#
# This file is part of the OpenID Connect-based authentication for Squash TM (security-openid-connect) project.
# Copyright (C) 2023 Henix, henix.fr - All Rights Reserved
#
# Unauthorized copying of this file, via any medium is strictly prohibited
# Proprietary and confidential
#

#################################################
#									        	#
#   Squash OpenId Connect plugin configuration	#
#									        	#
#################################################


# 1/ What is this ?
# -------------------------------
# This file contains the main configuration of the Squash OpenId Connect plugin. Every configurable property is listed
# here and documented.

# 2/ Installing the configuration
# --------------------------------
# Squash TM will find the configuration if you do one of the following :
#
# a - Since TM 1.18 : copy this file in Squash TM config directory (next to squash.tm.cfg.properties), then reference it
# by setting the property 'spring.profiles.include=openid-connect' in the main file squash.tm.cfg.properties. If a value is
# already defined there you can simply append 'openid-connect' to the list, using a comma ',' as separator.
#
# b - The old way : copy the content of this file in the main configuration file squash.tm.cfg.properties.
#
# These are the simplest options to configure Squash, but there are other ways to provide Squash TM with the configuration.
# Being a Spring Boot-based application Squash TM supports several alternate configuration inlets : see
# https://docs.spring.io/spring-boot/docs/current/reference/html/boot-features-external-config.html.

# 3/ Short lexicon
# --------------------------------
# Throughout this file the following definition will apply :
#
# IDP :         Identity Provider
# SP :          Service Provider, ie Squash in our case.
# * :           Represents any value
#
# Values should NOT be surrounded by single nor double quotes although some examples might quote the sample value for
# clarity. When reusing an example, the XXX values should be replaced with the lowercase name of the IDP. If the name
# contains multiple words, an underscore ( _ ) should be used as a separator
# Ex: microsoft_azure


# ---------- MAIN CONFIGURATION -------------

# This section shows the main configuration properties for the Squash TM plugin,
# distinct from the configuration of the chosen IDP.

# By default, access to Squash TM and restriction of users is to be configured directly in the IDP.
# This property handles restriction of access on Squash TM's side in case the IDP does not offer that possibility.
# It verifies that the connecting user's e-mail domain matches one or more of the domain values indicated via this property.
# Several values can be added however, they must be separated by commas ( , ) with no spaces between the values.
# If this property is left blank, no restrictions will be applied.
# Example: oidc.access.whitelist=@company-name.com,@domain.fr
# oidc.access.whitelist=

# This property handles Squash TM's behavior in terms of unauthenticated user requests.
# It defines the URL to which the user will be redirected for login, in other words, it sets the main entry point.
# If the set value matches the pattern /oidc/authorization/XXX , the login will be redirected to the specified IDP's
# login page or logged in directly if they are already connected to their IDP.
# Please note that this is a generic Squash TM property and is not exclusive to the OpenId Connect plugin.
# If you also rely on other authentication plugins, please check that this property is not already set in another
# plugin to avoid any conflicts.
# Default value: /login (login page for form-based basic authentication)
# preferred-auth-url=


# ----------------- IDP PROVIDER OPTIONS -----------------------

# The options below allow you to declare a new custom IDP to use with Squash. For default providers (i.e. google,
# facebook, github, okta), some of these properties may be pre-configured and can be omitted.

# The OpenID Connect configuration values for an IDP are often accessible from the provider's
# Well-Known Configuration Endpoint: (issuer-uri)/.well-known/openid-configuration
# For example, if the issuer-uri provided is "https://example.com", then an OpenID Provider Configuration Request will be
# made to "https://example.com/.well-known/openid-configuration". The result is expected to be an OpenID Provider
# Configuration Response

# Set this property to specify which attribute value should be used as a username in Squash (email, etc.)
# spring.security.oauth2.client.provider.XXX.user-name-attribute=

# The issuer identifier formatted as a URL
# spring.security.oauth2.client.provider.XXX.issuer-uri=

# Specifies the IDP endpoint to start the authorization request by identifying the user and obtaining an access code
# spring.security.oauth2.client.provider.XXX.authorization-uri=

# Specifies the endpoint for retrieving access tokens
# spring.security.oauth2.client.provider.XXX.token-uri=

# Specifies the endpoint for retrieving user data
# spring.security.oauth2.client.provider.XXX.user-info-uri

# This Uri allows the user to retrieve the Auth provider's public key to verify JWT tokens
# spring.security.oauth2.client.provider.XXX.jwk-set-uri=


# ----------------- IDP CLIENT OPTIONS -----------------------

# OAuth2 client identifier provided by the IDP on registering your Squash instance
# spring.security.oauth2.client.registration.XXX.client-id=

# OAuth2 client secret provided by the IDP on registering your Squash instance
# spring.security.oauth2.client.registration.XXX.client-secret=

# The OAuth framework specifies several grant types for different use cases, as well as a framework for creating new
# grant types. Squash supports the following grant types: "authorization_code"
# spring.security.oauth2.client.registration.XXX.authorization-grant-type=

# The redirect uri is the URL to which the authentication response will be sent. It must match the redirect uri configured
# in the IDP on registering your Squash instance.
# For Squash, only redirect uris matching the pattern " /oidc/code/* " will be processed
# spring.security.oauth2.client.registration.XXX.redirect-uri=

# The scope defines the information the IDP will provide about the user. The available scopes can vary from one IDP
# to another. OpenId Connect requires the "openid" scope, but additional scopes can be specified.
# spring.security.oauth2.client.registration.XXX.scope=openid

# Customizable name of the IDP client. This value will be displayed on the Squash login page. If this property is omitted,
# display will default to the name of the IDP as specified in the property (instead of XXX in the example below).
# spring.security.oauth2.client.registration.XXX.client-name=


# ----------------- SAMPLE CONFIGURATION WITH GITLAB CUSTOM PROVIDER --------------

# spring.security.oauth2.client.provider.gitlab.authorization-uri=https://gitlab.com/oauth/authorize
# spring.security.oauth2.client.provider.gitlab.token-uri=https://gitlab.com/oauth/token
# spring.security.oauth2.client.provider.gitlab.user-info-uri=https://gitlab.com/oauth/userinfo
# spring.security.oauth2.client.provider.gitlab.user-name-attribute=email
# spring.security.oauth2.client.provider.gitlab.jwk-set-uri=https://gitlab.com/oauth/discovery/keys
# spring.security.oauth2.client.provider.gitlab.issuer-uri=https://gitlab.com
#
# spring.security.oauth2.client.registration.gitlab.client-id= (client id)
# spring.security.oauth2.client.registration.gitlab.client-secret= (client secret)
# spring.security.oauth2.client.registration.gitlab.authorization-grant-type=authorization_code
# spring.security.oauth2.client.registration.gitlab.redirect-uri= (ex: http://localhost:8080/squash/oidc/code/gitlab )
# spring.security.oauth2.client.registration.gitlab.scope=openid,email
# spring.security.oauth2.client.registration.gitlab.client-name=GitLab


# ------------------ ADDITIONAL INFORMATION ----------------------------------

# For direct access to the IDP login page, please note that the authorization endpoints for all IDPs must
# match the following pattern in order for Squash authentication to be handled : /oidc/authorization/XXX
#
# This is separate from authorization-uri which should match the IDP's OpenId Connect documentation exactly



