esignet-default.properties

# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at https://mozilla.org/MPL/2.0/.

# Follow properites have their values assigned via 'overrides' environment variables of config server docker.
# DO NOT define these in any of the property files.  They must be passed as env variables.  Refer to config-server
# helm chart:
# db.dbuser.password
# keycloak.external.url
# keycloak.internal.host
# keycloak.internal.url
# keycloak.admin.password
# mosip.auth.client.secret   (convention: <realm>.<keycloak client name>.secret)
# mosip.ida.client.secret
# mosip.admin.client.secret
# mosip.reg.client.secret
# mosip.prereg.client.secret
# softhsm.kernel.pin
# softhsm-security-pin
# email.smtp.host
# email.smtp.username
# email.smtp.secret
# mosip.kernel.tokenid.uin.salt
# mosip.kernel.tokenid.partnercode.salt
# mosip.api.internal.url
# mosip.api.public.url

server.port=8088
server.servlet.path=/v1/esignet

openapi.info.title=e-Signet Service
openapi.info.description=Rest Endpoints for operations related to e-Signet
openapi.info.version=1.0
openapi.info.license.name=Mosip
openapi.info.license.url=https://docs.mosip.io/platform/license
mosipbox.public.url=http://localhost:${server.port}
openapi.service.server.url=${mosipbox.public.url}${server.servlet.path}
openapi.service.server.description=e-Signet Service
springdoc.swagger-ui.disable-swagger-default-url=true
spring.mvc.servlet.path=${server.servlet.path}

#logging.level.org.springframework.web=DEBUG
#logging.level.org.springframework.security=DEBUG

spring.messages.basename=messages
spring.messages.encoding=UTF-8

spring.main.allow-bean-definition-overriding=true

## ------------------------------------------------- e-Signet ----------------------------------------------------------
mosip.esignet.amr-acr-mapping-file-url=https://raw.githubusercontent.com/mosip/mosip-config/collab1/amr-acr-mapping.json
mosip.esignet.auth-txn-id-length=10
mosip.esignet.supported-id-regex=\\S*
mosip.esignet.id-token-expire-seconds=3600
mosip.esignet.access-token-expire-seconds=3600
mosip.esignet.link-code-expire-in-secs=600
mosip.esignet.generate-link-code.limit-per-transaction=10
mosip.esignet.authentication-expire-in-secs=600
mosip.esignet.supported-pkce-methods={'S256'}

mosip.esignet.captcha.required.auth-factors={{'PWD'}}

mosip.esignet.header-filter.paths-to-validate={'${server.servlet.path}/authorization/send-otp', \
  '${server.servlet.path}/authorization/authenticate', \
  '${server.servlet.path}/authorization/v2/authenticate', \
  '${server.servlet.path}/authorization/v3/authenticate', \
  '${server.servlet.path}/authorization/auth-code'}

## ------------------------------------------ e-Signet binding ---------------------------------------------------------

mosip.esignet.binding.salt-length=16
mosip.esignet.binding.audience-id=esignet-binding
mosip.esignet.binding.key-expire-days=10
mosip.esignet.binding.encrypt-binding-id=false

## -------------------------------------- Authentication & Authorization -----------------------------------------------

mosip.esignet.security.auth.post-urls={}
mosip.esignet.security.auth.put-urls={}
mosip.esignet.security.auth.get-urls={}

mosip.esignet.security.ignore-csrf-urls=${server.servlet.path}/client-mgmt/**,${server.servlet.path}/oidc/**,${server.servlet.path}/oauth/**,\
  ${server.servlet.path}/actuator/**,/favicon.ico,${server.servlet.path}/error,\
  ${server.servlet.path}/swagger-ui/**,${server.servlet.path}/v3/api-docs/**,\
  ${server.servlet.path}/vci/**

mosip.esignet.security.ignore-auth-urls=${server.servlet.path}/csrf/**,${server.servlet.path}/authorization/**,\
  ${server.servlet.path}/linked-authorization/**,${server.servlet.path}/oidc/**,${server.servlet.path}/oauth/**,\
  ${server.servlet.path}/actuator/**,/favicon.ico,${server.servlet.path}/error,${server.servlet.path}/swagger-ui/**,\
  ${server.servlet.path}/v3/api-docs/**,${server.servlet.path}/client-mgmt/**,${server.servlet.path}/vci/**

