<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">

    <modelVersion>4.0.0</modelVersion>

    <groupId>com.mulesoft.modules</groupId>
    <artifactId>mule-wss-module</artifactId>
    <version>2.2.4</version>
    <packaging>mule-extension</packaging>

    <name>Web Service Security Module</name>
    <description>A Mule extension that provides functionality for applying security to Web Services</description>

    <parent>
        <groupId>org.mule.extensions</groupId>
        <artifactId>mule-ee-core-modules-parent</artifactId>
        <version>1.9.11</version>
    </parent>

    <properties>
        <licenseYear>2025</licenseYear>
        <wss4j.version>2.4.1</wss4j.version>
        <spring.version>6.5.10</spring.version>
        <spring-core.version>6.2.19</spring-core.version>
        <spring-context.version>6.2.19</spring-context.version>
        <!-- CVE-2026-41850/41851/41852: force spring-expression off the vulnerable 6.2.0 transitive -->
        <spring-expression.version>6.2.19</spring-expression.version>
        <!-- CVE-2026-41720 (P0): force spring-ldap-core off the vulnerable 3.2.16 transitive -->
        <spring-ldap-core.version>3.3.8</spring-ldap-core.version>
        <jaxws-rt.version>2.3.6</jaxws-rt.version>

        <formatterConfigPath>formatter.xml</formatterConfigPath>

        <!-- Remove when a new parent version with MTF is available -->
        <munit.input.directory>src/test/munit</munit.input.directory>
        <munit.output.directory>${basedir}/target/test-mule/munit</munit.output.directory>
        <munit.extensions.maven.plugin.version>1.7.1-rc3</munit.extensions.maven.plugin.version>
        <munit.version>3.7.3</munit.version>

        <docker.maven.plugin.version>0.43.0</docker.maven.plugin.version>
        <docker.skip>${skipTests}</docker.skip>
        <ldap.host>localhost</ldap.host>
        <ldap.port>10389</ldap.port>
        <powermock.version>2.0.9</powermock.version>
        <maven.surefire.plugin.version>3.1.2</maven.surefire.plugin.version>
        <maven.compiler.plugin.version>3.11.0</maven.compiler.plugin.version>
        <jacoco.version>0.8.14</jacoco.version>

        <mockito-core.version>4.11.0</mockito-core.version>
        <byte-buddy.version>1.17.5</byte-buddy.version>
        <commons.io.version>2.21.0</commons.io.version>
        <sdk-api.version>1.0.0</sdk-api.version>
        <jakarta-ws-api.version>4.0.2</jakarta-ws-api.version>
        <metro.version>4.0.4</metro.version>

        <validate.saml.empty.truststore.config.ref>${validate.saml.empty.truststore.config}</validate.saml.empty.truststore.config.ref>
        <validate.saml.truststore.config.ref>${validate.saml.truststore.config}</validate.saml.truststore.config.ref>
        <validate.saml.truststore.non.matching.config.ref>${validate.saml.truststore.non.matching.config}</validate.saml.truststore.non.matching.config.ref>
        <request.without.security.config.ref>${request.without.security.config}</request.without.security.config.ref>
        <validate.signature.config.ref>${validate.signature.config}</validate.signature.config.ref>
        <valid.certificate.constraint.config.ref>${valid.certificate.constraint.config}</valid.certificate.constraint.config.ref>
        <invalid.certificate.constraint.config.ref>${invalid.certificate.constraint.config}</invalid.certificate.constraint.config.ref>
        <expression.certificate.constraint.config.ref>${expression.certificate.constraint.config}</expression.certificate.constraint.config.ref>
        <decryption.config.ref>${decryption.config}</decryption.config.ref>
        <decryption.username.config.ref>${decryption.username.config}</decryption.username.config.ref>
        <remove.header.config.ref>${remove.header.config}</remove.header.config.ref>
        <wss.validation.config.ref>${wss.validation.config}</wss.validation.config.ref>
        <outbound.timestamp.sign.config.ref>${outbound.timestamp.sign.config}</outbound.timestamp.sign.config.ref>
        <encryption.config.ref>${encryption.config}</encryption.config.ref>
        <encryption.config.with.key.ref>${encryption.config.with.key}</encryption.config.with.key.ref>
        <sign.config.ref>${sign.config}</sign.config.ref>
        <check.signature.with.binary.security.token.config.ref>${check.signature.with.binary.security.token.config}</check.signature.with.binary.security.token.config.ref>
        <valid.encryption.without.keystore.config.ref>${valid.encryption.without.keystore.config}</valid.encryption.without.keystore.config.ref>
        <!-- FIPS-only tests: ignored by default, enabled when running in FIPS mode -->
        <env.ignore.outside-fips>true</env.ignore.outside-fips>
        <!-- SHA-1 rejection test: only runs in FIPS 140-3 (SHA-1 is allowed in FIPS 140-2) -->
        <env.ignore.outside-fips140-3>true</env.ignore.outside-fips140-3>
    </properties>

