location /sts/wstrust {
        	STSExchange wstrust https://pingfed:9031/pf/sts.wst
				auth=basic&username=wstrust&password=2Federate&applies_to=urn:pingfed&value_type=urn:pingidentity.com:oauth2:grant_type:validate_bearer&token_type=urn:bogus:token&ssl_verify=false;

            STSVariables $source_token $wst_target_token;
            
            proxy_set_header Cookie STS_COOKIE=$wst_target_token;
            proxy_pass http://echo:8080$is_args$args;            
        }

        location /sts/ropc {
			STSExchange ropc https://pingfed:9031/as/token.oauth2
				auth=client_secret_basic&client_id=sts0&client_secret=2Federate&username=dummy&ssl_verify=false;
            
            STSVariables $source_token $ropc_target_token;
            
            proxy_set_header Cookie STS_COOKIE=$ropc_target_token;
            proxy_pass http://echo:8080$is_args$args;            
        }

        location /sts/cc {        
			STSExchange cc https://keycloak:8443/realms/master/protocol/openid-connect/token
				auth=client_secret_basic&client_id=cc_client&client_secret=mysecret&ssl_verify=false;
          
            set $dummy_variable "notempty";
            STSVariables $dummy_variable $cc_target_token;
            
            proxy_set_header Authorization "bearer $cc_target_token";
            proxy_pass http://echo:8080$is_args$args;            
        }

        location /sts/otx {
			STSExchange otx https://keycloak:8443/auth/realms/master/protocol/openid-connect/token
				auth=client_secret_basic&client_id=otxclient&client_secret=2Federate&ssl_verify=false;

            STSVariables $source_token $otx_target_token;
            
            proxy_set_header Cookie STS_COOKIE=$otx_target_token;
            proxy_pass http://echo:8080$is_args$args;            
        }        

	map $http_cookie $sts_source_token {
		default "";
		"~*MyCookieName=(?<token>[^;]+)" "$token";
	}

	map $http_authorization $sts_source_token {
		default "";
		"~*^Bearer\s+(?<token>[\S]+)$" $token;
	}

	if ($args_token != "not found") {
		$sts_source_token = $args_token
	}

	# use form-input-nginx-module
	set_form_input $sts_source_token access_token;

	set $new_cookie $http_cookie;
	if ($http_cookie ~ "(.*)(?:^|;)\s*source_token=[^;]+(.*)") {
		set $new_cookie $1$2;
	}
	proxy_set_header Cookie $new_cookie;

	proxy_set_header Authorization "";

	if ($args ~ (.*)source_token=[^&]*(.*)) {
		set $args $1$2;
	}
	# cleanup any repeated & introduced 
	if ($args ~ (.*)&&+(.*)) {
		set $args $1&$2;
	}
	# cleanup leading &
	if ($args ~ ^&(.*)) {
		set $args $1;
	}
	# cleanup ending &
	if ($args ~ (.*)&$) {
		set $args $1;
	}

	fastcgi_param STS_TOKEN $sts_target_token

	proxy_set_header Authorization "Bearer $sts_target_token"

	proxy_set_header Cookie STS_COOKIE=$sts_target_token

	set $sep "";
	if ($is_args) {
		set $sep "&";
	}
	set $args $args${sep}token=$sts_target_token;

	proxy_set_body $request_body&token=$sts_target_token;