@eui/base 17.3.0 → 18.0.0-next.1

package/assets/openid/openid-login.js

@@ -1,1311 +0,0 @@
-(function () {
-    // private function:
-    function isLocalDevelopmentEnvironment(href) {
-        if (href == null) {
-            href = window.top.location.href;
-        }
-
-        return href.indexOf("://localhost:") >= 0 || href.indexOf("://localhost/") >= 0;
-    }
-
-    var keypair = null;
-    var publicKeyInJWKFormat = null;
-    var hrefSavedFromIdTokenMurder = null;
-
-    var OpenIdConnect = {
-        OPENID_LOGIN_CONFIGURATION_URL: ((typeof OPENID_LOGIN_CONFIGURATION_URL) == "undefined" ? "assets/openid-login-config" + ((typeof OPENID_LOGIN_ENVIRONMENT) == "undefined" ? "" : "." + OPENID_LOGIN_ENVIRONMENT) + ".json" : OPENID_LOGIN_CONFIGURATION_URL),
-        SESSION_STORAGE_KEY_ID_TOKEN: "ux-openid-connect-id-token",
-        SESSION_STORAGE_KEY_USER_DETAILS: "ux-openid-connect-user-details",
-        SESSION_STORAGE_KEY_API_GATEWAY_ACCESS_TOKEN: "ux-openid-connect-api-gateway-access-token",
-        SESSION_STORAGE_KEY_IMPERSONATED_USER_ID: "ux-openid-connect-impersonated-user-id",
-        SESSION_STORAGE_KEY_DEVELOPMENT_URL: "ux-openid-connect-dev-url",
-        SESSION_STORAGE_KEY_ORIGINAL_URL: "ux-openid-connect-original-url",
-        SESSION_STORAGE_KEY_TRACK_USERNAME: "ux-openid-connect-track-username",
-        SESSION_STORAGE_KEY_TRACK_LOGIN: "ux-openid-connect-track-login",
-        SESSION_STORAGE_KEY_PUBLIC_KEY: "ux-openid-connect-public-key",
-        SESSION_STORAGE_KEY_PRIVATE_KEY: "ux-openid-connect-private-key",
-        SESSION_STORAGE_KEY_LOGIN_TIMESTAMP: "ux-openid-connect-login-timestamp",
-        REQUEST_PARAMETER_DEVELOPMENT_URL: "ux-openid-connect-dev-url",
-        REQUEST_PARAMETER_DEVELOPMENT_PUBLIC_KEY: "ux-openid-connect-dev-public-key",
-        DEFAULT_OPENID_SCOPE: "openid email profile",
-        DEFAULT_OPENID_CLOCK_SKEW: 15 * 60, // This means a 15 minutes difference between the clock on the EU Login server and the clock on the user's PC. (Issue related to trade wars and the frequency of the AC carrier wave on the electrical grid causing clocks to run slower.)
-        DEFAULT_MAX_REQUEST_RETRIES: 1,
-        DEFAULT_ID_TOKEN_SIGNING_ALGORITHM: "ES256",
-        DEFAULT_ACCESS_TOKEN_SIGNING_ALGORITHM: "ES256",
-
-        config: null,
-        configInitialised: false,
-        metadata: null,
-        waitForClientQueue: [],
-        waitForConfigQueue: [],
-        waitForIdTokenQueue: [],
-        waitForApiGatewayAccessTokenQueue: [],
-        loginWasRequested: false,
-        extractingIdToken: false,
-        requestingLogin: false,
-        requestingApiGatewayAccessToken: false,
-        wasLoggedIn: false,
-        client: null,
-        usedEuLoginAccessTokens: {},
-
-        // --------------- Login with EU Login ---------------
-        loadConfiguration: function (callbackFunction) {
-            var configurationUrl = OpenIdConnect.OPENID_LOGIN_CONFIGURATION_URL;
-            // Add the href of the <base> tag to it:
-            var baseTags = document.head.getElementsByTagName("base");
-            if (baseTags != null && baseTags.length > 0) {
-                var baseHref = baseTags [0].getAttribute("href");
-                if (baseHref != null) {
-                    configurationUrl = baseHref + configurationUrl;
-                }
-            }
-
-            var xhr = new XMLHttpRequest();
-            xhr.withCredentials = true;
-            xhr.open("GET", configurationUrl);
-            xhr.onload = function () {
-                if (this.readyState == 4 && this.status == 200) {
-                    try {
-                        var config = JSON.parse(xhr.responseText);
-                        if (config != null && config.openIdConnect != null) {
-                            OpenIdConnect.config = config.openIdConnect;
-                            OpenIdConnect.loadMetadata(callbackFunction);
-                        } else {
-                            if (callbackFunction != null && (typeof callbackFunction) == "function") {
-                                callbackFunction();
-                            }
-                        }
-                    } catch (error) {
-                        console.error("Unable to properly load the configuration.");
-                        console.error(error);
-                    }
-                }
-            };
-            xhr.send();
-        },
-
-        loadMetadata: function (callbackFunction) {
-            var config = OpenIdConnect.config;
-            if (config != null && config.enabled && config.metadataUrl != null && config.metadataUrl.trim().length > 0) {
-                var xhr = new XMLHttpRequest();
-                xhr.withCredentials = true;
-                xhr.open("GET", config.metadataUrl);
-                xhr.onload = function () {
-                    if (this.readyState == 4 && this.status == 200) {
-                        try {
-                            OpenIdConnect.metadata = JSON.parse(xhr.responseText);
-                            OpenIdConnect.createOpenIdClient();
-                            if (callbackFunction != null && (typeof callbackFunction) == "function") {
-                                callbackFunction();
-                            }
-                        } catch (error) {
-                            console.error("Unable to properly load the OpenID Connect metadata.");
-                            console.error(error);
-                        }
-                    }
-                };
-                xhr.send();
-            } else {
-                if (callbackFunction != null && (typeof callbackFunction) == "function") {
-                    callbackFunction();
-                }
-            }
-        },
-
-        createOpenIdClient: function () {
-            var config = OpenIdConnect.config;
-            var settings = {
-                authority: OpenIdConnect.metadata.authorization_endpoint,
-                metadataUrl: config.metadataUrl,
-                client_id: config.spaClientId,
-                redirect_uri: config.spaRedirectUrl,
-                post_logout_redirect_uri: config.spaRedirectUrl,
-                response_type: 'id_token',
-                scope: (config.scope || OpenIdConnect.DEFAULT_OPENID_SCOPE),
-                filterProtocolClaims: true,
-                loadUserInfo: true
-            };
-            var clockSkew = config.clockSkew;
-            if (clockSkew != null && clockSkew > 0) {
-                settings ["clockSkew"] = clockSkew;
-            } else {
-                settings ["clockSkew"] = OpenIdConnect.DEFAULT_OPENID_CLOCK_SKEW;
-            }
-
-            OpenIdConnect.client = new Oidc.OidcClient(settings);
-            // Continue the pending log in:
-            var queue = OpenIdConnect.waitForClientQueue;
-            while (queue.length > 0) {
-                // Extra timeout to prevent endless loop in case of accidental recursion due to still not being authorized because of an unknown issue:
-                setTimeout(queue.pop(), 0);
-            }
-        },
-
-        loginWithOpenIDConnect: function (dontRenew) {
-            // Don't renew means that we don't automatically login when there is no ID token.
-            // This is for applications that have public areas.
