+
+
+
+
diff --git a/lumbung.space/login/messages/messages_en.properties b/lumbung.space/login/messages/messages_en.properties
new file mode 100755
index 0000000..397437a
--- /dev/null
+++ b/lumbung.space/login/messages/messages_en.properties
@@ -0,0 +1,415 @@
+doLogIn=Sign In
+doRegister=Register
+doCancel=Cancel
+doSubmit=Submit
+doBack=Back
+doYes=Yes
+doNo=No
+doContinue=Continue
+doIgnore=Ignore
+doAccept=Accept
+doDecline=Decline
+doForgotPassword=Forgot Password?
+doClickHere=Click here
+doImpersonate=Impersonate
+doTryAgain=Try again
+doTryAnotherWay=Try Another Way
+doConfirmDelete=Confirm deletion
+errorDeletingAccount=Error happened while deleting account
+deletingAccountForbidden=You do not have enough permissions to delete your own account, contact admin.
+kerberosNotConfigured=Kerberos Not Configured
+kerberosNotConfiguredTitle=Kerberos Not Configured
+bypassKerberosDetail=Either you are not logged in by Kerberos or your browser is not set up for Kerberos login. Please click continue to login in through other means
+kerberosNotSetUp=Kerberos is not set up. You cannot login.
+registerTitle=Register
+loginAccountTitle=Sign in to your account
+loginTitle=Sign in to {0}
+loginTitleHtml={0}
+impersonateTitle={0} Impersonate User
+impersonateTitleHtml={0} Impersonate User
+realmChoice=Realm
+unknownUser=Unknown user
+loginTotpTitle=Mobile Authenticator Setup
+loginProfileTitle=Update Account Information
+loginTimeout=Your login attempt timed out. Login will start from the beginning.
+oauthGrantTitle=Grant Access to {0}
+oauthGrantTitleHtml={0}
+errorTitle=We are sorry...
+errorTitleHtml=We are sorry ...
+emailVerifyTitle=Email verification
+emailForgotTitle=Forgot Your Password?
+updatePasswordTitle=Update password
+codeSuccessTitle=Success code
+codeErrorTitle=Error code\: {0}
+displayUnsupported=Requested display type unsupported
+browserRequired=Browser required to login
+browserContinue=Browser required to complete login
+browserContinuePrompt=Open browser and continue login? [y/n]:
+browserContinueAnswer=y
+
+
+termsTitle=Terms and Conditions
+termsText=
Terms and conditions to be defined
+termsPlainText=Terms and conditions to be defined.
+
+recaptchaFailed=Invalid Recaptcha
+recaptchaNotConfigured=Recaptcha is required, but not configured
+consentDenied=Consent denied.
+
+noAccount=New user?
+username=Username
+usernameOrEmail=Username or email
+firstName=First name
+givenName=Given name
+fullName=Full name
+lastName=Last name
+familyName=Family name
+email=Email
+password=Password
+passwordConfirm=Confirm password
+passwordNew=New Password
+passwordNewConfirm=New Password confirmation
+rememberMe=Remember me
+authenticatorCode=One-time code
+address=Address
+street=Street
+locality=City or Locality
+region=State, Province, or Region
+postal_code=Zip or Postal code
+country=Country
+emailVerified=Email verified
+website=Web page
+phoneNumber=Phone number
+phoneNumberVerified=Phone number verified
+gender=Gender
+birthday=Birthdate
+zoneinfo=Time zone
+gssDelegationCredential=GSS Delegation Credential
+logoutOtherSessions=Sign out from other devices
+
+profileScopeConsentText=User profile
+emailScopeConsentText=Email address
+addressScopeConsentText=Address
+phoneScopeConsentText=Phone number
+offlineAccessScopeConsentText=Offline Access
+samlRoleListScopeConsentText=My Roles
+rolesScopeConsentText=User roles
+
+restartLoginTooltip=Restart login
+
+loginTotpIntro=You need to set up a One Time Password generator to access this account
+loginTotpStep1=Install one of the following applications on your mobile:
+loginTotpStep2=Open the application and scan the barcode:
+loginTotpStep3=Enter the one-time code provided by the application and click Submit to finish the setup.
