig.licensing.userProfiles"/>
                        <span class="help-inline">
                             Default user profile to apply upon provisioning and resync.
                            <span ng-if="generalSettings.ldapSettings.enableGroups && generalSettings.ldapSettings.groupNameAttribute">Applies if no group → profile mapping rule matched.</span>
                        </span>
                    </div>
                </div>

<h3 id="ldap-testing">Testing</h3>
                <div class="control-group">
                    <label class="control-label">Connection</label>
                    <div class="controls">
                        <button class="btn btn--secondary" ng-click="testLdapSettings()" ng-disabled="miscSettingsForm.$invalid">
                            Test connection
                        </button>
                    </div>
                </div>
                <div ng-if="ldapTesting" class="alert alert-info"> <i class="icon-spin icon-spinner" />Please wait, testing connection
                </div>
                <div ng-if="! miscSettingsForm.$invalid && ldapTestResult">
                    <div ng-if="!ldapTestResult.connectionOK" class="alert alert-error">
                        <i class="icon-dku-error" />
                        Connection failed: <span summary-of-error="ldapTestResult.connectionError" />
                    </div>
                    <div ng-if="ldapTestResult.connectionOK" class="alert alert-success">
                        <i class="icon-success" />
                        Connection OK
                        <pre ng-if="ldapTestResult.serverInfo.length">{{ldapTestResult.serverInfo}}</pre>
                    </div>
                </div>

<div class="control-group">
                    <label class="control-label">Username to test</label>
                    <div class="controls">
                        <input type="text" ng-model="ldapTestUsername" placeholder="john.doe" />
                        <button class="btn btn--secondary" ng-click="testLdapGetUserDetails(ldapTestUsername)" ng-disabled="miscSettingsForm.$invalid || ldapTestUsername == null || ldapTestUsername.length == 0">
                            Test a Username
                        </button>
                    </div>
                </div>
                <div ng-if="ldapUserTesting" class="alert alert-info"> <i class="icon-spin icon-spinner" />Please wait, fetching user</div>
                <div ng-if="! miscSettingsForm.$invalid && ldapTestUserDetails">
                    <div ng-if="!ldapTestUserDetails.connectionOK" class="alert alert-error">
                        <i class="icon-dku-error" />
                        Connection failed:  <span summary-of-error="ldapTestUserDetails.connectionError" />
                    </div>
                    <div ng-if="!ldapTestUserDetails.recordOK && ldapTestUserDetails.connectionOK" class="alert alert-error">
                        <i class="icon-dku-error" />
                        User does not exist
                    </div>
                    <div class="alert alert-info" ng-if="ldapTestUserDetails.recordOK" >
                        <table style="background: none; margin-bottom: 0" class="table" >

<tr><th>Username</th><td>{{ ldapTestUserDetails.username }}</td></tr>
                            <tr><th>Display name</th><td>{{ ldapTestUserDetails.displayName }}</td></tr>
                            <tr><th>Email</th><td>{{ ldapTestUserDetails.email }}</td></tr>
                            <tr><th>Groups</th><td>{{ ldapTestUserDetails.groups }}</td></tr>
                            <tr><th>Distinguished name</th><td>{{ ldapTestUserDetails.distinguishedName }}</td></tr>
                        </table>

</div>
                </div>

</fieldset>
        </form>
    </div>

<div class="section">
        <h2 id="azureAD">Azure AD</h2>
        <div class="alert alert-info">
            Azure AD integration only handles provisioning and synchronization of users. It does not authenticate users. Azure AD needs to be combined with an authenticator, such as SSO (which can target your Azure directory too)
        </div>

<form class="dkuform-horizontal" >
            <div class="control-group">
                <label for="azureADSettings.enabled" class="control-label">Enable</label>
                <div class="controls" >
                    <input id="azureADSettings.enabled" type="checkbox" ng-model="generalSettings.azureADSettings.enabled" />
                    <span class="help-inline">Import users and groups from Azure AD</span>
                </div>
            </div>

