constructor(public oidcSecurityService: OidcSecurityService) {

      const openIDImplicitFlowConfiguration = new OpenIDImplicitFlowConfiguration();
      openIDImplicitFlowConfiguration.stsServer = 'https://daue2sungtwb01.azurewebsites.net/core';
      openIDImplicitFlowConfiguration.redirect_url = environment.redirectUrl;
      openIDImplicitFlowConfiguration.client_id = 'lex.test.client';
      openIDImplicitFlowConfiguration.response_type = 'id_token token';
      openIDImplicitFlowConfiguration.scope = 'openid profile roles all_claims lexapi';
      openIDImplicitFlowConfiguration.post_logout_redirect_uri = environment.postLogoutRedirectUri;
      openIDImplicitFlowConfiguration.post_login_route = '/home';
      openIDImplicitFlowConfiguration.forbidden_route = '/Forbidden';
      openIDImplicitFlowConfiguration.unauthorized_route = '/Unauthorized';
      openIDImplicitFlowConfiguration.trigger_authorization_result_event = true;
      openIDImplicitFlowConfiguration.log_console_warning_active = true;
      openIDImplicitFlowConfiguration.log_console_debug_active = true;
      openIDImplicitFlowConfiguration.max_id_token_iat_offset_allowed_in_seconds = 20;
      openIDImplicitFlowConfiguration.override_well_known_configuration = false;

      this.oidcSecurityService.setupModule(openIDImplicitFlowConfiguration);
  }

  intercept(
    req: HttpRequest<any>,
    next: HttpHandler
  ): Observable<HttpEvent<any>> {
    let requestToForward = req;

    if (this.oidcSecurityService === undefined) {
      this.oidcSecurityService = this.injector.get(OidcSecurityService);
    }
    if (this.oidcSecurityService !== undefined) {
      const token = this.oidcSecurityService.getToken();
      if (token !== '') {
        const tokenValue = 'Bearer ' + token;
        requestToForward = req.clone({
          setHeaders: { 'Authorization': tokenValue }
        });
      }
    } else {
      console.log('OidcSecurityService undefined: NO auth header!');
    }
    return next.handle(requestToForward);
  }

 private onOidcModuleSetup() {
   if (window.location.hash) {
     this.oidcSecurityService.authorizedCallback();
   } else {
     if ('/autologin' !== window.location.pathname) {
       this.write('redirect', window.location.pathname);
     }
     this.oidcSecurityService
       .getIsAuthorized()
       .subscribe((authorized: boolean) => {
         if (!authorized) {
           this.router.navigate(['/autologin']);
         } else {
         }
       });
   }
 }

 private onOidcModuleSetup() {
   if (window.location.hash) {
     this.oidcSecurityService.authorizedCallback();
   } else {
     if ('/autologin' !== window.location.pathname) {
       this.write('redirect', window.location.pathname);
     }
     this.oidcSecurityService
       .getIsAuthorized()
       .subscribe((authorized: boolean) => {
         if (!authorized) {
           this.router.navigate(['/autologin']);
         } else {
           if (!this.read('from_silent_renew')) {
             this.store.dispatch(new fromStore.LoadPanels());
           }
         }
       });
   }
 }

    this.oidcConfigService.onConfigurationLoaded.subscribe(() => {
      const openIDImplicitFlowConfiguration = new OpenIDImplicitFlowConfiguration();

      openIDImplicitFlowConfiguration.stsServer = environment.stsServer;
      // openIDImplicitFlowConfiguration.redirect_url = document.baseURI;
      openIDImplicitFlowConfiguration.redirect_url = document.baseURI;
      // openIDImplicitFlowConfiguration.redirect_url = document.baseURI + 'assets/silent_login.html';
      // The Client MUST validate that the aud (audience) Claim contains its client_id value registered at the Issuer
      // identified by the iss (issuer) Claim as an audience.
      // The ID Token MUST be rejected if the ID Token does not list the Client as a valid audience,
      // or if it contains additional audiences not trusted by the Client.
      openIDImplicitFlowConfiguration.client_id = environment.clientId;
      openIDImplicitFlowConfiguration.response_type = 'id_token token';
      openIDImplicitFlowConfiguration.scope = 'openid profile email offline_access ala roles';
      openIDImplicitFlowConfiguration.post_logout_redirect_uri = document.baseURI;
      openIDImplicitFlowConfiguration.start_checksession = false; // CAS doesn't support this
      openIDImplicitFlowConfiguration.silent_renew = true;
      openIDImplicitFlowConfiguration.silent_renew_offset_in_seconds = 3600;
      openIDImplicitFlowConfiguration.silent_renew_url = document.baseURI + 'assets/silent_renew.html';
      openIDImplicitFlowConfiguration.silent_redirect_url = document.baseURI + 'assets/silent_renew.html';
      // openIDImplicitFlowConfiguration.storage = window.localStorage;
      // openIDImplicitFlowConfiguration.post_login_route = '/';
      // HTTP 403
      openIDImplicitFlowConfiguration.forbidden_route = '/403';
      // HTTP 401
      openIDImplicitFlowConfiguration.unauthorized_route = '/401';
      openIDImplicitFlowConfiguration.log_console_warning_active = true; // false
      openIDImplicitFlowConfiguration.log_console_debug_active = true; // false
      // id_token C8: The iat Claim can be used to reject tokens that were issued too far away from the current time,
      // limiting the amount of time that nonces need to be stored to prevent attacks.The acceptable range is Client specific.
      openIDImplicitFlowConfiguration.max_id_token_iat_offset_allowed_in_seconds = 3600; // 3
      openIDImplicitFlowConfiguration.auto_userinfo = true;
      openIDImplicitFlowConfiguration.auto_clean_state_after_authentication = true;
      // openIDImplicitFlowConfiguration.trigger_authorization_result_event = true;
      openIDImplicitFlowConfiguration.post_login_route = '/';
      // openIDImplicitFlowConfiguration.resource = '';
      // openIDImplicitFlowConfiguration.silent_renew = true;
      // openIDImplicitFlowConfiguration.trigger_authorization_result_event = false;