+loginTotpStep3DeviceName=Provide a Device Name to help you manage your OTP devices.
+loginTotpManualStep2=Open the application and enter the key:
+loginTotpManualStep3=Use the following configuration values if the application allows setting them:
+loginTotpUnableToScan=Unable to scan?
+loginTotpScanBarcode=Scan barcode?
+loginCredential=Credential
+loginOtpOneTime=One-time code
+loginTotpType=Type
+loginTotpAlgorithm=Algorithm
+loginTotpDigits=Digits
+loginTotpInterval=Interval
+loginTotpCounter=Counter
+loginTotpDeviceName=Device Name
+
+loginTotp.totp=Time-based
+loginTotp.hotp=Counter-based
+
+loginChooseAuthenticator=Select login method
+
+oauthGrantRequest=Do you grant these access privileges?
+inResource=in
+
+oauth2DeviceVerificationTitle=Device Login
+verifyOAuth2DeviceUserCode=Enter the code provided by your device and click Submit
+oauth2DeviceInvalidUserCodeMessage=Invalid code, please try again.
+oauth2DeviceExpiredUserCodeMessage=The code has expired. Please go back to your device and try connecting again.
+oauth2DeviceVerificationCompleteHeader=Device Login Successful
+oauth2DeviceVerificationCompleteMessage=You may close this browser window and go back to your device.
+oauth2DeviceVerificationFailedHeader=Device Login Failed
+oauth2DeviceVerificationFailedMessage=You may close this browser window and go back to your device and try connecting again.
+oauth2DeviceConsentDeniedMessage=Consent denied for connecting the device.
+oauth2DeviceAuthorizationGrantDisabledMessage=Client is not allowed to initiate OAuth 2.0 Device Authorization Grant. The flow is disabled for the client.
+
+emailVerifyInstruction1=An email with instructions to verify your email address has been sent to you.
+emailVerifyInstruction2=Haven''t received a verification code in your email?
+emailVerifyInstruction3=to re-send the email.
+
+emailLinkIdpTitle=Link {0}
+emailLinkIdp1=An email with instructions to link {0} account {1} with your {2} account has been sent to you.
+emailLinkIdp2=Haven''t received a verification code in your email?
+emailLinkIdp3=to re-send the email.
+emailLinkIdp4=If you already verified the email in different browser
+emailLinkIdp5=to continue.
+
+backToLogin=« Back to Login
+
+emailInstruction=Enter your username or email address and we will send you instructions on how to create a new password.
+
+copyCodeInstruction=Please copy this code and paste it into your application:
+
+pageExpiredTitle=Page has expired
+pageExpiredMsg1=To restart the login process
+pageExpiredMsg2=To continue the login process
+
+personalInfo=Personal Info:
+role_admin=Admin
+role_realm-admin=Realm Admin
+role_create-realm=Create realm
+role_create-client=Create client
+role_view-realm=View realm
+role_view-users=View users
+role_view-applications=View applications
+role_view-clients=View clients
+role_view-events=View events
+role_view-identity-providers=View identity providers
+role_manage-realm=Manage realm
+role_manage-users=Manage users
+role_manage-applications=Manage applications
+role_manage-identity-providers=Manage identity providers
+role_manage-clients=Manage clients
+role_manage-events=Manage events
+role_view-profile=View profile
+role_manage-account=Manage account
+role_manage-account-links=Manage account links
+role_read-token=Read token
+role_offline-access=Offline access
+client_account=Account
+client_account-console=Account Console
+client_security-admin-console=Security Admin Console
+client_admin-cli=Admin CLI
+client_realm-management=Realm Management
+client_broker=Broker
+
+requiredFields=Required fields
+
+invalidUserMessage=Invalid username or password.
+invalidUsernameMessage=Invalid username.
+invalidUsernameOrEmailMessage=Invalid username or email.
+invalidPasswordMessage=Invalid password.
+invalidEmailMessage=Invalid email address.
+accountDisabledMessage=Account is disabled, contact your administrator.
+accountTemporarilyDisabledMessage=Account is temporarily disabled; contact your administrator or retry later.
+expiredCodeMessage=Login timeout. Please sign in again.
+expiredActionMessage=Action expired. Please continue with login now.