<fieldset ng-if="generalSettings.azureADSettings.enabled">
                <div class="control-group">
                    <label for="azureADSettings.autoProvisionUsersAtLoginTime" class="control-label">Login-time provisioning</label>
                    <div class="controls">
                        <input id="azureADSettings.autoProvisionUsersAtLoginTime" type="checkbox"
                               ng-model="generalSettings.azureADSettings.autoProvisionUsersAtLoginTime" />
                        <span class="help-inline">Automatically provision users from Azure AD at login time</span>
                    </div>
                </div>

<div class="control-group">
                    <label for="azureADSettings.autoSyncUsersAtLoginTime" class="control-label">Login-time resync</label>
                    <div class="controls">
                        <input id="azureADSettings.autoSyncUsersAtLoginTime" type="checkbox"
                               ng-model="generalSettings.azureADSettings.autoSyncUsersAtLoginTime" />
                        <span class="help-inline">Automatically resynchronize user properties from Azure AD at login time</span>
                    </div>
                </div>

<div class="control-group">
                    <label for="azureADSettings.syncUsers" class="control-label">Allow on-demand resync</label>
                    <div class="controls">
                        <input id="azureADSettings.syncUsers" type="checkbox"
                               ng-model="generalSettings.azureADSettings.allowOnDemandUsersSync" />
                        <span class="help-inline">Allow resynchronization of user properties from Azure AD independently from login</span>
                    </div>
                </div>

<h3 id="azure-ad-credentials">Connection</h3>

<div class="control-group">
                    <label for="azureADSettings.credentialsTenantId" class="control-label">Tenant ID*</label>
                    <div class="controls">
                        <input id="azureADSettings.credentialsTenantId" type="text" class="input-xxlarge" ng-model="generalSettings.azureADSettings.credentialsTenantId" required/>
                        <span class="help-inline">You can find the tenant ID for a given application, in Azure directory, in the application dashboard (mandatory)</span>
                    </div>
                </div>
                <div class="control-group">
                    <label for="azureADSettings.credentialsClientId" class="control-label">Application ID (Client ID)*</label>
                    <div class="controls">
                        <input id="azureADSettings.credentialsClientId" type="text" class="input-xxlarge" ng-model="generalSettings.azureADSettings.credentialsClientId" required/>
                        <span class="help-inline">You can find your application in Azure directory, in your application dashboard (mandatory)</span>
                    </div>
                </div>
                <div class="control-group">
                    <label for="azureADSettings.credentialMethod" class="control-label">Authentication method*</label>
                    <div class="controls" >
                        <label>
                            <select dku-bs-select id="azureADSettings.credentialMethod" ng-model="generalSettings.azureADSettings.credentialMethod" ng-options="x[0] as x[1] for x in [['OAUTH2_SECRET', 'Secret'],['OAUTH2_CERT', 'Certificate']]"  layout="list" required></select>
                            <span class="help-inline">The OAuth2 credential method for DSS to connect to Azure</span>
                        </label>
                    </div>
                </div>
                <div ng-if="generalSettings.azureADSettings.credentialMethod == 'OAUTH2_SECRET'">
                    <div class="control-group">
                        <label for="azureADSettings.credentialsClientSecret" class="control-label">Client secret*</label>
                        <div class="controls">
                            <input id="azureADSettings.credentialsClientSecret" class="input-xxlarge" type="password" ng-model="generalSettings.azureADSettings.credentialsClientSecret" required/>
                            <span class="help-inline">You can generate a secret in Azure directory, in your application settings (mandatory)</span>
                        </div>
                    </div>
                </div>
                <div ng-if="generalSettings.azureADSettings.credentialMethod == 'OAUTH2_CERT'">
                    <div class="control-group">
                        <label for="azureADSettings.credentialsCertificatePath" class="control-label">Certificate path*</label>
                        <div class="controls">
                            <input id="azureADSettings.credentialsCertificatePath" class="input-xxlarge" type="text" ng-model="generalSettings.azureADSettings.credentialsCertificatePath" required/>
                            <span class="help-inline">The certificate pfx path (mandatory)</span>
                        </div>
                    </div>
                    <div class="control-group">
                        <label for="azureADSettings.credentialsCertificatePassword" class="control-label">Certificate password</label>
                        <div class="controls">
                            <input id="azureADSettings.credentialsCertificatePassword" type="password" ng-model="generalSettings.azureADSettings.credentialsCertificatePassword"/>
                            <span class="help-inline">The certificate pfx password</span>
                        </div>
                    </div>
                </div>
                <div class="control-group">
                    <label for="azureADSettings.useGlobalProxy" class="control-label">Use global proxy</label>
                    <div class="controls">
                        <input id="azureADSettings.useGlobalProxy" type="checkbox"
                               ng-model="generalSettings.azureADSettings.useGlobalProxy" />
                        <span class="help-inline">Use the global proxy of DSS if configured</span>
                    </div>
                </div>

<h3 id="azure-ad-user-mapping">Users mapping</h3>

<div class="control-group">
                    <label for="azureADSettings.userQueryFilter" class="control-label">User query filter*</label>
                    <div class="controls">
                        <input id="azureADSettings.userQueryFilter" type="text" class="input-xxlarge" ng-model="generalSettings.azureADSettings.userQueryFilter" required/>
                        <span class="help-inline">
                            The query used by DSS to fetch a user in Azure AD. You can use the variables <code>$login</code> or <code>$email</code> to refer
                            to a user attribute resulting from the authentication. The most common query filter is by email: `mail eq '$login` (mandatory)
                        </span>
                    </div>
                </div>
                <div class="control-group">
                    <label class="control-label">Groups restriction</label>
                    <div class="controls">
                        <ng2-values-list
                                [(items)]="generalSettings.azureADSettings.authorizedGroups"
                                value-placeholder="group name"
                                add-label="Add group">
                        </ng2-values-list>
                        <span class="help-inline">
                            Optional list of Azure AD group names that are allowed to login to DSS. If empty, all Azure AD users are allowed to login
                        </span>
                    </div>
                </div>

<h3 id="azuread-user-provisioning">On-demand provisioning</h3>

<div class="control-group">
                    <label for="azureADSettings.allowOnDemandUsersProvisioning" class="control-label">Allow on-demand provisioning</label>
                    <div class="controls">
                        <input id="azureADSettings.allowOnDemandUsersProvisioning" type="checkbox" ng-model="generalSettings.azureADSettings.allowOnDemandUsersProvisioning" />
                        <span class="help-inline">Allow provisioning of users independently from login</span>
                    </div>
                </div>

<div ng-if="generalSettings.azureADSettings.allowOnDemandUsersProvisioning">
                    <div class="control-group">
                        <label for="azure-ad-login-attribute" class="control-label">Login attribute*</label>
                        <div class="controls">
                            <select id="azure-ad-login-attribute" dku-bs-select ng-model="generalSettings.azureADSettings.loginAttributeRef" required>
                                <option value="EMAIL">Email</option>
                                <option value="DISPLAY_NAME">Display name</option>
                                <option value="USER_PRINCIPAL_NAME">User principal name</option>
                            </select>
                            <span class="help-inline">User attribute to use as login (mandatory)</span>
                        </div>
                    </div>
                    <div class="control-group" ng-if="generalSettings.azureADSettings.allowOnDemandUsersProvisioning">
                        <label class="control-label">Login remapping rules</label>
                        <div class="controls" >
                            <ng2-key-values-list
                                [(items)]="generalSettings.azureADSettings.remappingRules"
                                add-label="Add Remapping Rule"
                                key-placeholder="Regexp"
                                value-placeholder="Replacement string"
                                key-identifier="ruleFrom"
                                value-identifier="ruleTo">
                            </ng2-key-values-list>
                            <span class="help-inline">Remapping from the assertion attribute value to the DSS login. Regular expressions are expressed in Java syntax. Use '()' to capture a substring and '$1' in the replacement string to retrieve it.
                            Note that you must be able to look up the resulting username in the Azure AD with the above 'user filter by username'.</span>
                        </div>
                    </div>
                    <div class="control-group">
                        <label for="azureADSettings.groupQueryFilter" class="control-label">Group query filter</label>
                        <div class="controls">
                            <input id="azureADSettings.groupQueryFilter" type="text" class="input-xxlarge" ng-model="generalSettings.azureADSettings.groupQueryFilter"/>
                            <span class="help-inline">Filter to search all groups - used to fetch and display AzureAD groups</span>
                        </div>
                    </div>

