<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE packagegui SYSTEM "../schema/packages.dtd">
<?xml-stylesheet type="text/xsl" href="../xsl/package.xsl"?>
<packagegui>
	<name>univnautes</name>
	<title>Services: Captive portal / Univnautes</title>
	<include_file>/usr/local/pkg/univnautes.inc</include_file>
        <configpath>['installedpackages']['univnautes']['config']</configpath>
        <aftersaveredirect>/pkg_edit.php?xml=univnautes.xml</aftersaveredirect>
	<custom_php_resync_config_command>
		univnautes_sync();
		univnautes_restart_all();
	</custom_php_resync_config_command>
	<tabs>
		<tab>
			<text>Captive portal</text>
			<url>services_captiveportal.php</url>
		</tab>
		<tab>
			<text>Univnautes</text>
			<url>/pkg_edit.php?xml=univnautes.xml</url>
			<active/>
		</tab>
		<tab>
			<text>Univnautes UI</text>
			<url>/pkg_edit.php?xml=univnautes_texts.xml</url>
		</tab>
		<tab>
			<text>File Manager</text>
			<url>services_captiveportal_filemanager.php</url>
		</tab>
		<tab>
			<text>Pass-through MAC</text>
			<url>services_captiveportal_mac.php</url>
		</tab>
		<tab>
			<text>Allowed IP</text>
			<url>services_captiveportal_ip.php</url>
		</tab>
	</tabs>
	<fields>
		<field>
			<type>listtopic</type>
			<name>Captive portal: User interface</name>
		</field>
		<field>
			<fielddescr>Default IdP (Entity ID)</fielddescr>
			<fieldname>defaultidp</fieldname>
			<description>EntityID of the identity provider displayed by default on login page.</description>
			<default_value>https://services-federation.renater.fr/test/idp</default_value>
			<type>input</type>
			<size>60</size>
		</field>
		<field>
			<fielddescr>Redirection delay</fielddescr>
			<fieldname>redirectdelay</fieldname>
			<description><![CDATA[After login, redirect the user to the original requested URL after this delay (in seconds).<br />
				0 = redirect immediately<br />
				empty = do not redirect]]>
			</description>
			<default_value/>
			<type>input</type>
			<size>3</size>
		</field>
		<field>
			<fielddescr>Redirection URL</fielddescr>
			<fieldname>redirecturl</fieldname>
			<description><![CDATA[If you provide a URL here, clients will be redirected to that URL instead of the one they initially tried to access after they've authenticated.<br />
				You can use variables, with python format: %(ip)s, %(mac)s, %(display_name)s, %(idp)s, %(timestamp)s, %(datetime_local)s, %(next_url)s, %(redirect_delay)s, %(pfsenseid)s.<br />
				For example: http://univ.fr/eduspot?ip=%(ip)s&name=%(display_name)s]]>
			</description>
			<default_value/>
			<type>input</type>
			<size>60</size>
		</field>
		<field>
			<type>listtopic</type>
			<name>SAML 2.0 Service Provider</name>
		</field>
		<field>
			<fielddescr>SP SAML Private Key</fielddescr>
			<fieldname>samlkey</fieldname>
			<encoding>base64</encoding>
			<description>in PEM format</description>
			<type>textarea</type>
			<rows>4</rows>
			<cols>66</cols>
		</field>
		<field>
			<fielddescr>SP SAML Signing Key (Certificate)</fielddescr>
			<fieldname>samlcrt</fieldname>
			<encoding>base64</encoding>
			<description>in PEM format</description>
			<type>textarea</type>
			<rows>4</rows>
			<cols>66</cols>
		</field>
		<field>
			<type>listtopic</type>
			<name>SAML 2.0 Local Identity Provider</name>
		</field>
		<field>
			<fielddescr>Enable local IdP</fielddescr>
			<fieldname>enableidp</fieldname>
			<description><![CDATA[Enable a local Identity Provider (IdP SAML 2.0) with HTTPS on port 4443. This local IdP authenticates pfSense's users with the 'UnivNautes IdP - account' privilege (see <a href="/system_usermanager.php">User Manager</a>)]]></description>
			<type>checkbox</type>
		</field>
		<field>
			<fielddescr>Local IdP SAML Private Key</fielddescr>
			<fieldname>samlkeyidp</fieldname>
			<encoding>base64</encoding>
			<description>in PEM format</description>
			<type>textarea</type>
			<rows>4</rows>
			<cols>66</cols>
		</field>
		<field>
			<fielddescr>Local IdP SAML Signing Key (Certificate)</fielddescr>
			<fieldname>samlcrtidp</fieldname>
			<encoding>base64</encoding>
			<description>in PEM format</description>
			<type>textarea</type>
			<rows>4</rows>
			<cols>66</cols>
		</field>
		<field>
			<type>listtopic</type>
			<name>Federation: metadata download</name>
		</field>
		<field>
			<fielddescr>IdPs metadata URL, used by captive portal</fielddescr>
			<fieldname>mdurl</fieldname>
			<description>If this field is empty, current metadata will be removed.</description>
			<default_value>https://services-federation.renater.fr/metadata/renater-test-metadata.xml</default_value>
			<type>input</type>
			<size>60</size>
		</field>
		<field>
			<fielddescr>IdPs metadata CA (https certificate issuer)</fielddescr>
			<fieldname>mdca</fieldname>
			<encoding>base64</encoding>