-            OpenIdConnect.loginWasRequested = true;
-
-            // check for a development login first:
-            var developmentUrl = OpenIdConnect.getRequestParameter(OpenIdConnect.REQUEST_PARAMETER_DEVELOPMENT_URL);
-            if (developmentUrl == null) {
-                // First check if there is a new ID token coming back from EU Login:
-                OpenIdConnect.extractIdTokenFromLocation(function (idToken) {
-                    if (idToken != null) {
-                        OpenIdConnect.saveUserToSessionStorage(idToken);
-                        OpenIdConnect.navigateToOriginallyRequestedUrl(idToken);
-                        OpenIdConnect.removeLocationHash();
-                    } else {
-                        // There is no new ID token; check if there is already one in the session storage:
-                        var cachedIdToken = sessionStorage.getItem(OpenIdConnect.SESSION_STORAGE_KEY_ID_TOKEN);
-                        if (cachedIdToken == null && ! dontRenew) {
-                            OpenIdConnect.renewIdToken();
-                        } else {
-                            OpenIdConnect.wasLoggedIn = true;
-                            var developmentUrl = localStorage.getItem(OpenIdConnect.SESSION_STORAGE_KEY_DEVELOPMENT_URL);
-                            if (developmentUrl != null) {
-                                OpenIdConnect.navigateToOriginallyRequestedUrl(cachedIdToken);
-                            }
-                        }
-                    }
-
-                    var continuePendingRequests = function () {
-                        var queue = OpenIdConnect.waitForIdTokenQueue;
-                        OpenIdConnect.wasLoggedIn = true;
-                        while (queue.length > 0) {
-                            // Extra timeout to prevent endless loop in case of accidental recursion due to still not being authorized because of an unknown issue:
-                            setTimeout(queue.pop(), 0);
-                        }
-                    };
-
-                    // We may have the ID token already being processed, while the configuration is still loading:
-                    if (OpenIdConnect.configInitialised) {
-                        continuePendingRequests();
-                    } else {
-                        OpenIdConnect.waitForConfigQueue.push(continuePendingRequests);
-                    }
-                });
-            } else {
-                // development login was requested; force the login:
-                OpenIdConnect.renewIdToken();
-            }
-        },
-
-        getAuthorizationHeaders: function (url, callbackFunction, errorCallbackFunction) { // calls the callback function with an object containing all the headers necessary to authenticate the request
-            if (url != null && (typeof callbackFunction) == "function") {
-                if (OpenIdConnect.configInitialised) {
-                    if (OpenIdConnect.config != null && OpenIdConnect.config.enabled) {
-                        if (sessionStorage.getItem(OpenIdConnect.SESSION_STORAGE_KEY_ID_TOKEN) != null) {
-                            if (OpenIdConnect.config.apiGatewayServices) {
-                                var service = OpenIdConnect.getMatchingServiceFromConfiguration(url, OpenIdConnect.config.apiGatewayServices);
-                                if (service != null) {
-                                    OpenIdConnect.getApiGatewayAuthorizationHeaders(service.audienceId, callbackFunction, errorCallbackFunction, service.authenticatedByGateway);
-                                    return;
-                                }
-                            }
-
-                            if (OpenIdConnect.config.services) {
-                                var service = OpenIdConnect.getMatchingServiceFromConfiguration(url, OpenIdConnect.config.services);
-                                if (service != null && service.audienceId != null && service.audienceId != "") {
-                                    OpenIdConnect.getServiceAuthorizationHeaders(service.audienceId, callbackFunction, errorCallbackFunction, service.authenticatedByGateway);
-                                    return;
-                                }
-                            }
-
-                            if (OpenIdConnect.config.ecasServices) {
-                                var service = OpenIdConnect.getMatchingServiceFromConfiguration(url, OpenIdConnect.config.ecasServices);
-                                if (service != null) {
-                                    OpenIdConnect.getEcasServiceAuthorizationHeaders(url, callbackFunction, errorCallbackFunction);
-                                    return;
-                                }
-                            }
-
-                            // No known OpenID service call, doing normal call:
-                            callbackFunction();
-                        } else {
-                            // We are not logged in; first check if we are already logging in, or if we need to log in automatically:
-                            if (OpenIdConnect.idTokenPresentInLocation() || (OpenIdConnect.config != null && (OpenIdConnect.config.autoLogin == null || OpenIdConnect.config.autoLogin))) {
-                                // ... then check if the request is protected:
-                                var urlIsProtected = false;
-                                if (OpenIdConnect.config.apiGatewayServices) {
-                                    var service = OpenIdConnect.getMatchingServiceFromConfiguration(url, OpenIdConnect.config.apiGatewayServices);
-                                    urlIsProtected = (service != null && ((service.audienceId != null && service.audienceId != "") || service.authenticatedByGateway));
-                                }
-                                if (! urlIsProtected && OpenIdConnect.config.services) {
-                                    var service = OpenIdConnect.getMatchingServiceFromConfiguration(url, OpenIdConnect.config.services);
-                                    urlIsProtected = (service != null && service.audienceId != null && service.audienceId != "");
-                                }
-                                if (! urlIsProtected && OpenIdConnect.config.ecasServices) {
-                                    var service = OpenIdConnect.getMatchingServiceFromConfiguration(url, OpenIdConnect.config.ecasServices);
-                                    urlIsProtected = (service != null && service != "");
-                                }
-
-                                if (urlIsProtected) {
-                                    // The service URL is protected, but we are not logged in yet; queue the function call:
-                                    OpenIdConnect.waitForIdTokenQueue.push(function () {
-                                        OpenIdConnect.getAuthorizationHeaders(url, callbackFunction, errorCallbackFunction);
-                                    });
-
-                                    if (!OpenIdConnect.loginWasRequested) {
-                                        OpenIdConnect.loginWithOpenIDConnect();
-                                    }
-                                } else {
-                                    // We don't need to automatically log in; resume call:
-                                    callbackFunction();
-                                }
-                            } else {
-                                // The service URL is not protected; resume call:
-                                callbackFunction();
-                            }
-                        }
-                    } else {
-                        // OpenID is disabled, resume call:
-                        callbackFunction();
-                    }
-                } else {
-                    // Configuration is not yet loaded. Try again later:
-                    OpenIdConnect.waitForIdTokenQueue.push(function () {
-                        OpenIdConnect.getAuthorizationHeaders(url, callbackFunction, errorCallbackFunction);
-                    });
-                }
-            } else {
-                console.error("To be able to access a service, please specify the url, xhr and the callback function.");
-            }
-        },
-
-        getMatchingServiceFromConfiguration: function (url, configuredServices) {
-            if (configuredServices != null) {
-                for (var serviceId in configuredServices) {
-                    if (configuredServices.hasOwnProperty(serviceId)) {
-                        var service = configuredServices [serviceId];
-                        if (OpenIdConnect.urlMatches(url, service.endpoint)) {
-                            return service;
-                        }
-                    }
-                }
-            }
-
-            return null;
-        },
-
-        getApiGatewayAuthorizationHeaders: function (audienceId, callbackFunction, errorCallbackFunction, authenticatedByGateway) {
-            if (! OpenIdConnect.requestingApiGatewayAccessToken) {
-                // Check if we already have an API Gateway access token cached in memory:
-                if (OpenIdConnect.cachedApiGatewayAccessTokenHasExpired()) {
-                    OpenIdConnect.requestingApiGatewayAccessToken = true;
-                    // Get an EU Login access token for the API Gateway and for the target service:
-                    var euLoginTokenApiGateway = null;
-                    var euLoginTokenService = null;
-                    var getApiGatewayAccessToken = function () {
-                        if (euLoginTokenApiGateway != null && (euLoginTokenService != null || audienceId == null)) {
-                            // Prevent the same EU Login access token from being used:
-                            if (euLoginTokenApiGateway != null && OpenIdConnect.usedEuLoginAccessTokens [euLoginTokenApiGateway.access_token]) {
-                                // Due to unexpected racing conditions, the same EU Login access token is being used to request the API Gateway token.
-                                // Simply retry:
-                                OpenIdConnect.requestingApiGatewayAccessToken = false;
-                                setTimeout(function () {
-                                    OpenIdConnect.getApiGatewayAuthorizationHeaders(audienceId, callbackFunction, errorCallbackFunction, authenticatedByGateway);
-                                }, 0);
-                                return;
-                            }
-
-                            var impersonatedUserId = OpenIdConnect.getImpersonatedUserId();
-                            if (impersonatedUserId == null) {
-                                // We now have an EU Login access token for the API Gateway and the target service.
-                                // Continue by asking an access token to the gateway itself. It requires the EU Login access token...
-                                var xhr = new XMLHttpRequest();
-                                xhr.withCredentials = false;
-                                xhr.onload = function () {
-                                    if (this.readyState == 4 && this.status == 200) {
-                                        // We now have access to the API Gateway.
-                                        // Continue by calling the gateway (using the API Gateway access token),
-                                        // and by propagating the EU Login access token for the target service...
