<security-config>
    <parameters>
        <init-param>
            <!--
              The login URL to redirect to when the user tries to access a protected resource (rather than clicking on
              an explicit login link). Most of the time, this will be the same value as 'link.login.url'.
                - if the URL is absolute (contains '://'), then redirect that URL (for SSO applications)
                - else the context path will be prepended to this URL

                If '${originalurl}' is present in the URL, it will be replaced with the URL that the user requested.
                This gives SSO login pages the chance to redirect to the original page
            -->
            <param-name>login.url</param-name>
            <param-value>/login.jsp?os_destination=${originalurl}</param-value>
            <!--<param-value>http://sso.mycompany.com/login?redirectTo=${originalurl}</param-value>-->
        </init-param>
        <init-param>
            <!--
              the URL to redirect to when the user explicitly clicks on a login link (rather than being redirected after
              trying to access a protected resource). Most of the time, this will be the same value as 'login.url'.
                - same properties as login.url above
            -->
            <param-name>link.login.url</param-name>
            <param-value>/login.jsp?os_destination=${originalurl}</param-value>
            <!--<param-value>/secure/Dashboard.jspa?os_destination=${originalurl}</param-value>-->
            <!--<param-value>http://sso.mycompany.com/login?redirectTo=${originalurl}</param-value>-->
        </init-param>
        <init-param>
            <!-- URL for logging out.
                 - If relative, Seraph just redirects to this URL, which is responsible for calling Authenticator.logout().
                 - If absolute (eg. SSO applications), Seraph calls Authenticator.logout() and redirects to the URL
                 -->
            <param-name>logout.url</param-name>
            <param-value>/secure/Logout!default.jspa</param-value>
            <!--<param-value>http://sso.mycompany.com/logout</param-value>-->
        </init-param>
        <!-- The key that the original URL is stored with in the session -->
        <init-param>
            <param-name>original.url.key</param-name>
            <param-value>os_security_originalurl</param-value>
        </init-param>
        <init-param>
            <param-name>login.cookie.key</param-name>
            <param-value>seraph.os.cookie</param-value>
        </init-param>
        <!-- This property controls how your cookie is encrypted.  If you truly want to secure your cookies, you need
            to change this to a secure password -->
        <init-param>
            <param-name>cookie.encoding</param-name>
            <param-value>jiracookie</param-value>
        </init-param>
        <!-- This property sets the default cookie timeout in seconds.  It is currently set to 1 year -->
        <init-param>
            <param-name>autologin.cookie.age</param-name>
            <param-value>31536000</param-value>
        </init-param>
        <!-- Basic Authentication can be enabled by passing the authentication type as a configurable url parameter.
        With this example, you will need to pass http://mycompany.com/anypage?os_authType=basic in the url to enable Basic Authentication -->
        <init-param>
            <param-name>authentication.type</param-name>
            <param-value>os_authType</param-value>
        </init-param>
        <!--  If this parameter is set to true, the cookie will never be set secure.  This is useful if you're logging
              into JIRA via https, but want to browse JIRA over http.  This flag will ensure that the remember me option
              works correctly.
        <init-param>
            <param-name>insecure.cookie</param-name>
            <param-value>true</param-value>
        </init-param> -->
    </parameters>

    <rolemapper class="com.atlassian.jira.security.JiraRoleMapper"/>

    <!-- CROWD:START - If enabling Crowd SSO integration uncomment the following JIRAAuthenticator and comment out the DefaultAuthenticator below -->
    <!--
    <authenticator class="com.atlassian.crowd.integration.seraph.JIRAAuthenticator"/>
    -->
    <!-- CROWD:END -->

    <!-- CROWD:START - The authenticator below here will need to be commented out for Crowd SSO integration -->
    <authenticator class="com.atlassian.seraph.auth.DefaultAuthenticator"/>
    <!-- CROWD:END -->

    <!-- NB: the URL to redirect to is now specified by login.url above -->
    <services>
        <service class="com.atlassian.seraph.service.PathService">
            <init-param>
                <param-name>config.file</param-name>
                <param-value>/seraph-paths.xml</param-value>
            </init-param>
        </service>

        <service class="com.atlassian.seraph.service.WebworkService">
            <init-param>
                <param-name>action.extension</param-name>
                <param-value>jspa</param-value>
            </init-param>
        </service>
    </services>

    <interceptors>
        <interceptor class="com.atlassian.jira.portal.PortalPageInterceptor"/>
        <interceptor class="com.atlassian.jira.user.preferences.UserPreferencesResetInterceptor"/>
    </interceptors>
</security-config>