##------------------------------------------ Kafka configurations ------------------------------------------------------
spring.kafka.bootstrap-servers=kafka:9092
spring.kafka.consumer.group-id=esignet-consumer
spring.kafka.consumer.enable-auto-commit=true
#spring.kafka.listener.concurrency=1

mosip.esignet.kafka.linked-session.topic=esignet-linked
mosip.esignet.kafka.linked-auth-code.topic=esignet-consented

# captcha validator
mosip.esignet.send-otp.captcha-required=false
mosip.esignet.captcha-validator.url=https://www.google.com/recaptcha/api/siteverify
mosip.esignet.captcha-validator.secret=secretkey
mosip.esignet.captcha-validator.site-key=sitekey

mosip.esignet.authenticator.ida.otp-channels=email,phone

#------------------------------- Mock IDA integration properties--------------------------------------------
mosip.esignet.mock.authenticator.get-identity-url=http://mock-identity-system:8082/v1/mock-identity-system/identity
mosip.esignet.mock.authenticator.kyc-auth-url=http://mock-identity-system:8082/v1/mock-identity-system/kyc-auth
mosip.esignet.mock.authenticator.kyc-exchange-url=http://mock-identity-system:8082/v1/mock-identity-system/kyc-exchange
mosip.esignet.mock.authenticator.ida.otp-channels=${mosip.esignet.authenticator.ida.otp-channels}
mosip.esignet.mock.authenticator.send-otp=http://mock-identity-system:8082/v1/mock-identity-system/send-otp
mosip.esignet.mock.supported.bind-auth-factor-types={'WLA'}
mosip.esignet.mock.vciplugin.verification-method=${mosip.esignet.vci.authn.jwk-set-uri}

## ------------------------------------------ oauth & openid supported values ------------------------------------------

## supported scopes
mosip.esignet.supported.credential.scopes={'sample_vc_ldp','mock_identity_vc_ldp','mosip_identity_vc_ldp','sunbird_rc_insurance_vc_ldp','health_insurance_identity_vc_ldp','life_insurance_vc_ldp'}
mosip.esignet.supported.authorize.scopes={'resident-service'}
mosip.esignet.supported.openid.scopes={'profile','email','phone'}
mosip.esignet.openid.scope.claims={'profile' : {'name','given_name','middle_name','preferred_username','picture','gender','birthdate','locale','nickname', 'family_name','zoneinfo', 'updated_at','address'},'email' : {'email','email_verified'}, 'phone' : {'phone_number','phone_number_verified'}}
mosip.esignet.credential.scope-resource-mapping={'sample_vc_ldp' : '${mosipbox.public.url}${server.servlet.path}/vci/credential','mock_identity_vc_ldp' : '${mosipbox.public.url}${server.servlet.path}/vci/credential','mosip_identity_vc_ldp' : '${mosipbox.public.url}${server.servlet.path}/vci/credential','sunbird_rc_insurance_vc_ldp' : '${mosipbox.public.url}${server.servlet.path}/vci/credential','life_insurance_vc_ldp' : '${mosipbox.public.url}${server.servlet.path}/vci/credential','health_insurance_identity_vc_ldp' : '${mosipbox.public.url}${server.servlet.path}/vci/credential' }
## supported authorization processing flow to be used, Currently only supports Authorization Code Flow.
mosip.esignet.supported.response.types={'code'}

## Form of Authorization Grant presented to token endpoint
mosip.esignet.supported.grant.types={'authorization_code'}

## specifies how the Authorization Server displays the authentication and consent user interface pages to the End-User
# page-The Authorization Server SHOULD display the authentication and consent UI consistent with a full User Agent page view. If the display parameter is not specified, this is the default display mode.
# popup-The Authorization Server SHOULD display the authentication and consent UI consistent with a popup User Agent window. The popup User Agent window should be of an appropriate size for a login-focused dialog and should not obscure the entire window that it is popping up over.
# touch-The Authorization Server SHOULD display the authentication and consent UI consistent with a device that leverages a touch interface.
# wap-The Authorization Server SHOULD display the authentication and consent UI consistent with a "feature phone" type display.
mosip.esignet.supported.ui.displays={'page','popup','touch','wap'}