-                                        var apiGatewayAccessToken = OpenIdConnect.parseSafely(xhr, errorCallbackFunction);
-                                        OpenIdConnect.storeCachedApiGatewayAccessToken(apiGatewayAccessToken);
-
-                                        // Prevent the same EU Login access token from being used:
-                                        if (euLoginTokenService != null && OpenIdConnect.usedEuLoginAccessTokens [euLoginTokenService.access_token]) {
-                                            // Due to unexpected racing conditions, the same EU Login access token is being used to request the API Gateway token.
-                                            // Simply retry:
-                                            OpenIdConnect.requestingApiGatewayAccessToken = false;
-                                            setTimeout(function () {
-                                                OpenIdConnect.getApiGatewayAuthorizationHeaders(audienceId, callbackFunction, errorCallbackFunction, authenticatedByGateway);
-                                            }, 0);
-                                            return;
-                                        }
-                                        OpenIdConnect.returnApiGatewayAuthorizationHeaders(apiGatewayAccessToken, euLoginTokenService, callbackFunction, authenticatedByGateway);
-                                    } else if (xhr.status >= 400) {
-                                        OpenIdConnect.handleErrorResponse(xhr, errorCallbackFunction);
-                                    }
-                                };
-                                xhr.onerror = function () {
-                                    OpenIdConnect.handleErrorResponse(xhr, errorCallbackFunction);
-                                };
-                                xhr.open("POST", OpenIdConnect.config.apiGatewayAccessTokenUrl);
-                                xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
-                                xhr.send(
-                                    "grant_type=oauth2:eui&" +
-                                    "eul_access_token=" + OpenIdConnect.signAccessToken(euLoginTokenApiGateway.access_token) + "&"+
-                                    "consumer_key=" + encodeURIComponent(OpenIdConnect.config.apiGatewayConsumerKey)
-                                );
-                                if (euLoginTokenApiGateway != null) {
-                                    OpenIdConnect.usedEuLoginAccessTokens [euLoginTokenApiGateway.access_token] = true;
-                                }
-                            } else {
-                                // Re-impersonate:
-                                OpenIdConnect.impersonate(impersonatedUserId, function () {
-                                    OpenIdConnect.returnApiGatewayAuthorizationHeaders(OpenIdConnect.getCachedApiGatewayAccessToken(), euLoginTokenService, callbackFunction, authenticatedByGateway);
-                                }, errorCallbackFunction);
-                            }
-                        }
-                    };
-
-                    OpenIdConnect.doServiceAccessTokenRequest(OpenIdConnect.config.apiGatewayAccessTokenAudienceId, function (newEuLoginToken) {
-                        euLoginTokenApiGateway = newEuLoginToken;
-                        getApiGatewayAccessToken();
-                    }, errorCallbackFunction);
-                    if (audienceId != null && audienceId != "") {
-                        OpenIdConnect.doServiceAccessTokenRequest(audienceId, function (newEuLoginToken) {
-                            euLoginTokenService = newEuLoginToken;
-                            getApiGatewayAccessToken();
-                        }, errorCallbackFunction);
-                    } else {
-                        getApiGatewayAccessToken();
-                    }
-                } else {
-                    // We already have an API Gateway access token.
-                    // Now request an EU Login access token for the target service.
-                    if (audienceId != null && audienceId != "") {
-                        var gatherHeaders = function () {
-                            OpenIdConnect.doServiceAccessTokenRequest(audienceId, function (newEuLoginToken) {
-                                // Prevent the same EU Login access token from being used:
-                                if (newEuLoginToken != null && OpenIdConnect.usedEuLoginAccessTokens [newEuLoginToken.access_token]) {
-                                    // Due to unexpected racing conditions, the same EU Login access token is being used to request the API Gateway token.
-                                    // Simply retry:
-                                    return gatherHeaders();
-                                }
-
-                                // We have now both the API Gateway access token and a EU Login access token for the target service;
-                                // we can call the API Gateway.
-                                OpenIdConnect.returnApiGatewayAuthorizationHeaders(OpenIdConnect.getCachedApiGatewayAccessToken(), newEuLoginToken, callbackFunction, authenticatedByGateway);
-                            }, errorCallbackFunction);
-                        };
-                        gatherHeaders();
-                    } else {
-                        OpenIdConnect.returnApiGatewayAuthorizationHeaders(OpenIdConnect.getCachedApiGatewayAccessToken(), null, callbackFunction, authenticatedByGateway);
-                    }
-                }
-            } else {
-                // An API Gateway token is already being requested; queue the request:
-                OpenIdConnect.waitForApiGatewayAccessTokenQueue.push(function () {
-                    OpenIdConnect.getApiGatewayAuthorizationHeaders(audienceId, callbackFunction, errorCallbackFunction, authenticatedByGateway);
-                });
-            }
-        },
-
-        getServiceAuthorizationHeaders: function (audienceId, callbackFunction, errorCallbackFunction, authenticatedByGateway) {
-            if (authenticatedByGateway) {
-                OpenIdConnect.returnServiceAuthorizationHeaders(null, callbackFunction, authenticatedByGateway);
-            } else {
-                OpenIdConnect.doServiceAccessTokenRequest(audienceId, function (newEuLoginToken) {
-                    OpenIdConnect.returnServiceAuthorizationHeaders(newEuLoginToken, callbackFunction, authenticatedByGateway);
-                }, errorCallbackFunction);
-            }
-        },
-
-        getEcasServiceAuthorizationHeaders: function (url, callbackFunction, errorCallbackFunction) {
-            OpenIdConnect.doEcasProxyTicketRequest(url, function (newProxyTicketToken) {
-                var ecasProxyTicketToken = newProxyTicketToken;
-                OpenIdConnect.returnEcasServiceAuthorizationHeaders(ecasProxyTicketToken, callbackFunction);
-            }, errorCallbackFunction);
-        },
-
-        impersonate: function (userId, callbackFunction, errorCallbackFunction, reason) {
-            var makeImpersonationCallFunction = function () {
-                OpenIdConnect.doServiceAccessTokenRequest(OpenIdConnect.config.apiGatewayAccessTokenAudienceId, function (newEuLoginToken) {
-                    var euLoginTokenForApiGateway = newEuLoginToken;
-                    var xhr = new XMLHttpRequest();
-                    xhr.withCredentials = false;
-                    xhr.onload = function () {
-                        if (this.readyState == 4 && this.status == 200) {
-                            var apiGatewayAccessToken = OpenIdConnect.parseSafely(xhr, errorCallbackFunction);
-                            OpenIdConnect.storeCachedApiGatewayAccessToken(apiGatewayAccessToken);
-                            if (callbackFunction != null && (typeof callbackFunction) == "function") {
-                                if (apiGatewayAccessToken && apiGatewayAccessToken.access_token) {
-                                    var tokenObject = OpenIdConnect.decodeJwtToken(apiGatewayAccessToken.access_token);
-                                    if (tokenObject.imp_userId) {
-                                        var impersonatedUser = {
-                                            dg: tokenObject.imp_dg,
-                                            email: tokenObject.imp_email,
-                                            employeeNumber: tokenObject.imp_employeeNumber,
-                                            name: tokenObject.imp_name,
-                                            organisationId: tokenObject.imp_organizationId,
-                                            organisation: tokenObject.imp_organization,
-                                            phoneNumber: tokenObject.imp_phoneNumber,
-                                            userId: tokenObject.imp_userId
-                                        };
-
-                                        OpenIdConnect.storeImpersonatedUserId(userId);
-
-                                        callbackFunction(true, impersonatedUser);
-                                    } else {
-                                        callbackFunction(false);
-                                    }
-                                } else {
-                                    OpenIdConnect.handleErrorResponse(xhr, errorCallbackFunction);
-                                }
-                            }
-                        } else if (xhr.status >= 400) {
-                            if (xhr.status === 403) {
-                                // Not allowed to impersonate!
