micronaut.security.ip-patterns[0]=127.0.0.1
micronaut.security.ip-patterns[1]=192.168.1.*

micronaut:
  security:
    ip-patterns:
      - 127.0.0.1
      - 192.168.1.*

[micronaut.security]
ip-patterns = [ "127.0.0.1", "192.168.1.*" ]

micronaut {
  security {
    ipPatterns = ['127.0.0.1', '192.168.1.*']
  }
}

{
  micronaut = {
    security = {
      ip-patterns = ["127.0.0.1", "192.168.1.*"]
    }
  }
}

{
  "micronaut": {
    "security": {
      "ip-patterns": [
        "127.0.0.1",
        "192.168.1.*"
      ]
    }
  }
}

@Controller("/authenticated")
public class ExampleController {

    @Secured("#{ user?.attributes?.get('email') == 'sherlock@micronaut.example' }")
    @Produces(MediaType.TEXT_PLAIN)
    @Get("/email")
    public String authenticationByEmail(Principal principal) {
        return principal.getName() + " is authenticated";
    }
}

@Controller("/authenticated")
class ExampleController:

    @Secured("#{ user?.attributes?.get('email') == 'sherlock@micronaut.example' }")
    @Produces(MediaType.TEXT_PLAIN)
    @Get("/email")
    def authentication_by_email(self, principal: Principal) -> str:
        return principal.getName() + " is authenticated"

@Controller("/authenticated")
class ExampleController {
    @Secured("#{ user?.attributes?.get('email') == 'sherlock@micronaut.example' }")
    @Produces(MediaType.TEXT_PLAIN)
    @Get("/email")
    fun authenticationByEmail(principal: Principal) = "${principal.name} is authenticated"
}

@Controller("/authenticated")
class ExampleController {

    @Secured("#{ user?.attributes?.get('email') == 'sherlock@micronaut.example' }")
    @Produces(MediaType.TEXT_PLAIN)
    @Get("/email")
    String authenticationByEmail(Principal principal) {
        "${principal.name} is authenticated"
    }
}

micronaut.security.intercept-url-map[0].pattern=/images/*
micronaut.security.intercept-url-map[0].http-method=GET
micronaut.security.intercept-url-map[0].access[0]=isAnonymous()
micronaut.security.intercept-url-map[1].pattern=/books
micronaut.security.intercept-url-map[1].access[0]=isAuthenticated()
micronaut.security.intercept-url-map[2].pattern=/books/grails
micronaut.security.intercept-url-map[2].http-method=POST
micronaut.security.intercept-url-map[2].access[0]=ROLE_GRAILS
micronaut.security.intercept-url-map[2].access[1]=ROLE_GROOVY
micronaut.security.intercept-url-map[3].pattern=/books/grails
micronaut.security.intercept-url-map[3].http-method=PUT
micronaut.security.intercept-url-map[3].access[0]=ROLE_ADMIN

micronaut:
  security:
    intercept-url-map:
      -
        pattern: /images/*
        http-method: GET
        access:
          - isAnonymous()
      -
        pattern: /books
        access:
          - isAuthenticated()
      -
        pattern: /books/grails
        http-method: POST
        access:
          - ROLE_GRAILS
          - ROLE_GROOVY
      -
        pattern: /books/grails
        http-method: PUT
        access:
          - ROLE_ADMIN

[[micronaut.security.intercept-url-map]]
pattern = "/images/*"
http-method = "GET"
access = [ "isAnonymous()" ]

[[micronaut.security.intercept-url-map]]
pattern = "/books"
access = [ "isAuthenticated()" ]

[[micronaut.security.intercept-url-map]]
pattern = "/books/grails"
http-method = "POST"
access = [ "ROLE_GRAILS", "ROLE_GROOVY" ]

[[micronaut.security.intercept-url-map]]
pattern = "/books/grails"
http-method = "PUT"
access = [ "ROLE_ADMIN" ]

micronaut {
  security {
    interceptUrlMap = ['[object Object]', '[object Object]', '[object Object]', '[object Object]']
  }
}