<div class="control-group">
                        <label for="azureADSettings.groupsLimit" class="control-label">Number of groups limit*</label>
                        <div class="controls">
                            <input id="azureADSettings.groupsLimit" type="text" class="input-xxlarge" ng-model="generalSettings.azureADSettings.groupsLimit" required/>
                            <span class="help-inline">Limiting the number of AzureAD groups queried.</span>
                        </div>
                        <div class="alert alert-warning" ng-if="generalSettings.azureADSettings.groupsLimit > 5000">
                            Increasing the limit over 5000 could lead to performance degradation when fetching external users (mandatory).
                        </div>
                    </div>
                </div>

<h3 id="azure-ad-profiles">User profiles</h3>

<div class="control-group">
                    <label class="control-label">Group → profile mapping</label>
                    <table style="background: none;" class="controls">
                        <tr ng-repeat="elem in generalSettings.azureADSettings.groupProfiles">
                            <td>
                                <input type="text" ng-model="elem.group" placeholder="my-azure-ad-group" required >
                            </td>
                            <td>
                                <select dku-bs-select ng-model="elem.profile" ng-options="x as x|niceProfileName for x in appConfig.licensing.userProfiles" required/>
                            </td>
                            <td full-click>
                                <a main-click ng-click="deleteAzureADGroupProfile($index)"> <i class="icon-trash" /></a>
                            </td>
                        </tr>
                    </table>
                    <div class="controls">
                        <button class="btn btn--secondary" ng-click="addAzureADGroupProfile()" >
                            + Group defined profile
                        </button>
                        <span class="help-inline">
                            Defines a mapping from Azure AD group names to DSS user profile. When users match multiple profiles, the highest profile will be assigned.
                        </span>
                    </div>
                </div>

<div class="control-group">
                    <label for="azureADSettings.defaultUserProfile" class="control-label">Default user profile</label>
                    <div class="controls">
                        <select id="azureADSettings.defaultUserProfile" dku-bs-select ng-model="generalSettings.azureADSettings.defaultUserProfile" ng-options="x as x|niceProfileName for x in appConfig.licensing.userProfiles"/>
                        <span class="help-inline">
                            Default user profile to apply upon provisioning and resync. Applies if no group → profile mapping rule matched.
                        </span>
                    </div>
                </div>

<h3 id="azure-ad-testing">Testing</h3>
                <div class="control-group">
                    <label for="azureADSettings.loginToTest" class="control-label">Login</label>
                    <div class="controls">
                        <input id="azureADSettings.loginToTest" type="text" ng-model="loginToTest" placeholder="john.doe" />
                        <span class="help-inline">
                            Replaces <code>$login</code> in the user query filter
                        </span>
                    </div>
                </div>
                <div class="control-group">
                    <label for="azureADSettings.emailToTest" class="control-label">Email</label>
                    <div class="controls">
                        <input id="azureADSettings.emailToTest" type="text" ng-model="emailToTest" placeholder="john.doe@example.org" />
                        <span class="help-inline">
                            Replaces <code>$email</code> in the user query filter
                        </span>
                    </div>
                </div>
                <div class="control-group">
                    <label class="control-label">Fetch user</label>
                    <div class="controls">
                        <button class="btn btn--secondary" ng-click="testAzureADSettings(loginToTest,emailToTest)">
                            Test
                        </button>
                    </div>
                </div>

<h3 id="azure-ad-testing">Permissions</h3>
                <div class="control-group">
                    <label class="control-label">Azure AD groups readable by</label>
                    <div class="controls">
                        <label>
                            <input type="radio" ng-model="generalSettings.azureADSettings.azureADGroupsRetrievableBy" value="NOBODY" name="azureADGroupsRetrievableBy" class="exclude-from-smart-change"/>
                            Nobody
                        </label>
                        <label>
                            <input type="radio" ng-model="generalSettings.azureADSettings.azureADGroupsRetrievableBy" value="EVERYBODY" name="azureADGroupsRetrievableBy" class="exclude-from-smart-change"/>
                            Everybody
                        </label>
                        <span class="help-inline">
                            Who can read Azure AD groups in order to run the List Access recipe.
                        </span>
                    </div>
                </div>