-                                if (callbackFunction != null && (typeof callbackFunction) == "function") {
-                                    callbackFunction(false);
-                                } else {
-                                    OpenIdConnect.handleErrorResponse(xhr, errorCallbackFunction);
-                                }
-                            } else {
-                                OpenIdConnect.handleErrorResponse(xhr, errorCallbackFunction);
-                            }
-                        }
-                    };
-                    xhr.onerror = function () {
-                        if (xhr.status === 403) {
-                            // Not allowed to impersonate!
-                            if (callbackFunction != null && (typeof callbackFunction) == "function") {
-                                callbackFunction(false);
-                            } else {
-                                OpenIdConnect.handleErrorResponse(xhr, errorCallbackFunction);
-                            }
-                        } else {
-                            OpenIdConnect.handleErrorResponse(xhr, errorCallbackFunction);
-                        }
-                    };
-
-                    var userString = sessionStorage.getItem(OpenIdConnect.SESSION_STORAGE_KEY_USER_DETAILS);
-                    if (userString == null) {
-                        throw "You are not logged in yet. Impersonation cannot be started yet.";
-                    }
-                    var user = null;
-                    try {
-                        user = JSON.parse(userString);
-                    } catch (error) {}
-                    if (user == null || user.userId == null) {
-                        throw "Unable to determine your user ID. Impersonation cannot be started.";
-                    }
-
-                    xhr.open("POST", OpenIdConnect.config.apiGatewayImpersonationUrl + "/" + user.userId + "/impersonate/" + userId);
-                    xhr.setRequestHeader("Content-Type", "application/json");
-                    xhr.setRequestHeader("Authorization-Propagation", "pop " + OpenIdConnect.signAccessToken(euLoginTokenForApiGateway.access_token));
-                    if (reason != null) {
-                        xhr.send(JSON.stringify({
-                            impersonationReason: reason
-                        }));
-                    } else {
-                        xhr.send();
-                    }
-                }, errorCallbackFunction);
-            };
-
-            try {
-                OpenIdConnect.unimpersonate(makeImpersonationCallFunction, errorCallbackFunction);
-            } catch (error) {
-                makeImpersonationCallFunction();
-            }
-        },
-
-        unimpersonate: function (callbackFunction, errorCallbackFunction) {
-            if (OpenIdConnect.getCachedApiGatewayAccessToken() != null) {
-                OpenIdConnect.doServiceAccessTokenRequest(OpenIdConnect.config.apiGatewayAccessTokenAudienceId, function (newEuLoginToken) {
-                    var euLoginTokenForApiGateway = newEuLoginToken;
-                    var xhr = new XMLHttpRequest();
-                    xhr.withCredentials = false;
-                    xhr.onload = function () {
-                        if (this.readyState == 4 && this.status == 200) {
-                            // We now have access to the API Gateway.
-                            // Continue by calling the gateway (using the API Gateway access token),
-                            // and by propagating the EU Login access token for the target service...
-                            if (callbackFunction != null && (typeof callbackFunction) == "function") {
-                                OpenIdConnect.clearImpersonatedUserId();
-                                OpenIdConnect.clearCachedApiGatewayAccessToken();
-                                callbackFunction(true);
-                            }
-                        } else if (xhr.status >= 400) {
-                            OpenIdConnect.handleErrorResponse(xhr, errorCallbackFunction);
-                        }
-                    };
-                    xhr.onerror = function () {
-                        OpenIdConnect.handleErrorResponse(xhr, errorCallbackFunction);
-                    };
-                    xhr.open("DELETE", OpenIdConnect.config.apiGatewayImpersonationUrl);
-                    xhr.setRequestHeader("Content-Type", "text/plain");
-                    xhr.setRequestHeader("Authorization-Propagation", "pop " + OpenIdConnect.signAccessToken(euLoginTokenForApiGateway.access_token));
-                    xhr.send(OpenIdConnect.getCachedApiGatewayAccessToken().access_token);
-                });
-            } else {
-                if (callbackFunction != null && (typeof callbackFunction) == "function") {
-                    callbackFunction(true);
-                }
-            }
-        },
-
-        returnApiGatewayAuthorizationHeaders: function (apiGatewayAccessToken, serviceAccessToken, callbackFunction, authenticatedByGateway) {
-            var headers = {};
-            if (apiGatewayAccessToken != null && apiGatewayAccessToken.token_type != null && apiGatewayAccessToken.access_token != null) {
-                headers ["Authorization"] = apiGatewayAccessToken.token_type + " " + apiGatewayAccessToken.access_token;
-                if (authenticatedByGateway) {
-                    headers ["Authorization-Propagation"] = apiGatewayAccessToken.access_token;
-                }
-            }
-
-            if (serviceAccessToken != null && serviceAccessToken.access_token != null) {
-                headers ["Authorization-Propagation"] = OpenIdConnect.signAccessToken(serviceAccessToken.access_token);
-                OpenIdConnect.usedEuLoginAccessTokens [serviceAccessToken.access_token] = true;
-            }
-            OpenIdConnect.addImpersonationHeaders(headers);
-
-            if (callbackFunction != null && (typeof callbackFunction) == "function") {
-                callbackFunction(headers);
-            }
-
-            OpenIdConnect.continuePendingApiGatewayServiceRequests();
-        },
-
-        returnServiceAuthorizationHeaders: function (serviceAccessToken, callbackFunction, authenticatedByGateway) {
-            var headers = {};
-            if (authenticatedByGateway) {
-                headers ["Authorization"] = "Bearer " + apiGatewayAccessToken.access_token;
-            } else if (serviceAccessToken != null) {
-                headers ["Authorization"] = serviceAccessToken.token_type + " " + OpenIdConnect.signAccessToken(serviceAccessToken.access_token);
-            }
-            OpenIdConnect.addImpersonationHeaders(headers);
-
-            if (callbackFunction != null && (typeof callbackFunction) == "function") {
-                callbackFunction(headers);
-            }
-        },
-
-        returnEcasServiceAuthorizationHeaders: function (ecasProxyTicketToken, callbackFunction) {
-            var headers = {};
-            if (ecasProxyTicketToken != null) {
-                headers ["Authorization"] = ecasProxyTicketToken.token_type + " " + ecasProxyTicketToken.access_token;
-            }
-            OpenIdConnect.addImpersonationHeaders(headers);
-
-            if (callbackFunction != null && (typeof callbackFunction) == "function") {
-                callbackFunction(headers);
-            }
-        },
-
-        isApiGatewayTokenInvalidResponse: function (xhr) {
-            return xhr.responseText != null && xhr.responseText.indexOf("<ams:code>900901</ams:code>") >= 0;
-        },
-
-        isEuLoginInvalidIdTokenResponse: function (xhr, responseAsJson) {
-            return responseAsJson != null && responseAsJson.error == "invalid_request";
-        },
-
-        isEuAccessDeniedErrorResponse: function (xhr, responseAsJson) {
-            return responseAsJson != null && responseAsJson.error == "access_denied";
-        },
-
-        handleErrorResponse: function (xhr, errorCallbackFunction) {
-            if (xhr != null) {
-                var response = null;
-                try {
-                    response = JSON.parse(xhr.responseText);
-                } catch (error) {}
-
-                if (OpenIdConnect.isEuLoginInvalidIdTokenResponse(xhr, response)) {
-                    // The ID token is invalid or incorrect; retrieve another one:
-                    OpenIdConnect.renewIdToken();
-                } else if (xhr.status === 401 || xhr.status === 403) {
-                    // Can be one of the following conditions:
-                    // * The client ID is invalid or incorrect; fail the request.
-                    //   Either the developer needs to use a valid client ID or the administrator should allow the client ID access.
-                    // * The API Gateway access token is invalid. (401)
-                    // * The EU Login access token is invalid. (403)
-                    // * EU Access is returning an error object with "access_denied" error. (403)
-                    if (xhr.retry != null && (typeof xhr.retry == "function") && ! OpenIdConnect.isEuAccessDeniedErrorResponse(xhr, response)) {
-                        xhr.retry(OpenIdConnect.isApiGatewayTokenInvalidResponse(xhr));
-                    } else {
-                        if ((typeof errorCallbackFunction) == "function") {
-                            errorCallbackFunction(xhr);
-                        }
-                    }
-                } else if (xhr.status === 0) {
-                    // One of the access token requests or the original request was not sent.
