#
# Copyright (c) 2018, 2020 Oracle and/or its affiliates.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

mp.jwt.verify.publickey.location: "verify-jwk.json"

security:
  jersey.analyzers:
    mp-jwt-auth:
      auth-method-mapping:
        - key: "MP-JWT"
          provider: "mp-jwt-auth"
        - key: "BASIC"
          provider: "http-basic-auth"
  providers:
    - mp-jwt-auth:
        # Token extraction
        atn-token:
          # Expected audience (if not defined, any audience is accepted - security issue...)
          jwt-audience: "audience.application.id"
          default-key-id: "verify-rsa"
        sign-token:
          # JWK configuration (where to get keys for signatures)
          # This is defined only once, as we can have more keys in a single jwk
          jwk.resource.resource-path: "sign-jwk.json"
          jwt-issuer: "jwt.example.com"
          outbound:
            - name: "rsa"
              paths:
                - "/rsa"
              # if we want to create a new token based on current subject
              # we need the key to sign
              jwk-kid: "sign-rsa"
              jwt-kid: "verify-rsa"
              jwt-audience: "audience.application.id"
              # notBefore = now - jwt-not-before-seconds
              # defaults to 5 seconds
              jwt-not-before-seconds: 60
              # expiration = now + jwt-validity-seconds
              # defaults to 1 day
              jwt-validity-seconds: 3600
              # defaults to the same as inbound
              outbound-token:
                header: "Authorization"
                format: "bearer %1$s"
            - name: "ec"
              paths:
                - "/ec"
              jwk-kid: "sign-ec"
              jwt-kid: "verify-ec"
              jwt-audience: "audience.application.id"
            - name: "oct"
              paths:
                - "/oct"
              jwk-kid: "sign-oct"
              jwt-kid: "verify-oct"
              jwt-audience: "audience.application.id"
            - name: "asIs"
              paths:
                - "/asis"
    - abac: