# Copyright 2018 Red Hat, Inc.

# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at

#  http://www.apache.org/licenses/LICENSE-2.0

# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

security.abstract-management-auth-disable.option.mechanism.description=\
The authentication mechanism to disable. The option completer exposes all enabled mechanisms.

security.abstract-management-auth-disable.option.mechanism.value=mechanism name

security.abstract-management-auth-enable.option.mechanism.description=\
The authentication mechanism to enable. The option completer exposes all supported \
 mechanisms that the CLI support.\n\
NB: If the mechanism you want to configure is not present in the list, then \
you must use elytron subsystem management operations to configure it.

security.abstract-management-auth-enable.option.mechanism.value=mechanism name

security.abstract-auth-disable.option.no-reload.description=\
Optional, by default the server is reloaded once the configuration changes have been applied. \
In order to not reload the server, use this option.\n\
NB: reload is done in start-mode=<the mode the current server is running>.

security.abstract-auth-enable.option.file-system-realm-name.description=\
The elytron file-system-realm name.

security.abstract-auth-enable.option.file-system-realm-name.value=realm name

security.abstract-auth-enable.option.user-role-decoder.description=\
Usable only if --file-system-realm is in use. This is the name of the role decoder \
to extract the roles from the users repository.

security.abstract-auth-enable.option.user-role-decoder.value=role-decoder name

security.abstract-auth-enable.option.properties-realm-name.description=\
The name of an existing properties realm.

security.abstract-auth-enable.option.properties-realm-name.value=realm name

security.abstract-auth-enable.option.roles.description=\
Optional, a comma separated list of roles associated to the current identity. \
If no existing constant role mapper exists for this list of roles, a constant role mapper will be generated. \
Apply only to EXTERNAL (SASL) or CLIENT_CERT (HTTP Auth) mechanisms.

security.abstract-auth-enable.option.roles.value=list of roles

security.abstract-auth-enable.option.user-properties-file.description=\
A path to the properties file that contains users.

security.abstract-auth-enable.option.user-properties-file.value=file path

security.abstract-auth-enable.option.group-properties-file.description=\
A path to the properties file that contains groups (management) or roles (http-server).

security.abstract-auth-enable.option.group-properties-file.value=file path

security.abstract-auth-enable.option.exposed-realm.description=\
The Realm exposed to the client. If a properties realm is used, this value MUST \
be the same as the 'realm-name' value located inside users properties file.\n\
NB: It must be set when --user-properties-file or --properties-realm is used. For other \
kinds of realm it is optional.

security.abstract-auth-enable.option.exposed-realm.value=exposed realm

security.abstract-auth-enable.option.relative-to.description=\
Optional, to be used with the --group-properties-file and --user-properties-file options. \
Makes the provided paths relative to a system property (eg:jboss.server.config.dir).

security.abstract-auth-enable.option.relative-to.value=system property

security.abstract-auth-enable.option.no-reload.description=\
Optional, by default the server is reloaded once the configuration changes have been applied. \
In order to not reload the server, use this option.\n\
NB: reload is done in start-mode=<the mode the current server is running>.

security.abstract-auth-enable.option.super-user.description=\
In order to configure local user with super-user permissions. Usable with JBOSS-LOCAL-USER \
mechanism.

security.abstract-auth-enable.option.new-security-domain-name.description=\
Optional, used to name the security domain with the specified value, by default \
a name is computed.

security.abstract-auth-enable.option.new-security-domain-name.value=name

security.abstract-auth-enable.option.new-auth-factory-name.description=\
Optional, used to name the factory with the specified value, by default \
a name is computed.

security.abstract-auth-enable.option.new-auth-factory-name.value=name

security.abstract-auth-enable.option.new-realm-name.description=\
Optional, used to name the properties file realm resource with the specified value, by default \
a name is computed.

security.abstract-auth-enable.option.new-realm-name.value=name

security.abstract-auth-enable.option.key-store-name.description=\
Must be specified when the mechanism is EXTERNAL (SASL) or CLIENT_CERT (HTTP Auth), \
this is the name of the trust-store. \
Option completer proposes the existing key-stores.\n\
NB: You can instead use an existing key-store-realm (--key-store-realm-name) option.

security.abstract-auth-enable.option.key-store-name.value=key-store name

security.abstract-auth-enable.option.key-store-realm-name.description=\
Must be specified when the mechanism is EXTERNAL (SASL) or CLIENT_CERT (HTTP Auth), \
this is the name of the trust-store. \
Option completer proposes the existing key-store-realms.\n\
NB: You can instead use an existing key-store (--key-store-name) option.

security.abstract-auth-enable.option.key-store-realm-name.vale=realm name

security.abstract-auth-sasl-re-order.option.mechanisms-order.description=\
Comma separated list of mechanisms names. Completer for this option proposes the \
mechanisms present in the targeted factory.

security.abstract-auth-sasl-re-order.option.mechanisms-order.value=list of mechanisms

security.abstract-auth-sasl-re-order.option.no-reload.description=\
Optional, by default the server is reloaded once the configuration changes have been applied. \
In order to not reload the server, use this option.\n\
NB: reload is done in start-mode=<the mode the current server is running>.

