{
  "name": "risk",
  "baseURI": "https://app.example.com:8444/login",
  "condition": "${find(request.uri.path, '^/home/cdsso')}",
  "properties": {
    "amInstanceUrl": "https://myTenant.forgeblocks.com/am",
    "clientId": "my-application-client-id",
    "policySetId": "my-policy-set-id",
    "serviceEndpoint": "https://api.pingone.eu/v1/environments/my-environment-id",
    "tokenEndpoint": "https://auth.pingone.eu/my-environment-id/as/token"
  },
  "heap": [
    {
      "name": "SystemAndEnvSecretStore-1",
      "type": "SystemAndEnvSecretStore"
    },
    {
      "name": "AmService-1",
      "type": "AmService",
      "config": {
        "url": "&{amInstanceUrl}",
        "realm": "/alpha",
        "agent": {
          "username": "ig_agent",
          "passwordSecretId": "agent.secret.id"
        },
        "secretsProvider": "SystemAndEnvSecretStore-1",
        "sessionCache": {
          "enabled": false
        }
      }
    },
    {
      "name": "ClientCredentialsOAuth2ClientFilter-1",
      "type": "ClientCredentialsOAuth2ClientFilter",
      "config": {
        "tokenEndpoint": "&{tokenEndpoint}",
        "scopes": [
          "openid",
          "profile",
          "email",
          "p1"
        ],
        "endpointHandler": {
          "name": "AccessTokenHandler",
          "type": "Chain",
          "config": {
            "filters": [
              {
                "type": "ClientSecretBasicAuthenticationFilter",
                "config": {
                  "clientId": "&{clientId}",
                  "clientSecretId": "client.secret.id",
                  "secretsProvider": "SystemAndEnvSecretStore-1"
                }
              }
            ],
            "handler": "ForgeRockClientHandler"
          }
        }
      }
    },
    {
      "name": "RiskEndpointHandler",
      "type": "Chain",
      "config": {
        "filters": [
          "ClientCredentialsOAuth2ClientFilter-1"
        ],
        "handler": "ForgeRockClientHandler"
      }
    },
    {
      "name": "PingOneService-1",
      "type": "PingOneService",
      "config": {
        "serviceEndpoint": "&{serviceEndpoint}",
        "endpointHandler": "RiskEndpointHandler"
      }
    },
    {
      "name": "StepUpHandler",
      "type": "Chain",
      "config": {
        "filters": [
          {
            "name": "PolicyEnforcementFilter-1",
            "type": "PolicyEnforcementFilter",
            "config": {
              "application": "PEP-CDSSO",
              "ssoTokenSubject": "${contexts.cdsso.token}",
              "amService": "AmService-1"
            }
          },
          {
            "name": "SuccessFeedbackFilter",
            "type": "PingOneProtectFeedbackSuccessFilter",
            "config": {
              "pingOneService": "PingOneService-1",
              "postEvaluationAssumedRiskLevel": "low"
            }
          }
        ],
        "handler": "ReverseProxyHandler"
      }
    },
    {
      "name": "FailureHandler",
      "type": "Chain",
      "config": {
        "filters": [
          {
            "name": "FailureFeedbackFilter",
            "type": "PingOneProtectFeedbackFailureFilter",
            "config": {
              "pingOneService": "PingOneService-1"
            }
          }
        ],
        "handler": {
          "type": "StaticResponseHandler",
          "config": {
            "status": 403,
            "headers": {
              "Content-Type": [
                "text/plain; charset=UTF-8"
              ]
            },
            "entity": "HTTP 403 Forbidden"
          }
        }
      }
    }
  ],
  "handler": {
    "type": "Chain",
    "config": {
      "filters": [
        {
          "name": "CrossDomainSingleSignOnFilter-1",
          "type": "CrossDomainSingleSignOnFilter",
          "config": {
            "redirectEndpoint": "/home/cdsso/redirect",
            "authCookie": {
              "path": "/home",
              "name": "ig-token-cookie"
            },
            "amService": "AmService-1"
          }
        },
        {
          "name": "PingOneProtectEvaluationFilter-1",
          "type": "PingOneProtectEvaluationFilter",
          "config": {
            "pingOneService": "PingOneService-1",
            "policySet": "&{policySetId}",
            "userId": "${contexts.cdsso.claimsSet.getClaim('subname')}",
            "nonEvaluatedUrls": "${find(request.uri.path, '/home/cdsso/redirect')}",
            "deviceProfile": {
              "callbackEndpoint": "/home/cdsso/profilecallback"
            }
          }
        }
      ],
      "handler": {
        "name": "PingOneProtectThreatLevelRoutingHandler-1",
        "type": "PingOneProtectThreatLevelRoutingHandler",
        "config": {
          "levels": {
            "low": "ReverseProxyHandler",
            "medium": "StepUpHandler",
            "high": "FailureHandler"
          }
        }
      }
    }
  }
}