{
  micronaut = {
    security = {
      intercept-url-map = [{
        pattern = "/images/*"
        http-method = "GET"
        access = ["isAnonymous()"]
      }, {
        pattern = "/books"
        access = ["isAuthenticated()"]
      }, {
        pattern = "/books/grails"
        http-method = "POST"
        access = ["ROLE_GRAILS", "ROLE_GROOVY"]
      }, {
        pattern = "/books/grails"
        http-method = "PUT"
        access = ["ROLE_ADMIN"]
      }]
    }
  }
}

{
  "micronaut": {
    "security": {
      "intercept-url-map": [
        {
          "pattern": "/images/*",
          "http-method": "GET",
          "access": [
            "isAnonymous()"
          ]
        },
        {
          "pattern": "/books",
          "access": [
            "isAuthenticated()"
          ]
        },
        {
          "pattern": "/books/grails",
          "http-method": "POST",
          "access": [
            "ROLE_GRAILS",
            "ROLE_GROOVY"
          ]
        },
        {
          "pattern": "/books/grails",
          "http-method": "PUT",
          "access": [
            "ROLE_ADMIN"
          ]
        }
      ]
    }
  }
}

micronaut.security.intercept-url-map[0].pattern=/v1/myResource/**
micronaut.security.intercept-url-map[0].httpMethod=GET
micronaut.security.intercept-url-map[0].access[0]=isAnonymous()
micronaut.security.intercept-url-map[1].pattern=/v1/myResource/**
micronaut.security.intercept-url-map[1].access[0]=isAuthenticated()

micronaut:
  security:
    intercept-url-map:
      - pattern: /v1/myResource/**
        httpMethod: GET
        access:
          - isAnonymous()
      - pattern: /v1/myResource/**
        access:
          - isAuthenticated()

[[micronaut.security.intercept-url-map]]
pattern = "/v1/myResource/**"
httpMethod = "GET"
access = [ "isAnonymous()" ]

[[micronaut.security.intercept-url-map]]
pattern = "/v1/myResource/**"
access = [ "isAuthenticated()" ]

micronaut {
  security {
    interceptUrlMap = ['[object Object]', '[object Object]']
  }
}

{
  micronaut = {
    security = {
      intercept-url-map = [{
        pattern = "/v1/myResource/**"
        httpMethod = "GET"
        access = ["isAnonymous()"]
      }, {
        pattern = "/v1/myResource/**"
        access = ["isAuthenticated()"]
      }]
    }
  }
}

{
  "micronaut": {
    "security": {
      "intercept-url-map": [
        {
          "pattern": "/v1/myResource/**",
          "httpMethod": "GET",
          "access": [
            "isAnonymous()"
          ]
        },
        {
          "pattern": "/v1/myResource/**",
          "access": [
            "isAuthenticated()"
          ]
        }
      ]
    }
  }
}

endpoints.beans.enabled=true
endpoints.beans.sensitive=true
endpoints.info.enabled=true
endpoints.info.sensitive=false

endpoints:
  beans:
    enabled: true
    sensitive: true
  info:
    enabled: true
    sensitive: false

[endpoints.beans]
enabled = true
sensitive = true

[endpoints.info]
enabled = true
sensitive = false

endpoints {
  beans {
    enabled = true
    sensitive = true
  }
  info {
    enabled = true
    sensitive = false
  }
}

{
  endpoints = {
    beans = {
      enabled = true
      sensitive = true
    }
    info = {
      enabled = true
      sensitive = false
    }
  }
}

{
  "endpoints": {
    "beans": {
      "enabled": true,
      "sensitive": true
    },
    "info": {
      "enabled": true,
      "sensitive": false
    }
  }
}

import io.micronaut.context.annotation.Replaces;
import io.micronaut.context.annotation.Requires;
import org.jspecify.annotations.NonNull;
import io.micronaut.http.HttpRequest;
import io.micronaut.inject.ExecutableMethod;
import io.micronaut.management.endpoint.EndpointSensitivityProcessor;
import io.micronaut.security.authentication.Authentication;
import io.micronaut.security.rules.SecurityRuleResult;
import io.micronaut.security.rules.SensitiveEndpointRule;
import io.micronaut.security.token.RolesFinder;
import jakarta.inject.Singleton;
import java.util.Collections;
import org.reactivestreams.Publisher;
import reactor.core.publisher.Mono;