<div ng-if="azureADTesting" class="alert alert-info">
                    <i class="icon-spin icon-spinner" />
                    Please wait, fetching user
                </div>
                <div ng-if="! miscSettingsForm.$invalid && azureADTestResult">
                    <div ng-if="azureADTestResult.connectionOK == false" class="alert alert-error">
                        <i class="icon-dku-error" />
                        Connection failed: <span summary-of-error="azureADTestResult.connectionError" />
                    </div>
                    <div ng-if="azureADTestResult.connectionOK == true" class="alert alert-success">
                        <i class="icon-success" />
                        Connection OK
                        <pre>{{azureADTestResult.userAttributes}}</pre>
                    </div>
                </div>

</fieldset>
        </form>
    </div>

<div class="control-group">
                <label for="pamSettings.enabled" class="control-label">Enable</label>
                <div class="controls" >
                    <input id="pamSettings.enabled" type="checkbox" ng-model="generalSettings.pamSettings.enabled" />
                    <span class="help-inline">Allow login using PAM</span>
                </div>
            </div>

<fieldset ng-if="generalSettings.pamSettings.enabled">
                <div class="control-group">
                    <label for="pamSettings.autoImportUsers" class="control-label">Login-time provisioning</label>
                    <div class="controls">
                        <input id="pamSettings.autoImportUsers" type="checkbox"
                               ng-model="generalSettings.pamSettings.autoImportUsers" />
                        <span class="help-inline">Automatically provision users from PAM at login time</span>
                    </div>
                </div>
                <div class="control-group">
                    <label for="pamSettings.serviceName" class="control-label">Service name</label>
                    <div class="controls">
                        <input id="pamSettings.serviceName" type="text" ng-model="generalSettings.pamSettings.serviceName"/>
                        <span class="help-inline">The PAM service name.</span>
                    </div>
                </div>
                <div class="control-group">
                    <label for="pamSettings.defaultGroup" class="control-label">Default group</label>
                    <div class="controls">
                        <input id="pamSettings.defaultGroup" type="text" ng-model="generalSettings.pamSettings.defaultGroup"/>
                        <span class="help-inline">Assign a default group to newly provisioned users</span>
                    </div>
                </div>
                <div class="control-group">
                    <label for="pamSettings.defaultUserProfile" class="control-label">Default user profile</label>
                    <div class="controls">
                        <select id="pamSettings.defaultUserProfile" dku-bs-select ng-model="generalSettings.pamSettings.defaultUserProfile" ng-options="x as x|niceProfileName for x in appConfig.licensing.userProfiles" />
                        <span class="help-inline">
                            Assign a default user profile to newly imported users
                        </span>
                    </div>
                </div>
            </fieldset>

</form>
    </div>

<div class="section">
        <h2 id="custom-auth">Custom authenticator and supplier</h2>

<div class="control-group">
                <label for="customAuthSettings.enabled" class="control-label">Enable</label>
                <div class="controls" >
                    <input id="customAuthSettings.enabled" type="checkbox" ng-model="generalSettings.customAuthSettings.enabled" />
                    <span class="help-inline">Allow custom authenticator and/or supplier</span>
                </div>
            </div>
            <div ng-if="generalSettings.customAuthSettings.enabled">
                <div class="control-group">
                    <label for="customAuthSettings.authenticationEnabled" class="control-label">Enable authentication</label>
                    <div class="controls" >
                        <input id="customAuthSettings.authenticationEnabled" type="checkbox" ng-model="generalSettings.customAuthSettings.authenticationEnabled" />
                        <span class="help-inline">Allow custom authenticator to authenticate users</span>
                    </div>
                </div>

