{
    "$schema": "http://json-schema.org/draft-04/schema#",
    "title": "single_tenant_template",
    "order": 4,
    "definitions": {
        "AssertionConsumerServiceBinding": {
            "type": "string",
            "enum": [
                "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect",
                "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
                "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign",
                "urn:oasis:names:tc:SAML:2.0:bindings:SOAP",
                "urn:oasis:names:tc:SAML:2.0:bindings:PAOS",
                "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact",
                "urn:oasis:names:tc:SAML:2.0:bindings:URI"
            ],
            "default": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
            "info": "Select the binding the SP claims support for. A binding specifies the technical method of a connection."
        },
        "NameIDFormat": {
            "type": "string",
            "enum": [
                "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified",
                "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
                "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
            ],
            "default": "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent",
            "info": "This indicates whether the nameID is set to something random or the same every time the user logs in. Use transient if user does not need to be identified in a new session."
        },
        "ArpAttribute": {
            "type": "array",
            "items": {
                "type": "object",
                "properties": {
                    "source": {
                        "type": "string"
                    },
                    "value": {
                        "type": "string"
                    }
                }
            }
        }
    },
    "type": "object",
    "properties": {
        "id": {
            "type": "number"
        },
        "eid": {
            "type": "number"
        },
        "entityid": {
            "type": "string"
        },
        "type": {
            "type": "string",
            "enum": [
                "single-tenant-template"
            ]
        },
        "revisionid": {
            "type": "number"
        },
        "state": {
            "type": "string",
            "enum": [
                "prodaccepted",
                "testaccepted"
            ]
        },
        "metadataurl": {
            "type": [
                "string",
                "null"
            ]
        },
        "allowedall": {
            "type": "boolean"
        },
        "user": {
            "type": "string"
        },
        "created": {
            "type": "string"
        },
        "ip": {
            "type": "string"
        },
        "revisionnote": {
            "type": "string"
        },
        "active": {
            "type": "boolean"
        },
        "allowedEntities": {
            "type": "array",
            "items": {
                "type": "object",
                "properties": {
                    "name": {
                        "type": "string"
                    }
                }
            }
        },
        "arp": {
            "type": "object",
            "sources": [
                "idp",
                "ala",
                "orcid",
                "sab",
                "voot",
                "pseudo_email",
                "sbs",
                "surfmarket_entitlements",
                "manage"
            ],
            "properties": {
                "enabled": {
                    "type": "boolean"
                },
                "attributes": {
                    "properties": {
                        "urn:mace:dir:attribute-def:eduPersonTargetedID": {
                            "$ref": "#/definitions/ArpAttribute",
                            "alias": "urn:oid:1.3.6.1.4.1.5923.1.1.1.10"
                        },
                        "urn:mace:dir:attribute-def:eduPersonPrincipalName": {
                            "$ref": "#/definitions/ArpAttribute",
                            "alias": "urn:oid:1.3.6.1.4.1.5923.1.1.1.6"
                        },
                        "urn:mace:dir:attribute-def:displayName": {
                            "$ref": "#/definitions/ArpAttribute",
                            "alias": "urn:oid:2.16.840.1.113730.3.1.241"
                        },
                        "urn:mace:dir:attribute-def:cn": {
                            "$ref": "#/definitions/ArpAttribute",
                            "description": "common name",
                            "alias": "urn:oid:2.5.4.3"
                        },
                        "urn:mace:dir:attribute-def:givenName": {
                            "$ref": "#/definitions/ArpAttribute",
                            "alias": "urn:oid:2.5.4.42"
                        },
                        "urn:mace:dir:attribute-def:sn": {
                            "$ref": "#/definitions/ArpAttribute",
                            "description": "surname",
                            "alias": "urn:oid:2.5.4.4"
                        },
                        "urn:mace:dir:attribute-def:mail": {
                            "$ref": "#/definitions/ArpAttribute",
                            "alias": "urn:oid:0.9.2342.19200300.100.1.3"
                        },
                        "urn:mace:terena.org:attribute-def:schacHomeOrganization": {
                            "$ref": "#/definitions/ArpAttribute",
                            "alias": "urn:oid:1.3.6.1.4.1.25178.1.2.9"
                        },
