# ============================================================================
# OAuth / Authentication Configuration
# ============================================================================
# Two configuration modes are supported:
#
# MODE 1 (Recommended): Discovery-Based Auto-Configuration
#   - Set APPMOD_AUTH_ENABLED=true, TA_AUTH_OIDC_ISSUER, and provide
#     Client ID / Secret when prompted at install time
#   - OAuth endpoints will be automatically populated from the OIDC
#     discovery document
#   - Works with modern OAuth providers (Keycloak, Okta, Azure AD, PingOne, etc.)
#
# MODE 2: Manual Configuration (for legacy OAuth systems)
#   - Set APPMOD_AUTH_ENABLED=true and configure all endpoint variables below
#   - Use when your OAuth provider doesn't support OIDC discovery
# ============================================================================

# Enable/Disable Authentication
APPMOD_AUTH_ENABLED=false                                                # set to true to enable authentication

# Note: AMA_RBAC_ENABLED and AMA_AUDIT_ENABLED are automatically managed
# when running Application Modernization Accelerator.
# They are NOT set when running Transformation Advisor.
# AMA_RBAC_ENABLED defaults to false for AMA
AMA_RBAC_ENABLED=false
# AMA_AUDIT_ENABLED defaults to false for AMA
AMA_AUDIT_ENABLED=false

# ============================================================================
# REQUIRED: OAuth Client Credentials (both modes)
# ============================================================================
# TA_AUTH_OIDC_CLIENT_ID and TA_AUTH_OIDC_CLIENT_SECRET are intentionally
# omitted here. When APPMOD_AUTH_ENABLED=true, launch.sh will prompt you for
# these values and store them securely as Podman secrets.

# TA_AUTH_OIDC_CALLBACK_URI is required for OAuth login redirect handling.
# If left empty, installation will derive it from TA_PUBLIC_ACCESSIBLE_UI_URL
# after .env has been fully resolved.
TA_AUTH_OIDC_CALLBACK_URI=

# ============================================================================
# OPTIONAL: OIDC Issuer URL (enables auto-population - MODE 1)
# ============================================================================
# If set, the system will attempt to fetch the OIDC discovery document from:
#   {TA_AUTH_OIDC_ISSUER}/.well-known/openid-configuration
# and automatically populate all OAuth endpoint variables below.
#
# Examples:
#   Keycloak:       TA_AUTH_OIDC_ISSUER=https://keycloak.example.com/realms/myrealm
#   Okta:           TA_AUTH_OIDC_ISSUER=https://your-org.okta.com
#   Azure AD:       TA_AUTH_OIDC_ISSUER=https://login.microsoftonline.com/your-tenant-id/v2.0
#   PingOne:        TA_AUTH_OIDC_ISSUER=https://auth.pingone.com/your-env-id/as
#   PingFederate:   TA_AUTH_OIDC_ISSUER=https://pingfederate.example.com:9031
#
TA_AUTH_OIDC_ISSUER=

# ============================================================================
# MANUAL ENDPOINT CONFIGURATION (MODE 2)
# ============================================================================
# These variables are OPTIONAL if TA_AUTH_OIDC_ISSUER is set and discovery succeeds.
# They are REQUIRED if:
#   - TA_AUTH_OIDC_ISSUER is not set, OR
#   - Your OAuth provider doesn't support OIDC discovery, OR
#   - You want to override auto-discovered values
#
# Uncomment and configure these variables for manual configuration:
# ============================================================================

#TA_AUTH_IDENTITY_REQUEST_ENDPOINT=https://account.example.com          # endpoint to request identity of the OAuth2 Server, no trailing /
#TA_AUTH_IDENTITY_REQUEST_ENDPOINT_PATH=/api/oauth2/authorize           # path of the endpoint to request identity to OAuth2 Server, with leading /
#TA_AUTH_IDENTITY_REQUEST_ENDPOINT_SCOPE=openid                         # OAuth2 scope
#TA_AUTH_CALLBACK_STATE_PREFIX_PADDING=                                 # some OAuth2 state requires minimum length, default to empty

#TA_AUTH_TOKEN_REQUEST_ENDPOINT=https://api.example.com                 # endpoint to request token of the OAuth2 Server, no trailing /
#TA_AUTH_TOKEN_REQUEST_ENDPOINT_PATH=/oauth2/token                      # path of the endpoint to request token of the OAuth2 Server, with leading /

#TA_AUTH_TOKEN_VERIFICATION_ENDPOINT=https://api.example.com            # endpoint to verify tokens of the OAuth2 Server, no trailing /
#TA_AUTH_TOKEN_VERIFICATION_ENDPOINT_PATH=/oauth2/userinfo              # path to the endpoint to verify tokens of the OAuth2 Server, with leading /

#TA_AUTH_TOKEN_REVOCATION_ENDPOINT=https://api.example.com              # endpoint to revoke tokens of the OAuth2 Server, no trailing /
#TA_AUTH_TOKEN_REVOCATION_ENDPOINT_PATH=/oauth2/revoke                  # path to the endpoint to revoke tokens of the OAuth2 Server, with leading /

#TA_AUTH_END_SESSION_ENDPOINT=https://api.example.com                   # endpoint to end session of the OAuth2 Server, no trailing /
#TA_AUTH_END_SESSION_ENDPOINT_PATH=/oauth2/logout                       # path to the endpoint to end session of the OAuth2 Server, with leading /

#TA_OCP_API_ENDPOINT=https://api.example.com                            # required only if the token revocation endpoint points to OpenShift Container Platform, no trailing /