<div class="control-group">
                    <label for="customAuthSettings.autoProvisionUsersAtLoginTime" class="control-label">Login-time provisioning</label>
                    <div class="controls">
                        <input id="customAuthSettings.autoProvisionUsersAtLoginTime"
                               type="checkbox"
                               ng-model="generalSettings.customAuthSettings.autoProvisionUsersAtLoginTime" />
                        <span class="help-inline">Automatically provision users from supplier at login time</span>
                    </div>
                </div>
                <div class="control-group">
                    <label for="customAuthSettings.autoSyncUsersAtLoginTime" class="control-label">Login-time resync</label>
                    <div class="controls">
                        <input id="customAuthSettings.autoSyncUsersAtLoginTime" type="checkbox"
                               ng-model="generalSettings.customAuthSettings.autoSyncUsersAtLoginTime" />
                        <span class="help-inline">Automatically resynchronize user properties from supplier at login time</span>
                    </div>
                </div>

<div class="control-group">
                    <label for="customAuthSettings.allowOnDemandUsersSync" class="control-label">Allow on-demand resync</label>
                    <div class="controls">
                        <input id="customAuthSettings.allowOnDemandUsersSync" type="checkbox"
                               ng-model="generalSettings.customAuthSettings.allowOnDemandUsersSync" />
                        <span class="help-inline">Allow resynchronization of user properties from supplier independently from login if the custom supplier has this capability</span>
                    </div>
                </div>
                <div class="control-group">
                    <label for="customAuthSettings.allowOnDemandUsersProvisioning" class="control-label">Allow on-demand provisioning</label>
                    <div class="controls">
                        <input id="customAuthSettings.allowOnDemandUsersProvisioning" type="checkbox" ng-model="generalSettings.customAuthSettings.allowOnDemandUsersProvisioning" />
                        <span class="help-inline">Allow provisioning of users independently from login</span>
                    </div>
                </div>

<h3 id="custom-auth-classes" class="settings-section-subtitle">Classes</h3>

<div class="alert alert-warning" ng-hide="generalSettings.customAuthSettings.customUserAuthenticatorClassName || generalSettings.customAuthSettings.customUserSupplierClassName">
                    At least one of the two custom classes is mandatory
                </div>

<div class="control-group">
                    <label for="customAuthSettings.customUserAuthenticatorClassName" class="control-label">Custom user authenticator full class name</label>
                    <div class="controls" >
                        <input id="customAuthSettings.customUserAuthenticatorClassName" ng-required="!generalSettings.customAuthSettings.customUserAuthenticatorClassName && !generalSettings.customAuthSettings.customUserSupplierClassName" type="text" ng-model="generalSettings.customAuthSettings.customUserAuthenticatorClassName" />
                        <span class="help-inline">Full class name to your custom user authenticator</span>
                    </div>
                </div>

<div class="control-group">
                    <label for="customAuthSettings.customUserSupplierClassName" class="control-label">Custom user supplier full class name</label>
                    <div class="controls" >
                        <input id="customAuthSettings.customUserSupplierClassName" ng-required="!generalSettings.customAuthSettings.customUserAuthenticatorClassName && !generalSettings.customAuthSettings.customUserSupplierClassName" type="text" ng-model="generalSettings.customAuthSettings.customUserSupplierClassName" />
                        <span class="help-inline">Full class name to your custom user supplier</span>
                    </div>
                </div>

<h3 id="custom-auth-user-mapping">Users mapping</h3>

<div class="control-group">
                    <label class="control-label">Groups restriction</label>
                    <div class="controls">
                        <ng2-values-list
                                [(items)]="generalSettings.customAuthSettings.authorizedGroups"
                                value-placeholder="group name"
                                add-label="Add group">
                        </ng2-values-list>
                        <span class="help-inline">
                            Optional list of supplier group names that are allowed to login to DSS. If empty, all users are allowed to login
                        </span>
                    </div>
                </div>