    <dependencies>
        <dependency>
            <groupId>org.mule.sdk</groupId>
            <artifactId>mule-sdk-api</artifactId>
            <version>${sdk-api.version}</version>
        </dependency>

        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-ldap</artifactId>
            <version>${spring.version}</version>

            <exclusions>
                <exclusion>
                    <!-- This artifact doesn't end up being used and has known issues until 6.0.0 (6.0.0 has Java 17 as baseline) -->
                    <groupId>org.springframework.security</groupId>
                    <artifactId>spring-security-crypto</artifactId>
                </exclusion>
            </exclusions>
        </dependency>
        <dependency>
            <groupId>org.apache.wss4j</groupId>
            <artifactId>wss4j-ws-security-dom</artifactId>
            <version>${wss4j.version}</version>

            <exclusions>
                <exclusion>
                    <!-- This artifact doesn't end up being used and includes a jar-packaged vm agent -->
                    <groupId>org.ehcache</groupId>
                    <artifactId>ehcache</artifactId>
                </exclusion>
                <!--
                    bcprov is not FIPS approved and its usage is only allowed in non FIPS env
                    As we have no usage of bcprov in this module we can exclude it for FIPS compliance
                -->
                <exclusion>
                    <groupId>org.bouncycastle</groupId>
                    <artifactId>bcprov-jdk15on</artifactId>
                </exclusion>
                <!--
                    W-22373455 / CVE-2023-2976: wss4j-ws-security-common 2.4.1 declares guava 30.1-jre but
                    no class in the wss4j 2.4.1 chain references com.google.common.*. Verified via jdeps
                    against all jars in target/repository of a downstream Mule app. Excluding here so that
                    consumers don't ship the vulnerable artifact.
                -->
                <exclusion>
                    <groupId>com.google.guava</groupId>
                    <artifactId>guava</artifactId>
                </exclusion>
            </exclusions>
        </dependency>

        <!-- Update dependency to fix vulnerability       -->
        <dependency>
            <groupId>org.apache.santuario</groupId>
            <artifactId>xmlsec</artifactId>
            <version>3.0.3</version>
        </dependency>

        <!--
            W-22373455 / CVE-2023-2976: explicit guava 32.0.1-jre. Used by SoapMessageHandler
            (ImmutableMap) and WssErrorTypeProvider (ImmutableSet). Must be declared at <dependencies>
            level (not only dependencyManagement) so downstream Mule apps bundle 32.0.1-jre instead
            of falling back to wss4j-ws-security-common's transitive guava 30.1-jre request.

            Upstream context: Apache wss4j has not patched the 2.4.x line (2.4.0–2.4.3 all ship
            guava 30.1-jre). 3.0.0–3.0.4 ship guava 31.1-jre (also vulnerable). Only 3.0.5+ and
            4.0.x ship safe guava (33.x). A wss4j major upgrade is out of scope for this fix, so
            we exclude + pin instead.
        -->
        <dependency>
            <groupId>com.google.guava</groupId>
            <artifactId>guava</artifactId>
            <version>32.0.1-jre</version>
        </dependency>

        <!--
            Spring CVE pins. spring-security-ldap ${spring.version} pulls spring-expression,
            spring-ldap-core, spring-core and spring-context transitively and UNMANAGED. Like guava
            above, these MUST be declared at <dependencies> level (not only dependencyManagement):
            dependencyManagement is not inherited when this module is consumed as a mule-plugin, so a
            depMgmt-only pin fixes our own build but is silently dropped downstream and the vulnerable
            transitive versions still land in the consuming app's classloader-model.json.

