#
# Copyright (c) 2016, 2018 Oracle and/or its affiliates. All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#


# Full web server security integration
security:
  # Section for configuration of web server
  web-server:
    # Executor service used by security (as web server doesn't give us any)
    # for asynchronous processing (accessible through SecurityRequest.getExecutorService())
    # The following section shows the defaults (we use java.util.concurrent.ThreadPoolExecutor)
    executor-service:
      # Number of threads in the core pool size
      core-pool-size: 10
      # Maximal thread pool size
      max-pool-size: 50
      # How often to check pool to decrease # of threads
      keep-alive-minutes: 3
      # Capacity of the queue (we use LinkedBlockingQueue)
      queue-capacity: 10000
      # Are the threads in the thread pool daemon threads?
      is-daemon: true
      # Name of the thread is constructed as thread-name-prefix<counter>
      thread-name-prefix: "security-"
      # Whether to prestart core threads when the pool is created
      should-prestart: true
    # Defaults for all protected paths
    defaults:
      # whether to authenticate (defaults to false)
      authenticate: true
      # whether to authorize (defaults to false)
      authorize: true
      # list of roles allowed to access this path
      roles-allowed: ["role1", "role2"]
      # name of authentication provider - if not defined, default provider is used
      authenticator: "nameOfProvider"
      # name of authorization provider - if not defined, default provider is used
      authorizer: "nameOfProvider"
      # if set to true, failed authentication is ignored and processing proceeds as anonymous
      authentication-optional: true
      # audit all methods (by default GET and HEAD are not audited)
      audit: true
      # type of audit event to use - see @Audited annotation for default
      audit-event-type: "unit_test"
      # message format of audit event - see @Audited annotation for default
      audit-message-format: "Unit test message format"
      # query parameters will be extracted from request
      # and sent to authentication and authorization providers
      # as headers. These will NOT be available to application
      # as headers.
      query-params:
        - name: "jwt"
          header: "BEARER_TOKEN"
          # looking for first matching group
          token-regexp: "bearer (.*)"
          # optional alternative - using a prefix
          # prefix: "bearer "
        - name: "name"
          header: "NAME_FROM_REQUEST"
    # Paths that have some security restrictions
    paths:
      - path: "/path"
        # HTTP method(s) this will be applied to, if not defined, any is used
        methods: ["get"]
        # and now we can override any default specified above (or define a property not defined in defaults)
        roles-allowed: ["role2"]
        query-params:
          - name: "queryParam"
            header: "someHeader"
            prefix: "prefix_"
