#
# Copyright (c) 2016, 2018 Oracle and/or its affiliates. All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#


security:
  config:
    require-encryption: false
  providers:
    - http-signatures:
        # expected incoming headers
        # if AUTHORIZATION is defined, challenge will be sent if missing
        # if SIGNATURE is defined, no challenge will be sent, only fails authentication
        headers: ["SIGNATURE", "AUTHORIZATION"]
        # if set to optional, challenge will never be sent and provider
        # will abstain if no request signature is available
        optional: true
        realm: "prime"
        # required headers to be signed in request
        # there may be more headers signed, which is OK
        sign-headers:
          # if method is not defined, then this is the default config
          # MUST be present and signed
          - always: ["date"]
          - method: "get"
            # MUST be present and signed
            always: ["date", "(request-target)", "host"]
            # MUST be signed IF present
            if-present: ["authorization"]
        inbound:
          keys:
            - key-id: "rsa-key-12345"
              principal-name: "aUser"
              # Either "Service" or "User", defaults to Service
              # Will create appropriate principal type when constructing security subject
              principal-type: "USER"
              # algorithm to use
              algorithm: "rsa-sha256"
              # RSA public key
              public-key:
                # path to keystore
                keystore-path: "src/test/resources/keystore.p12"
                # Keystore type
                # PKCS12 or JKS
                # defaults to jdk default
                keystore-type: "PKCS12"
                # password of the keystore
                keystore-passphrase: "password"
                # alias of the certificate to get public key from
                cert-alias: "service_cert"
            - key-id: "myServiceKeyId"
              algorithm: "hmac-sha256"
              principal-name: "aSetOfTrustedServices"
              hmac.secret: "${CLEAR=MyPasswordForHmac}"
            # configuration of outbound requests, to sign them
        outbound:
          - name: "first"
            transports: ["http"]
            hosts: ["example.org"]
            paths: ["/my/.*"]
            signature:
              header: "SIGNATURE"
              # required headers to be signed in request
              # there may be more headers signed, which is OK
              sign-headers:
                  # if method is not defined, then this is the default config
                  # MUST be present and signed - for outbound, date and host will
                  # be generated if missing
                - always: ["date", "host", "(request-target)"]
                  # MUST be signed IF present
                  if-present: ["authorization"]
              # defaults to rsa-sha256 if private-key configured
              # algorithm: "rsa-sha256"
              key-id: "rsa-key-12345"
              private-key:
                # path to keystore
                keystore-path: "src/test/resources/keystore.p12"
                # Keystore type
                # PKCS12, JSK or RSA (not really a keystore, but directly the linux style private key unencrypted)
                # defaults to jdk default
                keystore-type: "PKCS12"
                # password of the keystore
                keystore-passphrase: "password"
                # alias of the key to sign request
                key-alias: "myPrivateKey"
                # password of the private key (usually the same as keystore - that's how openssl does it)
                # also defaults to keystore-passphrase
                # key-passphrase: "password"
          - name: "second"
            transports: ["http"]
            hosts: ["localhost"]
            paths: ["/second/.*"]
            signature:
              key-id: "myServiceKeyId"
              header: "SIGNATURE"
              # defaults to hmac-sha256 if hmac configured
              # algorithm: "hmac-sha256"
              hmac.secret: "${CLEAR=MyPasswordForHmac}"