            CVE-2026-41720 (P0): spring-ldap-core off the vulnerable 3.2.16 transitive -> 3.3.8.
            CVE-2026-41850 / 41851 / 41852: spring-expression off the vulnerable 6.2.0 transitive -> 6.2.19.
        -->
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-expression</artifactId>
            <version>${spring-expression.version}</version>
        </dependency>
        <dependency>
            <groupId>org.springframework.ldap</groupId>
            <artifactId>spring-ldap-core</artifactId>
            <version>${spring-ldap-core.version}</version>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-core</artifactId>
            <version>${spring-core.version}</version>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-context</artifactId>
            <version>${spring-context.version}</version>
        </dependency>

        <dependency>
            <groupId>jakarta.xml.ws</groupId>
            <artifactId>jakarta.xml.ws-api</artifactId>
            <version>${jakarta-ws-api.version}</version>
        </dependency>
        <dependency>
            <groupId>org.glassfish.metro</groupId>
            <artifactId>webservices-rt</artifactId>
            <version>${metro.version}</version>
        </dependency>


        <dependency>
            <groupId>org.mockito</groupId>
            <artifactId>mockito-core</artifactId>
            <version>${mockito-core.version}</version>
            <scope>test</scope>
        </dependency>

        <dependency>
            <groupId>commons-io</groupId>
            <artifactId>commons-io</artifactId>
            <version>${commons.io.version}</version>
            <scope>test</scope>
        </dependency>
    </dependencies>

    <dependencyManagement>
        <dependencies>
	    <!-- from org.mule.extensions:mule-ee-core-modules-parent -->
	    <!--     from org.mule.services:mule-service-scheduler -->
	    <!-- The dep is unused. This ghost version bump is made so analysis tools don't get angry at us -->
            <dependency>
                <groupId>com.google.guava</groupId>
                <artifactId>guava</artifactId>
                <version>32.0.1-jre</version>
            </dependency>
            <dependency>
                <groupId>org.springframework</groupId>
                <artifactId>spring-core</artifactId>
                <version>${spring-core.version}</version>
            </dependency>
            <dependency>
                <groupId>org.springframework</groupId>
                <artifactId>spring-context</artifactId>
                <version>${spring-context.version}</version>
            </dependency>
            <!-- Pin Byte Buddy to a J25-aware version (Mockito ships older 1.12.x which fails on Java class-file 69). -->
            <dependency>
                <groupId>net.bytebuddy</groupId>
                <artifactId>byte-buddy</artifactId>
                <version>${byte-buddy.version}</version>
            </dependency>
            <dependency>
                <groupId>net.bytebuddy</groupId>
                <artifactId>byte-buddy-agent</artifactId>
                <version>${byte-buddy.version}</version>
            </dependency>
            <!--
                CVE-2026-41850 / 41851 / 41852: spring-security-ldap 6.5.10 pulls spring-expression 6.2.0
                transitively (UNMANAGED). Pin to 6.2.19 to match the already-managed spring-core/spring-context.
            -->
            <dependency>
                <groupId>org.springframework</groupId>
                <artifactId>spring-expression</artifactId>
                <version>${spring-expression.version}</version>
            </dependency>
            <!--
                CVE-2026-41720 (P0): spring-security-ldap 6.5.10 pulls spring-ldap-core 3.2.16 transitively
                (UNMANAGED). Pin to 3.3.8 (same 3.x major) which carries the fix.
            -->
            <dependency>
                <groupId>org.springframework.ldap</groupId>
                <artifactId>spring-ldap-core</artifactId>
                <version>${spring-ldap-core.version}</version>
            </dependency>
        </dependencies>
    </dependencyManagement>

    <distributionManagement>
        <repository>
            <id>mule-releases</id>
            <name>Mule Release Repository</name>
            <url>https://repository-master.mulesoft.org/nexus/content/repositories/releases</url>
        </repository>
        <snapshotRepository>
            <id>mule-ee-snapshots</id>
            <name>Mule Snapshot Repository</name>
            <url>https://repository-master.mulesoft.org/nexus/content/repositories/ci-snapshots</url>
            <uniqueVersion>false</uniqueVersion>
        </snapshotRepository>
    </distributionManagement>