@Replaces(SensitiveEndpointRule.class)
@Singleton
public class SensitiveEndpointRuleReplacement extends SensitiveEndpointRule {
    private final RolesFinder rolesFinder;

    public SensitiveEndpointRuleReplacement(EndpointSensitivityProcessor endpointSensitivityProcessor,
                                            RolesFinder rolesFinder) {
        super(endpointSensitivityProcessor);
        this.rolesFinder = rolesFinder;
    }

    @Override
    @NonNull
    protected Publisher<SecurityRuleResult> checkSensitiveAuthenticated(@NonNull HttpRequest<?> request,
                                                                        @NonNull Authentication authentication,
                                                                        @NonNull ExecutableMethod<?, ?> method) {
        return Mono.just(rolesFinder.hasAnyRequiredRoles(Collections.singletonList("ROLE_SYSTEM"), authentication.getRoles())
                ? SecurityRuleResult.ALLOWED : SecurityRuleResult.REJECTED);
    }
}

from jakarta.inject import Singleton
from micronaut.context.annotation import Replaces, Requires
from micronaut.http import HttpRequest
from micronaut.inject import ExecutableMethod
from micronaut.management.endpoint import EndpointSensitivityProcessor
from micronaut.security.authentication import Authentication
from micronaut.security.rules import SecurityRuleResult, SensitiveEndpointRule
from micronaut.security.token import RolesFinder
from org.reactivestreams import Publisher
from reactor.core.publisher import Mono

@Replaces(SensitiveEndpointRule)
@Singleton
class SensitiveEndpointRuleReplacement(SensitiveEndpointRule):
    def __init__(self, endpointSensitivityProcessor: EndpointSensitivityProcessor, rolesFinder: RolesFinder):
        super().__init__(endpointSensitivityProcessor)
        self.rolesFinder = rolesFinder

    def checkSensitiveAuthenticated(self, request: HttpRequest, authentication: Authentication, method: ExecutableMethod) -> Publisher[SecurityRuleResult]:
        if self.rolesFinder.hasAnyRequiredRoles(["ROLE_SYSTEM"], authentication.getRoles()):
            return Mono.just(SecurityRuleResult.ALLOWED)
        return Mono.just(SecurityRuleResult.REJECTED)

import io.micronaut.context.annotation.Replaces
import io.micronaut.context.annotation.Requires
import io.micronaut.http.HttpRequest
import io.micronaut.inject.ExecutableMethod
import io.micronaut.management.endpoint.EndpointSensitivityProcessor
import io.micronaut.security.authentication.Authentication
import io.micronaut.security.rules.SecurityRuleResult
import io.micronaut.security.rules.SensitiveEndpointRule
import io.micronaut.security.token.RolesFinder
import jakarta.inject.Singleton
import org.reactivestreams.Publisher
import reactor.core.publisher.Mono

@Replaces(SensitiveEndpointRule::class)
@Singleton
class SensitiveEndpointRuleReplacement(endpointSensitivityProcessor: EndpointSensitivityProcessor,
                                       private val rolesFinder: RolesFinder) : SensitiveEndpointRule(endpointSensitivityProcessor) {
    override fun checkSensitiveAuthenticated(
        request: HttpRequest<*>,
        authentication: Authentication,
        method: ExecutableMethod<*, *>
    ): Publisher<SecurityRuleResult> {
        return Mono.just(
            if (rolesFinder.hasAnyRequiredRoles(listOf("ROLE_SYSTEM"), authentication.roles)) SecurityRuleResult.ALLOWED
            else SecurityRuleResult.REJECTED
        )
    }
}

import org.reactivestreams.Publisher
import reactor.core.publisher.Mono

@Replaces(SensitiveEndpointRule.class)
@Singleton
class SensitiveEndpointRuleReplacement extends SensitiveEndpointRule {
    private final RolesFinder rolesFinder;

    SensitiveEndpointRuleReplacement(EndpointSensitivityProcessor endpointSensitivityProcessor,
                                     RolesFinder rolesFinder) {
        super(endpointSensitivityProcessor)
        this.rolesFinder = rolesFinder
    }

