#
# Copyright (c) 2017, 2018 Oracle and/or its affiliates. All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#


# Full configuration of JWT provider
security:
  providers:
    - jwt:
        # If set to true, provider will abstain rather than fail if header is not available
        # defaults to false
        optional: true
        # If set to false, no authentication will be attempted
        # If set to false and this is the default provider, authentication will not work
        # defaults to true
        authenticate: true
        # If set to true, identity will be propagated further using the configured header and format
        # The user id from current subject will be propagated
        # defaults to true
        propagate: true
        # Can be USER or SERVICE
        # defaults to USER
        principal-type: USER
        # Token extraction
        atn-token:
          # JWK configuration (where to get keys for verification/signatures)
          # either of the following (as defined in Resource utility):
          jwk-path: "/filesystem/path/of/jwk"
          jwk-resource-path: "classpath/resource"
          jwk-url: "http://url/of/jwk"
          jwk-content-plain: "{}"
          jwk-content: "base64"
          handler:
            # name of header to extract token from (see providers-common module for all options), defaults to "Authorization"
            header: "Authorization"
            # or do not specify - then the whole header is considered to be the token value, defaults to "bearer "
            prefix: "bearer "
            # optional alternative - looking for first matching group
            # regexp: "bearer (.*)"
            # format: "string format to generate outbound token"
        # Optional - if not defined, atn-token config will be used for identity propagation (and the same token will be
        # propagated)
        sign-token:
          # JWK configuration (where to get keys for signatures)
          # This is defined only once, as we can have more keys in a single jwk
          # either of the following:
          jwk-path: "/filesystem/path/of/jwk"
          jwk-resource-path: "classpath/resource"
          jwk-url: "http://url/of/jwk"
          jwk-content-plain: "{}"
          jwk-content: "base64"
          jwt-issuer: "issuer.of.JWT"
          # Used by OutboundConfig
          outbound:
            - name: "internal-service"
              transports:
                - "http"
                - "https"
              hosts:
                - "*.oracle.com"
              paths:
                - "*"
              # if we want to create a new token based on current subject
              # we need the key to sign - if the following is not present
              # we just propagate existing token
              jwk-kid: "key-id-to-use"
              jwt-kid: "key-id-to-put-to-jwt"
              jwt-audience: "audience"
              # notBefore = now - jwt-not-before-seconds
              # defaults to 5 seconds
              jwt-not-before-seconds: 60
              # expiration = now + jwt-validity-seconds
              # defaults to 1 day
              jwt-validity-seconds: 3600
              # defaults to the same as inbound
              outbound-token:
                header: "Custom"
                format: "bearer %1$s"