    <repositories>
        <repository>
            <id>mulesoft-maven-all</id>
            <name>Mulesoft Maven All</name>
            <url>https://nexus-proxy.repo.local.sfdc.net/nexus/content/repositories/mulesoft-maven-all/</url>
        </repository>
        <repository>
            <id>maven2-proxy-msp-n3builds</id>
            <name>Maven2 Proxy MSP n3 Builds</name>
            <url>https://nexus-proxy.repo.local.sfdc.net/nexus/repository/maven2-proxy-msp-n3builds</url>
        </repository>
        <repository>
            <id>studio</id>
            <name>Studio build repositories</name>
            <url>https://repository.mulesoft.org/nexus/content/groups/studio</url>
        </repository>
        <repository>
            <id>mule-private</id>
            <name>Mule Repository</name>
            <url>https://repository.mulesoft.org/nexus/content/repositories/private/</url>
        </repository>
    </repositories>

    <pluginRepositories>
        <pluginRepository>
            <id>studio</id>
            <name>Studio build repositories</name>
            <url>https://repository.mulesoft.org/nexus/content/groups/studio</url>
        </pluginRepository>
        <pluginRepository>
            <id>mulesoft-maven-all</id>
            <name>Mulesoft Maven All</name>
            <url>https://nexus-proxy.repo.local.sfdc.net/nexus/content/repositories/mulesoft-maven-all/</url>
        </pluginRepository>
        <pluginRepository>
            <id>maven2-proxy-msp-n3builds</id>
            <name>Maven2 Proxy MSP n3 Builds</name>
            <url>https://nexus-proxy.repo.local.sfdc.net/nexus/repository/maven2-proxy-msp-n3builds</url>
        </pluginRepository>

        <pluginRepository>
            <id>mule-private</id>
            <name>Mule Repository</name>
            <url>https://repository.mulesoft.org/nexus/content/repositories/private/</url>
        </pluginRepository>

    </pluginRepositories>

    <build>
        <pluginManagement>
            <plugins>
                <plugin>
                    <groupId>com.mulesoft.munit</groupId>
                    <artifactId>munit-extensions-maven-plugin</artifactId>
                    <version>${munit.extensions.maven.plugin.version}</version>
                    <executions>
                        <execution>
                            <goals>
                                <goal>test</goal>
                            </goals>
                            <phase>integration-test</phase>
                        </execution>
                    </executions>
                    <configuration>
                        <argLines>
                            <argLine>
                                -javaagent:${settings.localRepository}/org/jacoco/org.jacoco.agent/${jacoco.version}/org.jacoco.agent-${jacoco.version}-runtime.jar=destfile=${session.executionRootDirectory}/target/jacoco.exec
                            </argLine>
                        </argLines>
                        <runtimeConfiguration>
                            <discoverRuntimes>
                                <product>EE</product>
                                <includeSnapshots>true</includeSnapshots>
                            </discoverRuntimes>
                        </runtimeConfiguration>
                        <environmentVariables>
                            <LDAP_HOST>${ldap.host}</LDAP_HOST>
                            <LDAP_PORT>${ldap.port}</LDAP_PORT>
                        </environmentVariables>
                    </configuration>
                    <dependencies>
                        <dependency>
                            <groupId>com.mulesoft.munit</groupId>
                            <artifactId>munit-runner</artifactId>
                            <version>${munit.version}</version>
                            <classifier>mule-plugin</classifier>
                        </dependency>
                        <dependency>
                            <groupId>com.mulesoft.munit</groupId>
                            <artifactId>munit-tools</artifactId>
                            <version>${munit.version}</version>
                            <classifier>mule-plugin</classifier>
                        </dependency>
                    </dependencies>
                </plugin>
            </plugins>
        </pluginManagement>