      const authWellKnownEndpoints = new AuthWellKnownEndpoints();
      authWellKnownEndpoints.setWellKnownEndpoints(this.oidcConfigService.wellKnownEndpoints);

      window.addEventListener("sc-login-message", (evt: CustomEvent) => {
        console.log("sc-login-message", evt.detail);
        this.oidcSecurityService.authorizedCallback(evt.detail)
      });
      this.oidcSecurityService.setupModule(
        openIDImplicitFlowConfiguration,
        authWellKnownEndpoints
      );

    });

  intercept(req: HttpRequest<any>, next: HttpHandler): Observable<HttpEvent<any>> {
    if (req.url.startsWith(environment.api)) {

      const token = this.oidcSecurityService.getToken();
      if (token !== '') {
        const tokenValue = 'Bearer ' + token;
        return next.handle(req.clone({
          setHeaders: {
            'Authorization': tokenValue
          }
        }));
      }
    }
    return next.handle(req);
  }

    canActivate( route: ActivatedRouteSnapshot, state: RouterStateSnapshot): Observable<boolean> | boolean {
        console.log('auth guard: can activate ...');
        return this.oidcSecurityService.getIsAuthorized()
        .map((isAuthorized: boolean) => {
            if ( isAuthorized ) {
                console.log(state.url);
                return true;                
            }
            this.redirectUrl = state.url;
            console.log('auth guard: redirect to login:');
            // this.oidcSecurityService.authorize();
            this.router.navigate(['autologin'], {queryParams: { returnUrl: state.url }});
            console.log(state.url);
            return false;
        });

        

        // return this.getAuthorized(state.url);
    }

     this.oidcConfigService.onConfigurationLoaded.subscribe(() => {
      const openIDImplicitFlowConfiguration = new OpenIDImplicitFlowConfiguration();
      openIDImplicitFlowConfiguration.stsServer = this.oidcConfigService.clientConfiguration.stsServer;
      openIDImplicitFlowConfiguration.redirect_url = this.oidcConfigService.clientConfiguration.redirect_url;
      // The Client MUST validate that the aud (audience) Claim contains its client_id value registered at the Issuer
      // identified by the iss (issuer) Claim as an audience.
      // The ID Token MUST be rejected if the ID Token does not list the Client as a valid audience,
      // or if it contains additional audiences not trusted by the Client.
      openIDImplicitFlowConfiguration.client_id = this.oidcConfigService.clientConfiguration.client_id;
      openIDImplicitFlowConfiguration.response_type = this.oidcConfigService.clientConfiguration.response_type;
      openIDImplicitFlowConfiguration.scope = this.oidcConfigService.clientConfiguration.scope;
      openIDImplicitFlowConfiguration.post_logout_redirect_uri = this.oidcConfigService.clientConfiguration.post_logout_redirect_uri;
      openIDImplicitFlowConfiguration.start_checksession = this.oidcConfigService.clientConfiguration.start_checksession;
      openIDImplicitFlowConfiguration.silent_renew = this.oidcConfigService.clientConfiguration.silent_renew;
      openIDImplicitFlowConfiguration.silent_renew_url = this.oidcConfigService.clientConfiguration.silent_renew_url;
      openIDImplicitFlowConfiguration.post_login_route = this.oidcConfigService.clientConfiguration.startup_route;
      // HTTP 403
      openIDImplicitFlowConfiguration.forbidden_route = this.oidcConfigService.clientConfiguration.forbidden_route;
      // HTTP 401
      openIDImplicitFlowConfiguration.unauthorized_route = this.oidcConfigService.clientConfiguration.unauthorized_route;
      openIDImplicitFlowConfiguration.log_console_warning_active = this.oidcConfigService.clientConfiguration.log_console_warning_active;
      openIDImplicitFlowConfiguration.log_console_debug_active = this.oidcConfigService.clientConfiguration.log_console_debug_active;
      // id_token C8: The iat Claim can be used to reject tokens that were issued too far away from the current time,
      // limiting the amount of time that nonces need to be stored to prevent attacks.The acceptable range is Client specific.
      openIDImplicitFlowConfiguration.max_id_token_iat_offset_allowed_in_seconds = this.oidcConfigService.clientConfiguration.max_id_token_iat_offset_allowed_in_seconds;

      const authWellKnownEndpoints = new AuthWellKnownEndpoints();
      authWellKnownEndpoints.setWellKnownEndpoints(
        this.oidcConfigService.wellKnownEndpoints
      );

      this.oidcSecurityService.setupModule(
        openIDImplicitFlowConfiguration,
        authWellKnownEndpoints
      );

      
    });

 private onModuleSetup() {
   this.oidcSecurityService.authorize();
 }

 window.addEventListener("sc-login-message", (evt: CustomEvent) => {
   console.log("sc-login-message", evt.detail);
   this.oidcSecurityService.authorizedCallback(evt.detail)
 });

 logout() {
   console.log('start logoff');
   this.oidcSecurityService.logoff();
 }

 refreshSession() {
   console.log('start refreshSession');
   this.oidcSecurityService.authorize();
 }

 login() {
   console.log('start login');
   this.oidcSecurityService.authorize();
 }