application-default.properties

# Inji default properties
mosip.inji.allowedAuthType=demo,otp,bio-Finger,bio-Iris,bio-Face
mosip.inji.allowedEkycAuthType=demo,otp,bio-Finger,bio-Iris,bio-Face
mosip.inji.allowedInternalAuthType=otp,bio-Finger,bio-Iris,bio-Face
mosip.inji.faceSdkModelUrl=https://api.collab.mosip.net/inji
# maximum number of retry for downloading vc
mosip.inji.vcDownloadMaxRetry=10
# pool interval in milliseconds
mosip.inji.vcDownloadPoolInterval=6000
# validate binding audience url to be sent in token
mosip.inji.audience=ida-binding
# issuer to be sent in token
mosip.inji.issuer=residentapp
# warning screen domain name
mosip.inji.warningDomainName=${mosip.api.public.url}
#timeout for vc download api via OpenId4VCI flow in milliseconds
mosip.inji.openId4VCIDownloadVCTimeout=30000
# inji documentation url
mosip.inji.aboutInjiUrl=https://docs.inji.io/inji-wallet/inji-mobile
# minimum storage space required for making audit entry in MB
mosip.inji.minStorageRequiredForAuditEntry=2
# minimum storage space required for downloading / receiving vc in MB
mosip.inji.minStorageRequired=2

#------------------------------------ Key-manager specific properties --------------------------------------------------

# Crypto asymmetric algorithm name
mosip.kernel.crypto.asymmetric-algorithm-name=RSA/ECB/OAEPWITHSHA-256ANDMGF1PADDING
# Crypto symmetric algorithm name
mosip.kernel.crypto.symmetric-algorithm-name=AES/GCM/NoPadding
# Encrypted data and encrypted symmetric key separator
mosip.kernel.data-key-splitter=#KEY_SPLITTER#
# GCM tag length
mosip.kernel.crypto.gcm-tag-length=128
# Hash algo name
mosip.kernel.crypto.hash-algorithm-name=PBKDF2WithHmacSHA512
# Symmetric key length used in hash
mosip.kernel.crypto.hash-symmetric-key-length=256
# No of iterations in hash
mosip.kernel.crypto.hash-iteration=10000
# Keygenerator symmetric algorithm name
mosip.kernel.keygenerator.symmetric-algorithm-name=AES
# Symmetric algorithm key length
mosip.kernel.keygenerator.symmetric-key-length=256
# Asymmetric algorithm key length
mosip.kernel.keygenerator.asymmetric-key-length=2048
# Keygenerator asymmetric algorithm name
mosip.kernel.keygenerator.asymmetric-algorithm-name=RSA
# Defines the file path for the PKCS#12 keystore used by the KeyManager service for cryptographic keys
# E.g., place the .p12 file in 'mimoto/certs' folder and provide its path here
mosip.kernel.keymanager.hsm.config-path=/home/mosip/encryption/encryptionkeystore.p12
# Defines the type of the keystore used by the Key Manager as PKCS#12
mosip.kernel.keymanager.hsm.keystore-type=PKCS12
# Password to access the KeyManager PKCS#12 keystore file
mosip.kernel.keymanager.hsm.keystore-pass=${mimoto.oidc.keystore.password}

# Default Certificate properties
mosip.kernel.keymanager.certificate.default.common-name=www.example.com
mosip.kernel.keymanager.certificate.default.organizational-unit=EXAMPLE-CENTER
mosip.kernel.keymanager.certificate.default.organization=IIITB
mosip.kernel.keymanager.certificate.default.location=BANGALORE
mosip.kernel.keymanager.certificate.default.state=KA
mosip.kernel.keymanager.certificate.default.country=IN

# keymanager database properties
# Specifies the driver class name for the PostgreSQL database, required for the application to interact with the database
keymanager.persistence.jdbc.driver=org.postgresql.Driver
# Specifies the JDBC URL for connecting to the PostgreSQL database, required to establish a connection to the inji_mimoto database
keymanager_database_url = jdbc:postgresql://${inji.mimoto.database.hostname}:${inji.mimoto.database.port}/inji_mimoto
# Defines the password for accessing the PostgreSQL database, required for authentication
keymanager_database_password=${db.dbuser.password}
# Defines the username for accessing the PostgreSQL database, required for authentication
keymanager_database_username= mimotouser
# Specifies the schema name used by the Keymanager in the PostgreSQL database
keymanager.persistence.jdbc.schema=mimoto

# Hibernate properties
hibernate.dialect=org.hibernate.dialect.PostgreSQLDialect
hibernate.hbm2ddl.auto=none
hibernate.jdbc.lob.non_contextual_creation=true
hibernate.show_sql=false
hibernate.format_sql=false
hibernate.connection.charSet=utf8
hibernate.cache.use_second_level_cache=false
hibernate.cache.use_query_cache=false
hibernate.cache.use_structured_entries=false
hibernate.generate_statistics=false
hibernate.current_session_context_class=org.springframework.orm.hibernate5.SpringSessionContext

