### Standalone server

The standalone server will default to port `8080` and can be started by invoking `main()` in `StandaloneMockOAuth2Server.kt` (in kotlin) or `StandaloneMockOAuth2ServerKt` (in Java)

On Windows, it's easier to run the server in docker while specifying the host as localhost, e.g. `docker run -p 8080:8080 -h localhost $IMAGE_NAME`

> **Note**
> If you want to check if the server is up and running you can visit `/isalive` and see if you get a 200 in return.

#### Configuration

The standalone server supports the following configuration by `ENV` variables:

| Variable | Description |
|-------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `SERVER_HOSTNAME` | Lets the standalone server bind to a specific hostname, by default it binds to `0.0.0.0` |
| `SERVER_PORT` or `PORT` | The port that the standalone server will listen to, defaults to `8080`. The `PORT` environment variable may be used to [run the Docker image on Heroku](https://devcenter.heroku.com/articles/container-registry-and-runtime#pushing-an-existing-image) as per the documentation [here](https://devcenter.heroku.com/articles/setting-the-http-port-for-java-applications). |
| `JSON_CONFIG_PATH` | The absolute path to a json file containing configuration about the OAuth2 part of the server (`OAuth2Config`). More details on the format below. |
| `JSON_CONFIG` | The actual JSON content of `OAuth2Config`, this ENV var takes precedence over the `JSON_CONFIG_PATH` var. More details on the format below. |
| `LOG_LEVEL` | How verbose the root logging output is, defaults to `INFO` |
| `LOGBACK_CONFIG` | You can override the default logging config in [logback-standalone.xml](src/main/resources/logback-standalone.xml) with a path to your own logback xml file. |

##### JSON_CONFIG

The JSON_CONFIG lets you configure the contents of the [`OAuth2Config`](src/main/kotlin/no/nav/security/mock/oauth2/OAuth2Config.kt) class using JSON.

Example:
```json
{
"interactiveLogin": true,
"httpServer": "NettyWrapper",
"tokenCallbacks": [
{
"issuerId": "issuer1",
"tokenExpiry": 120,
"requestMappings": [
{
"requestParam": "scope",
"match": "scope1",
"claims": {
"sub": "subByScope",
"aud": [
"audByScope"
]
}
}
]
},
{
"issuerId": "issuer2",
"requestMappings": [
{
"requestParam": "someparam",
"match": "somevalue",
"claims": {
"sub": "subBySomeParam",
"aud": [
"audBySomeParam"
]
}
}
]
}
]
}
```

A token provider can support different `signing` algorithms. Configure your token provider and
add this to your config with preferred `JWS algorithm`:

```json
{
"tokenProvider" : {
"keyProvider" : {
"algorithm" : "ES256"
}
}
}
```

A token provider can also support a static "systemTime", i.e. the time for when the token is issued (`iat` claim) if you have tests that require a specific time.
The following configuration will set the system time to `2020-01-21T00:00:00Z`:

```json
{
"tokenProvider" : {
"systemTime" : "2020-01-21T00:00:00Z"
}
}
```

| Property | Description |
|----------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `interactiveLogin` | `true` or `false`, enables login screen when redirecting to server `/authorize` endpoint |
| `loginPagePath` | An optional string refering to a html file that is served as login page. This page needs to contain a form that posts a `username` and optionally a `claims` field. See `src/test/resource/login.example.html` as an example. |
| `staticAssetsPath` | The path to a directory containing static resources/assets. Lets you serve your own static resources from the server. Resources are served under the `/static` URL path. E.g. http://localhost:8080/static/myimage.svg or by reference `/static/myimage.svg` from the login page. | |
| `rotateRefreshToken` | `true` or `false`, setting to true will generate a new unique refresh token when using the `refresh_token` grant. |
| `httpServer` | A string identifying the httpserver to use. Must match one of the following enum values: `MockWebServerWrapper` or `NettyWrapper` |
| `tokenCallbacks` | A list of [`RequestMappingTokenCallback`](src/main/kotlin/no/nav/security/mock/oauth2/token/OAuth2TokenCallback.kt) that lets you specify which token claims to return when a token request matches the specified condition. |

*From the first JSON example above:*

A token request to `http://localhost:8080/issuer1/token` with parameter `scope` equal to `scope1` will match the first `tokenCallback`:

```json
{
"issuerId": "issuer1",
"tokenExpiry": 120,
"requestMappings": [
{
"requestParam": "scope",
"match": "scope1",
"claims": {
"sub": "subByScope",
"aud": [
"audByScope"
]
}
}
]
}
```

and return a token response containing a token with the following claims:

```json
{
"sub": "subByScope",
"aud": "audByScope",
"nbf": 1616416942,
"iss": "http://localhost:54905/issuer1",
"exp": 1616417062,
"iat": 1616416942,
"jti": "28697333-6f25-4b1f-b2c2-409ce010933a"
}
```

Use variable `clientId` to set `sub` claim for Client Credentials Grant dynamically.