## specifies whether the Authorization Server prompts the End-User for reauthentication and consent
# none-The Authorization Server MUST NOT display any authentication or consent user interface pages.
# An error is returned if an End-User is not already authenticated or the Client does not have pre-configured consent
# for the requested Claims or does not fulfill other conditions for processing the request.
# The error code will typically be login_required, interaction_required, or another code defined in Section 3.1.2.6.
# This can be used as a method to check for existing authentication and/or consent.
# login-The Authorization Server SHOULD prompt the End-User for reauthentication. If it cannot reauthenticate the End-User, \
#  it MUST return an error, typically login_required.
# consent-The Authorization Server SHOULD prompt the End-User for consent before returning information to the Client.
# If it cannot obtain consent, it MUST return an error, typically consent_required.
# select_account-The Authorization Server SHOULD prompt the End-User to select a user account. This enables an End-User
# who has multiple accounts at the Authorization Server to select amongst the multiple accounts that they might have current
# sessions for. If it cannot obtain an account selection choice made by the End-User, it MUST return an error,
# typically account_selection_required.
mosip.esignet.supported.ui.prompts={'none','login','consent','select_account'}

## Type of the client assertion
mosip.esignet.supported.client.assertion.types={'urn:ietf:params:oauth:client-assertion-type:jwt-bearer'}

## Type of the client authentication methods for token endpoint
mosip.esignet.supported.client.auth.methods={'private_key_jwt'}


## ---------------------------------------- Cache configuration --------------------------------------------------------

mosip.esignet.cache.secure.individual-id=false
mosip.esignet.cache.store.individual-id=true
mosip.esignet.cache.security.secretkey.reference-id=TRANSACTION_CACHE
mosip.esignet.cache.security.algorithm-name=AES/ECB/PKCS5Padding

mosip.esignet.cache.names=clientdetails,preauth,authenticated,authcodegenerated,userinfo,linkcodegenerated,linked,linkedcode,linkedauth,consented,authtokens,bindingtransaction,vcissuance,apiRateLimit,blocked

spring.cache.type=redis
spring.cache.cache-names=${mosip.esignet.cache.names}
spring.redis.host=cache
spring.redis.port=6379
spring.redis.password=redis
management.health.redis.enabled=false

#spring.cache.type=simple
mosip.esignet.cache.key.hash.algorithm=SHA3-256
mosip.esignet.cache.size={'clientdetails' : 200, 'preauth': 200, 'authenticated': 200, 'authcodegenerated': 200, 'userinfo': 200, \
    'linkcodegenerated' : 500, 'linked': 200 , 'linkedcode': 200, 'linkedauth' : 200 , 'consented' :200, 'authtokens': 2, 'bindingtransaction': 1500, 'vcissuance' : 2000, 'blocked': 300, 'apiRateLimit': 180}
mosip.esignet.cache.expire-in-seconds={'clientdetails' : 86400, 'preauth': 1000,'authenticated': ${mosip.esignet.authentication-expire-in-secs},'authenticated': 1000, 'authcodegenerated': 600, \
  'userinfo': ${mosip.esignet.access-token-expire-seconds}, 'linkcodegenerated' : ${mosip.esignet.link-code-expire-in-secs}, \
  'linked': 600 , 'linkedcode': ${mosip.esignet.link-code-expire-in-secs}, 'linkedauth' : ${mosip.esignet.authentication-expire-in-secs}, 'consented': 600, \
  'authtokens': 28800, 'bindingtransaction': 600, 'vcissuance': ${mosip.esignet.access-token-expire-seconds}, 'apiRateLimit': 180, 'blocked': 300 }

## ------------------------------------------ Discovery openid-configuration -------------------------------------------

mosip.esignet.domain.url=http://localhost:8088
mosip.esignet.discovery.issuer-id=${mosip.esignet.domain.url}${server.servlet.path}