                        "urn:mace:terena.org:attribute-def:schacHomeOrganizationType": {
                            "$ref": "#/definitions/ArpAttribute",
                            "alias": "urn:oid:1.3.6.1.4.1.25178.1.2.10"
                        },
                        "urn:schac:attribute-def:schacPersonalUniqueCode": {
                            "$ref": "#/definitions/ArpAttribute",
                            "alias": "urn:oid:1.3.6.1.4.1.25178.1.2.14",
                            "multiplicity": true
                        },
                        "urn:mace:dir:attribute-def:eduPersonAffiliation": {
                            "$ref": "#/definitions/ArpAttribute",
                            "alias": "urn:oid:1.3.6.1.4.1.5923.1.1.1.1",
                            "multiplicity": true
                        },
                        "urn:mace:dir:attribute-def:eduPersonScopedAffiliation": {
                            "$ref": "#/definitions/ArpAttribute",
                            "alias": "urn:oid:1.3.6.1.4.1.5923.1.1.1.9",
                            "multiplicity": true
                        },
                        "urn:mace:dir:attribute-def:eduPersonEntitlement": {
                            "$ref": "#/definitions/ArpAttribute",
                            "alias": "urn:oid:1.3.6.1.4.1.5923.1.1.1.7",
                            "multiplicity": true
                        },
                        "urn:mace:dir:attribute-def:eduPersonOrcid": {
                            "$ref": "#/definitions/ArpAttribute",
                            "alias": "urn:oid:1.3.6.1.4.1.5923.1.1.1.16"
                        },
                        "urn:mace:dir:attribute-def:eduPersonAssurance": {
                            "$ref": "#/definitions/ArpAttribute",
                            "alias": "urn:oid:1.3.6.1.4.1.5923.1.1.1.11"
                        },
                        "urn:mace:surf.nl:attribute-def:eckid": {
                            "$ref": "#/definitions/ArpAttribute"
                        },
                        "urn:mace:eduid.nl:1.1": {
                            "$ref": "#/definitions/ArpAttribute",
                            "display": "eduid"
                        },
                        "urn:mace:surf.nl:attribute-def:surf-crm-id": {
                            "$ref": "#/definitions/ArpAttribute",
                            "alias": "urn:oid:1.3.6.1.4.1.1076.20.100.10.50.2"
                        },
                        "urn:mace:dir:attribute-def:isMemberOf": {
                            "$ref": "#/definitions/ArpAttribute",
                            "alias": "urn:oid:1.3.6.1.4.1.5923.1.5.1.1",
                            "multiplicity": true
                        },
                        "urn:mace:dir:attribute-def:uid": {
                            "$ref": "#/definitions/ArpAttribute",
                            "alias": "urn:oid:0.9.2342.19200300.100.1.1"
                        },
                        "urn:mace:dir:attribute-def:preferredLanguage": {
                            "$ref": "#/definitions/ArpAttribute",
                            "alias": "urn:oid:2.16.840.1.113730.3.1.39"
                        },
                        "urn:mace:surffederatie.nl:attribute-def:nlEduPersonOrgUnit": {
                            "$ref": "#/definitions/ArpAttribute",
                            "alias": "urn:oid:1.3.6.1.4.1.1076.20.40.20.10.1",
                            "deprecated": true,
                            "multiplicity": true
                        },
                        "urn:mace:surffederatie.nl:attribute-def:nlEduPersonStudyBranch": {
                            "$ref": "#/definitions/ArpAttribute",
                            "alias": "urn:oid:1.3.6.1.4.1.1076.20.40.20.10",
                            "deprecated": true,
                            "multiplicity": true
                        },
                        "urn:mace:surffederatie.nl:attribute-def:nlStudielinkNummer": {
                            "$ref": "#/definitions/ArpAttribute",
                            "alias": "urn:oid:1.3.6.1.4.1.1076.20.40.20.10.3",
                            "deprecated": true
                        }
                    }
                }
            },
            "required": [
                "enabled",
                "attributes"
            ]
        },
        "notes": {
            "type": [
                "string",
                "null"
            ]
        },
        "metaDataFields": {
            "type": "object",
            "properties": {
                "NameIDFormat": {
                    "$ref": "#/definitions/NameIDFormat"
                },
                "SingleLogoutService_Binding": {
                    "type": "string",
                    "enum": [
                        "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect",
                        "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
                        "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign",
                        "urn:oasis:names:tc:SAML:2.0:bindings:SOAP",
                        "urn:oasis:names:tc:SAML:2.0:bindings:PAOS",
                        "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact",
                        "urn:oasis:names:tc:SAML:2.0:bindings:URI"
                    ],
                    "default": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect",
                    "info": "SingleLogoutService is not supported by the Engine Block. Selects the SingleLogoutService binding an SP claims support for. A binding specifies the protocol to access the service."