A token request with client credentials where `clientId = myClientId` and `tokenCallback`:
```json
{
"issuerId": "issuer1",
"tokenExpiry": 120,
"requestMappings": [
{
"requestParam": "scope",
"match": "scope1",
"claims": {
"sub": "${clientId}",
"aud": [
"audByScope"
]
}
}
]
}
```
will return a token response containing a token with the following claims:

```json
{
"sub": "myClientId",
"aud": "audByScope",
"nbf": 1616416942,
"iss": "http://localhost:54905/issuer1",
"exp": 1616417062,
"iat": 1616416942,
"jti": "28697333-6f25-4b1f-b2c2-409ce010933a"
}
```

#### Docker

Build to local docker daemon

```gradle
./gradlew -Djib.from.platforms=linux/amd64 jibDockerBuild # or alternatively -Djib.from.platforms=linux/arm64 for ARM64
```

Run container

```gradle
docker run -p 8080:8080 $IMAGE_NAME
```

#### Docker-Compose

In order to get container-to-container networking to work smoothly alongside browser interaction you must specify a host entry in your `hosts` file, `127.0.0.1 host.docker.internal` and set `hostname` in the **mock-oauth2-server** service in your `docker-compose.yaml` file:

```yaml
version: '3.7'
services:
your_app:
build: .
ports:
- 8080:8080
mock-oauth2-server:
image: ghcr.io/navikt/mock-oauth2-server:$MOCK_OAUTH2_SERVER_VERSION
ports:
- 8080:8080
hostname: host.docker.internal
```

#### Debugger

The debugger is a OAuth2 client implementing the `authorization_code` flow with a UI for debugging (e.g. request parameters).
Point your browser to [http://localhost:8080/default/debugger](http://localhost:8080/default/debugger) to check it out.

### Enabling HTTPS

In order to enable HTTPS you can either provide your own keystore or let the server generate one for you.

#### Unit tests

You need to supply the server with an SSL config, in order to do that you must specify your chosen server type in `OAuth2Config` and
pass in the SSL config to your server.

*Generate keystore:*
```kotlin
val ssl = Ssl()
val server = MockOAuth2Server(
OAuth2Config(httpServer = MockWebServerWrapper(ssl))
)
```
*This will generate a SSL certificate for `localhost` and can be added to your client's truststore by getting the ssl config:
`ssl.sslKeystore.keyStore`*

*Bring your own:*
```kotlin
val ssl = Ssl(
SslKeystore(
keyPassword = "",
keystoreFile = File("src/test/resources/localhost.p12"),
keystorePassword = "",
keystoreType = SslKeystore.KeyStoreType.PKCS12
)
)
val server = MockOAuth2Server(
OAuth2Config(httpServer = MockWebServerWrapper(ssl))
)
```

#### Docker / Standalone mode - JSON_CONFIG

In order to enable HTTPS for the server in Docker or standalone mode
you can either make the server generate the keystore or bring your own.

*Generate keystore:*

```json
{
"httpServer" : {
"type" : "NettyWrapper",
"ssl" : {}
}
}
```

*Bring your own:*

```json

{
"httpServer" : {
"type" : "NettyWrapper",
"ssl" : {
"keyPassword" : "",
"keystoreFile" : "src/test/resources/localhost.p12",
"keystoreType" : "PKCS12",
"keystorePassword" : ""
}
}
}
```

## Upgrading the gradle wrapper
Find the newest version of gradle here: https://gradle.org/releases/
Then run this command:
```./gradlew wrapper --gradle-version $gradleVersion```

Remeber to also update the gradle version in the build.gradle.kts file
``` gradleVersion = "$gradleVersion"```

## 👥 Contact

This project is currently maintained by the organisation [@navikt](https://github.com/navikt).

If you need to raise an issue or question about this library, please create an issue here and tag it with the appropriate label.

For contact requests within the [@navikt](https://github.com/navikt) org, you can use the Slack channel #pig_sikkerhet

If you need to contact anyone directly, please see contributors.

## ✏️ Contributing

To get started, please fork the repo and checkout a new branch. You can then build the library with the Gradle wrapper

```shell script
./gradlew build
```

See more info in [CONTRIBUTING.md](CONTRIBUTING.md)

## ⚖️ License
This library is licensed under the [MIT License](LICENSE.md)