{
  "phase": "7",
  "mode": "dry_run",
  "target": "hub_and_idp",
  "status": "manual_approval_required",
  "operation": "bootstrap_lab_saml_federation",
  "name": "lab-pf-bootstrap-saml-saml-a-local",
  "admin_api_bases": {
    "hub": "https://hub-adm.sabathe.eu/pf-admin-api/v1",
    "idp": "https://idp-adm.sabathe.eu/pf-admin-api/v1"
  },
  "principle": "Create the smallest lab federation path: local password user -> HTML Form -> policy contract -> Hub/IdP federation -> SAML SP connection.",
  "lab_user": {
    "username": "user1",
    "password_env": "PF_LAB_USER1_PASSWORD",
    "password_value": "not_exported"
  },
  "objects": [
    {
      "order": 1,
      "target": "idp",
      "operation": "create_simple_password_pcv",
      "name": "lab-simple-pcv",
      "endpoint_family": "passwordCredentialValidators",
      "payload_ref": "draft_payload.password_credential_validator",
      "secret_source": "PF_LAB_USER1_PASSWORD",
      "desired_state": {
        "users": [
          {
            "username": "user1",
            "password": "[REDACTED]"
          }
        ]
      }
    },
    {
      "order": 2,
      "target": "idp",
      "operation": "create_html_form_adapter",
      "name": "lab-html-form",
      "endpoint_family": "idp/adapters",
      "payload_ref": "draft_payload.html_form_adapter",
      "depends_on": [
        "lab-simple-pcv"
      ]
    },
    {
      "order": 3,
      "target": "idp",
      "operation": "create_authentication_policy_contract",
      "name": "lab-policy-contract-basic",
      "endpoint_family": "authenticationPolicyContracts",
      "desired_state": {
        "extended_attributes": [
          "subject",
          "email"
        ],
        "core_attribute": "subject"
      }
    },
    {
      "order": 4,
      "target": "idp",
      "operation": "create_authentication_policy",
      "name": "lab-policy-html-form-basic",
      "endpoint_family": "authenticationPolicies",
      "desired_state": {
        "root": "lab-html-form",
        "success": "lab-policy-contract-basic",
        "flow": "HTML Form directly fulfills the policy contract"
      },
      "depends_on": [
        "lab-html-form",
        "lab-policy-contract-basic"
      ]
    },
    {
      "order": 5,
      "target": "hub_and_idp",
      "operation": "create_hub_idp_federation_link",
      "name": "lab-pf-federation-link-hub-idp-local",
      "payload_ref": "hub_idp_link_plan",
      "depends_on": [
        "lab-policy-html-form-basic"
      ]
    },
    {
      "order": 6,
      "target": "hub",
      "operation": "create_saml_sp_connection",
      "name": "lab-pf-saml-sp-iamlab-saml-a-local",
      "payload_ref": "saml_sp_connection_plan",
      "depends_on": [
        "lab-pf-federation-link-hub-idp-local"
      ]
    },
    {
      "order": 7,
      "target": "hub",
      "operation": "add_policy_contract_mapping_to_saml_connection",
      "name": "lab-saml-a-policy-contract-mapping",
      "endpoint_family": "idp/spConnections",
      "desired_state": {
        "connection": "lab-pf-saml-sp-iamlab-saml-a-local",
        "policy_contract": "lab-policy-contract-basic",
        "mapping": {
          "subject": "adapter_or_contract.subject",
          "email": "adapter_or_contract.email"
        }
      },
      "depends_on": [
        "lab-pf-saml-sp-iamlab-saml-a-local",
        "lab-policy-contract-basic"
      ]
    }
  ],
  "included_plans": {
    "html_form_pcv": {
      "phase": "5",
      "mode": "dry_run",
      "target": "idp",
      "status": "draft_payload_requires_pingfederate_schema_validation",
      "operation": "create_or_update_html_form_adapter_with_simple_pcv",
      "name": "lab-pf-html-form-pcv-idp-local",
      "admin_api_base": "https://idp-adm.sabathe.eu/pf-admin-api/v1",
      "draft_payload": {
        "password_credential_validator": {
          "id": "lab-simple-pcv",
          "type": "simple_pcv",
          "credential_source": "manual_lab_only",
          "secret_policy": "no_password_in_git_or_cli_output",
          "activation": "manual_approval_required"
        },
        "html_form_adapter": {
          "id": "lab-html-form",
          "name": "Lab HTML Form Adapter",
          "pcv_reference": "lab-simple-pcv",
          "session_state": "lab_default",
          "activation": "manual_approval_required"
        },
        "policy_contract": {
          "status": "planned",
          "attributes": [
            "subject",
            "email"