security.disable-http-auth-http-server.description=\
Without any mechanism specified, this command removes the http-server security domain. \
If a mechanism is specified, the mechanism is removed from the http authentication factory \
that this security domain references.\n\
NB: Elytron existing resources are not removed from management model.\n\
TIPS: Use 'echo-dmr security disable-http-auth-http-server <options>' in order to \
visualize the composite request that would be sent to disable authentication.

security.disable-http-auth-http-server.option.security-domain.description=\
Required, the undertow security domain name.

security.disable-http-auth-http-server.option.security-domain.value=name

security.enable-http-auth-http-server.description=\
Associate an elytron security domain or HTTP Authentication factory to the http-server security domain. \
If no elytron referenced security domain is provided nor mechanism, then the elytron Out of The Box Application \
security domain is associated to the http-server security domain.\n\
NB: If the server the CLI is connected to doesn't support "elytron referenced security \
domain from http-server security domain", the elytron Out of The Box Application \
HTTP Authentication factory is associated to the http-server security domain when no mechanism is provided.\n\
In case a factory already exists for the passed security domain, the factory \
is extended (or updated) with the selected mechanism.
NB: This command creates all the non existing resources required to configure \
authentication. This command can be called multiple times to configure the \
referenced HTTP Authentication factory.\n\
TIPS: Use 'echo-dmr security enable-http-auth-http-server <options>' in order to \
visualize the composite request that would be sent to enable authentication.

security.disable-http-auth-http-server.option.mechanism.description=\
The authentication mechanism to disable. The option completer exposes all enabled mechanisms.\n\
NB: Only applies to security-domain that references an HTTP Authentication factory.

security.disable-http-auth-http-server.option.mechanism.value=mechanism name

security.enable-http-auth-http-server.option.mechanism.description=\
The authentication mechanism to enable. The option completer exposes all supported \
 mechanisms that the CLI support.\n\
NB: If the mechanism you want to configure is not present in the list, then \
you must use elytron subsystem management operations to configure it.\n\
NB: This option can't be used when referencing an elytron security domain.

security.enable-http-auth-http-server.option.mechanism.value=mechanism name

security.enable-http-auth-http-server.option.referenced-security-domain.description=\
An existing elytron security domain name. This option is only available if the server \
the CLI is connected to support "elytron referenced security domain from http-server \
security domain".

security.enable-http-auth-http-server.option.referenced-security-domain.value=name

security.enable-http-auth-http-server.option.security-domain.description=\
Required, the undertow security domain name.

security.enable-http-auth-http-server.option.security-domain.value=name

security.disable-http-auth-management.description=\
This command removes the active HTTP Authentication factory or a mechanism from \
the active HTTP Authentication factory. Without any mechanism provided, this \
command erases the factory from the interface.\n\
NB: Elytron existing resources are not removed from management model.\n\
TIPS: Use 'echo-dmr security disable-http-auth-management <options>' in order to \
visualize the composite request that would be sent to disable authentication.

security.disable-sasl-management.description=\
This command removes the active SASL Authentication factory or a mechanism from \
the active SASL Authentication factory. Without any mechanism provided, this \
command erases the factory from the http or native interfaces.\n\
NB: Elytron existing resources are not removed from management model.\n\
TIPS: Use 'echo-dmr security disable-sasl-management <options>' in order to \
visualize the composite request that would be sent to disable authentication.

security.disable-sasl-management.option.management-interface.description=\
The management interface to configure, by default this is the http-interface.

security.disable-sasl-management.option.management-interface.value=name

security.enable-http-auth-management.description=\
Associate an elytron HTTP Authentication factory to the management interface. \
In case an HTTP Authentication factory already exists, the factory is extended \
(or updated) with the selected mechanism. If no mechanism is provided, \
the elytron Out of the Box HTTP Authentication factory is associated to the management \
interface. This command creates all the non existing resources required to configure \
authentication. This command can be called multiple times to configure the \
referenced HTTP Authentication factory.\n\
NB: This command targets only the management http-interface.\n\
TIPS: Use 'echo-dmr security enable-http-auth-management <options>' in order to \
visualize the composite request that would be sent to enable authentication.

security.enable-sasl-management.description=\
Associate an elytron SASL Authentication factory to the management interface. \
In case a SASL Authentication factory already exists, the factory is extended (or updated) \
with the selected mechanism. If no mechanism is provided, the elytron Out of the Box SASL \
Authentication factory is associated to the management interface. \
This command creates all the non existing resources required to configure authentication. \
This command can be called multiple times to configure the referenced SASL Authentication factory.\n\
TIPS: Use 'echo-dmr security enable-sasl-management <options>' in order to \
visualize the composite request that would be sent to enable authentication.

security.enable-sasl-management.option.management-interface.description=\
The management interface to configure, by default this is the http-interface.

security.enable-sasl-management.option.management-interface.value=name

security.reorder-sasl-management.description=\
Re-order the SASL mechanisms present is the SASL Authentication factory attached \
to the targeted management interface. \

security.reorder-sasl-management.option.management-interface.description=\
The management interface to configure, by default this is the http-interface.

security.reorder-sasl-management.option.management-interface.value=name