Merge branch 'release/2.8'

Conflicts:
	composer.lock

.gitignore

@@ -1,6 +1,8 @@
 /web/bundles/
 /web/app_dev.php
 /web/app_dev.php.dist
+/web/js
+/web/css
 /app/bootstrap.php.cache
 /app/cache/*
 /app/config/parameters.yml

app/AppKernel.php

@@ -41,6 +41,7 @@ public function registerBundles()
             new JMS\DiExtraBundle\JMSDiExtraBundle($this),
             new JMS\AopBundle\JMSAopBundle(),
             new Surfnet\StepupU2fBundle\SurfnetStepupU2fBundle(),
+            new OpenConext\MonitorBundle\OpenConextMonitorBundle(),
         );
 
         if (in_array($this->getEnvironment(), array('dev', 'test'))) {

app/Resources/translations/validators.en_GB.xliff

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <xliff xmlns="urn:oasis:names:tc:xliff:document:1.2" xmlns:jms="urn:jms:translation" version="1.2">
-  <file date="2017-05-30T16:11:35Z" source-language="en" target-language="en_GB" datatype="plaintext" original="not.available">
+  <file date="2018-01-22T13:59:08Z" source-language="en" target-language="en_GB" datatype="plaintext" original="not.available">
     <header>
       <tool tool-id="JMSTranslationBundle" tool-name="JMSTranslationBundle" tool-version="1.1.0-DEV"/>
       <note>The source node in most cases contains the sample message as written by the developer. If it looks like a dot-delimitted string such as "form.label.firstname", then the developer has not provided a default message.</note>
@@ -90,6 +90,10 @@
         <source>middleware_client.dto.configuration.use_ra_locations.must_be_boolean</source>
         <target state="new">middleware_client.dto.configuration.use_ra_locations.must_be_boolean</target>
       </trans-unit>
+      <trans-unit id="77ed46e12521792cd4b8d2040443b43b6df3dc25" resname="middleware_client.dto.configuration.verify_email.must_be_boolean">
+        <source>middleware_client.dto.configuration.verify_email.must_be_boolean</source>
+        <target state="new">middleware_client.dto.configuration.verify_email.must_be_boolean</target>
+      </trans-unit>
       <trans-unit id="f033a6177f4f371fbc302f07a6b8c67ec8b46549" resname="middleware_client.dto.identity.common_name.must_be_string">
         <source>middleware_client.dto.identity.common_name.must_be_string</source>
         <target>Remote identity common name must be a string.</target>

app/Resources/translations/validators.nl_NL.xliff

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <xliff xmlns="urn:oasis:names:tc:xliff:document:1.2" xmlns:jms="urn:jms:translation" version="1.2">
-  <file date="2017-05-30T16:11:31Z" source-language="en" target-language="nl_NL" datatype="plaintext" original="not.available">
+  <file date="2018-01-22T13:59:02Z" source-language="en" target-language="nl_NL" datatype="plaintext" original="not.available">
     <header>
       <tool tool-id="JMSTranslationBundle" tool-name="JMSTranslationBundle" tool-version="1.1.0-DEV"/>
       <note>The source node in most cases contains the sample message as written by the developer. If it looks like a dot-delimitted string such as "form.label.firstname", then the developer has not provided a default message.</note>
@@ -90,6 +90,10 @@
         <source>middleware_client.dto.configuration.use_ra_locations.must_be_boolean</source>
         <target state="new">middleware_client.dto.configuration.use_ra_locations.must_be_boolean</target>
       </trans-unit>
+      <trans-unit id="77ed46e12521792cd4b8d2040443b43b6df3dc25" resname="middleware_client.dto.configuration.verify_email.must_be_boolean">
+        <source>middleware_client.dto.configuration.verify_email.must_be_boolean</source>
+        <target state="new">middleware_client.dto.configuration.verify_email.must_be_boolean</target>
+      </trans-unit>
       <trans-unit id="f033a6177f4f371fbc302f07a6b8c67ec8b46549" resname="middleware_client.dto.identity.common_name.must_be_string">
         <source>middleware_client.dto.identity.common_name.must_be_string</source>
         <target>Remote identity common name must be a string.</target>

app/Resources/views/base.html.twig

@@ -10,7 +10,7 @@
     '@SurfnetStepupSelfServiceSelfServiceBundle/Resources/public/less/style.less'
     '@SurfnetStepupBundle/Resources/public/less/stepup.less'
     %}
-    <link href="{{ asset_url }}" type="text/css" rel="stylesheet" media="screen" />
+    <link href="{{ asset_url }}" type="text/css" rel="stylesheet" media="screen, print" />
     {% endstylesheets %}
 {% endblock head_style %}
 
@@ -27,7 +27,7 @@
                 <h2>{{ 'app.subname'|trans }}</h2>
             </div>
         {% if app.user %}
-            <div class="clearfix">
+            <div class="clearfix page-header-user">
                 <form method="post" action="{{ logout_url('saml_based') }}" class="pull-right">
                     <button type="submit" class="btn btn-link">
                         <i class="fa fa-sign-out"></i>

app/config/config.yml

@@ -100,6 +100,10 @@ services:
         class: Twig_Extensions_Extension_Text
         tags: [{ name: twig.extension }]
 
