From 765157016c73cf58082bb288bcfd3898bbd5f927 Mon Sep 17 00:00:00 2001
From: tvallin <thibault.vallin@oracle.com>
Date: Fri, 10 Nov 2023 10:18:59 +0100
Subject: [PATCH] remove main security main class + rename google index.html

Signed-off-by: tvallin <thibault.vallin@oracle.com>
---
 .../common/files/application.abac.yaml        |  34 --
 .../src/main/archetype/common/security.xml    |   3 -
 .../mp/custom/files/application.abac.yaml     |   3 +
 .../mp/custom/files/application.oidc.yaml     |  32 +-
 .../archetype/mp/custom/security-outputs.xml  |  10 +
 .../main/archetype/se/common/common-se.xml    |   7 +
 .../java/__pkg__/GoogleMain.java.mustache     |  76 ----
 .../__pkg__/OutboundOverrideJwt.java.mustache |  97 ------
 .../java/__pkg__/SignatureMain.java.mustache  | 218 ------------
 .../{index-google.html => google-login.html}  |   0
 .../java/__pkg__/GoogleMainTest.java.mustache |  44 ---
 .../archetype/se/custom/security-outputs.xml  | 324 ++++++++++++++++--
 12 files changed, 327 insertions(+), 521 deletions(-)
 delete mode 100644 archetypes/helidon/src/main/archetype/common/files/application.abac.yaml
 create mode 100644 archetypes/helidon/src/main/archetype/mp/custom/files/application.abac.yaml
 delete mode 100644 archetypes/helidon/src/main/archetype/se/custom/files/src/main/java/__pkg__/GoogleMain.java.mustache
 delete mode 100644 archetypes/helidon/src/main/archetype/se/custom/files/src/main/java/__pkg__/OutboundOverrideJwt.java.mustache
 delete mode 100644 archetypes/helidon/src/main/archetype/se/custom/files/src/main/java/__pkg__/SignatureMain.java.mustache
 rename archetypes/helidon/src/main/archetype/se/custom/files/src/main/resources/WEB/{index-google.html => google-login.html} (100%)
 delete mode 100644 archetypes/helidon/src/main/archetype/se/custom/files/src/test/java/__pkg__/GoogleMainTest.java.mustache

diff --git a/archetypes/helidon/src/main/archetype/common/files/application.abac.yaml b/archetypes/helidon/src/main/archetype/common/files/application.abac.yaml
deleted file mode 100644
index 432b05d3d9f..00000000000
--- a/archetypes/helidon/src/main/archetype/common/files/application.abac.yaml
+++ /dev/null
@@ -1,34 +0,0 @@
-  - abac:
-    # prepares environment
-    # executes attribute validations
-    # validates that attributes were processed
-    # grants/denies access to resource
-    #
-    ####
-    # Combinations:
-    # # Will fail if any attribute is not validated and if any has failed validation
-    # fail-on-unvalidated: true
-    # fail-if-none-validated: true
-    #
-    # # Will fail if there is one or more attributes present and NONE of them is validated or if any has failed validation
-    # # Will NOT fail if there is at least one validated attribute and any number of not validated attributes (and NONE failed)
-    # fail-on-unvalidated: false
-    # fail-if-none-validated: true
-    #
-    # # Will fail if there is any attribute that failed validation
-    # # Will NOT fail if there are no failed validation or if there are NONE validated
-    # fail-on-unvalidated: false
-    # fail-if-none-validated: false
-    ####
-    # fail if an attribute was not validated (e.g. we do not know, whether it is valid or not)
-    # defaults to true
-    fail-on-unvalidated: true
-    # fail if none of the attributes were validated
-    # defaults to true
-    fail-if-none-validated: true
-#    policy-validator:
-#      validators:
-#      - class: "io.helidon.security.abac.policy.DefaultPolicyValidator"
-#      my-custom-policy-engine:
-#        some-key: "some value"
-#        another-key: "another value"
diff --git a/archetypes/helidon/src/main/archetype/common/security.xml b/archetypes/helidon/src/main/archetype/common/security.xml
index 232967c26a9..24eadb99f62 100644
--- a/archetypes/helidon/src/main/archetype/common/security.xml
+++ b/archetypes/helidon/src/main/archetype/common/security.xml
@@ -84,9 +84,6 @@
                         <option value="abac" name="ABAC" description="Attribute Based Access Control">
                             <output>
                                 <model>
-                                    <list key="providers-config-entries">
-                                        <value file="files/application.abac.yaml"/>
-                                    </list>
                                     <list key="dependencies">
                                         <map>
                                             <value key="groupId">io.helidon.security.providers</value>
diff --git a/archetypes/helidon/src/main/archetype/mp/custom/files/application.abac.yaml b/archetypes/helidon/src/main/archetype/mp/custom/files/application.abac.yaml
new file mode 100644
index 00000000000..b24b2e8660d
--- /dev/null
+++ b/archetypes/helidon/src/main/archetype/mp/custom/files/application.abac.yaml
@@ -0,0 +1,3 @@
+  - abac:
+      fail-on-unvalidated: true
+      fail-if-none-validated: true
diff --git a/archetypes/helidon/src/main/archetype/mp/custom/files/application.oidc.yaml b/archetypes/helidon/src/main/archetype/mp/custom/files/application.oidc.yaml
index 5f3f2aff3e1..850d884cc53 100644
--- a/archetypes/helidon/src/main/archetype/mp/custom/files/application.oidc.yaml
+++ b/archetypes/helidon/src/main/archetype/mp/custom/files/application.oidc.yaml
@@ -1,16 +1,16 @@
-    - oidc:
-        # use a custom name, so it does not clash with other examples
-        cookie-name: "OIDC_EXAMPLE_COOKIE"
-        # support for "Authorization" header with bearer token
-        header-use: true
-        # the default redirect-uri, where the webserver listens on redirects from identity server
-        redirect-uri: "/oidc/redirect"
-        issuer: "https://tenant.some-server.com/oauth2/default"
-        audience: "configured audience"
-        client-id: "some client id"
-        client-secret: "some client secret"
-        identity-uri: "https://tenant.some-server.com/oauth2/default"
-        frontend-uri: "http://localhost:7987"
-        server-type: "@default"
-        # We want to redirect to login page (and token can be received either through cookie or header)
-        redirect: true
+  - oidc:
+      # use a custom name, so it does not clash with other examples
+      cookie-name: "OIDC_EXAMPLE_COOKIE"
+      # support for "Authorization" header with bearer token
+      header-use: true
+      # the default redirect-uri, where the webserver listens on redirects from identity server
+      redirect-uri: "/oidc/redirect"
+      issuer: "https://tenant.some-server.com/oauth2/default"
+      audience: "configured audience"
+      client-id: "some client id"
+      client-secret: "some client secret"
+      identity-uri: "https://tenant.some-server.com/oauth2/default"
+      frontend-uri: "http://localhost:7987"
+      server-type: "@default"
+      # We want to redirect to login page (and token can be received either through cookie or header)
+      redirect: true
diff --git a/archetypes/helidon/src/main/archetype/mp/custom/security-outputs.xml b/archetypes/helidon/src/main/archetype/mp/custom/security-outputs.xml
index 877d7d94869..93aa72fbe53 100644
--- a/archetypes/helidon/src/main/archetype/mp/custom/security-outputs.xml
+++ b/archetypes/helidon/src/main/archetype/mp/custom/security-outputs.xml
@@ -99,7 +99,17 @@ to your tenant and application configuration.
                 </model>
             </output>
         </method>
+        <method name="security-abac">
+            <output if="${security.atz} contains ['abac']">
+                <model>
+                    <list key="providers-config-entries">
+                        <value file="files/application.abac.yaml"/>
+                    </list>
+                </model>
+            </output>
+        </method>
     </methods>
+    <call method="security-abac"/>
     <call method="security-oidc"/>
     <call method="security-jwt"/>
     <call method="security-google"/>
diff --git a/archetypes/helidon/src/main/archetype/se/common/common-se.xml b/archetypes/helidon/src/main/archetype/se/common/common-se.xml
index ad391521df8..8aa5442fb25 100644
--- a/archetypes/helidon/src/main/archetype/se/common/common-se.xml
+++ b/archetypes/helidon/src/main/archetype/se/common/common-se.xml
@@ -125,7 +125,14 @@
                 .build()
                 .start();
 
+        {{#Main-after-server}}
+        {{.}}
+        {{/Main-after-server}}
+
         System.out.println("WEB server is up! http://localhost:" + server.port() + "/simple-greet");
+        {{#Main-logging}}
+        {{.}}
+        {{/Main-logging}}
 ]]></value>
             </list>
             <list key="main-class-content">
diff --git a/archetypes/helidon/src/main/archetype/se/custom/files/src/main/java/__pkg__/GoogleMain.java.mustache b/archetypes/helidon/src/main/archetype/se/custom/files/src/main/java/__pkg__/GoogleMain.java.mustache
deleted file mode 100644
index 193c1727a8c..00000000000
--- a/archetypes/helidon/src/main/archetype/se/custom/files/src/main/java/__pkg__/GoogleMain.java.mustache
+++ /dev/null
@@ -1,76 +0,0 @@
-package {{package}};
-
-import java.util.Optional;
-import java.util.concurrent.TimeUnit;
-
-import io.helidon.http.HttpMediaTypes;
-import io.helidon.logging.common.LogConfig;
-import io.helidon.security.Security;
-import io.helidon.security.SecurityContext;
-import io.helidon.security.Subject;
-import io.helidon.security.providers.google.login.GoogleTokenProvider;
-import io.helidon.webserver.WebServer;
-import io.helidon.webserver.WebServerConfig;
-import io.helidon.webserver.context.ContextFeature;
-import io.helidon.webserver.security.SecurityFeature;
-import io.helidon.webserver.staticcontent.StaticContentService;
-
-/**
- * Google login button example main class using builders.