-                    // Most likely one of the CORS pre-flight requests failed, or the browser is offline.
-                    console.warn(
-                        "The OpenID Connect call may have issues:\n" +
-                        "* the CORS pre-flight requests for the OpenID Connect access tokens or for the REST call could be failing\n" +
-                        "* the browser could be currently offline."
-                    );
-
-                    if ((typeof errorCallbackFunction) == "function") {
-                        errorCallbackFunction(xhr);
-                    }
-                } else {
-                    if ((typeof errorCallbackFunction) == "function") {
-                        errorCallbackFunction(xhr);
-                    }
-                }
-            }
-        },
-
-        doServiceAccessTokenRequest: function (audienceId, onloadFunction, errorCallbackFunction) {
-            var parameters = "" +
-                "grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer" +
-                "&scope=" + (OpenIdConnect.config.scope || OpenIdConnect.DEFAULT_OPENID_SCOPE) +
-                "&assertion=" + OpenIdConnect.signIdToken() +
-                "&audience=" + audienceId +
-                "&client_id=" + OpenIdConnect.config.spaClientId;
-            var url = OpenIdConnect.metadata.token_endpoint;
-            url += (url.indexOf("?") > 0 ? "&" : "?") + parameters;
-
-            var xhr = new XMLHttpRequest();
-            xhr.withCredentials = true;
-            xhr.onload = function () {
-                if (this.readyState == 4) {
-                    if (this.status >= 200 && this.status < 300) {
-                        onloadFunction(OpenIdConnect.parseSafely(xhr, errorCallbackFunction));
-                    } else {
-                        OpenIdConnect.handleErrorResponse(xhr, errorCallbackFunction);
-                    }
-                }
-            };
-            xhr.onerror = function () {
-                OpenIdConnect.handleErrorResponse(xhr, errorCallbackFunction);
-            };
-            xhr.retry = function (clearApiGatewayAccessToken) {
-                var retryCount = xhr.retryCount;
-                if (retryCount == null) {
-                    retryCount = -1;
-                }
-                var maximumRequestRetries = OpenIdConnect.config.maximumRequestRetries;
-                if (maximumRequestRetries == null) {
-                    maximumRequestRetries = OpenIdConnect.DEFAULT_MAX_REQUEST_RETRIES;
-                }
-                if (maximumRequestRetries == null) {
-                    maximumRequestRetries = 1;
-                }
-                if (retryCount < maximumRequestRetries) {
-                    xhr.retryCount = retryCount + 1;
-                    if (clearApiGatewayAccessToken) {
-                        // Clear the cached token to fully retry the request:
-                        OpenIdConnect.clearCachedApiGatewayAccessToken();
-                    }
-
-                    xhr.open("POST", url);
-                    xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
-                    xhr.send();
-                } else {
-                    console.error(
-                        "The OpenID Connect call may have issues:\n" +
-                        "* the client ID could be invalid\n" +
-                        "* the API Gateway access token could be invalid\n" +
-                        "* the EU Login access token for the target service could be invalid."
-                    );
-
-                    if ((typeof errorCallbackFunction) == "function") {
-                        errorCallbackFunction(xhr);
-                    }
-                }
-            };
-
-            xhr.retry();
-        },
-
-        doEcasProxyTicketRequest: function (url, onloadFunction, errorCallbackFunction) {
-            var parameters = "" +
-                "grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer" +
-                "&requested_token_type=urn:ietf:params:oauth:token-type:cas_ticket" +
-                "&assertion=" + OpenIdConnect.signIdToken() +
-                "&resource=" + encodeURIComponent(url) +
-                "&client_id=" + OpenIdConnect.config.spaClientId;
-            var url = OpenIdConnect.metadata.token_endpoint;
-            url += (url.indexOf("?") > 0 ? "&" : "?") + parameters;
-
-            var xhr = new XMLHttpRequest();
-            xhr.withCredentials = true;
-            xhr.onload = function () {
-                if (this.readyState == 4) {
-                    if (this.status >= 200 && this.status < 300) {
-                        onloadFunction(OpenIdConnect.parseSafely(xhr, errorCallbackFunction));
-                    } else {
-                        OpenIdConnect.handleErrorResponse(xhr, errorCallbackFunction);
-                    }
-                }
-            };
-            xhr.onerror = function () {
-                OpenIdConnect.handleErrorResponse(xhr, errorCallbackFunction);
-            };
-            xhr.retry = function (clearApiGatewayAccessToken) {
-                var retryCount = xhr.retryCount;
-                if (retryCount == null) {
-                    retryCount = -1;
-                }
-                var maximumRequestRetries = OpenIdConnect.config.maximumRequestRetries;
-                if (maximumRequestRetries == null) {
-                    maximumRequestRetries = OpenIdConnect.DEFAULT_MAX_REQUEST_RETRIES;
-                }
-                if (maximumRequestRetries == null) {
-                    maximumRequestRetries = 1;
-                }
-                if (retryCount < maximumRequestRetries) {
-                    xhr.retryCount = retryCount + 1;
-                    if (clearApiGatewayAccessToken) {
-                        // Clear the cached token to fully retry the request:
-                        OpenIdConnect.clearCachedApiGatewayAccessToken();
-                    }
-
-                    xhr.open("POST", url);
-                    xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
-                    xhr.send();
-                } else {
-                    console.error(
-                        "The OpenID Connect call may have issues:\n" +
-                        "* the client ID could be invalid\n" +
-                        "* the API Gateway access token could be invalid\n" +
-                        "* the EU Login access token for the target service could be invalid."
-                    );
-
-                    if ((typeof errorCallbackFunction) == "function") {
-                        errorCallbackFunction(xhr);
-                    }
-                }
-            };
-
-            xhr.retry();
-        },
-
-        continuePendingApiGatewayServiceRequests: function () {
-            OpenIdConnect.requestingApiGatewayAccessToken = false;
-
-            var queue = OpenIdConnect.waitForApiGatewayAccessTokenQueue;
-            while (queue.length > 0) {
-                // Extra timeout to prevent endless loop in case of accidental recursion due to still not being authorized because of an unknown issue:
-                setTimeout(queue.pop(), 0);
-            }
-        },
-
-        continuePendingUserTracking: function () {
-            var fullName = sessionStorage.getItem(OpenIdConnect.SESSION_STORAGE_KEY_TRACK_USERNAME);
-            if (fullName != null && (typeof dtrum) != "undefined" && (typeof dtrum.identifyUser) == "function") {
-                dtrum.identifyUser(fullName);
-            }
-            sessionStorage.removeItem(OpenIdConnect.SESSION_STORAGE_KEY_TRACK_USERNAME);
-
-            var loginAction = sessionStorage.getItem(OpenIdConnect.SESSION_STORAGE_KEY_TRACK_LOGIN);
-            if (loginAction != null && (typeof dtrum) != "undefined" && (typeof dtrum.leaveAction) == "function" && (typeof dtrum.sendBeacon) == "function") {
-                dtrum.leaveAction(loginAction);
-                dtrum.sendBeacon(true, true, true);
-                sessionStorage.removeItem(OpenIdConnect.SESSION_STORAGE_KEY_TRACK_LOGIN);
-            }
-        },
-
-
-        // --------------- Utility functions ---------------
-        idTokenPresentInLocation: function () {
-            var href = window.top.location.href;
-            if (href != null) {
-                return href.indexOf("#id_token=") >= 0 || href.indexOf("&id_token=") >= 0;
-            } else {
-                return false;
-            }
-        },
-
-        getIdToken: function (callbackFunction) {
-            // This function support delayed logins and checking if the ID token is available.
-            // Also waits for the ID token when a user is still logging in.
-            if ((typeof callbackFunction) == "function") {
-                var responseFunction = function () {
-                    callbackFunction(OpenIdConnect.decodeIdToken());
-                };
-
-                // Check if we are still initialising:
-                if (OpenIdConnect.client == null || OpenIdConnect.config == null || OpenIdConnect.metadata == null || OpenIdConnect.idTokenPresentInLocation()) {
-                    OpenIdConnect.waitForIdTokenQueue.push(responseFunction);
-                } else {
-                    responseFunction();
-                }
-            } else {
-                console.error("You need to specify a callback function to be able to wait for the ID token to be retrieved.")