+expiredActionTokenNoSessionMessage=Action expired.
+expiredActionTokenSessionExistsMessage=Action expired. Please start again.
+
+missingFirstNameMessage=Please specify first name.
+missingLastNameMessage=Please specify last name.
+missingEmailMessage=Please specify email.
+missingUsernameMessage=Please specify username.
+missingPasswordMessage=Please specify password.
+missingTotpMessage=Please specify authenticator code.
+missingTotpDeviceNameMessage=Please specify device name.
+notMatchPasswordMessage=Passwords don''t match.
+
+invalidPasswordExistingMessage=Invalid existing password.
+invalidPasswordBlacklistedMessage=Invalid password: password is blacklisted.
+invalidPasswordConfirmMessage=Password confirmation doesn''t match.
+invalidTotpMessage=Invalid authenticator code.
+
+usernameExistsMessage=Username already exists.
+emailExistsMessage=Email already exists.
+
+federatedIdentityExistsMessage=User with {0} {1} already exists. Please login to account management to link the account.
+federatedIdentityUnavailableMessage=User {0} authenticated with identity provider {1} does not exists. Please contact your administrator.
+
+confirmLinkIdpTitle=Account already exists
+federatedIdentityConfirmLinkMessage=User with {0} {1} already exists. How do you want to continue?
+federatedIdentityConfirmReauthenticateMessage=Authenticate to link your account with {0}
+nestedFirstBrokerFlowMessage=The {0} user {1} is not linked to any known user.
+confirmLinkIdpReviewProfile=Review profile
+confirmLinkIdpContinue=Add to existing account
+
+configureTotpMessage=You need to set up Mobile Authenticator to activate your account.
+updateProfileMessage=You need to update your user profile to activate your account.
+updatePasswordMessage=You need to change your password to activate your account.
+resetPasswordMessage=You need to change your password.
+verifyEmailMessage=You need to verify your email address to activate your account.
+linkIdpMessage=You need to verify your email address to link your account with {0}.
+
+emailSentMessage=You should receive an email shortly with further instructions.
+emailSendErrorMessage=Failed to send email, please try again later.
+
+accountUpdatedMessage=Your account has been updated.
+accountPasswordUpdatedMessage=Your password has been updated.
+
+delegationCompleteHeader=Login Successful
+delegationCompleteMessage=You may close this browser window and go back to your console application.
+delegationFailedHeader=Login Failed
+delegationFailedMessage=You may close this browser window and go back to your console application and try logging in again.
+
+noAccessMessage=No access
+
+invalidPasswordMinLengthMessage=Invalid password: minimum length {0}.
+invalidPasswordMinDigitsMessage=Invalid password: must contain at least {0} numerical digits.
+invalidPasswordMinLowerCaseCharsMessage=Invalid password: must contain at least {0} lower case characters.
+invalidPasswordMinUpperCaseCharsMessage=Invalid password: must contain at least {0} upper case characters.
+invalidPasswordMinSpecialCharsMessage=Invalid password: must contain at least {0} special characters.
+invalidPasswordNotUsernameMessage=Invalid password: must not be equal to the username.
+invalidPasswordNotEmailMessage=Invalid password: must not be equal to the email.
+invalidPasswordRegexPatternMessage=Invalid password: fails to match regex pattern(s).
+invalidPasswordHistoryMessage=Invalid password: must not be equal to any of last {0} passwords.
+invalidPasswordGenericMessage=Invalid password: new password doesn''t match password policies.
+
+failedToProcessResponseMessage=Failed to process response
+httpsRequiredMessage=HTTPS required
+realmNotEnabledMessage=Realm not enabled
+invalidRequestMessage=Invalid Request
+failedLogout=Logout failed
+unknownLoginRequesterMessage=Unknown login requester
+loginRequesterNotEnabledMessage=Login requester not enabled
+bearerOnlyMessage=Bearer-only applications are not allowed to initiate browser login
+standardFlowDisabledMessage=Client is not allowed to initiate browser login with given response_type. Standard flow is disabled for the client.
+implicitFlowDisabledMessage=Client is not allowed to initiate browser login with given response_type. Implicit flow is disabled for the client.