- */
-@SuppressWarnings({"SpellCheckingInspection", "DuplicatedCode"})
-public final class GoogleMain {
-
-    private GoogleMain() {
-    }
-
-    /**
-     * Start the example.
-     *
-     * @param args ignored
-     */
-    public static void main(String[] args) {
-        LogConfig.configureRuntime();
-        WebServerConfig.Builder builder = WebServerConfig.builder();
-        setup(builder);
-        WebServer server = builder.build();
-
-        long t = System.nanoTime();
-        server.start();
-        long time = System.nanoTime() - t;
-
-        System.out.printf("""
-                        Server started in %d ms
-                        Started server on localhost: %2$d
-                        You can access this example at http://localhost:%2$d/index.html
-
-                        Check application.yaml in case you are behind a proxy to configure it
-                        """,
-                TimeUnit.MILLISECONDS.convert(time, TimeUnit.NANOSECONDS),
-                server.port());
-    }
-
-    static void setup(WebServerConfig.Builder server) {
-        Security security = Security.builder()
-                .addProvider(GoogleTokenProvider.builder()
-                        .clientId("your-client-id.apps.googleusercontent.com"))
-                .build();
-        server.featuresDiscoverServices(false)
-                .addFeature(ContextFeature.create())
-                .addFeature(SecurityFeature.builder()
-                                    .security(security)
-                                    .build())
-                .routing(routing -> routing
-                .get("/rest/profile", SecurityFeature.authenticate(),
-                     (req, res) -> {
-                            Optional<SecurityContext> securityContext = req.context().get(SecurityContext.class);
-                            res.headers().contentType(HttpMediaTypes.PLAINTEXT_UTF_8);
-                            res.send("Response from builder based service, you are: \n" + securityContext
-                                    .flatMap(SecurityContext::user)
-                                    .map(Subject::toString)
-                                    .orElse("Security context is null"));
-                            res.next();
-                        })
-                .register(StaticContentService.create("/WEB")));
-    }
-}
diff --git a/archetypes/helidon/src/main/archetype/se/custom/files/src/main/java/__pkg__/OutboundOverrideJwt.java.mustache b/archetypes/helidon/src/main/archetype/se/custom/files/src/main/java/__pkg__/OutboundOverrideJwt.java.mustache
deleted file mode 100644
index d522e37352b..00000000000
--- a/archetypes/helidon/src/main/archetype/se/custom/files/src/main/java/__pkg__/OutboundOverrideJwt.java.mustache
+++ /dev/null
@@ -1,97 +0,0 @@
-package {{package}};
-
-import java.util.concurrent.TimeUnit;
-
-import io.helidon.config.Config;
-import io.helidon.config.ConfigSources;
-import io.helidon.http.HeaderNames;
-import io.helidon.security.Principal;
-import io.helidon.security.SecurityContext;
-import io.helidon.security.Subject;
-import io.helidon.webserver.WebServer;
-import io.helidon.webserver.WebServerConfig;
-import io.helidon.webserver.security.SecurityHttpFeature;
-
-/**
- * Creates two services.
- * First service invokes the second with outbound security.
- * There are two endpoints:
- * <ul>
- *     <li>One that does simple identity propagation and one that uses an explicit username</li>
- *     <li>One that uses basic authentication to authenticate users and JWT to propagate identity</li>
- * </ul>- one that does simple identity propagation and one that uses an explicit username.
- * <p>
- * The difference between this example and basic authentication example:
- * <ul>
- *     <li>Configuration files (this example uses ones with -jwt.yaml suffix)</li>
- *     <li>Client property used to override username</li>
- * </ul>
- */
-public final class OutboundOverrideJwt {
-
-    private OutboundOverrideJwt() {
-    }
-
-    /**
-     * Example that propagates identity and on one endpoint explicitly sets the username and password.
