#
# Copyright (c) 2016, 2018 Oracle and/or its affiliates. All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

security {
    config {
        # Configuration of secured config (encryption of passwords in property files)

        # Set to true for production - if set to true, clear text passwords will cause failure
        require-encryption = false
    }

    # composite provider policy
    provider-policy {
        type = "COMPOSITE"
        authentication: [
            {
                # first resolve signature, then resolve basic-auth
                name = "http-signatures"
                flag = "OPTIONAL"
            },
            {
                # must be present
                name = "http-basic-auth"
            }
        ]
    }

    providers: [
        {
            # Signatures
            http-signatures {
                # only inbound configured, no outbound calls
                inbound {
                    keys: [
                        {
                            key-id = "service1-hmac"
                            principal-name = "Service1 - HMAC signature"
                            hmac.secret = "${CLEAR=somePasswordForHmacShouldBeEncrypted}"
                        },
                        {
                            key-id = "service1-rsa"
                            principal-name = "Service1 - RSA signature"
                            public-key {
                                # path to keystore
                                keystore-path = "src/main/resources/keystore.p12"
                                # Keystore type
                                # PKCS12 or JKS
                                # defaults to jdk default
                                # keystore-type = "PKCS12"
                                # password of the keystore
                                keystore-passphrase = "password"
                                # alias of the certificate to get public key from
                                cert-alias = "service_cert"
                            }
                        }
                    ]
                }
            }
        }
        # Security provider - basic authentication (supports roles)
        {
            http-basic-auth {
                realm = "mic"

                users: [
                    {
                        login = "jack"
                        password = "${CLEAR=password}"
                        roles = ["user", "admin"]

                    },
                    {
                        login = "jill"
                        # master password is "jungle", password is "password"
                        password = "${CLEAR=password}"
                        roles = ["user"]
                    },
                    {
                        login = "john"
                        password = "${CLEAR=password}"
                        roles = []
                    }
                ]
            }
        },

    ]

    web-server {
        # Configuration of integration with web server
        defaults {
            authenticate = true
        }
        paths: [
            {
                path = "/service2"
                roles-allowed = ["user"]
            },
            {
                path = "/service2-rsa"
                roles-allowed = ["user"]
            }
        ]
    }
}
