#
# Copyright (c) 2018, 2024 Oracle and/or its affiliates.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

server:
  port: 7987
  features:
    security:
      # protected paths on the web server - do not include paths served by Jersey, as those are protected directly
      paths:
        - path: "/rest/profile"
          methods: [ "get" ]
          authenticate: true
          roles-allowed: [ "my_admins" ]
          # abac:
          # scopes: ["first_scope", "second_scope"]

security:
  config.require-encryption: false
  properties:
    # This is a nice way to be able to override this with local properties or env-vars
    idcs-uri: "https://your-tenant-id.identity.oracle.com"
    idcs-client-id: "your-client-id"
    idcs-client-secret: "${CLEAR=changeit}"
    proxy-host: ""
  providers:
  - abac:
    # Adds ABAC Provider - it does not require any configuration
  - oidc:
      client-id: "${security.properties.idcs-client-id}"
      client-secret: "${security.properties.idcs-client-secret}"
      identity-uri: "${security.properties.idcs-uri}"
      # A prefix used for custom scopes
      scope-audience: "http://localhost:7987/test-application"
      proxy-host: "${security.properties.proxy-host}"
      # Used as a base for redirects back to us (based on Host header now, so no need to explicitly define it)
      # If explicitly defined, will override host header
      # frontend-uri: "http://localhost:7987"
      # support for non-public signature JWK (and maybe other IDCS specific handling)
      server-type: "idcs"
      logout-enabled: true
      # Can define just a path, host will be taken from header
      post-logout-uri: "/loggedout"
      # We want to redirect to login page (and token can be received either through cookie or header)
      redirect: true
  - idcs-role-mapper:
      multitenant: false
      oidc-config:
        # we must repeat IDCS configuration, as in this case
        # IDCS serves both as open ID connect authenticator and
        # as a role mapper. Using minimal configuration here
        client-id: "${security.properties.idcs-client-id}"
        client-secret: "${security.properties.idcs-client-secret}"
        identity-uri: "${security.properties.idcs-uri}"