			<description>in PEM format, can be a bundle</description>
			<default_value/>
			<type>textarea</type>
			<rows>4</rows>
			<cols>66</cols>
		</field>
		<field>
			<fielddescr>IdPs metadata certificate</fielddescr>
			<fieldname>mdcrt</fieldname>
			<encoding>base64</encoding>
			<description>in PEM format</description>
			<default_value/>
			<type>textarea</type>
			<rows>4</rows>
			<cols>66</cols>
		</field>
		<field>
			<fielddescr>SPs metadata URL, used by local IdP</fielddescr>
			<fieldname>mdspurl</fieldname>
			<description>If this field is empty, use IdPs metadata URL (see above).</description>
			<default_value/>
			<type>input</type>
			<size>60</size>
		</field>
		<field>
			<fielddescr>SPs metadata CA (https certificate issuer)</fielddescr>
			<fieldname>mdspca</fieldname>
			<encoding>base64</encoding>
			<description>in PEM format, can be a bundle</description>
			<default_value/>
			<type>textarea</type>
			<rows>4</rows>
			<cols>66</cols>
		</field>
		<field>
			<fielddescr>SPs metadata certificate</fielddescr>
			<fieldname>mdspcrt</fieldname>
			<encoding>base64</encoding>
			<description>in PEM format</description>
			<default_value/>
			<type>textarea</type>
			<rows>4</rows>
			<cols>66</cols>
		</field>
		<field>
			<type>listtopic</type>
			<name>Federation: IP whitelist, for IdPs</name>
		</field>
		<field>
			<fielddescr>IP whitelist URL</fielddescr>
			<fieldname>wlurl</fieldname>
			<description/>
			<default_value>https://www.cru.fr/eduspot/whitelist-eduspot.txt</default_value>
			<type>input</type>
			<size>60</size>
		</field>
		<field>
			<fielddescr>IP whitelist CA (https certificate issuer)</fielddescr>
			<fieldname>wlca</fieldname>
			<encoding>base64</encoding>
			<description>in PEM format, can be a bundle</description>
			<default_value/>
			<type>textarea</type>
			<rows>4</rows>
			<cols>66</cols>
		</field>
		<field>
			<fielddescr>Whitelist statics IP</fielddescr>
			<fieldname>wlstaticips</fieldname>
			<encoding>base64</encoding>
			<description>one IP a.b.c.d per line; for a network address use: a.b.c.d/N</description>
			<default_value># one IP or network address per line ; you can use comments</default_value>
			<type>textarea</type>
			<rows>4</rows>
			<cols>66</cols>
		</field>
		<field>
			<type>listtopic</type>
			<name>Federation: local metadata (SPs and IdPs)</name>
		</field>
		<field>
			<fielddescr>Local metadata (SPs and IdPs)</fielddescr>
			<fieldname>mdlocal</fieldname>
			<encoding>base64</encoding>
			<description>metadata XML file</description>
			<type>textarea</type>
			<rows>8</rows>
			<cols>66</cols>
		</field>
		<field>
			<type>listtopic</type>
			<name>Discovery Service</name>
		</field>
		<field>
			<fielddescr>IdP Discovery Service endpoints (read)</fielddescr>
			<fieldname>discostoresread</fieldname>
			<encoding>base64</encoding>
			<description>List of IdP Discovery Service endpoints to contact, one URL per line. You may safely include a short list of services, but you are reccomended to limit the number, because all these services are contacted by all users when disco is used. REMEMBER: add the corresponding IPs in the whitelist statics IP above.</description>
			<type>textarea</type>
			<rows>4</rows>
			<cols>66</cols>
		</field>
		<field>
			<fielddescr>IdP Discovery Service endpoints (write)</fielddescr>
			<fieldname>discostoreswrite</fieldname>
			<encoding>base64</encoding>
			<description>List of IdP Discovery Service endpoints that supports DiscoJuiceReadWrite, which is an extension to the IdP Discovery Protocol, that allows you to write the result of the user selection to a central discovery service. One URL per line. REMEMBER: add the corresponding IPs in the whitelist statics IP above.</description>
			<type>textarea</type>
			<rows>4</rows>
			<cols>66</cols>
		</field>
		<field>
			<type>listtopic</type>
			<name>Blacklists</name>
		</field>
		<field>
			<fielddescr>User blacklist</fielddescr>
			<fieldname>userbl</fieldname>
			<encoding>base64</encoding>
			<description>format: nameId|entityId, one per line. Start with ~ for regex</description>
			<type>textarea</type>
			<rows>4</rows>
			<cols>66</cols>
		</field>
		<field>
			<fielddescr>MAC blacklist</fielddescr>
			<fieldname>macbl</fieldname>
			<encoding>base64</encoding>
			<description>format: 00:11:22:33:44:55, one per line.</description>
			<type>textarea</type>
			<rows>4</rows>
			<cols>66</cols>
		</field>
		<field>
			<fielddescr>First URLs blacklist</fielddescr>
			<fieldname>firsturlbl</fieldname>
			<encoding>base64</encoding>
			<description>URLs that are not web pages: captive portal should not handle them. Format: one regex per line.</description>
			<type>textarea</type>
			<rows>4</rows>
			<cols>66</cols>
		</field>
	</fields>
</packagegui>