                },
                "SingleLogoutService_Location": {
                    "type": "string",
                    "format": "url",
                    "info": "SingleLogoutService is not supported by the Engine Block. If the connected SP supports SAML 2.0 Single Logout, this will specify the endpoint element as a URL."
                },
                "mdrpi:RegistrationInfo": {
                    "type": "string",
                    "info": "The name of the authority that can register a service provider or identity provider."
                },
                "logo:0:url": {
                    "type": "string",
                    "format": "url",
                    "info": "Enter the URL to the logo used for this service. e.g. https://static.example-logo.nl/media/sp/logo.png."
                },
                "logo:0:width": {
                    "type": "number",
                    "info": "The width of the logo found at logo:0:url in pixels."
                },
                "logo:0:height": {
                    "type": "number",
                    "info": "The height of the logo found at logo:0:url in pixels."
                },
                "redirect.sign": {
                    "type": "boolean",
                    "info": "Whether authentication request, logout requests and logout responses should be signed. The default is FALSE. This is generally set for trusted proxies like OpenID Connect Gateway."
                },
                "coin:publish_in_edugain": {
                    "type": "boolean",
                    "default": false,
                    "info": "Set this for service providers published in eduGAIN."
                },
                "coin:publish_in_edugain_date": {
                    "type": "string",
                    "format": "date-time",
                    "info": "When to add metadata to the eduGAIN feed. Usually the current time."
                },
                "coin:interfed_source": {
                    "type": "string",
                    "enum": [
                        "Entree",
                        "eduGAIN"
                    ],
                    "info": "Must be set if the federation source is either eduGAIN or Entree."
                },
                "coin:additional_logging": {
                    "type": "boolean",
                    "info": "Set to get an extended form of logging."
                },
                "coin:institution_id": {
                    "type": "string",
                    "info": "The defined client code."
                },
                "coin:institution_guid": {
                    "type": "string",
                    "format": "uuid",
                    "info": "This is a 128 bit number also known as a globally unique identifier (GUID or UUID) for this service."
                },
                "coin:trusted_proxy": {
                    "type": "boolean",
                    "default": false,
                    "info": "Set if the service provider can act on behalf of connected services to this service."
                },
                "coin:no_consent_required": {
                    "type": "boolean",
                    "info": "Select this option to skip the consent for a user."
                },
                "coin:eula": {
                    "type": "string",
                    "format": "url",
                    "info": "The URL to the end-user license agreement (EULA) of the service provider."
                },
                "coin:ss:idp_visible_only": {
                    "type": "boolean",
                    "info": "Set to make invisible in the dashboard for institutions that are not connected to this service."
                },
                "coin:ss:aansluitovereenkomst_refused": {
                    "type": "boolean",
                    "info": "Set to indicate the service in the dashboard for institutions is marked as to have disagreed to sign the aansluitovereenkomst."
                },
                "coin:application_url": {
                    "type": "string",
                    "format": "url",
                    "info": "The URL of the service used to log on."
                },
                "coin:transparant_issuer": {
                    "type": "boolean",
                    "info": "Set this to let the Engineblock use the EntityID of the IdP in stead of the EntityID of the Engineblock."
                },
                "coin:do_not_add_attribute_aliases": {
                    "type": "boolean",
                    "info": "Only send the SAML 2.0 name scheme. "
                },
                "coin:display_unconnected_idps_wayf": {
                    "type": "boolean",
                    "info": "Display unconnected IdPs in the WAYF."
                },
                "coin:policy_enforcement_decision_required": {
                    "type": "boolean",
                    "info": "Set to activate the user policy engine (PDP)."
                },
                "coin:original_metadata_url": {
                    "type": "string",
                    "format": "url",
                    "info": "The provided URL to the metadata of the service."
                },
                "coin:service_team_id": {
                    "type": "string",
                    "info": "Enter the team name as used in the SP Dashboard. e.g. urn:collab:group:example-teams.nl:nl:surfnet:services:spd_example. "
                },
                "coin:privacy:what_data": {
                    "type": "string",
                    "info": "Explain in a sufficient level of detail what (types of) data, so not just attributes, are processed within the service."
                },
                "coin:privacy:access_data": {
                    "type": "string",
                    "info": "Explain what people or roles at which companies can access data, and if necessary to which extend."
                },
                "coin:privacy:country": {
                    "type": "string",
                    "info": "In what country or countries does the data reside; include both primary processing location(s) as well as for instance locations where backups live."
                },
                "coin:privacy:security_measures": {
                    "type": "string",
                    "info": "Explains what security measures are taken to protect data. You can also link to a page describing this."