+invalidRedirectUriMessage=Invalid redirect uri
+unsupportedNameIdFormatMessage=Unsupported NameIDFormat
+invalidRequesterMessage=Invalid requester
+registrationNotAllowedMessage=Registration not allowed
+resetCredentialNotAllowedMessage=Reset Credential not allowed
+
+permissionNotApprovedMessage=Permission not approved.
+noRelayStateInResponseMessage=No relay state in response from identity provider.
+insufficientPermissionMessage=Insufficient permissions to link identities.
+couldNotProceedWithAuthenticationRequestMessage=Could not proceed with authentication request to identity provider.
+couldNotObtainTokenMessage=Could not obtain token from identity provider.
+unexpectedErrorRetrievingTokenMessage=Unexpected error when retrieving token from identity provider.
+unexpectedErrorHandlingResponseMessage=Unexpected error when handling response from identity provider.
+identityProviderAuthenticationFailedMessage=Authentication failed. Could not authenticate with identity provider.
+couldNotSendAuthenticationRequestMessage=Could not send authentication request to identity provider.
+unexpectedErrorHandlingRequestMessage=Unexpected error when handling authentication request to identity provider.
+invalidAccessCodeMessage=Invalid access code.
+sessionNotActiveMessage=Session not active.
+invalidCodeMessage=An error occurred, please login again through your application.
+identityProviderUnexpectedErrorMessage=Unexpected error when authenticating with identity provider
+identityProviderMissingStateMessage=Missing state parameter in response from identity provider.
+identityProviderNotFoundMessage=Could not find an identity provider with the identifier.
+identityProviderLinkSuccess=You successfully verified your email. Please go back to your original browser and continue there with the login.
+staleCodeMessage=This page is no longer valid, please go back to your application and sign in again
+realmSupportsNoCredentialsMessage=Realm does not support any credential type.
+credentialSetupRequired=Cannot login, credential setup required.
+identityProviderNotUniqueMessage=Realm supports multiple identity providers. Could not determine which identity provider should be used to authenticate with.
+emailVerifiedMessage=Your email address has been verified.
+staleEmailVerificationLink=The link you clicked is an old stale link and is no longer valid. Maybe you have already verified your email.
+identityProviderAlreadyLinkedMessage=Federated identity returned by {0} is already linked to another user.
+confirmAccountLinking=Confirm linking the account {0} of identity provider {1} with your account.
+confirmEmailAddressVerification=Confirm validity of e-mail address {0}.
+confirmExecutionOfActions=Perform the following action(s)
+
+locale_ca=Catal\u00E0
+locale_cs=\u010Ce\u0161tina
+locale_da=Dansk
+locale_de=Deutsch
+locale_en=English
+locale_es=Espa\u00F1ol
+locale_fr=Fran\u00E7ais
+locale_hu=Magyar
+locale_it=Italiano
+locale_ja=\u65E5\u672C\u8A9E
+locale_lt=Lietuvi\u0173
+locale_nl=Nederlands
+locale_no=Norsk
+locale_pl=Polski
+locale_pt_BR=Portugu\u00EAs (Brasil)
+locale_pt-BR=Portugu\u00EAs (Brasil)
+locale_ru=\u0420\u0443\u0441\u0441\u043A\u0438\u0439
+locale_sk=Sloven\u010Dina
+locale_sv=Svenska
+locale_tr=T\u00FCrk\u00E7e
+locale_zh-CN=\u4E2D\u6587\u7B80\u4F53
+
+backToApplication=« Back to Application
+missingParameterMessage=Missing parameters\: {0}
+clientNotFoundMessage=Client not found.
+clientDisabledMessage=Client disabled.
+invalidParameterMessage=Invalid parameter\: {0}
+alreadyLoggedIn=You are already logged in.
+differentUserAuthenticated=You are already authenticated as different user ''{0}'' in this session. Please sign out first.
+brokerLinkingSessionExpired=Requested broker account linking, but current session is no longer valid.
