#
# Copyright (c) 2016, 2024 Oracle and/or its affiliates.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

security:
  config:
    # Configuration of secured config (encryption of passwords in property files)
    # Set to true for production - if set to true, clear text passwords will cause failure
    require-encryption: false

  # composite provider policy
  provider-policy:
    type: "COMPOSITE"
    outbound:
      - name: "http-basic-auth"
      - name: "http-signatures"

  providers:
    # Security provider - basic authentication (supports roles) - default
    - http-basic-auth:
        realm: "helidon"
        users:
          - login: "jack"
            password: "${CLEAR=changeit}"
            roles: ["user", "admin"]
          - login: "jill"
            # master password is "changeit", password is "changeit"
            password: "${CLEAR=changeit}"
            roles: ["user"]
          - login: "john"
            password: "${CLEAR=changeit}"
            roles: []
        outbound:
          - name: "propagate-all"
    # only configured for outbound security
    - http-signatures:
        outbound:
          - name: "service2"
            hosts: ["localhost"]
            paths: ["/service2"]
            signature:
              key-id: "service1-hmac"
              hmac.secret: "${CLEAR=changeit}"
          - name: "service2-rsa"
            hosts: ["localhost"]
            paths: ["/service2-rsa.*"]
            signature:
              key-id: "service1-rsa"
              private-key:
                keystore:
                  # path to keystore
                  resource.path: "src/main/resources/keystore.p12"
                  # Keystore type
                  # PKCS12, JSK or RSA (not really a keystore, but directly the linux style private key unencrypted)
                  # defaults to jdk default
                  type: "PKCS12"
                  # password of the keystore
                  passphrase: "changeit"
                  # alias of the key to sign request
                  key.alias: "myPrivateKey"
  web-server:
    # Configuration of integration with web server
    defaults:
      authenticate: true
    paths:
      - path: "/service1"
        methods: ["get"]
        roles-allowed: ["user"]
      - path: "/service1-rsa"
        methods: ["get"]
        roles-allowed: ["user"]