#Inji Web Config
# Specifies the URL to redirect the user after successful authentication using Identity Provider(e.g., Goggle), pointing to the passcode page in Inji Web
mosip.inji.web.authentication.success.redirect.url=${mosip.inji.web.url}/user/passcode
# Defines the List of Issuers that are limited to issue only single Verifiable Credential
mosip.inji.wallet.issuersWithSingleVcLimit=Mosip
# Defines the maximum number of characters allowed to be encoded into a QR code. The value can be set to anything less than or equal to 4096.
# If the data size exceeds 4096 characters (equivalent to 4KB), the 'pixel pass' library will fail to generate the QR code.
mosip.inji.qr.data.size.limit=4096
# Defines the height (in Pixels) of the generated QR code
mosip.inji.qr.code.height=400
# Defines the width (in Pixels) of the generated QR code
mosip.inji.qr.code.width=400

#User Wallet Config
# Regular expression for validating wallet PINs, ensuring it is exactly 6 digits
mosip.inji.user.wallet.pin.validation.regex=^\\d{6}$
# Regular expression for validating wallet names, allowing alphanumeric characters, spaces, underscores, hyphens, and periods with a maximum length of 50 characters
mosip.inji.user.wallet.name.validation.regex=^[A-Za-z0-9 _.-]{0,50}$

#Google OAuth2 configuration
# Specifies the client ID for Google OAuth2 authentication, required to identify the application during OAuth2 requests.
spring.security.oauth2.client.registration.google.client-id=${mosip.injiweb.google.client.id}
# Specifies the client secret for Google OAuth2 authentication, used to authenticate the application securely
spring.security.oauth2.client.registration.google.client-secret=${mosip.injiweb.google.client.secret}
# Defines the scopes requested during Google OAuth2 authentication, specifying the level of access required (e.g., profile and email)
spring.security.oauth2.client.registration.google.scope=profile,email
# Specifies the redirect URI for Google OAuth2 authentication callbacks, where Google sends the authorization response
spring.security.oauth2.client.registration.google.redirect-uri={baseUrl}/oauth2/callback/{registrationId}
# Defines the authorization grant type for Google OAuth2 authentication, indicating the flow used (e.g., authorization code)
spring.security.oauth2.client.registration.google.authorization-grant-type=authorization_code
# Defines the human-readable name that will be displayed for the Google login option
# For example, if it is set to "Login with Google" it will appear as "Login with Google" on a spring security generated login page
spring.security.oauth2.client.registration.google.client-name=Google
# Specifies the authorization endpoint URI for Google OAuth2, where users are redirected to authenticate
spring.security.oauth2.client.provider.google.authorization-uri=https://accounts.google.com/o/oauth2/auth?prompt=select_account
# Specifies the token endpoint URI for Google OAuth2, used to exchange the authorization code for an access token
spring.security.oauth2.client.provider.google.token-uri=https://oauth2.googleapis.com/token
# Specifies the user information endpoint URI for Google OAuth2, used to fetch user details after authentication
spring.security.oauth2.client.provider.google.user-info-uri=https://www.googleapis.com/oauth2/v3/userinfo
# Specifies the URI for Google's JSON Web Key Set (JWK) used for token validation, ensuring secure communication
spring.security.oauth2.client.provider.google.jwk-set-uri=https://www.googleapis.com/oauth2/v3/certs
# Maps the 'sub' attribute from the Google UserInfo endpoint response to the Spring Security principal's name (username)
spring.security.oauth2.client.provider.google.userNameAttribute=sub
# Maps the 'name' attribute from the Google UserInfo endpoint response to the Spring Security principal's accessible name
spring.security.oauth2.client.provider.google.nameAttribute=name
# Maps the 'email' attribute from the Google UserInfo endpoint response to the Spring Security principal's email address
spring.security.oauth2.client.provider.google.emailAttribute=email
# Maps the 'picture' attribute from the Google UserInfo endpoint response to the Spring Security principal's profile picture URL
spring.security.oauth2.client.provider.google.pictureAttribute=picture
# Maps the 'phone_number' attribute from the Google UserInfo endpoint response to the Spring Security principal's phone number
spring.security.oauth2.client.provider.google.phoneNumberAttribute=phone_number

#Database configuration
# Specifies the JDBC URL for connecting to the PostgreSQL database, required to establish a connection to the inji_mimoto database
spring.datasource.url=jdbc:postgresql://${inji.mimoto.database.hostname}:${inji.mimoto.database.port}/inji_mimoto
# Defines the username for accessing the PostgreSQL database, required for authentication
spring.datasource.username=mimotouser
# Defines the password for accessing the PostgreSQL database, required for authentication
spring.datasource.password=${db.dbuser.password}
# Configures the Hibernate behavior for database schema management, setting it to 'none' prevents Hibernate from automatically creating, updating, or dropping the database schema on startup
spring.jpa.hibernate.ddl-auto=none
# Enables or disables the display of SQL statements in the logs, useful for debugging database queries
spring.jpa.show-sql=true
# Specifies the driver class name for the PostgreSQL database, required for the application to interact with the database
spring.datasource.driver-class-name=org.postgresql.Driver

