#
# Copyright (c) 2016, 2018 Oracle and/or its affiliates. All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#


security:
  config:
    # Configuration of secured config (encryption of passwords in property files)
    # Set to true for production - if set to true, clear text passwords will cause failure
    require-encryption: false
  providers:
    - http-basic-auth:
        realm: "mic"
        users:
          - login: "jack"
            password: "${CLEAR=jackIsGreat}"
            roles: ["user", "admin"]
          - login: "jill"
            password: "${CLEAR=password}"
            roles: ["user"]
          - login: "john"
            password: "${CLEAR=password}"
    - abac:
  web-server:
    defaults:
      query-params:
        - name: "jwt"
          header: "BEARER_TOKEN"
          # looking for first matching group
          token-regexp: "bearer (.*)"
          # optional alternative - using a prefix
          # prefix: "bearer "
        - name: "name"
          header: "NAME_FROM_REQUEST"
    paths:
      - path: "/query"
        audit: true
      - path: "/noRoles"
        methods: ["get"]
        authenticate: true
      - path: "/user[/{*}]"
        methods: ["get"]
        # implies authentication and authorization
        roles-allowed: ["user"]
      - path: "/admin"
        methods: ["get"]
        roles-allowed: ["admin"]
      - path: "/deny"
        methods: ["get"]
        roles-allowed: ["deny"]
      - path: "/auditOnly"
        # method - any
        # audit all methods (by default GET and HEAD are not audited)
        audit: true
        audit-event-type: "unit_test"
        audit-message-format: "Unit test message format"