<h3 id="custom-auth-user-profiles">User profiles</h3>

<div class="control-group">
                    <label class="control-label">Group → profile mapping</label>
                    <table style="background: none;" class="controls">
                        <tr ng-repeat="elem in generalSettings.customAuthSettings.groupProfiles">
                            <td >
                                <input type="text" ng-model="elem.group" required >
                            </td>
                            <td>
                                <select dku-bs-select ng-model="elem.profile" ng-options="x as x|niceProfileName for x in appConfig.licensing.userProfiles" required/>
                            </td>
                            <td full-click>
                                <a main-click ng-click="deleteCustomAuthGroupProfile($index)"> <i class="icon-trash" /></a>
                            </td>
                        </tr>
                    </table>
                    <div class="controls">
                        <button class="btn btn--secondary" ng-click="addCustomAuthGroupProfile()" >
                            + Group defined profile
                        </button>
                        <span class="help-inline">
                            Defines a mapping from supplier group names to DSS user profile. When users match multiple profiles, the highest profile will be assigned.
                        </span>
                    </div>

</div>

<div class="control-group">
                    <label for="customAuthSettings.defaultUserProfile" class="control-label">Default user profile</label>
                    <div class="controls">
                        <select id="customAuthSettings.defaultUserProfile" dku-bs-select ng-model="generalSettings.customAuthSettings.defaultUserProfile" ng-options="x as x|niceProfileName for x in appConfig.licensing.userProfiles"/>
                        <span class="help-inline">
                            Default user profile to apply upon provisioning and resync. Applies if no group → profile mapping rule matched.
                        </span>
                    </div>
                </div>

</div>
        </form>
    </div>

<div class="section">
        <h2 id="authSettings">Users synchronization</h2>

<p>Configure which user settings should be resynchronized when synchronizing from the source (either at login time or on-demand)</p>

<div>
            <div class="control-group">
                <label for="authSettings.syncUserGroups" class="control-label">Synchronize user groups</label>
                <div class="controls">
                    <input id="authSettings.syncUserGroups" type="checkbox"
                           ng-model="generalSettings.authSyncSettings.syncUserGroups" />
                </div>
            </div>
            <div class="control-group">
                <label for="authSettings.syncUserDisplayName" class="control-label">Synchronize user display name</label>
                <div class="controls">
                    <input id="authSettings.syncUserDisplayName" type="checkbox"
                           ng-model="generalSettings.authSyncSettings.syncUserDisplayName" />
                </div>
            </div>
            <div class="control-group">
                <label for="authSettings.syncUserEmail" class="control-label">Synchronize user email</label>
                <div class="controls">
                    <input id="authSettings.syncUserEmail" type="checkbox"
                           ng-model="generalSettings.authSyncSettings.syncUserEmail" />
                </div>
            </div>
            <div class="control-group">
                <label for="authSettings.syncUserProfile" class="control-label">Synchronize user profile</label>
                <div class="controls">
                    <input id="authSettings.syncUserProfile" type="checkbox"
                           ng-model="generalSettings.authSyncSettings.syncUserProfile" />
                </div>
            </div>
            <div class="control-group">
                <label for="authSettings.missingUserAction" class="control-label">Action if user is missing from the external source</label>
                <div class="controls">
                    <select id="authSettings.missingUserAction" ng-model="generalSettings.authSyncSettings.missingUserAction">
                        <option value="DISABLE_USER">Disable user in DSS</option>
                        <option value="WARN">Add a warning in the logs</option>
                    </select>
                </div>
            </div>
            <div class="control-group">
                <label for="authSettings.notInAuthorizedGroupsAction" class="control-label">Action if user is not in groups restriction</label>
                <div class="controls">
                    <select id="authSettings.notInAuthorizedGroupsAction" ng-model="generalSettings.authSyncSettings.notInAuthorizedGroupsAction">
                        <option value="DISABLE_USER">Disable user in DSS</option>
                        <option value="WARN">Add a warning in the logs</option>
                    </select>
                </div>
            </div>
        </div>

</div>

<div class="section">
        <h2 id="misc">Miscellaneous</h2>
        <div class="alert alert-info">
            To enable a <b>welcome email</b> sent to all new users upon account creation, go to <a href="/admin/general/notifications/">notifications and integrations</a>
        </div>
        <div class="control-group">
            <label for="case-sensitive-logins" class="control-label">Case-sensitive logins</label>
            <div class="controls" >
                <input id="case-sensitive-logins" type="checkbox" ng-model="generalSettings.security.caseSensitiveLogins" />
            </div>
        </div>
    </div>
</div>

User login & provisioning

SSO

IdP configuration