#
# Copyright (c) 2016, 2018 Oracle and/or its affiliates. All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

security {
    config {
        # Configuration of secured config (encryption of passwords in property files)

        # Set to true for production - if set to true, clear text passwords will cause failure
        require-encryption = false
    }

    providers: [
        # Security provider - digest authentication (supports roles)
        {
            http-digest-auth {
                realm = "mic"
                server-secret = "aPassword"
                users: [
                    {
                        login = "jack"
                        password = "${CLEAR=password}"
                        roles = ["user", "admin"]

                    },
                    {
                        login = "jill"
                        # master password is "jungle", password is "password"
                        password = "${CLEAR=password}"
                        roles = ["user"]
                    },
                    {
                        login = "john"
                        password = "${CLEAR=password}"
                        roles = []
                    }
                ]
            }
        }
    ]

    web-server {
        # Configuration of integration with web server
        defaults {
            authenticate = true
        }
        paths: [
            {
                path = "/noRoles"
                methods = ["get"]
            },
            {
                path = "/user[/{*}]"
                methods = ["get"]
                roles-allowed = ["user"]
            },
            {
                path = "/admin"
                methods = ["get"]
                roles-allowed = ["admin"]
            },
            {
                path = "/deny"
                methods = ["get"]
                roles-allowed = ["deny"]
                audit = true
            },
            {
                path = "/noAuthn"
                roles-allowed = ["admin"]
                authentication-optional = true
                audit = true
            }
        ]
    }
}