                },
                "coin:privacy:certification": {
                    "type": "boolean",
                    "info": "Can a Third Party Memorandum (TPM) be supplied? e.g. ISO27001/2, ISAE3402, etc."
                },
                "coin:privacy:certification_location": {
                    "type": "string",
                    "info": "Where can customers find the mentioned certificates or how can they request access."
                },
                "coin:privacy:certification_valid_from": {
                    "type": "string",
                    "format": "date-time",
                    "info": "The date from which the Third Party Memorandum (TPM) is valid."
                },
                "coin:privacy:certification_valid_to": {
                    "type": "string",
                    "format": "date-time",
                    "info": "The date until the Third Party Memorandum (TPM) is valid."
                },
                "coin:privacy:surfmarket_dpa_agreement": {
                    "type": "boolean",
                    "info": "Is the SURFmarket model Data Processing Agreement (DPA) signed by the service provider?"
                },
                "coin:privacy:surfnet_dpa_agreement": {
                    "type": "boolean",
                    "info": "Is the SURFnet model Data Processing Agreement (DPA) signed by the service provider?"
                },
                "coin:privacy:sn_dpa_why_not": {
                    "type": "string",
                    "info": "Explains why the SP answered no on the subject of the SURFmarket DPA."
                },
                "coin:privacy:privacy_policy": {
                    "type": "boolean",
                    "info": "Does the SP publish an applicable privacy policy on a web page?"
                },
                "coin:privacy:privacy_policy_url": {
                    "type": "string",
                    "format": "url",
                    "info": "The URL to the applicable privacy policy. "
                },
                "coin:privacy:other_info": {
                    "type": "string",
                    "info": "Other data privacy and security information that helps the institution decide whether it is OK to connect the service."
                },
                "coin:signature_method": {
                    "type": "string",
                    "format": "url",
                    "enum": [
                        "http://www.w3.org/2000/09/xmldsig#rsa-sha1",
                        "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"
                    ],
                    "default": "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256",
                    "info": "Select the Secure Hash Algorithm (SHA) as used by the service provider."
                },
                "coin:privacy:gdpr_is_in_wiki": {
                    "type": "boolean",
                    "info": "Set if the 'General Data Protection Regulation' (GDPR) is available on the SURF wiki. In Dutch known as 'Algemene Verordening Gegevensbescherming' (AVG). "
                },
                "coin:ss:license_status": {
                    "type": "string",
                    "enum": [
                        "license_required_by_service_provider",
                        "license_not_required",
                        "license_available_through_surfmarket"
                    ],
                    "default": "license_required_by_service_provider",
                    "info": "Set the applicable license for this service as provisioned by the SP Dashboard."
                },
                "coin:stepup:requireloa": {
                    "type": "string",
                    "format": "url",
                    "enum": [
                        "http://test.surfconext.nl/assurance/loa2",
                        "http://test.surfconext.nl/assurance/loa3"
                    ],
                    "info": "Set to require Stepup Authentication for this SP with the specified minimum Level of Assurance."
                },
                "coin:stepup:allow_no_token": {
                    "type": "boolean",
                    "info": "When Stepup Authentication is required for this SP, allow users without a registered token to log in regardless."
                },
                "coin:contractual_base": {
                    "type": "string",
                    "enum": [
                        "AO",
                        "IX",
                        "R&S+CoCo",
                        "Entree",
                        "Clarin"
                    ],
                    "default": "AO",
                    "info": "Set the contractual base that underlies a production SP / RP entity."
                }
            },
            "patternProperties": {
                "^name:(en|nl)$": {
                    "type": "string",
                    "info": "Set the name of the service. Format: 'Service Name | Supplier'"
                },
                "^displayName:(en|nl)$": {
                    "type": "string",
                    "info": "Name as displayed in applications."
                },
                "^coin:ss:wiki_url:(en|nl)$": {
                    "type": "string",
                    "format": "url",
                    "info": "Add the URL to the SURF wiki for additional information of this service."
                },
                "^description:(en|nl)$": {
                    "type": "string",
                    "info": "The description of the service."
                },
                "^coin:ss:type_of_service:(en|nl)$": {
                    "type": "string",
                    "info": "The type of service used in the facet search in dashboard."
                },
                "^AssertionConsumerService:([0-9]{1}):Binding$": {
                    "$ref": "#/definitions/AssertionConsumerServiceBinding",
                    "multiplicity": 10,
                    "info": "An Assertion Consumer Service (or ACS) the location at a ServiceProvider that accepts <samlp:Response> messages. The type of binding for this location can be selected from the pull-down."
