#
# Copyright (c) 2018 Oracle and/or its affiliates. All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

security:
  config.require-encryption: false
  properties:
    # This is a nice way to be able to override this with local properties or env-vars
    idcs-uri: "https://your-tenant-id.identity.oracle.com"
    idcs-client-id: "your-client-id"
    idcs-client-secret: "${CLEAR=your-client-secret}"
    # Used as a base for redirects back to us
    frontend-uri: "http://localhost:7987"
    proxy-host: ""
  providers:
  - abac:
  - oidc:
      client-id: "${ALIAS=security.properties.idcs-client-id}"
      client-secret: "${ALIAS=security.properties.idcs-client-secret}"
      identity-uri: "${ALIAS=security.properties.idcs-uri}"
      # A prefix used for custom scopes
      scope-audience: "http://localhost:7987/test-application"
      proxy-host: "${ALIAS=security.properties.proxy-host}"
      frontend-uri: "${ALIAS=security.properties.frontend-uri}"
  - idcs-role-mapper:
      oidc-config:
        # we must repeat IDCS configuration, as in this case
        # IDCS serves both as open ID connect authenticator and
        # as a role mapper. Using minimal configuration here
        client-id: "${ALIAS=security.properties.idcs-client-id}"
        client-secret: "${ALIAS=security.properties.idcs-client-secret}"
        identity-uri: "${ALIAS=security.properties.idcs-uri}"
      cache-config:
        cache-timeout-millis: 100000
  web-server:
    # protected paths on the web server - do not include paths served by Jersey, as those are protected directly
    paths:
    - path: "/rest/profile"
      methods: ["get"]
      authenticate: true