-            }
-        },
-
-        preventIdTokenMurder: function () {
-            // In case the UI framework uses hash-based Routers,
-            // there can be certain race conditions where the ID token in the location's hash is being replaced with the default route,
-            // while the OpenID Connect client is waiting for it's configuration to be loaded.
-            // Since the OpenID Connect client cannot verify the ID token without the Identity Server's configuration, we have no choice but to store the id_token hash and to swap it out with the router's hash when verifying it.
-            if (OpenIdConnect.idTokenPresentInLocation()) {
-                hrefSavedFromIdTokenMurder = window.top.location.href;
-            }
-        },
-
-        extractIdTokenFromLocation: function (callbackFunction) {
-            if (callbackFunction != null && (typeof callbackFunction) == "function") {
-                if (OpenIdConnect.client != null) {
-                    if (! isLocalDevelopmentEnvironment()) {
-                        if (hrefSavedFromIdTokenMurder != null) {
-                            if (! OpenIdConnect.extractingIdToken) {
-                                OpenIdConnect.extractingIdToken = true;
-                                OpenIdConnect.client.processSigninResponse(hrefSavedFromIdTokenMurder).then(function (response) {
-                                    if (response != null && response.id_token) {
-                                        callbackFunction(response.id_token);
-                                    } else {
-                                        console.error(response);
-                                        OpenIdConnect.loginFailed(callbackFunction);
-                                    }
-                                }).catch(function (error) {
-                                    console.error(error);
-                                    if (("" + error).indexOf("is in the future") >= 0) {
-                                        console.error("The device's clock is running behind the world's time.\nUnable to validate the ID token.");
-                                        alert("The clock on your device is running behind the world's time.\nWithout synchronized clocks, it's difficult to verify your identity.\nPlease change the clock on your device and restart the application.");
-                                        OpenIdConnect.removeLocationHash();
-                                    } else if (("" + error).indexOf("is in the past") >= 0) {
-                                        alert("The log in failed.\nOne possible cause is that the clock on your device is ahead of the world's time.\nWithout synchronized clocks, it's difficult to verify your identity.\nIf your clock is set to a future date & time, please change the clock on your device.\n\nThe application will now attempt to log in again...");
-                                        OpenIdConnect.loginFailed(callbackFunction);
-                                    } else {
-                                        OpenIdConnect.loginFailed(callbackFunction);
-                                    }
-                                });
-                            }
-                        } else {
-                            OpenIdConnect.loginFailed(callbackFunction);
-                        }
-                    } else {
-                        var idTokenIndex = (hrefSavedFromIdTokenMurder != null ? (hrefSavedFromIdTokenMurder.indexOf("#id_token=") >= 0 ? hrefSavedFromIdTokenMurder.indexOf("#id_token=") : hrefSavedFromIdTokenMurder.indexOf("&id_token=") + 1) : -1);
-                        if (idTokenIndex >= 0) {
-                            callbackFunction(hrefSavedFromIdTokenMurder.substr(idTokenIndex).split("&")[0].split("=")[1]);
-                        } else {
-                            OpenIdConnect.loginFailed(callbackFunction);
-                        }
-                    }
-                } else {
-                    // The client isn't loaded yet; wait for it to load:
-                    OpenIdConnect.waitForClientQueue.push(function () {
-                        OpenIdConnect.extractIdTokenFromLocation(callbackFunction);
-                    });
-                }
-            }
-        },
-
-        loginFailed: function (callbackFunction) {
-            OpenIdConnect.removeLocationHash();
-            if (callbackFunction != null && (typeof callbackFunction) == "function") {
-                callbackFunction(undefined);
-            }
-        },
-
-        getRequestParameter: function (name) {
-            if (name = (new RegExp("[?&]" + encodeURIComponent(name) + "=([^&]*)")).exec(window.top.location.search)) {
-                return decodeURIComponent(name [1]);
-            } else {
-                return null;
-            }
-        },
-
-        renewIdToken: function () {
-            if (OpenIdConnect.client != null) {
-                // Check for errors first:
-                var search = window.top.location.search;
-                if (search.indexOf("?error=invalid_client") < 0 && search.indexOf("&error=invalid_client") < 0 && search.indexOf("?error=invalid_request") < 0 && search.indexOf("&error=invalid_request") < 0) {
-                    // First check if we are not in a login loop:
-                    var lastLoginAttempt = sessionStorage.getItem(OpenIdConnect.SESSION_STORAGE_KEY_LOGIN_TIMESTAMP);
-                    var now = new Date().getTime();
-                    if (lastLoginAttempt != null && (now - lastLoginAttempt) < 30000) {
-                        throw "Login loop detected; 2 login attempts were made in less than half a minute.\nCheck the OpenID Connect configuration for errors.";
-                    } else {
-                        sessionStorage.setItem(OpenIdConnect.SESSION_STORAGE_KEY_LOGIN_TIMESTAMP, now);
-                    }
-
-                    sessionStorage.removeItem(OpenIdConnect.SESSION_STORAGE_KEY_ID_TOKEN);
-                    // Also invalidate the API Gateway token because it can be used for authentication too:
-                    OpenIdConnect.clearCachedApiGatewayAccessToken();
-                    OpenIdConnect.trackUserLogin();
-
-                    var redirectUrl = OpenIdConnect.config.spaRedirectUrl;
-                    // Also allow the redirect URL to go to localhost in case of mock OpenIDConnect servers:
-                    if (! isLocalDevelopmentEnvironment() || isLocalDevelopmentEnvironment(redirectUrl)) {
-                        var developmentUrl = OpenIdConnect.getRequestParameter(OpenIdConnect.REQUEST_PARAMETER_DEVELOPMENT_URL);
-                        if (developmentUrl == null) {
-                            localStorage.setItem(OpenIdConnect.SESSION_STORAGE_KEY_ORIGINAL_URL, window.top.location.href);
-                        } else {
-                            localStorage.setItem(OpenIdConnect.SESSION_STORAGE_KEY_DEVELOPMENT_URL, developmentUrl);
-                        }
-
-                        var cnfParameter = publicKeyInJWKFormat;
-                        var developmentPublicKey = OpenIdConnect.getRequestParameter(OpenIdConnect.REQUEST_PARAMETER_DEVELOPMENT_PUBLIC_KEY);
-                        if (developmentPublicKey != null) {
-                            cnfParameter = developmentPublicKey
-                        }
-                        var extraQueryParams = { req_cnf: cnfParameter };
-                        if (OpenIdConnect.config.claims != null) {
-                            if ((typeof OpenIdConnect.config.claims) == "object") {
-                                extraQueryParams ["claims"] = JSON.stringify(OpenIdConnect.config.claims);
-                            } else if ((typeof OpenIdConnect.config.claims) == "string") {
-                                extraQueryParams ["claims"] = OpenIdConnect.config.claims;
-                            }
-                        }
-
-                        var extraEuLoginParameters = OpenIdConnect.config.extraEuLoginParameters;
-                        if (extraEuLoginParameters != null && (typeof extraEuLoginParameters) == "object") {
-                            for (var parameter in extraEuLoginParameters) {
-                                extraQueryParams [parameter] = extraEuLoginParameters [parameter];
-                            }
-                        }
-
-                        // Check for functional test account logins:
-                        var parameters = new URLSearchParams(window.top.location.search);
-                        if (parameters != null && parameters.get("1fa") != null) {