    @Override
    @NonNull
    protected Publisher<SecurityRuleResult> checkSensitiveAuthenticated(@NonNull HttpRequest<?> request,
                                                                        @NonNull Authentication authentication,
                                                                        @NonNull ExecutableMethod<?, ?> method) {
        Mono.just(rolesFinder.hasAnyRequiredRoles(["ROLE_SYSTEM"], authentication.roles)
                ? SecurityRuleResult.ALLOWED : SecurityRuleResult.REJECTED)
    }
}

@RunAs(
    name = "aegon",
    roles = {"TARGARYEN"},
    attributes = {
        @Attribute(key = "family_name", value = "Targaryen"),
        @Attribute(key = "given_name", value = "Aegon")
    }
)
@Singleton
public class RunAsService {
    public Authentication changeAuth() {
        return SecurityContextHolder.getSecurityContext().getAuthentication();
    }
}

@RunAs(
    name="aegon",
    roles=["TARGARYEN"],
    attributes=[
        RunAs.Attribute(key="family_name", value="Targaryen"),
        RunAs.Attribute(key="given_name", value="Aegon"),
    ],
)
@Singleton
class RunAsService:
    def change_auth(self) -> Authentication:
        return SecurityContextHolder.getSecurityContext().getAuthentication()

@RunAs(
    name = "aegon",
    roles = ["TARGARYEN"],
    attributes = [
        Attribute(key = "family_name", value = "Targaryen"),
        Attribute(key = "given_name", value = "Aegon")
    ]
)
@Singleton
open class RunAsService {
    open fun changeAuth(): Authentication? = SecurityContextHolder.getSecurityContext().authentication
}

@RunAs(
        name = "aegon",
        roles = ["TARGARYEN"],
        attributes = [
                @Attribute(key = "family_name", value = "Targaryen"),
                @Attribute(key = "given_name", value = "Aegon")
        ]
)
@Singleton
class RunAsService {
    Authentication changeAuth() {
        SecurityContextHolder.securityContext.authentication
    }
}

micronaut.router.static-resources.default.mapping=/assets/**
micronaut.router.static-resources.default.paths=classpath:assets
micronaut.security.filter.static-resource-authentication-bypass=true
micronaut.security.intercept-url-map[0].pattern=/assets/**
micronaut.security.intercept-url-map[0].access[0]=isAnonymous()

micronaut:
  router:
    static-resources:
      default:
        mapping: /assets/**
        paths: classpath:assets
  security:
    filter:
      static-resource-authentication-bypass: true
    intercept-url-map:
      - pattern: /assets/**
        access:
          - isAnonymous()

[micronaut.router.static-resources.default]
mapping = "/assets/**"
paths = "classpath:assets"

[micronaut.security.filter]
static-resource-authentication-bypass = true

[[micronaut.security.intercept-url-map]]
pattern = "/assets/**"
access = [ "isAnonymous()" ]

micronaut {
  router {
    staticResources {
      'default' {
        mapping = '/assets/**'
        paths = 'classpath:assets'
      }
    }
  }
  security {
    filter {
      staticResourceAuthenticationBypass = true
    }
    interceptUrlMap = ['[object Object]']
  }
}

{
  micronaut = {
    router = {
      static-resources = {
        default = {
          mapping = "/assets/**"
          paths = "classpath:assets"
        }
      }
    }
    security = {
      filter = {
        static-resource-authentication-bypass = true
      }
      intercept-url-map = [{
        pattern = "/assets/**"
        access = ["isAnonymous()"]
      }]
    }
  }
}

{
  "micronaut": {
    "router": {
      "static-resources": {
        "default": {
          "mapping": "/assets/**",
          "paths": "classpath:assets"
        }
      }
    },
    "security": {
      "filter": {
        "static-resource-authentication-bypass": true
      },
      "intercept-url-map": [
        {
          "pattern": "/assets/**",
          "access": [
            "isAnonymous()"
          ]
        }
      ]
    }
  }
}

@Singleton
class CustomAuthenticationProvider<B> implements HttpRequestReactiveAuthenticationProvider<B> {
    @Override
    @SingleResult
    public Publisher<AuthenticationResponse> authenticate(HttpRequest<B> requestContext, AuthenticationRequest<String, String> authRequest) {
        AuthenticationResponse rsp = authRequest.getIdentity().equals("user") && authRequest.getSecret().equals("password")
                ? AuthenticationResponse.success("user")
                : AuthenticationResponse.failure(AuthenticationFailureReason.CREDENTIALS_DO_NOT_MATCH);
        return Mono.create(emitter -> {
            emitter.success(rsp);
        });
    }
}

