#
# Copyright (c) 2018, 2024 Oracle and/or its affiliates.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

security:
  provider-policy:
    type: "COMPOSITE"
    authentication:
    - name: "http-basic-auth"
    outbound:
    - name: "jwt"
  providers:
  - http-basic-auth:
      users:
      - login: "john"
        password: "changeit"
        roles: ["admin"]
      - login: "jack"
        password: "changeit"
        roles: ["user", "admin"]
      - login: "jill"
        password: "changeit"
        roles: ["user"]
  - jwt:
      allow-impersonation: true
      atn-token:
        # we are not interested in inbound tokens
        verify-signature: false
      sign-token:
        jwk.resource.resource-path: "signing-jwk.json"
        jwt-issuer: "example.helidon.io"
        outbound:
        - name: "propagate-identity"
          jwk-kid: "example"
          jwt-kid: "helidon"
          jwt-audience: "http://example.helidon.io"
          outbound-token:
            header: "Authorization"
            format: "bearer %1$s"
          outbound:
            - name: "propagate-all"
  web-server:
    defaults:
      authenticate: true
    paths:
    - path: "/propagate"
      methods: ["get"]
      roles-allowed: "user"
    - path: "/override"
      methods: ["get"]
      roles-allowed: "user"