-                            extraQueryParams ["acr_values"] = "https://ecas.ec.europa.eu/loa/basic";
-                        }
-
-                        if (! OpenIdConnect.requestingLogin) {
-                            OpenIdConnect.requestingLogin = true;
-                            OpenIdConnect.client.createSigninRequest({redirect_uri: redirectUrl, extraQueryParams: extraQueryParams}).then(function (req) {
-                                if (req != null && req.url != null) {
-                                    window.top.location.href = req.url;
-                                } else {
-                                    window.top.location.href = redirectUrl;
-                                }
-                            }).catch(function (err) {
-                                console.error(err);
-                            });
-                        }
-                    } else {
-                        localStorage.setItem(OpenIdConnect.SESSION_STORAGE_KEY_ORIGINAL_URL, window.top.location.href);
-
-                        // Automatically add the return URL:
-                        if (redirectUrl.indexOf(OpenIdConnect.REQUEST_PARAMETER_DEVELOPMENT_URL) < 0) {
-                            var currentUrl = window.top.location.href;
-                            redirectUrl = redirectUrl + (redirectUrl.indexOf("?") >= 0 ? "&" : "?") + OpenIdConnect.REQUEST_PARAMETER_DEVELOPMENT_URL + "=" + encodeURIComponent(currentUrl);
-                            // Check for single-factor authentication override:
-                            if (currentUrl != null && currentUrl.indexOf("?1fa") >= 0 || currentUrl.indexOf("&1fa") >= 0) {
-                                redirectUrl += "&1fa";
-                            }
-                        }
-                        if (redirectUrl.indexOf(OpenIdConnect.REQUEST_PARAMETER_DEVELOPMENT_PUBLIC_KEY) < 0) {
-                            redirectUrl = redirectUrl + (redirectUrl.indexOf("?") >= 0 ? "&" : "?") + OpenIdConnect.REQUEST_PARAMETER_DEVELOPMENT_PUBLIC_KEY + "=" + publicKeyInJWKFormat;
-                        }
-                        window.top.location.href = redirectUrl;
-                    }
-                } else {
-                    throw "EU Login does not recognise the application; please configure a proper OpenID Connect client ID.\n" +
-                    "This is configured in the spaClientId environment variable.";
-                }
-            } else {
-                // The client isn't loaded yet; wait for it to load:
-                OpenIdConnect.waitForClientQueue.push(OpenIdConnect.renewIdToken);
-            }
-        },
-
-        decodeJwtToken: function (jwtToken) {
-            if (jwtToken != null) {
-                var base64Url = jwtToken.split(".")[1];
-                return JSON.parse(b64utoutf8(base64Url));
-            } else {
-                return null;
-            }
-        },
-
-        decodeIdToken: function (callback) {
-            if (callback != null) {
-                var decodeIdToken = function () {
-                    callback(OpenIdConnect.decodeJwtToken(sessionStorage.getItem(OpenIdConnect.SESSION_STORAGE_KEY_ID_TOKEN)));
-                };
-
-                if (sessionStorage.getItem(OpenIdConnect.SESSION_STORAGE_KEY_ID_TOKEN) != null) {
-                    decodeIdToken();
-                } else {
-                    OpenIdConnect.waitForIdTokenQueue.push(decodeIdToken);
-                }
-            } else {
-                var idToken = sessionStorage.getItem(OpenIdConnect.SESSION_STORAGE_KEY_ID_TOKEN);
-                if (idToken != null) {
-                    return OpenIdConnect.decodeJwtToken(idToken);
-                } else {
-                    return null;
-                }
-            }
-        },
-
-        saveUserToSessionStorage: function (idToken) {
-            if (idToken != null) {
-                sessionStorage.setItem(OpenIdConnect.SESSION_STORAGE_KEY_ID_TOKEN, idToken);
-                // Also invalidate the API Gateway token because it can be used for authentication too:
-                OpenIdConnect.clearCachedApiGatewayAccessToken();
-
-                var tokenObject = OpenIdConnect.decodeJwtToken(idToken);
-                if (tokenObject != null) {
-                    // Also validate the audienceId of the SPA:
-                    if (tokenObject.aud === OpenIdConnect.config.spaClientId) {
-                        sessionStorage.setItem(OpenIdConnect.SESSION_STORAGE_KEY_USER_DETAILS, JSON.stringify({
-                            userId: tokenObject.sub,
-                            departmentNumber: null,
-                            domain: tokenObject.domain,
-                            domainUsername: tokenObject.preferred_username,
-                            email: tokenObject.email,
-                            firstName: tokenObject.given_name,
-                            lastName: tokenObject.family_name
-                        }));
-                        OpenIdConnect.trackUserName(tokenObject);
-                    } else {
-                        console.error("Not accepting ID token; incorrect audience (SPA) detected.");
-                    }
-                } else {
-                    console.error("Not accepting ID token; replay detected.");
-                }
-            }
-        },
-
-        removeLocationHash: function () {
-            if (OpenIdConnect.idTokenPresentInLocation() && (OpenIdConnect.config == null || (OpenIdConnect.config.stripIdTokenFromLocation == null || OpenIdConnect.config.stripIdTokenFromLocation))) {
-                var location = window.top.location;
-                if ("pushState" in history) {
-                    history.pushState("", document.title, location.pathname + location.search);
-                } else {
-                    location.hash = "";
-                }
-            }
-        },
-
-        navigateToOriginallyRequestedUrl: function (idToken) {
-            if (OpenIdConnect.config != null && OpenIdConnect.config.enabled) {
-                var originalUrl = localStorage.getItem(OpenIdConnect.SESSION_STORAGE_KEY_ORIGINAL_URL);
-                var developmentUrl = localStorage.getItem(OpenIdConnect.SESSION_STORAGE_KEY_DEVELOPMENT_URL);
-                // Remove any deep-linking state before redirecting:
-                localStorage.removeItem(OpenIdConnect.SESSION_STORAGE_KEY_ORIGINAL_URL);
-                localStorage.removeItem(OpenIdConnect.SESSION_STORAGE_KEY_DEVELOPMENT_URL);
-
-                if (OpenIdConnect.config.allowDevelopmentLogin && developmentUrl != null && developmentUrl.length > 0) {
-                    if (isLocalDevelopmentEnvironment(developmentUrl)) {
-                        window.top.location.href = developmentUrl + "#id_token=" + idToken;
-                    } else {
-                        console.warn("Not a development URL: " + developmentUrl);
-                    }
-                } else if (originalUrl != null) {
-                    // setTimeout is to fix a bug when URL fragments are being used in the original URL:
-                    setTimeout(function () {
-                        window.top.location.href = originalUrl;
-                    }, 0);
-                }
-            }
-        },
-
-        urlMatches: function (requestUrl, serviceUrl) {
-            return serviceUrl != "" && new RegExp("^" + serviceUrl.replace(/\*/g, ".*")).test(requestUrl);
-        },
-
-        cachedApiGatewayAccessTokenHasExpired: function () {
-            var cachedAccessToken = OpenIdConnect.getCachedApiGatewayAccessToken();
-            if (cachedAccessToken != null) {
-                var tokenObject = OpenIdConnect.decodeJwtToken(cachedAccessToken.access_token);
-                if (tokenObject != null && tokenObject.exp != null) {
-                    var expirationTimeInMilliseconds = 1000 * tokenObject.exp;
-                    return new Date().getTime() >= expirationTimeInMilliseconds;
-                } else {
-                    return true;
-                }
-            } else {
-                return true;
-            }
-        },
-
-        getCachedApiGatewayAccessToken: function () {
-            var accessToken = sessionStorage.getItem(OpenIdConnect.SESSION_STORAGE_KEY_API_GATEWAY_ACCESS_TOKEN);
-            if (accessToken) {
-                try {
-                    return JSON.parse(accessToken);
-                } catch (error) {
-                    console.warn("Unable to parse cached API Gateway access token; now attempting to renew it...");