+proceedWithAction=» Click here to proceed
+
+requiredAction.CONFIGURE_TOTP=Configure OTP
+requiredAction.terms_and_conditions=Terms and Conditions
+requiredAction.UPDATE_PASSWORD=Update Password
+requiredAction.UPDATE_PROFILE=Update Profile
+requiredAction.VERIFY_EMAIL=Verify Email
+
+doX509Login=You will be logged in as\:
+clientCertificate=X509 client certificate\:
+noCertificate=[No Certificate]
+
+
+pageNotFound=Page not found
+internalServerError=An internal server error has occurred
+
+console-username=Username:
+console-password=Password:
+console-otp=One Time Password:
+console-new-password=New Password:
+console-confirm-password=Confirm Password:
+console-update-password=Update of your password is required.
+console-verify-email=You need to verify your email address. We sent an email to {0} that contains a verification code. Please enter this code into the input below.
+console-email-code=Email Code:
+console-accept-terms=Accept Terms? [y/n]:
+console-accept=y
+
+# Openshift messages
+openshift.scope.user_info=User information
+openshift.scope.user_check-access=User access information
+openshift.scope.user_full=Full Access
+openshift.scope.list-projects=List projects
+
+# SAML authentication
+saml.post-form.title=Authentication Redirect
+saml.post-form.message=Redirecting, please wait.
+saml.post-form.js-disabled=JavaScript is disabled. We strongly recommend to enable it. Click the button below to continue.
+saml.artifactResolutionServiceInvalidResponse=Unable to resolve artifact.
+
+#authenticators
+otp-display-name=Authenticator Application
+otp-help-text=Enter a verification code from authenticator application.
+password-display-name=Password
+password-help-text=Sign in by entering your password.
+auth-username-form-display-name=Username
+auth-username-form-help-text=Start sign in by entering your username
+auth-username-password-form-display-name=Username and password
+auth-username-password-form-help-text=Sign in by entering your username and password.
+
+# WebAuthn
+webauthn-display-name=Security Key
+webauthn-help-text=Use your security key to sign in.
+webauthn-passwordless-display-name=Security Key
+webauthn-passwordless-help-text=Use your security key for passwordless sign in.
+webauthn-login-title=Security Key login
+webauthn-registration-title=Security Key Registration
+webauthn-available-authenticators=Available authenticators
+webauthn-unsupported-browser-text=WebAuthn is not supported by this browser. Try another one or contact your administrator.
+
+# WebAuthn Error
+webauthn-error-title=Security Key Error
+webauthn-error-registration=Failed to register your Security key. {0}
+webauthn-error-api-get=Failed to authenticate by the Security key. {0}
+webauthn-error-different-user=First authenticated user is not the one authenticated by the Security key.
+webauthn-error-auth-verification=Security key authentication result is invalid. {0}
+webauthn-error-register-verification=Security key registration result is invalid. {0}
+webauthn-error-user-not-found=Unknown user authenticated by the Security key.
+
+# Identity provider
+identity-provider-redirector=Connect with another Identity Provider
+identity-provider-login-label=Or sign in with
+
+finalDeletionConfirmation=If you delete your account, it cannot be restored. To keep your account, click Cancel.
+irreversibleAction=This action is irreversible
+deleteAccountConfirm=Delete account confirmation
+
+deletingImplies=Deleting your account implies:
+errasingData=Erasing all your data
+loggingOutImmediately=Logging you out immediately
+accountUnusable=Any subsequent use of the application will not be possible with this account
+userDeletedSuccessfully=User deleted successfully
+
+access-denied=Access denied
\ No newline at end of file
diff --git a/lumbung.space/login/register.ftl b/lumbung.space/login/register.ftl
new file mode 100755
index 0000000..db50984
--- /dev/null
+++ b/lumbung.space/login/register.ftl
@@ -0,0 +1,141 @@
+<#import "template.ftl" as layout>