                },
                "^AssertionConsumerService:([0-9]{1}):Location$": {
                    "type": "string",
                    "format": "url",
                    "multiplicity": 10,
                    "info": "An Assertion Consumer Service (or ACS) is the location at a ServiceProvider that accepts <samlp:Response> messages. A typical ACS location for an SP might look like this: https://data.example-service.nl/saml/saml2_acs/"
                },
                "^AssertionConsumerService:([0-9]{1}):index$": {
                    "type": "number",
                    "multiplicity": 10,
                    "info": "An Assertion Consumer Service (or ACS) is the location at a ServiceProvider that accepts <samlp:Response> messages. With the index you can include additional <md:AssertionConsumerService> elements in the SAML 2.0 SP metadata with the same binding, each with its own unique index."
                },
                "^NameIDFormats:([0-2]{1})$": {
                    "$ref": "#/definitions/NameIDFormat",
                    "multiplicity": 3,
                    "info": "The format in which the service expects the response. This can be transient, transparant or unspecified."
                },
                "^contacts:([0-3]{1}):surName$": {
                    "type": "string",
                    "multiplicity": 4,
                    "sibblingIndependent": true,
                    "info": "The surname of the contact. e.g. for 'John Doe', 'Doe' is the surname."
                },
                "^contacts:([0-3]{1}):givenName$": {
                    "type": "string",
                    "multiplicity": 4,
                    "sibblingIndependent": true,
                    "info": "The given name of the contact. e.g. for 'John Doe', 'John' is the given name."
                },
                "^contacts:([0-3]{1}):emailAddress$": {
                    "type": "string",
                    "format": "local-email",
                    "multiplicity": 4,
                    "sibblingIndependent": true,
                    "info": "The e-mail address; syntax in accordance with RFC 5322. e.g. m.l.vermeegen@university.example.org."
                },
                "^contacts:([0-3]{1}):telephoneNumber$": {
                    "type": "string",
                    "multiplicity": 4,
                    "sibblingIndependent": true,
                    "info": "The telephone number of the contact."
                },
                "^contacts:([0-3]{1}):isSirtfiSecurityContact$": {
                    "type": "boolean",
                    "multiplicity": 4,
                    "sibblingIndependent": true,
                    "info": "Set the security contact for this service."
                },
                "^contacts:([0-3]{1}):contactType$": {
                    "type": "string",
                    "enum": [
                        "technical",
                        "support",
                        "administrative",
                        "billing",
                        "other"
                    ],
                    "multiplicity": 4,
                    "sibblingIndependent": true,
                    "info": "From the pull down, select the type of contact."
                },
                "^OrganizationName:(en|nl)$": {
                    "type": "string",
                    "info": "The formal name of the organization. e.g. Service by University of Harderwijk."
                },
                "^OrganizationDisplayName:(en|nl)$": {
                    "type": "string",
                    "info": "The friendly name of the organization. e.g. University of Harderwijk."
                },
                "^OrganizationURL:(en|nl)$": {
                    "type": "string",
                    "format": "url",
                    "info": "The URL to the website of the service e.g. http://www.example-service.nl/en/."
                },
                "^url:(en|nl)$": {
                    "type": "string",
                    "format": "url",
                    "info": "The URL to the support site of the service."
                },
                "^mdui:PrivacyStatementURL:(en|nl)$": {
                    "type": "string",
                    "format": "url",
                    "info": "The URL to the Privacy Statement of the service."
                },
                "^mdrpi:RegistrationPolicy:(en|nl)$": {
                    "type": "string",
                    "info": "The URL to the Registration Policy of the service."
                },
                "^coin:entity_categories:([1-4]{1})$": {
                    "type": "string",
                    "enum": [
                        "http://refeds.org/category/research-and-scholarship",
                        "http://refeds.org/category/hide-from-discovery",
                        "http://www.geant.net/uri/dataprotection-code-of-conduct/v1",
                        "http://clarin.eu/category/clarin-member"
                    ],
                    "multiplicity": 4,
                    "startIndex": 1,
                    "info": "Select one of the entity categories applicable to this service. Entity Categories group federation entities that share common criteria."
                }
            },
            "required": [
                "name:en"
            ],
            "additionalProperties": false
        }
    },
    "required": [
        "state",
        "metaDataFields"
    ],
    "additionalProperties": false,
    "indexes": [
        {
            "name": "field_entityid",
            "type": "field",
            "fields": [
                "entityid"
            ],
            "unique": false
        }
    ]
}