+    twig.extension.intl:
+        class: Twig_Extensions_Extension_Intl
+        tags: [{ name: twig.extension }]
+
 surfnet_stepup_middleware_client:
     authorisation:
         username: %middleware_credentials_username%
@@ -161,6 +165,7 @@ jms_translation:
             extractors: []
 
 surfnet_stepup_self_service_self_service:
+    max_number_of_tokens: %number_of_tokens_per_identity%
     enabled_second_factors: %enabled_second_factors%
     enabled_generic_second_factors: %enabled_generic_second_factors%
     second_factor_test_identity_provider:

app/config/parameters.yml.dist

@@ -56,8 +56,11 @@ parameters:
 
     u2f_app_id: https://gateway.tld/u2f/app-id
 
-    tiqr_app_android_url: https://play.google.com/store/apps/details?id=org.tiqr.authenticator&hl=en
-    tiqr_app_ios_url: https://itunes.apple.com/us/app/tiqr/id430838214?mt=8&ls=1
+    irma_app_android_url: https://play.google.com/store/apps/details?id=org.irmacard.cardemu&hl=en
+    irma_app_ios_url: https://itunes.apple.com/us/app/irma-authentication/id1294092994?mt=8
 
     session_max_absolute_lifetime: 3600 # 1 hours * 60 minutes * 60 seconds
     session_max_relative_lifetime: 600  # 10 minutes * 60 seconds
+
+    # The maximum number of tokens each identity (person) can register.
+    number_of_tokens_per_identity: 2

app/config/routing.yml

@@ -2,6 +2,10 @@ surfnet_stepup_self_service_self_service:
     resource: "@SurfnetStepupSelfServiceSelfServiceBundle/Resources/config/routing.yml"
     prefix:   /
 
+openconext_monitor:
+    resource: "@OpenConextMonitorBundle/Resources/config/routing.yml"
+    prefix: /
+
 nelmio_security_report:
     path: /csp/report
     defaults: { _controller: nelmio_security.csp_reporter_controller:indexAction }

app/config/samlstepupproviders.yml

@@ -30,6 +30,8 @@ surfnet_stepup_self_service_saml_stepup_provider:
                 explanation: %gssp_tiqr_initiate_title%
                 authn_failed: %gssp_tiqr_authn_failed%
                 pop_failed: %gssp_tiqr_pop_failed%
+                app_android_url: %gssp_tiqr_app_android_url%
+                app_ios_url: %gssp_tiqr_app_ios_url%
         biometric:
             hosted:
                 service_provider:

app/config/samlstepupproviders_parameters.yml.dist

@@ -16,8 +16,10 @@ parameters:
         en_GB: 'Tiqr'
         nl_NL: 'Tiqr'
     gssp_tiqr_description:
-        en_GB: 'Log in with a smartphone app. For all smartphones with %%tiqr_ios_link_start%%Apple iOS%%tiqr_ios_link_end%% or %%tiqr_android_link_start%%Android%%tiqr_android_link_end%%.'
-        nl_NL: 'Log in met een app op je smartphone. Geschikt voor smartphones met %%tiqr_ios_link_start%%Apple iOS%%tiqr_ios_link_end%% of %%tiqr_android_link_start%%Android%%tiqr_android_link_end%%.'
+        en_GB: 'Log in with a smartphone app. For all smartphones with %%ios_link_start%%Apple iOS%%ios_link_end%% or %%android_link_start%%Android%%android_link_end%%.'
+        nl_NL: 'Log in met een app op je smartphone. Geschikt voor smartphones met %%ios_link_start%%Apple iOS%%ios_link_end%% of %%android_link_start%%Android%%android_link_end%%.'
+    gssp_tiqr_app_android_url: https://itunes.apple.com/us/app/tiqr/id430838214?mt=8&ls=1
+    gssp_tiqr_app_ios_url: https://play.google.com/store/apps/details?id=org.tiqr.authenticator&hl=en
     gssp_tiqr_button_use:
         en_GB: 'Select'
         nl_NL: 'Selecteer'

app/config/security.yml

@@ -12,6 +12,10 @@ security:
             pattern: ^/authentication/(metadata|session-expired)$
             anonymous: ~
 
+        monitor:
+            pattern: ^/(info|health)$
+            security: false
+
         saml_based:
             saml: true
             logout:

composer.json

@@ -21,20 +21,21 @@
         "mopa/bootstrap-bundle": "dev-master#818b0f47ebd352559950e9a64431ff9472e8a9dd as 3.0.0-beta5",
         "twbs/bootstrap": "~3.2.0",
         "fortawesome/font-awesome": "~4.2.0",
-        "jms/translation-bundle": "~1.1.0",
+        "jms/translation-bundle": "~1.3.0",
         "jms/di-extra-bundle": "~1.4.0",
         "surfnet/stepup-middleware-client-bundle": "^2.0",
         "guzzlehttp/guzzle": "^6",
-        "surfnet/stepup-saml-bundle": "^2.5",
-        "surfnet/stepup-bundle": "^2.0",
+        "surfnet/stepup-saml-bundle": "^3.0",
+        "surfnet/stepup-bundle": "^3.2",
         "surfnet/stepup-u2f-bundle": "dev-develop",
-        "mopa/composer-bridge": "~1.5"
+        "mopa/composer-bridge": "~1.5",
+        "openconext/monitor-bundle": "^1.0",
+        "mpdf/mpdf": "^7.0"
     },
     "require-dev": {
         "matthiasnoback/symfony-config-test": "^1.2.0",
         "mockery/mockery": "~0.9.0",
         "sensio/generator-bundle": "~2.3",
-        "liip/rmt": "1.1.*",
         "phpmd/phpmd": "^2.0",
         "phpunit/phpunit": "^4.0",
         "sensiolabs/security-checker": "^2.0",