#
# Copyright (c) 2016, 2024 Oracle and/or its affiliates.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

security:
  config:
    # Configuration of secured config (encryption of passwords in property files)
    # Set to true for production - if set to true, clear text passwords will cause failure
    require-encryption: false
  # composite provider policy
  provider-policy:
    type: "COMPOSITE"
    authentication:
      # first resolve signature, then resolve basic-auth
      - name: "http-signatures"
        flag: "OPTIONAL"
      # must be present
      - name: "http-basic-auth"
  providers:
    # Signatures
    - http-signatures:
        # only inbound configured, no outbound calls
        inbound:
          keys:
            - key-id: "service1-hmac"
              principal-name: "Service1 - HMAC signature"
              hmac.secret: "${CLEAR=changeit}"
            - key-id: "service1-rsa"
              principal-name: "Service1 - RSA signature"
              public-key:
                keystore:
                  # path to keystore
                  resource.path: "src/main/resources/keystore.p12"
                  # Keystore type
                  # PKCS12 or JKS
                  # defaults to jdk default
                  # keystore-type: "PKCS12"
                  # password of the keystore
                  passphrase: "changeit"
                  # alias of the certificate to get public key from
                  cert.alias: "service_cert"
    # Security provider - basic authentication (supports roles)
    - http-basic-auth:
        realm: "helidon"
        users:
          - login: "jack"
            password: "${CLEAR=changeit}"
            roles: [ "user", "admin" ]
          - login: "jill"
            password: "${CLEAR=changeit}"
            roles: [ "user" ]
          - login: "john"
            password: "${CLEAR=changeit}"
            roles: []
  web-server:
    # Configuration of integration with web server
    defaults:
      authenticate: true
    paths:
      - path: "/service2"
        roles-allowed: [ "user" ]
      - path: "/service2-rsa"
        roles-allowed: [ "user" ]