#
# Copyright (c) 2017, 2018 Oracle and/or its affiliates. All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#


# Full configuration of header authentication provider
security:
  providers:
    - header-atn:
        # If set to true, provider will abstain rather than fail if header is not available
        # defaults to false
        optional: true
        # If set to false, not authentication will be attempted
        # If set to false and this is the default provider, authentication will not work
        # defaults to true
        authenticate: true
        # If set to true, identity will be propagated further using the configured header and format
        # The user id from current subject will be propagated
        # defaults to true
        propagate: true
        # Can be USER or SERVICE
        # defaults to USER
        principal-type: USER
        # Token extraction (and propagation)
        # No default for token extraction
        atn-token:
          # name of header to extract token from (see providers-common module for all options)
          header: "Authorization"
          # or do not specify - then the whole header is considered to be the token value
          prefix: "bearer "
          # optional alternative - looking for first matching group
          # regexp: "bearer (.*)"
          # format: "string format to generate outbound token"
        # Optional - if not defined, atn-token config will be used for identity propagation
        outbound-token:
          header: "Custom"
          format: "bearer %1$s"