@Singleton
class CustomAuthenticationProvider(HttpRequestReactiveAuthenticationProvider):

    @SingleResult
    def authenticate(self, requestContext: HttpRequest, authRequest: AuthenticationRequest) -> Publisher[AuthenticationResponse]:
        if authRequest.getIdentity() == "user" and authRequest.getSecret() == "password":
            rsp = AuthenticationResponse.success("user")
        else:
            rsp = AuthenticationResponse.failure(AuthenticationFailureReason.CREDENTIALS_DO_NOT_MATCH)
        return Mono.create(lambda emitter: emitter.success(rsp))

@Singleton
class CustomAuthenticationProvider :
    HttpRequestReactiveAuthenticationProvider<Any> {
    override fun authenticate(
        requestContext: HttpRequest<Any>?,
        authenticationRequest: AuthenticationRequest<String, String>
    ): Publisher<AuthenticationResponse> {
        val rsp = if (authenticationRequest.identity == "user" && authenticationRequest.secret == "password")
            AuthenticationResponse.success("user")
        else AuthenticationResponse.failure(AuthenticationFailureReason.CREDENTIALS_DO_NOT_MATCH)
        return Mono.create { emitter -> emitter.success(rsp) }
    }
}

@Singleton
class CustomAuthenticationProvider<B> implements HttpRequestReactiveAuthenticationProvider<B> {
    @Override
    @SingleResult
    Publisher<AuthenticationResponse> authenticate(@Nullable HttpRequest<B> httpRequest,
                                                   @NonNull AuthenticationRequest<String, String> authRequest) {
        AuthenticationResponse rsp = (authRequest.identity == "user" && authRequest.secret == "password")
                ? AuthenticationResponse.success("user")
                : AuthenticationResponse.failure(AuthenticationFailureReason.CREDENTIALS_DO_NOT_MATCH)
        return Mono.create(emitter -> {
            emitter.success(rsp)
        })
    }
}

@Singleton
class CustomAuthenticationProvider<B> implements HttpRequestAuthenticationProvider<B> {

    @Override
    public AuthenticationResponse authenticate(HttpRequest<B> requestContext, AuthenticationRequest<String, String> authRequest) {
        return (authRequest.getIdentity().equals("user") && authRequest.getSecret().equals("password"))
                ? AuthenticationResponse.success("user")
                : AuthenticationResponse.failure(AuthenticationFailureReason.CREDENTIALS_DO_NOT_MATCH);
    }
}

@Singleton
class CustomAuthenticationProvider(HttpRequestAuthenticationProvider):

    def authenticate(self, requestContext: HttpRequest, authRequest: AuthenticationRequest) -> AuthenticationResponse:
        if authRequest.getIdentity() == "user" and authRequest.getSecret() == "password":
            return AuthenticationResponse.success("user")
        return AuthenticationResponse.failure(AuthenticationFailureReason.CREDENTIALS_DO_NOT_MATCH)

@Singleton
class CustomAuthenticationProvider :
    HttpRequestAuthenticationProvider<Any> {
    override fun authenticate(
        requestContext: HttpRequest<Any>?,
        authRequest: AuthenticationRequest<String, String>
    ): AuthenticationResponse {
        return if (authRequest.identity == "user" && authRequest.secret == "password")
            AuthenticationResponse.success("user")
        else AuthenticationResponse.failure(AuthenticationFailureReason.CREDENTIALS_DO_NOT_MATCH)
    }

}

@Singleton
class CustomAuthenticationProviderCustomAuthenticationProvider<B> implements HttpRequestAuthenticationProvider<B> {
    @Override
    AuthenticationResponse authenticate(HttpRequest<B> requestContext, AuthenticationRequest<String, String> authRequest) {
        authRequest.identity == "user" && authRequest.secret == "password"
                ? AuthenticationResponse.success("user")
                : AuthenticationResponse.failure(AuthenticationFailureReason.CREDENTIALS_DO_NOT_MATCH)
    }
}

curl "http://localhost:8080/info" \
     -u 'user:password'