+<@layout.registrationLayout displayMessage=!messagesPerField.existsError('firstName','lastName','email','username','password','password-confirm'); section>
+ <#if section = "header">
+ ${msg("registerTitle")}
+ <#elseif section = "form">
+
+
+
\ No newline at end of file
diff --git a/lumbung.space/login/resources/js/base64url.js b/lumbung.space/login/resources/js/base64url.js
new file mode 100644
index 0000000..64555bf
--- /dev/null
+++ b/lumbung.space/login/resources/js/base64url.js
@@ -0,0 +1,114 @@
+// for embedded scripts, quoted and modified from https://github.com/swansontec/rfc4648.js by William Swanson
+'use strict';
+var base64url = base64url || {};
+(function(base64url) {
+
+ function parse (string, encoding, opts = {}) {
+ // Build the character lookup table:
+ if (!encoding.codes) {
+ encoding.codes = {};
+ for (let i = 0; i < encoding.chars.length; ++i) {
+ encoding.codes[encoding.chars[i]] = i;
+ }
+ }
+
+ // The string must have a whole number of bytes:
+ if (!opts.loose && (string.length * encoding.bits) & 7) {
+ throw new SyntaxError('Invalid padding');
+ }
+
+ // Count the padding bytes:
+ let end = string.length;
+ while (string[end - 1] === '=') {
+ --end;
+
+ // If we get a whole number of bytes, there is too much padding:
+ if (!opts.loose && !(((string.length - end) * encoding.bits) & 7)) {
+ throw new SyntaxError('Invalid padding');
+ }
+ }
+
+ // Allocate the output:
+ const out = new (opts.out || Uint8Array)(((end * encoding.bits) / 8) | 0);
+
+ // Parse the data:
+ let bits = 0; // Number of bits currently in the buffer
+ let buffer = 0; // Bits waiting to be written out, MSB first
+ let written = 0; // Next byte to write
+ for (let i = 0; i < end; ++i) {
+ // Read one character from the string:
+ const value = encoding.codes[string[i]];
+ if (value === void 0) {
+ throw new SyntaxError('Invalid character ' + string[i]);
+ }
+
+ // Append the bits to the buffer:
+ buffer = (buffer << encoding.bits) | value;
+ bits += encoding.bits;
+
+ // Write out some bits if the buffer has a byte's worth:
+ if (bits >= 8) {
+ bits -= 8;
+ out[written++] = 0xff & (buffer >> bits);
+ }
+ }
+
+ // Verify that we have received just enough bits:
+ if (bits >= encoding.bits || 0xff & (buffer << (8 - bits))) {
+ throw new SyntaxError('Unexpected end of data');
+ }
+
+ return out
+ }
+
+ function stringify (data, encoding, opts = {}) {
+ const { pad = true } = opts;
+ const mask = (1 << encoding.bits) - 1;
+ let out = '';
+
+ let bits = 0; // Number of bits currently in the buffer
+ let buffer = 0; // Bits waiting to be written out, MSB first
+ for (let i = 0; i < data.length; ++i) {
+ // Slurp data into the buffer:
+ buffer = (buffer << 8) | (0xff & data[i]);
+ bits += 8;
+
+ // Write out as much as we can:
+ while (bits > encoding.bits) {
+ bits -= encoding.bits;
+ out += encoding.chars[mask & (buffer >> bits)];
+ }
+ }
+
+ // Partial character:
+ if (bits) {
+ out += encoding.chars[mask & (buffer << (encoding.bits - bits))];
+ }
+
+ // Add padding characters until we hit a byte boundary:
+ if (pad) {
+ while ((out.length * encoding.bits) & 7) {
+ out += '=';
+ }
+ }
+
+ return out
+ }
+
+ const encoding = {
+ chars: 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_',
+ bits: 6
+ }
+
+ base64url.decode = function (string, opts) {
+ return parse(string, encoding, opts);
+ }
+
+ base64url.encode = function (data, opts) {
+ return stringify(data, encoding, opts)
+ }
+
+ return base64url;
+}(base64url));
+
+
diff --git a/lumbung.space/login/saml-post-form.ftl b/lumbung.space/login/saml-post-form.ftl
new file mode 100644
index 0000000..94b0c30
--- /dev/null
+++ b/lumbung.space/login/saml-post-form.ftl
@@ -0,0 +1,25 @@
+<#import "template.ftl" as layout>
+<@layout.registrationLayout; section>
+ <#if section = "header">
+ ${msg("saml.post-form.title")}
+ <#elseif section = "form">
+
+
+
+ <#-- App-initiated actions should not see warning messages about the need to complete the action -->
+ <#-- during login. -->
+ <#if displayMessage && message?has_content && (message.type != 'warning' || !isAppInitiatedAction??)>
+
