#
# Copyright (c) 2017, 2018 Oracle and/or its affiliates. All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

security:
  providers:
    - header-atn:
        # Token extraction (and propagation)
        # No default for token extraction
        atn-token:
          # name of header to extract token from (see providers-common module for all options)
          header: "Authorization"
          # or do not specify - then the whole header is considered to be the token value
          prefix: "bearer "

full-config:
  # If set to true, provider will abstain rather than fail if header is not available
  # defaults to false
  optional: true
  # If set to false, not authentication will be attempted
  # If set to false and this is the default provider, authentication will not work
  # defaults to true
  authenticate: true
  # If set to true, identity will be propagated further using the configured header and format
  # The user id from current subject will be propagated
  # defaults to true
  propagate: true
  # Can be USER or SERVICE
  # defaults to USER
  principal-type: USER
  # Token extraction (and propagation)
  # No default for token extraction
  atn-token:
    # name of header to extract token from (see providers-common module for all options)
    header: "Authorization"
    # or do not specify - then the whole header is considered to be the token value
    prefix: "bearer "
    # optional alternative - looking for first matching group
    # regexp: "bearer (.*)"
    # format: "string format to generate outbound token"
  # Optional - if not defined, atn-token config will be used for identity propagation
  outbound-token:
    header: "Custom"
    format: "bearer %1$s"

no-atn-outbound-config:
  authenticate: false
  propagate: false

service-config:
  # Can be USER or SERVICE
  # defaults to USER
  principal-type: SERVICE
  # Token extraction (and propagation)
  # No default for token extraction
  atn-token:
    # name of header to extract token from (see providers-common module for all options)
    header: "Authorization"
    # or do not specify - then the whole header is considered to be the token value
    prefix: "bearer "