# This property holds ./wellknown/jwks.json URL,
# for local deployments without esignet-ui nginx change the value to ${mosip.esignet.domain.url}${server.servlet.path}/oauth/.well-known/jwks.json
mosip.esignet.jwks-uri=${mosip.esignet.domain.url}/.well-known/jwks.json

mosip.esignet.token.endpoint=${mosip.esignet.domain.url}${server.servlet.path}/oauth/v2/token

mosip.esignet.oauth.key-values={'issuer': '${mosip.esignet.domain.url}' ,\
  \ 'authorization_endpoint': '${mosip.esignet.domain.url}/authorize' , \
  \ 'token_endpoint': '${mosip.esignet.token.endpoint}' , \
  \ 'jwks_uri' : '${mosip.esignet.jwks-uri}' , \
  \ 'token_endpoint_auth_methods_supported' : ${mosip.esignet.supported.client.auth.methods}, \
  \ 'token_endpoint_auth_signing_alg_values_supported' : {'RS256'},\
  \ 'scopes_supported' : ${mosip.esignet.supported.openid.scopes}, \
  \ 'response_modes_supported' : { 'query' }, \
  \ 'grant_types_supported' : ${mosip.esignet.supported.grant.types},\
  \ 'response_types_supported' : ${mosip.esignet.supported.response.types}}

mosip.esignet.discovery.key-values={'issuer': '${mosip.esignet.domain.url}' ,\
  \ 'authorization_endpoint': '${mosip.esignet.domain.url}/authorize' , \
  \ 'token_endpoint': '${mosip.esignet.token.endpoint}' ,\
  \ 'jwks_uri' : '${mosip.esignet.jwks-uri}' , \
  \ 'userinfo_endpoint' : '${mosip.esignet.domain.url}${server.servlet.path}/oidc/userinfo' ,\
  \ 'scopes_supported' : ${mosip.esignet.supported.openid.scopes}, \
  \ 'response_types_supported' : ${mosip.esignet.supported.response.types}, \
  \ 'response_modes_supported' : { 'query' }, \
  \ 'token_endpoint_auth_methods_supported' : ${mosip.esignet.supported.client.auth.methods}, \
  \ 'token_endpoint_auth_signing_alg_values_supported' : {'RS256'}, \
  \ 'userinfo_signing_alg_values_supported' : {'RS256'}, \
  \ 'userinfo_encryption_alg_values_supported' : {'RSAXXXXX'},\
  \ 'userinfo_encryption_enc_values_supported' : {'A128GCM'}, \
  \ 'id_token_signing_alg_values_supported' : {'RS256'}, \
  \ 'claim_types_supported': {'normal'}, \
  \ 'claims_parameter_supported' : true, \
  \ 'display_values_supported' : ${mosip.esignet.supported.ui.displays}, \
  \ 'subject_types_supported' : { 'pairwise' }, \
  \ 'claims_supported' : {'name','address','gender','birthdate','picture','email','phone_number','individual_id'}, \
  \ 'acr_values_supported' : {'mosip:idp:acr:static-code', 'mosip:idp:acr:generated-code', 'mosip:idp:acr:linked-wallet', 'mosip:idp:acr:biometrics'},\
  \ 'request_parameter_supported' : false }

##----------------------------------------- Database properties --------------------------------------------------------

mosip.esignet.database.hostname=database
mosip.esignet.database.port=5432
spring.datasource.url=jdbc:postgresql://${mosip.esignet.database.hostname}:${mosip.esignet.database.port}/mosip_esignet?currentSchema=esignet
spring.datasource.username=postgres
spring.datasource.password=postgres

spring.jpa.database-platform=org.hibernate.dialect.PostgreSQL95Dialect
spring.jpa.show-sql=false
spring.jpa.hibernate.ddl-auto=none
spring.jpa.properties.hibernate.jdbc.lob.non_contextual_creation=true

#------------------------------------ Key-manager specific properties --------------------------------------------------
#Crypto asymmetric algorithm name
mosip.kernel.crypto.asymmetric-algorithm-name=RSA/ECB/OAEPWITHSHA-256ANDMGF1PADDING
#Crypto symmetric algorithm name
mosip.kernel.crypto.symmetric-algorithm-name=AES/GCM/PKCS5Padding
#Keygenerator asymmetric algorithm name
mosip.kernel.keygenerator.asymmetric-algorithm-name=RSA
#Keygenerator symmetric algorithm name
mosip.kernel.keygenerator.symmetric-algorithm-name=AES
#Asymmetric algorithm key length
mosip.kernel.keygenerator.asymmetric-key-length=2048
#Symmetric algorithm key length
mosip.kernel.keygenerator.symmetric-key-length=256
#Encrypted data and encrypted symmetric key separator
mosip.kernel.data-key-splitter=#KEY_SPLITTER#
#GCM tag length
mosip.kernel.crypto.gcm-tag-length=128
#Hash algo name
mosip.kernel.crypto.hash-algorithm-name=PBKDF2WithHmacSHA512
#Symmtric key length used in hash
mosip.kernel.crypto.hash-symmetric-key-length=256
#No of iterations in hash
mosip.kernel.crypto.hash-iteration=100000
#Sign algo name
mosip.kernel.crypto.sign-algorithm-name=RS256
#Certificate Sign algo name
mosip.kernel.certificate.sign.algorithm=SHA256withRSA

mosip.kernel.keymanager.hsm.config-path=ESIGNET_PKCS12/local.p12
mosip.kernel.keymanager.hsm.keystore-type=PKCS12
mosip.kernel.keymanager.hsm.keystore-pass=local

#Type of keystore, Supported Types: PKCS11, PKCS12, Offline, JCE
#mosip.kernel.keymanager.hsm.keystore-type=PKCS11
# For PKCS11 provide Path of config file.
# For PKCS12 keystore type provide the p12/pfx file path. P12 file will be created internally so provide only file path & file name.
# For Offline & JCE property can be left blank, specified value will be ignored.
#mosip.kernel.keymanager.hsm.config-path=/config/softhsm-application.conf
# Passkey of keystore for PKCS11, PKCS12
# For Offline & JCE proer can be left blank. JCE password use other JCE specific properties.
#mosip.kernel.keymanager.hsm.keystore-pass=${softhsm.esignet.mock.security.pin}

mosip.esignet.supported-formats={'OTP': 'alpha-numeric', 'PWD': 'alpha-numeric', 'BIO': 'encoded-json', 'WLA': 'jwt', 'PIN': 'number', 'KBA': 'base64url-encoded-json'}


mosip.kernel.keymanager.certificate.default.common-name=www.example.com
mosip.kernel.keymanager.certificate.default.organizational-unit=EXAMPLE-CENTER
mosip.kernel.keymanager.certificate.default.organization=IIITB
mosip.kernel.keymanager.certificate.default.location=BANGALORE
mosip.kernel.keymanager.certificate.default.state=KA
mosip.kernel.keymanager.certificate.default.country=IN

mosip.kernel.keymanager.softhsm.certificate.common-name=www.example.com
mosip.kernel.keymanager.softhsm.certificate.organizational-unit=Example Unit
mosip.kernel.keymanager.softhsm.certificate.organization=IIITB
mosip.kernel.keymanager.softhsm.certificate.country=IN

# Application Id for PMS master key.
mosip.kernel.partner.sign.masterkey.application.id=PMS
mosip.kernel.partner.allowed.domains=DEVICE

mosip.kernel.keymanager-service-validate-url=https://${mosip.hostname}/keymanager/validate
mosip.kernel.keymanager.jwtsign.validate.json=false
mosip.keymanager.dao.enabled=false
crypto.PrependThumbprint.enable=true

mosip.kernel.keymgr.hsm.health.check.enabled=true
mosip.kernel.keymgr.hsm.health.key.app-id=OIDC_SERVICE
mosip.kernel.keymgr.hsm.healthkey.ref-id=TRANSACTION_CACHE

mosip.kernel.keymgr.hsm.health.check.encrypt=true

## -------------------------------------------- IDP-UI config ----------------------------------------------------------
# NOTE:
# 1. linked-transaction-expire-in-secs value should be a sum of mosip.esignet.authentication-expire-in-secs and linked cache expire in seconds under mosip.esignet.cache.expire-in-seconds property
# 2. A new Qrcode will be autogenerated before the expiry of current qr-code, and the time difference in seconds for the same is defined in wallet.qr-code-buffer-in-secs property