        <plugins>
            <!-- Addition-3, W-23624366: on a force_redeploy recovery run, apikit-sfci's
                 check-deploy-skip step probes Nexus and writes a marker file when a target
                 is ALREADY fully published. Loading that marker into maven.deploy.skip here
                 (validate phase, before either mvn deploy process starts) lets the recovery
                 run skip a deploy that would otherwise 400/409. quiet=true makes both
                 executions a no-op whenever the corresponding marker is absent, i.e. every
                 normal release, and any recovery run where nothing needs skipping. Internal
                 and public deploys are two separate `mvn deploy` invocations (two separate
                 managed steps), so each marker is only ever relevant to, and only ever
                 present for, the deploy it corresponds to. See apikit-sfci
                 templates/apikit-exchange-module-strata.yaml "How to consume" step 10. -->
            <plugin>
                <groupId>org.codehaus.mojo</groupId>
                <artifactId>properties-maven-plugin</artifactId>
                <version>1.0.0</version>
                <executions>
                    <execution>
                        <id>sfci-check-internal-deploy-skip</id>
                        <phase>validate</phase>
                        <goals>
                            <goal>read-project-properties</goal>
                        </goals>
                        <configuration>
                            <quiet>true</quiet>
                            <files>
                                <file>${project.basedir}/.sfci-internal-deploy-skip.properties</file>
                            </files>
                        </configuration>
                    </execution>
                    <execution>
                        <id>sfci-check-public-deploy-skip</id>
                        <phase>validate</phase>
                        <goals>
                            <goal>read-project-properties</goal>
                        </goals>
                        <configuration>
                            <quiet>true</quiet>
                            <files>
                                <file>${project.basedir}/.sfci-public-deploy-skip.properties</file>
                            </files>
                        </configuration>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <version>${maven.compiler.plugin.version}</version>
            </plugin>
            <plugin>
                <groupId>io.fabric8</groupId>
                <artifactId>docker-maven-plugin</artifactId>
                <version>${docker.maven.plugin.version}</version>
                <configuration>
                    <skip>${docker.skip}</skip>
                    <images>
                        <image>
                            <name>docker.repo.local.sfdc.net/sfci/3pp/3pp/docker.io/rroemhild/test-openldap:latest</name>
                            <build>
                                <dockerFileDir>${project.basedir}</dockerFileDir>
                            </build>
                            <run>
                                <platform>linux/amd64</platform>
                                <ports>
                                    <port>ldap.port:10389</port>
                                </ports>
                                <log>
                                    <enabled>false</enabled>
                                </log>
                                <!--Workaround for avoiding name collisions with zombie containers left from failed executions-->
                                <!--or parallel executions on same agent-->
                                <containerNamePattern>%n-%i-%t</containerNamePattern>
                            </run>
                        </image>
                    </images>
                    <verbose>true</verbose>
                </configuration>
                <executions>
                    <execution>
                        <id>start</id>
                        <phase>test-compile</phase>
                        <goals>
                            <goal>build</goal>
                            <goal>start</goal>
                        </goals>
                        <configuration>
                            <showLogs>false</showLogs>
                            <logStdout>false</logStdout>
                        </configuration>
                    </execution>
                    <!--https://github.com/fabric8io/docker-maven-plugin/issues/915, if tests fail, run docker stop <CONTAINER_ID>-->
                    <execution>
                        <id>stop</id>
                        <phase>post-integration-test</phase>
                        <goals>
                            <goal>stop</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <artifactId>maven-resources-plugin</artifactId>
                <executions>
                    <execution>
                        <id>copy-munit-resources</id>
                        <phase>process-test-resources</phase>
                        <goals>
                            <goal>copy-resources</goal>
                        </goals>
                        <configuration>
                            <outputDirectory>${munit.output.directory}</outputDirectory>
                            <resources>
                                <resource>
                                    <directory>${munit.input.directory}</directory>
                                    <filtering>true</filtering>
                                </resource>
                            </resources>
                        </configuration>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-surefire-plugin</artifactId>
                <version>${maven.surefire.plugin.version}</version>
            </plugin>
            <plugin>
                <groupId>com.mulesoft.munit</groupId>
                <artifactId>munit-extensions-maven-plugin</artifactId>
            </plugin>
            <plugin>
                <groupId>io.qameta.allure</groupId>
                <artifactId>allure-maven</artifactId>
            </plugin>

        </plugins>
    </build>

    <profiles>
        <!-- Profile for SFDC Internal Nexus (used by first maven-publish step) -->
        <profile>
            <id>release-sfci</id>
            <activation>
                <activeByDefault>false</activeByDefault>
            </activation>
            <distributionManagement>
                <repository>
                    <id>project</id>
                    <name>SFCI Internal Releases</name>
                    <url>${env.NEXUS_BASE_URL}/repositories/releases/</url>
                </repository>
                <snapshotRepository>
                    <id>project</id>
                    <name>SFCI Internal Snapshots</name>
                    <url>${env.NEXUS_BASE_URL}/repositories/snapshots/</url>
                </snapshotRepository>
            </distributionManagement>
        </profile>