HttpRequest<?> request = HttpRequest.GET("/home").basicAuth("sherlock", "password");

request = HttpRequest.GET("/home").basicAuth("sherlock", "password")

val request = HttpRequest.GET<Any>("/home").basicAuth("sherlock", "password")

HttpRequest request = HttpRequest.GET("/home").basicAuth('sherlock', 'password')

micronaut.security.token.jwt.signatures.jwks.awscognito.url=https://cognito-idp.eu-west-1.amazonaws.com/eu-west-XXXX/.well-known/jwks.json

micronaut:
  security:
    token:
      jwt:
        signatures:
          jwks:
            awscognito:
              url: 'https://cognito-idp.eu-west-1.amazonaws.com/eu-west-XXXX/.well-known/jwks.json'

[micronaut.security.token.jwt.signatures.jwks.awscognito]
url = "https://cognito-idp.eu-west-1.amazonaws.com/eu-west-XXXX/.well-known/jwks.json"

micronaut {
  security {
    token {
      jwt {
        signatures {
          jwks {
            awscognito {
              url = 'https://cognito-idp.eu-west-1.amazonaws.com/eu-west-XXXX/.well-known/jwks.json'
            }
          }
        }
      }
    }
  }
}

{
  micronaut = {
    security = {
      token = {
        jwt = {
          signatures = {
            jwks = {
              awscognito = {
                url = "https://cognito-idp.eu-west-1.amazonaws.com/eu-west-XXXX/.well-known/jwks.json"
              }
            }
          }
        }
      }
    }
  }
}

{
  "micronaut": {
    "security": {
      "token": {
        "jwt": {
          "signatures": {
            "jwks": {
              "awscognito": {
                "url": "https://cognito-idp.eu-west-1.amazonaws.com/eu-west-XXXX/.well-known/jwks.json"
              }
            }
          }
        }
      }
    }
  }
}

micronaut.http.services.awscognito.url=https://cognito-idp.eu-west-1.amazonaws.com
micronaut.http.services.awscognito.proxy-type=http
micronaut.http.services.awscognito.proxy-address=proxy.company.net:8080
micronaut.security.token.jwt.signatures.jwks.awscognito.url=/eu-west-XXXX/.well-known/jwks.json

micronaut:
  http:
    services:
      awscognito:
        url: 'https://cognito-idp.eu-west-1.amazonaws.com'
        proxy-type: 'http'
        proxy-address: 'proxy.company.net:8080'
  security:
    token:
      jwt:
        signatures:
          jwks:
            awscognito:
              url: '/eu-west-XXXX/.well-known/jwks.json'

[micronaut.http.services.awscognito]
url = "https://cognito-idp.eu-west-1.amazonaws.com"
proxy-type = "http"
proxy-address = "proxy.company.net:8080"

[micronaut.security.token.jwt.signatures.jwks.awscognito]
url = "/eu-west-XXXX/.well-known/jwks.json"

micronaut {
  http {
    services {
      awscognito {
        url = 'https://cognito-idp.eu-west-1.amazonaws.com'
        proxyType = 'http'
        proxyAddress = 'proxy.company.net:8080'
      }
    }
  }
  security {
    token {
      jwt {
        signatures {
          jwks {
            awscognito {
              url = '/eu-west-XXXX/.well-known/jwks.json'
            }
          }
        }
      }
    }
  }
}

{
  micronaut = {
    http = {
      services = {
        awscognito = {
          url = "https://cognito-idp.eu-west-1.amazonaws.com"
          proxy-type = "http"
          proxy-address = "proxy.company.net:8080"
        }
      }
    }
    security = {
      token = {
        jwt = {
          signatures = {
            jwks = {
              awscognito = {
                url = "/eu-west-XXXX/.well-known/jwks.json"
              }
            }
          }
        }
      }
    }
  }
}

{
  "micronaut": {
    "http": {
      "services": {
        "awscognito": {
          "url": "https://cognito-idp.eu-west-1.amazonaws.com",
          "proxy-type": "http",
          "proxy-address": "proxy.company.net:8080"
        }
      }
    },
    "security": {
      "token": {
        "jwt": {
          "signatures": {
            "jwks": {
              "awscognito": {
                "url": "/eu-west-XXXX/.well-known/jwks.json"
              }
            }
          }
        }
      }
    }
  }
}