-                    return null;
-                }
-            } else {
-                return null;
-            }
-        },
-
-        storeCachedApiGatewayAccessToken: function (apiGatewayToken) {
-            if (apiGatewayToken) {
-                sessionStorage.setItem(OpenIdConnect.SESSION_STORAGE_KEY_API_GATEWAY_ACCESS_TOKEN, JSON.stringify(apiGatewayToken));
-            }
-        },
-
-        clearCachedApiGatewayAccessToken: function () {
-            sessionStorage.removeItem(OpenIdConnect.SESSION_STORAGE_KEY_API_GATEWAY_ACCESS_TOKEN);
-        },
-
-        getImpersonatedUserId: function () {
-            return sessionStorage.getItem(OpenIdConnect.SESSION_STORAGE_KEY_IMPERSONATED_USER_ID);
-        },
-
-        storeImpersonatedUserId: function (userId) {
-            if (userId != null) {
-                sessionStorage.setItem(OpenIdConnect.SESSION_STORAGE_KEY_IMPERSONATED_USER_ID, userId);
-            } else {
-                OpenIdConnect.clearImpersonatedUserId();
-            }
-        },
-
-        clearImpersonatedUserId: function () {
-            sessionStorage.removeItem(OpenIdConnect.SESSION_STORAGE_KEY_IMPERSONATED_USER_ID);
-        },
-
-        addImpersonationHeaders: function (headers) {
-            if (headers != null) {
-                var apiGatewayAccessToken = OpenIdConnect.getCachedApiGatewayAccessToken();
-                if (apiGatewayAccessToken != null && apiGatewayAccessToken.access_token != null) {
-                    var tokenObject = OpenIdConnect.decodeJwtToken(apiGatewayAccessToken.access_token);
-                    if (tokenObject && tokenObject.imp_userId) {
-                        headers ["Impersonated"] = apiGatewayAccessToken.access_token;
-                    }
-                }
-            }
-
-            return headers;
-        },
-
-        initializeKeypair: function () {
-            var serializedPublicKey = localStorage.getItem(OpenIdConnect.SESSION_STORAGE_KEY_PUBLIC_KEY);
-            var serializedPrivateKey = localStorage.getItem(OpenIdConnect.SESSION_STORAGE_KEY_PRIVATE_KEY);
-
-            if (serializedPublicKey == null || serializedPrivateKey == null) {
-                keypair = KEYUTIL.generateKeypair("EC");
-                serializedPublicKey = KEYUTIL.getPEM(keypair.pubKeyObj);
-                serializedPrivateKey = KEYUTIL.getPEM(keypair.prvKeyObj, "PKCS8PRV");
-
-                localStorage.setItem(OpenIdConnect.SESSION_STORAGE_KEY_PUBLIC_KEY, serializedPublicKey);
-                localStorage.setItem(OpenIdConnect.SESSION_STORAGE_KEY_PRIVATE_KEY, serializedPrivateKey);
-            } else {
-                keypair = {
-                    pubKeyObj: KEYUTIL.getKey(serializedPublicKey),
-                    prvKeyObj: KEYUTIL.getKey(serializedPrivateKey)
-                }
-            }
-            publicKeyInJWKFormat = window.btoa(JSON.stringify(KEYUTIL.getJWKFromKey(keypair.pubKeyObj)));
-        },
-
-        signIdToken: function (algorithm) {
-            if ((typeof algorithm) == "undefined") {
-                algorithm = OpenIdConnect.DEFAULT_ID_TOKEN_SIGNING_ALGORITHM;
-            }
-
-            var idToken = sessionStorage.getItem(OpenIdConnect.SESSION_STORAGE_KEY_ID_TOKEN);
-            var now = new Date().getTime();
-            var expiration = now + 1000 * 60; // 1 minute
-            var body = {
-                "iss" : OpenIdConnect.config.spaClientId,
-                "sub" : OpenIdConnect.config.spaClientId,
-                "aud" : OpenIdConnect.metadata.token_endpoint,
-                "jti" : KJUR.crypto.Util.getRandomHexOfNbytes(32),
-                "exp" : expiration,
-                "iat" : now,
-                "id_token" : idToken
-            };
-
-            return KJUR.jws.JWS.sign(algorithm, '{"alg": "' + algorithm + '", "cty":"JWT"}', JSON.stringify(body), keypair.prvKeyObj);
-        },
-
-        signAccessToken: function (accessToken, algorithm) {
-            if ((typeof algorithm) == "undefined") {
-                algorithm = OpenIdConnect.DEFAULT_ACCESS_TOKEN_SIGNING_ALGORITHM;
-            }
-
-            var body = {
-                "at": accessToken,
-                "ts": new Date().getTime()
-            };
-
-            return KJUR.jws.JWS.sign(algorithm, '{"alg": "' + algorithm + '", "cty":"JWT"}', JSON.stringify(body), keypair.prvKeyObj);
-        },
-
-        parseSafely: function (xhr, errorCallbackFunction) {
-            try {
-                return JSON.parse(xhr.responseText);
-            } catch (error) {
-                OpenIdConnect.handleErrorResponse(xhr, errorCallbackFunction);
-                throw(error);
-            }
-        },
-
-        continuePendingConfigRequests: function () {
-            var queue = OpenIdConnect.waitForConfigQueue;
-            while (queue.length > 0) {
-                // Extra timeout to prevent endless loop in case of accidental recursion due to still not being authorized because of an unknown issue:
-                setTimeout(queue.pop(), 0);
-            }
-        },
-
-        makeSessionApplicationSpecific: function () {
-            // Sometimes multiple applications are deployed on the same domain.
-            // Make the session application-specific:
-            if (OpenIdConnect.config != null && OpenIdConnect.config.spaClientId != null) {
-                var applicationSuffix = "-" + OpenIdConnect.config.spaClientId;
-                OpenIdConnect.SESSION_STORAGE_KEY_ID_TOKEN += applicationSuffix;
-                OpenIdConnect.SESSION_STORAGE_KEY_USER_DETAILS += applicationSuffix;
-                OpenIdConnect.SESSION_STORAGE_KEY_API_GATEWAY_ACCESS_TOKEN += applicationSuffix;
-                OpenIdConnect.SESSION_STORAGE_KEY_IMPERSONATED_USER_ID += applicationSuffix;
-                OpenIdConnect.SESSION_STORAGE_KEY_DEVELOPMENT_URL += applicationSuffix;
-                OpenIdConnect.SESSION_STORAGE_KEY_ORIGINAL_URL += applicationSuffix;
-                OpenIdConnect.SESSION_STORAGE_KEY_PUBLIC_KEY += applicationSuffix;
-                OpenIdConnect.SESSION_STORAGE_KEY_PRIVATE_KEY += applicationSuffix;
-                OpenIdConnect.SESSION_STORAGE_KEY_LOGIN_TIMESTAMP += applicationSuffix;
-            }
-        },
-
-        trackUserLogin: function () {
-            if ((typeof dtrum) != "undefined" && (typeof dtrum.actionName) == "function" && (typeof dtrum.enterAction) == "function" && (typeof dtrum.sendBeacon) == "function") {
-                sessionStorage.setItem(OpenIdConnect.SESSION_STORAGE_KEY_TRACK_LOGIN, dtrum.enterAction("EU Login (old client)"));
-                dtrum.actionName("EU Login (old client)");
-                dtrum.sendBeacon(true, true, true);
-            }
-        },
-
-        trackUserName: function (tokenObject) {
-            if (tokenObject != null) {
-                var firstName = tokenObject.given_name;
-                if (firstName == "UNKNOWN") {
-                    firstName = tokenObject.sub;
-                }
-                var lastName = tokenObject.family_name;
-                if (lastName == "UNKNOWN") {
-                    lastName = "Generic User";
-                }
-                var fullName = lastName + " " + firstName;
-
-                if ((typeof dtrum) != "undefined" && (typeof dtrum.identifyUser) == "function") {
-                    dtrum.identifyUser(fullName);
-                } else {
-                    // The username will be picked up after restoring the original URL:
-                    sessionStorage.setItem(OpenIdConnect.SESSION_STORAGE_KEY_TRACK_USERNAME, fullName);
-                }
-            }
-        }
-    };
-
-    window.OpenIdConnect = OpenIdConnect;
-
-    try {
-        OpenIdConnect.preventIdTokenMurder();
-        OpenIdConnect.loadConfiguration(function () {
-            if (OpenIdConnect.config != null && OpenIdConnect.config.enabled) {
-                OpenIdConnect.makeSessionApplicationSpecific();
-                OpenIdConnect.initializeKeypair();
-                OpenIdConnect.configInitialised = true;
-                OpenIdConnect.continuePendingConfigRequests();
-                if (OpenIdConnect.config.autoLogin == null || OpenIdConnect.config.autoLogin) {
-                    OpenIdConnect.loginWithOpenIDConnect();
-                } else {
-                    OpenIdConnect.loginWithOpenIDConnect(true);
-                }
-            } else {
-                OpenIdConnect.configInitialised = true;
-                OpenIdConnect.continuePendingConfigRequests();
-            }
-        });
-    } catch (error) {
-        console.error(error);
-    }
-}());