content: package io.aiven.klaw.config;
  
  import io.aiven.klaw.auth.KwAuthenticationFailureHandler;
  import io.aiven.klaw.auth.KwAuthenticationSuccessHandler;
  import java.util.Properties;
  import lombok.extern.slf4j.Slf4j;
  import org.springframework.beans.factory.annotation.Autowired;
  import org.springframework.beans.factory.annotation.Value;
  import org.springframework.boot.autoconfigure.condition.ConditionalOnExpression;
  import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
  import org.springframework.context.annotation.Bean;
  import org.springframework.context.annotation.Configuration;
  import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
  import org.springframework.security.oauth2.client.endpoint.DefaultAuthorizationCodeTokenResponseClient;
  import org.springframework.security.oauth2.client.endpoint.OAuth2AccessTokenResponseClient;
  import org.springframework.security.oauth2.client.endpoint.OAuth2AuthorizationCodeGrantRequest;
  import org.springframework.security.oauth2.client.registration.ClientRegistration;
  import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
  import org.springframework.security.oauth2.client.web.AuthorizationRequestRepository;
  import org.springframework.security.oauth2.client.web.HttpSessionOAuth2AuthorizationRequestRepository;
  import org.springframework.security.oauth2.client.web.OAuth2AuthorizedClientRepository;
  import org.springframework.security.oauth2.client.web.reactive.function.client.ServletOAuth2AuthorizedClientExchangeFilterFunction;
  import org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationRequest;
  import org.springframework.security.oauth2.jwt.JwtDecoderFactory;
  import org.springframework.security.provisioning.InMemoryUserDetailsManager;
  import org.springframework.security.web.SecurityFilterChain;
  import org.springframework.web.reactive.function.client.WebClient;
  
  @Slf4j
  @Configuration
  @ConditionalOnProperty(name = "klaw.enable.sso", havingValue = "true")
  @EnableWebSecurity
  public class SecurityConfigSSO {
  
    @Value("${klaw.coral.enabled:false}")
    private boolean coralEnabled;
  
    @Autowired KwAuthenticationSuccessHandler kwAuthenticationSuccessHandler;
  
    @Autowired KwAuthenticationFailureHandler kwAuthenticationFailureHandler;
  
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
      log.info("SSO enabled");
      ConfigUtils.applyHttpSecurityConfig(
          http, coralEnabled, kwAuthenticationSuccessHandler, kwAuthenticationFailureHandler);
      return http.build();
    }
  
    @Bean
    WebClient webClient(
        ClientRegistrationRepository clientRegistrationRepository,
        OAuth2AuthorizedClientRepository authorizedClientRepository) {
      ServletOAuth2AuthorizedClientExchangeFilterFunction oauth2 =
          new ServletOAuth2AuthorizedClientExchangeFilterFunction(
              clientRegistrationRepository, authorizedClientRepository);
      oauth2.setDefaultOAuth2AuthorizedClient(true);
  
      return WebClient.builder().apply(oauth2.oauth2Configuration()).build();
    }
  
    @Bean
    public AuthorizationRequestRepository<OAuth2AuthorizationRequest>
        authorizationRequestRepository() {
      return new HttpSessionOAuth2AuthorizationRequestRepository();
    }
  
    @Bean
    public OAuth2AccessTokenResponseClient<OAuth2AuthorizationCodeGrantRequest>
        accessTokenResponseClient() {
      DefaultAuthorizationCodeTokenResponseClient accessTokenResponseClient =
          new DefaultAuthorizationCodeTokenResponseClient();
      return accessTokenResponseClient;
    }
  
    @Bean
    public InMemoryUserDetailsManager inMemoryUserDetailsManager() {
      final Properties globalUsers = new Properties();
      return new InMemoryUserDetailsManager(globalUsers);
    }
  
    // Below code is only applicable for keycloak provider with legacy version (10.x)
    @Bean
    @ConditionalOnExpression("${klaw.sso.provider.keycloak.legacy:false}")
    public JwtDecoderFactory<ClientRegistration> customJwtDecoderFactory() {
      return new CustomJwtDecoder.CustomJwtDecoderFactory();
    }
  }
  