        <profile>
            <id>default-config</id>
            <activation>
                <property>
                    <name>!mule.security.model</name> <!-- if mule.security.model does not exist -->
                </property>
            </activation>
            <properties>
                <validate.saml.empty.truststore.config>validate-saml-using-empty-truststore-config</validate.saml.empty.truststore.config>
                <validate.saml.truststore.config>validate-saml-using-truststore-config</validate.saml.truststore.config>
                <validate.saml.truststore.non.matching.config>validate-saml-using-truststore-non-matching-issuer-config</validate.saml.truststore.non.matching.config>
                <request.without.security.config>request-without-security-config</request.without.security.config>
                <validate.signature.config>validate-signature-config</validate.signature.config>
                <valid.certificate.constraint.config>valid-certificate-constraint-config</valid.certificate.constraint.config>
                <invalid.certificate.constraint.config>invalid-certificate-constraint-config</invalid.certificate.constraint.config>
                <expression.certificate.constraint.config>expression-certificate-constraint-config</expression.certificate.constraint.config>
                <decryption.config>decryption-config</decryption.config>
                <decryption.username.config>decryption-username-config</decryption.username.config>
                <remove.header.config>remove-header-config</remove.header.config>
                <wss.validation.config>wss-validation-config</wss.validation.config>
                <outbound.timestamp.sign.config>outbound-timestamp-sign-config</outbound.timestamp.sign.config>
                <encryption.config>encryption-config</encryption.config>
                <encryption.config.with.key>encryption-config-with-encryption-key-identifier</encryption.config.with.key>
                <sign.config>sign-config</sign.config>
                <check.signature.with.binary.security.token.config>check-signature-with-binary-security-token-config</check.signature.with.binary.security.token.config>
                <valid.encryption.without.keystore.config>valid-encryption-without-keystore-config</valid.encryption.without.keystore.config>
            </properties>
        </profile>
        <profile>
            <id>fips-config</id>
            <activation>
                <property>
                    <name>mule.security.model</name>
                </property>
            </activation>
            <properties>
                <validate.saml.empty.truststore.config>validate-saml-using-empty-truststore-config-fips</validate.saml.empty.truststore.config>
                <validate.saml.truststore.config>validate-saml-using-truststore-config-fips</validate.saml.truststore.config>
                <validate.saml.truststore.non.matching.config>validate-saml-using-truststore-non-matching-issuer-config-fips</validate.saml.truststore.non.matching.config>
                <request.without.security.config>request-without-security-config-fips</request.without.security.config>
                <validate.signature.config>validate-signature-config-fips</validate.signature.config>
                <valid.certificate.constraint.config>valid-certificate-constraint-config-fips</valid.certificate.constraint.config>
                <invalid.certificate.constraint.config>invalid-certificate-constraint-config-fips</invalid.certificate.constraint.config>
                <expression.certificate.constraint.config>expression-certificate-constraint-config-fips</expression.certificate.constraint.config>
                <decryption.config>decryption-config-fips</decryption.config>
                <decryption.username.config>decryption-username-config-fips</decryption.username.config>
                <remove.header.config>remove-header-config-fips</remove.header.config>
                <wss.validation.config>wss-validation-config-fips</wss.validation.config>
                <outbound.timestamp.sign.config>outbound-timestamp-sign-config-fips</outbound.timestamp.sign.config>
                <encryption.config>encryption-config-fips</encryption.config>
                <encryption.config.with.key>encryption-config-with-encryption-key-identifier-fips</encryption.config.with.key>
                <sign.config>sign-config-fips</sign.config>
                <check.signature.with.binary.security.token.config>check-signature-with-binary-security-token-config-fips</check.signature.with.binary.security.token.config>
                <valid.encryption.without.keystore.config>valid-encryption-without-keystore-config-fips</valid.encryption.without.keystore.config>
                <!-- Enable FIPS-only tests (rejection tests) when running in FIPS mode -->
                <env.ignore.outside-fips>false</env.ignore.outside-fips>
            </properties>
        </profile>
        <!-- FIPS 140-3 specific: SHA-1 is only rejected in FIPS 140-3 (not 140-2) -->
        <profile>
            <id>fips140-3-config</id>
            <activation>
                <property>
                    <name>mule.security.model</name>
                    <value>fips140-3</value>
                </property>
            </activation>
            <properties>
                <env.ignore.outside-fips140-3>false</env.ignore.outside-fips140-3>
            </properties>
        </profile>
    </profiles>
</project>