          ]
        }
      },
      "checks_before_write": [
        "Confirm target engine for the login form",
        "Snapshot existing adapters and PCVs",
        "Confirm lab-only user source and password handling",
        "Show PCV and HTML Form payloads",
        "Request explicit approval before any write"
      ]
    },
    "hub_idp_link": {
      "phase": "4",
      "mode": "dry_run",
      "target": "hub_and_idp",
      "status": "draft_payload_requires_pingfederate_schema_validation",
      "operation": "create_or_update_hub_idp_federation_link",
      "name": "lab-pf-federation-link-hub-idp-local",
      "admin_api_bases": {
        "hub": "https://hub-adm.sabathe.eu/pf-admin-api/v1",
        "idp": "https://idp-adm.sabathe.eu/pf-admin-api/v1"
      },
      "runtime_urls": {
        "hub": "https://hub.sabathe.eu",
        "idp": "https://idp.sabathe.eu"
      },
      "draft_payload": {
        "hub_side": {
          "object_type": "sp_idp_connection",
          "connection_name": "lab-pf-sp-idpconn-hub-to-idp-local",
          "expected_endpoint_family": "sp/idpConnections",
          "partner_entity": "idp.sabathe.eu",
          "metadata_source": "idp_runtime_metadata_or_admin_export",
          "activation": "manual_approval_required"
        },
        "idp_side": {
          "object_type": "idp_sp_connection",
          "connection_name": "lab-pf-idp-spconn-idp-to-hub-local",
          "expected_endpoint_family": "idp/spConnections",
          "partner_entity": "hub.sabathe.eu",
          "metadata_source": "hub_runtime_metadata_or_admin_export",
          "activation": "manual_approval_required"
        },
        "policy_attachment": {
          "source": "html_form_adapter_with_simple_pcv",
          "status": "planned"
        }
      },
      "checks_before_write": [
        "Inventory Hub SP IdP connections and IdP SP connections",
        "Confirm federation direction and entity IDs",
        "Validate public certificates and signing expectations",
        "Show Hub-side and IdP-side payloads",
        "Request explicit approval for each side"
      ]
    },
    "saml_sp_connection": {
      "phase": "2",
      "mode": "dry_run",
      "target": "hub",
      "status": "draft_payload_requires_pingfederate_schema_validation",
      "operation": "create_or_update_saml_sp_connection",
      "name": "lab-pf-saml-sp-iamlab-saml-a-local",
      "application": {
        "id": "saml-a",
        "display_name": "SAML Inspector A",
        "protocol": "SAML",
        "mode": "saml-sp",
        "base_url": "https://saml-a.sabathe.eu",
        "enabled": true
      },
      "admin_api_base": "https://hub-adm.sabathe.eu/pf-admin-api/v1",
      "expected_sp_metadata": {
        "entity_id": "http://127.0.0.1:18102/apps/saml-a/metadata/local",
        "metadata_url": "http://127.0.0.1:18102/apps/saml-a/metadata/local",
        "acs_url": "http://127.0.0.1:18102/saml/acs",
        "slo_url": "http://127.0.0.1:18102/saml/slo"
      },
      "draft_payload": {
        "connection_name": "lab-pf-saml-sp-iamlab-saml-a-local",
        "entity_id": "http://127.0.0.1:18102/apps/saml-a/metadata/local",
        "base_url": "https://saml-a.sabathe.eu",
        "acs_urls": [
          "http://127.0.0.1:18102/saml/acs"
        ],
        "slo_url": "http://127.0.0.1:18102/saml/slo",
        "metadata_url": "http://127.0.0.1:18102/apps/saml-a/metadata/local",
        "signing": {
          "authn_requests_signed": false,
          "want_assertions_signed": true,
          "certificate_source": "PingFederate key pair to select manually in phase 2"
        },
        "activation": "manual_approval_required"
      },
      "checks_before_write": [
        "Confirm target PingFederate is Hub",
        "Snapshot existing SP connections",
        "Confirm signing certificate/key pair",
        "Validate metadata URL or import XML",
        "Show payload and request explicit approval"
      ]
    }
  },
  "checks_before_write": [
    "Capture Hub and IdP inventory snapshots",
    "Validate exact PingFederate Admin API schemas for every object type",
    "Confirm Simple Password PCV is available in this PingFederate version",
    "Load PF_LAB_USER1_PASSWORD from .env.local only",
    "Create objects disabled where PingFederate supports disabled creation",
    "Show full diff for each object",
    "Request explicit approval for the whole bundle and execute one object at a time"
  ]
}