#
# Copyright (c) 2017, 2020 Oracle and/or its affiliates.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#


# Full configuration of JWT provider
jwt:
  # Token extraction
  atn-token:
    # JWK configuration (where to get keys for verification/signatures)
    # either of the following (as defined in Resource utility):
    jwk.resource.resource-path: "verify-jwk.json"
    # Expected audience (if not defined, any audience is accepted - security issue...)
    jwt-audience: "audience.application.id"
  sign-token:
    # JWK configuration (where to get keys for signatures)
    # This is defined only once, as we can have more keys in a single jwk
    jwk.resource.resource-path: "sign-jwk.json"
    jwt-issuer: "jwt.example.com"
    outbound:
      - name: "rsa"
        paths:
          - "/rsa"
        # if we want to create a new token based on current subject
        # we need the key to sign
        jwk-kid: "sign-rsa"
        jwt-kid: "verify-rsa"
        jwt-audience: "audience.application.id"
        # notBefore = now - jwt-not-before-seconds
        # defaults to 5 seconds
        jwt-not-before-seconds: 60
        # expiration = now + jwt-validity-seconds
        # defaults to 1 day
        jwt-validity-seconds: 3600
        # defaults to the same as inbound
        outbound-token:
          header: "Authorization"
          format: "bearer %1$s"
      - name: "ec"
        paths:
          - "/ec"
        jwk-kid: "sign-ec"
        jwt-kid: "verify-ec"
        jwt-audience: "audience.application.id"
      - name: "oct"
        paths:
          - "/oct"
        jwk-kid: "sign-oct"
        jwt-kid: "verify-oct"
        jwt-audience: "audience.application.id"
      - name: "asIs"
        paths:
          - "/asis"
jwt-no-verification:
  # Token extraction
  atn-token:
    # JWK configuration (where to get keys for verification/signatures)
    # either of the following (as defined in Resource utility):
    # Not needed, as we do not verify signature
    # jwk.resource.resource-path: "verify-jwk.json"
    # Expected audience (if not defined, any audience is accepted - security issue...)
    jwt-audience: "audience.application.id"
    verify-signature: false
  sign-token:
    # JWK configuration (where to get keys for signatures)
    # This is defined only once, as we can have more keys in a single jwk
    jwk.resource.resource-path: "sign-jwk.json"
    jwt-issuer: "jwt.example.com"
    outbound:
      - name: "rsa"
        paths:
          - "/rsa"
        # if we want to create a new token based on current subject
        # we need the key to sign
        jwk-kid: "sign-rsa"
        jwt-kid: "verify-rsa"
        jwt-audience: "audience.application.id"
        # notBefore = now - jwt-not-before-seconds
        # defaults to 5 seconds
        jwt-not-before-seconds: 60
        # expiration = now + jwt-validity-seconds
        # defaults to 1 day
        jwt-validity-seconds: 3600
        # defaults to the same as inbound
        outbound-token:
          header: "Authorization"
          format: "bearer %1$s"
