boolean

Enable support for Helidon versions before 3.0.0 (exclusive).

Until version 3.0.0 (exclusive) there was a trailing end of line added to the signed
data.
To be able to communicate cross versions, we must configure this when talking to older versions of Helidon.
Default value is `false`. In Helidon 2.x, this switch exists as well and the default is `true`, to
allow communication between versions as needed.

HttpSignHeader[] (SIGNATURE, AUTHORIZATION, CUSTOM)

Add a header that is validated on inbound requests. Provider may support more than one header to validate.

InboundClientDefinition[]

Add inbound configuration. This is used to validate signature and authenticate the party.

The same can be done through configuration:
<pre>
{
 name = "http-signatures"
 class = "HttpSignProvider"
 http-signatures {
     inbound {
         # This configures the InboundClientDefinition
         keys: [
         {
             key-id = "service1"
             hmac.secret = "${CLEAR=password}"
         }]
     }
 }
}
</pre>

boolean

Set whether the signature is optional. If set to true (default), this provider will SecurityResponse.SecurityStatus#ABSTAIN from this request if signature is not present. If set to false, this provider will SecurityResponse.SecurityStatus#FAILURE fail if signature is not present.

OutboundConfig

Add outbound targets to this builder. The targets are used to chose what to do for outbound communication. The targets should have OutboundTargetDefinition attached through OutboundTarget.Builder#customObject(Class, Object) to tell us how to sign the request.

The same can be done through configuration:
<pre>
{
 name = "http-signatures"
 class = "HttpSignProvider"
 http-signatures {
     targets: [
     {
         name = "service2"
         hosts = ["localhost"]
         paths = ["/service2/.*"]

         # This configures the OutboundTargetDefinition
         signature {
             key-id = "service1"
             hmac.secret = "${CLEAR=password}"
         }
     }]
 }
}
</pre>

string

Realm to use for challenging inbound requests that do not have "Authorization" header in case header is HttpSignHeader#AUTHORIZATION and singatures are not optional.

HeadersConfig[]

Override the default inbound required headers (e.g. headers that MUST be signed and headers that MUST be signed IF present).

Defaults:

• get, head, delete methods: date, (request-target), host are mandatory; authorization if present (unless we are creating/validating the HttpSignHeader#AUTHORIZATION ourselves

• put, post: same as above, with addition of: content-length, content-type and digest if present

• for other methods: date, (request-target)

Note that this provider DOES NOT validate the "Digest" HTTP header, only the signature.