#Redis configuration
# Specifies the type of session store to use (Redis in this case) for storing http sessions in User Login flow, enabling distributed session management.
spring.session.store-type=redis
# Defines the hostname of the Redis server, required to connect to the Redis instance.
spring.data.redis.host=${redis.host:localhost}
# Specifies the port number for the Redis server, required to connect to the Redis instance.
spring.data.redis.port=${redis.port:6379}
# Sets the password for connecting to the Redis server (empty if no password is required), ensuring secure access.
spring.data.redis.password=${redis.password:""}
# Sets the duration for which the application waits to establish a connection with the Redis server, preventing long delays.
spring.data.redis.connect-timeout=10s
# Specifies the duration the application waits for a response from Redis operations (e.g., setting or retrieving keys), ensuring timely responses.
spring.data.redis.timeout=10s
# Specifies the duration of inactivity after which a user session in configured session store (Ex: redis) will expire, ensuring session cleanup.
server.servlet.session.timeout=30m
# Specifies the namespace for Redis session keys, used to avoid key collisions in Redis.
spring.session.redis.namespace=injiweb:session:
# Configures the database dialect for Hibernate (PostgreSQL in this case), ensuring compatibility with the database.
spring.jpa.database-platform=org.hibernate.dialect.PostgreSQLDialect

# List of URLs that can be accessed without any user authentication by Identity Provider
mosip.security.ignore-auth-urls=/safetynet/**,/actuator/**,/swagger-ui/**,/v3/api-docs/**,\
  /allProperties,/credentials/**,/credentialshare/**,/binding-otp,/wallet-binding,/get-token/**,\
  /issuers,/issuers/**,/v2/issuers,/v2/issuers/**,/authorize,/req/otp,/vid,/req/auth/**,/req/individualId/otp,/aid/get-individual-id,\
 /verifiers, /auth/*/token-login

# CSRF Security Configuration
# CSRF protection is always enabled by default. State-changing requests (POST, PUT, DELETE, PATCH)
# require a valid CSRF token to be sent in the X-XSRF-TOKEN header.
# List of URLs that are excluded from CSRF protection. These URLs can still require authentication.
# OAuth2 endpoints and public endpoints are typically excluded from CSRF protection.
mosip.security.csrf-ignore-urls=/oauth2/**,/logout,/safetynet/**,/credentials/**,/credentialshare/**,/binding-otp,/wallet-binding,\
  /get-token/**,/req/otp,/vid,/req/auth/**,/req/individualId/otp,/auth/*/token-login

# Inji mobile wallet configuration
# This template defines the list of the fields of the downloaded verifiable credential will be included in the event files when generating different documents
credential.template=template.json
# Specifies the base directory path where the credentials which are downloaded in the Inji mobile wallet will be stored
credential.data.path=data
safetynet.api.key=
safetynet.api.url=https://www.googleapis.com/androidcheck/v1/attestations/verify?key=${safetynet.api.key}

registration.processor.print.textfile=registration-processor-print-text-file.json

# Application ID used for identifying and managing the Mimoto service keys in Key Manager service
mosip.inji.app.id=MIMOTO

# Face key mappings - first available key is used for image display
mosip.injiweb.vc.subject.face.keys.order=image,face,photo,picture,portrait

# Enables or disables the display of disclosures for VCs
mosip.injiweb.mask.disclosures=true

#Caffeine cache related configurations
# Cache related configurations
# Specifies which cache type to use (e.g., caffeine, redis)
spring.cache.type=redis

# Cache expiry time in minutes for the issuer's well-known endpoint response.
cache.credential-issuer.wellknown.expiry-time-in-min = 60
# Cache expiry time in minutes for issuers configurations read from a config file.
cache.issuers-config.expiry-time-in-min = 60
# Cache expiry time in minutes for the authentication server's well-known endpoint response.
cache.credential-issuer.authserver-wellknown.expiry-time-in-min = 60
# Cache expiry time in minutes for the pre-registered trusted verifiers list.
cache.pre-registered-trusted-verifiers.expiry-time-in-min=60
# Default cache expiry time in minutes for others cache types
cache.default.expiry-time-in-min = 60

# Wallet Passcode Configuration
# Duration (in minutes) for which the wallet remains locked after exceeding failed attempts in a cycle.
# Must be a whole number; decimal/fractional values (e.g., 0.5) will throw an error during Mimoto launch
wallet.passcode.retryBlockedUntil=60
# Maximum number of failed passcode attempts allowed in a single cycle (defaults to 1 if <=0)
wallet.passcode.maxFailedAttemptsAllowedPerCycle=5
# Maximum number of lock cycles allowed before the wallet is permanently locked (defaults to 1 if <=0)
wallet.passcode.maxLockCyclesAllowed=3

# Signing Algorithms Priority Order Configuration
signing.algorithms.priority.order=ED25519,ES256K,ES256,RS256