# mosip.esignet.ui.wallet.config={{'wallet.name': 'Inji Mobile App', 'wallet.logo-url': 'https://www.mosip.io/images/logo.png', 'wallet.download-uri': '#', \
#  'wallet.deep-link-uri': 'inji://landing-page-name?linkCode=LINK_CODE&linkExpireDateTime=LINK_EXPIRE_DT' },{'wallet.name': 'Inji Mobile App1', 'wallet.logo-url': 'inji_logo.png', 'wallet.download-uri': '#', \
#  'wallet.deep-link-uri': 'inji://landing-page-name?linkCode=LINK_CODE&linkExpireDateTime=LINK_EXPIRE_DT' }}

# mosip.esignet.ui.wallet.config={'wallet.name': 'KBA', 'wallet.logo-url': 'inji_logo.png', "url": "https://sunbird.org/images/sunbird-logo-new.png"}

# mosip.esignet.ui.wallet.config={{'wallet.name': 'KBA', 'wallet.logo-url': 'inji_logo.png', 'wallet.download-uri': '#', \
#  'wallet.deep-link-uri': 'http://localhost:3001', "url": "https://sunbird.org/images/sunbird-logo-new.png" }}

# mosip.esignet.ui.config.key-values={'sbi.env': 'Developer', 'sbi.timeout.DISC': 30, \
#   'sbi.timeout.DINFO': 30, 'sbi.timeout.CAPTURE': 30, 'sbi.capture.count.face': 1, 'sbi.capture.count.finger': 1, \
#   'sbi.capture.count.iris': 1, 'sbi.capture.score.face': 70, 'sbi.capture.score.finger':70, 'sbi.capture.score.iris':70, \
#   'resend.otp.delay.secs': 120, 'send.otp.channels' : '${mosip.esignet.authenticator.ida.otp-channels}', \
#   'captcha.sitekey' : '${mosip.esignet.captcha-validator.site-key}', 'captcha.enable' : '', \
#   'auth.txnid.length' : '${mosip.esignet.auth-txn-id-length}', 'consent.screen.timeout-in-secs':${mosip.esignet.authentication-expire-in-secs}, \
#   'consent.screen.timeout-buffer-in-secs': 5, 'linked-transaction-expire-in-secs': 120, 'sbi.port.range': 4501-4600, \
#   'sbi.bio.subtypes.iris': 'UNKNOWN', 'sbi.bio.subtypes.finger': 'UNKNOWN', 'wallet.qr-code-buffer-in-secs': 10, 'otp.length': 6, \
#   'password.regex': '', 'wallet.config': ${mosip.esignet.ui.wallet.config} }


mosip.esignet.ui.wallet.config={{'wallet.name': 'Inji', 'wallet.logo-url': 'inji_logo.png', 'wallet.download-uri': '#', \
 'wallet.deep-link-uri': 'inji://landing-page-name?linkCode=LINK_CODE&linkExpireDateTime=LINK_EXPIRE_DT' }}

mosip.esignet.ui.signup.config={'signup.banner': true, 'signup.url': 'http://localhost:3000/signup'}

mosip.esignet.ui.forgot-password.config={'forgot-password': true, 'forgot-password.url': 'http://localhost:3000/forgot-password'}

mosip.esignet.authenticator.default.auth-factor.kba.individual-id-field=policyNumber

mosip.esignet.authenticator.default.auth-factor.kba.field-details={{"id":"policyNumber", "type":"text", "format":"", "maxLength": 50, "regex": "^[0-9\-]*$"},{"id":"fullName", "type":"text", "format":"", "maxLength": 50, "regex": "^[A-Za-z\s.0-9]+$"},{"id":"dob", "type":"date", "format":"dd/mm/yyyy"}}


mosip.esignet.ui.config.key-values={'sbi.env': 'Developer', 'sbi.timeout.DISC': 30, \
  'sbi.timeout.DINFO': 30, 'sbi.timeout.CAPTURE': 30, 'sbi.capture.count.face': 1, 'sbi.capture.count.finger': 2, \
  'sbi.capture.count.iris': 1, 'sbi.capture.score.face': 70, 'sbi.capture.score.finger':70, 'sbi.capture.score.iris':70, \
  'send.otp.channels':'email,phone', 'consent.screen.timeout-in-secs':${mosip.esignet.authentication-expire-in-secs}, \
  'consent.screen.timeout-buffer-in-secs': 5, 'sbi.port.range': 4501-4600, 'sbi.bio.subtypes.iris': 'UNKNOWN', 'sbi.bio.subtypes.finger': 'UNKNOWN', \
  'resend.otp.delay.secs': 120, 'captcha.enable': '', 'captcha.sitekey': '6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI', \
  'linked-transaction-expire-in-secs': 120, 'wallet.qr-code-buffer-in-secs': 10, 'auth.txnid.length': 10, \
  'otp.length': 6, 'password.regex': '^.{8,20}$', \ 'password.max-length': 20, \ 'username.regex': '^[1-9][0-9]{7,8}$',\ 'username.prefix': '+855', \
  'username.postfix': '', \ 'username.max-length': 9, \ 'username.input-type': 'number', \ 'wallet.config': ${mosip.esignet.ui.wallet.config},\
  'signup.config': ${mosip.esignet.ui.signup.config}, \
  'forgot-password.config': ${mosip.esignet.ui.forgot-password.config}, \
  'auth.factor.kba.individual-id-field' : 'policyNumber',\
  'auth.factor.kba.field-details':${mosip.esignet.authenticator.default.auth-factor.kba.field-details}}

##  ---------------------------------------------- VCI ------------------------------------------------------------------
mosip.esignet.vci.identifier=${mosip.esignet.domain.url}
mosip.esignet.vci.authn.filter-urls={ '${server.servlet.path}/vci/credential' }
mosip.esignet.vci.authn.issuer-uri=${mosip.esignet.domain.url}${server.servlet.path}
mosip.esignet.vci.authn.jwk-set-uri=${mosip.esignet.domain.url}${server.servlet.path}/oauth/.well-known/jwks.json
mosip.esignet.vci.authn.allowed-audiences={ '${mosip.esignet.domain.url}${server.servlet.path}/vci/credential' }

##change this to your value
mosip.esignet.cnonce-expire-seconds=1000
mosip.esignet.vci.supported.jwt-proof-alg={'RS256','PS256','ES256'}


## -------------------------------------------- Others ----------------------------------------------------------

# Auth challenge type & format mapping. Auth challenge length validations for each auth factor type.
mosip.esignet.auth-challenge.OTP.format=alpha-numeric
mosip.esignet.auth-challenge.OTP.min-length=6
mosip.esignet.auth-challenge.OTP.max-length=6

mosip.esignet.auth-challenge.PWD.format=alpha-numeric
mosip.esignet.auth-challenge.PWD.min-length=8
mosip.esignet.auth-challenge.PWD.max-length=30

mosip.esignet.auth-challenge.BIO.format=encoded-json
mosip.esignet.auth-challenge.BIO.min-length=5000
mosip.esignet.auth-challenge.BIO.max-length=300000

mosip.esignet.auth-challenge.WLA.format=jwt
mosip.esignet.auth-challenge.WLA.min-length=100
mosip.esignet.auth-challenge.WLA.max-length=800

mosip.esignet.auth-challenge.KBA.format=base64url-encoded-json
mosip.esignet.auth-challenge.KBA.min-length=50
mosip.esignet.auth-challenge.KBA.max-length=500

mosip.esignet.auth-challenge.PIN.format=number
mosip.esignet.auth-challenge.PIN.min-length=4
mosip.esignet.auth-challenge.PIN.max-length=4