-     *
-     * @param args ignored
-     */
-    public static void main(String[] args) {
-        WebServerConfig.Builder builder = WebServer.builder();
-        setup(builder);
-        WebServer server = builder.build();
-
-        long t = System.nanoTime();
-        server.start();
-        long time = System.nanoTime() - t;
-
-        server.context().register(server);
-
-        System.out.printf("""
-                        Server started in %3$d ms
-
-                        ***********************
-                        ** Endpoints:        **
-                        ***********************
-
-                        http://localhost:%1$d/propagate
-                        http://localhost:%1$d/override
-
-                        Backend service started on: http://localhost:%2$d/hello
-
-                        """,
-                server.port(),
-                server.port("backend"),
-                TimeUnit.MILLISECONDS.convert(time, TimeUnit.NANOSECONDS));
-    }
-
-    static void setup(WebServerConfig.Builder server) {
-        Config clientConfig = Config.create(ConfigSources.classpath("client-service-jwt.yaml"));
-        Config backendConfig = Config.create(ConfigSources.classpath("backend-service-jwt.yaml"));
-
-        server.routing(routing -> routing
-                        .addFeature(SecurityHttpFeature.create(clientConfig.get("security.web-server")))
-                        .register(new JwtOverrideService()))
-
-                // backend that prints the current user
-                .putSocket("backend", socket -> socket
-                        .routing(routing -> routing
-                                .addFeature(SecurityHttpFeature.create(backendConfig.get("security.web-server")))
-                                .get("/hello", (req, res) -> {
-
-                                    // This is the token. It should be bearer <signed JWT base64 encoded>
-                                    req.headers().first(HeaderNames.AUTHORIZATION)
-                                            .ifPresent(System.out::println);
-
-                                    String username = req.context()
-                                            .get(SecurityContext.class)
-                                            .flatMap(SecurityContext::user)
-                                            .map(Subject::principal)
-                                            .map(Principal::getName)
-                                            .orElse("Anonymous");
-
-                                    res.send(username);
-                                })));
-    }
-}
diff --git a/archetypes/helidon/src/main/archetype/se/custom/files/src/main/java/__pkg__/SignatureMain.java.mustache b/archetypes/helidon/src/main/archetype/se/custom/files/src/main/java/__pkg__/SignatureMain.java.mustache
deleted file mode 100644
index 0dfa4204d45..00000000000
--- a/archetypes/helidon/src/main/archetype/se/custom/files/src/main/java/__pkg__/SignatureMain.java.mustache
+++ /dev/null
@@ -1,218 +0,0 @@
-package {{package}};
-
-import java.util.Arrays;
-import java.util.Collection;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.Optional;
-import java.util.concurrent.TimeUnit;
-
-import io.helidon.common.configurable.Resource;
-import io.helidon.common.pki.Keys;
-import io.helidon.security.CompositeProviderFlag;
-import io.helidon.security.CompositeProviderSelectionPolicy;
-import io.helidon.security.Security;
-import io.helidon.security.providers.common.OutboundConfig;
-import io.helidon.security.providers.common.OutboundTarget;
-import io.helidon.security.providers.httpauth.HttpBasicAuthProvider;
-import io.helidon.security.providers.httpauth.SecureUserStore;
-import io.helidon.security.providers.httpsign.HttpSignProvider;
-import io.helidon.security.providers.httpsign.InboundClientDefinition;
-import io.helidon.security.providers.httpsign.OutboundTargetDefinition;
-import io.helidon.webserver.WebServer;
-import io.helidon.webserver.WebServerConfig;
-import io.helidon.webserver.http.HttpRouting;
-import io.helidon.webserver.security.SecurityFeature;
-import io.helidon.webserver.security.SecurityHttpFeature;
-
-/**
- * Example of authentication of service with http signatures, using configuration file as much as possible.
- */
-public class SignatureMain {
-
-    private static final Map<String, SecureUserStore.User> USERS = new HashMap<>();
-
-    static {
-        addUser("jack", "password", List.of("user", "admin"));
-        addUser("jill", "password", List.of("user"));
-        addUser("john", "password", List.of());
-    }
-
-    private SignatureMain() {
-    }
-
-    private static void addUser(String user, String password, List<String> roles) {
-        USERS.put(user, new SecureUserStore.User() {
-            @Override
-            public String login() {
-                return user;
-            }
-
-            char[] password() {
-                return password.toCharArray();
-            }
-
-            @Override
-            public boolean isPasswordValid(char[] password) {
-                return Arrays.equals(password(), password);
-            }
-
-            @Override
-            public Collection<String> roles() {
-                return roles;
-            }
-        });
-    }
-
-    /**
-     * Starts this example.
-     *
-     * @param args ignored
-     */
-    public static void main(String[] args) {
-        WebServerConfig.Builder builder = WebServer.builder();
-        setup(builder);
-        WebServer server = builder.build();
-        server.context().register(server);
-
-        long t = System.nanoTime();
-        server.start();
-        long time = System.nanoTime() - t;
-
-        System.out.printf("""
-                Server started in %1d ms
-
-                Signature example: from builder
-
-                Users:
-                jack/password in roles: user, admin
-                jill/password in roles: user
-                john/password in no roles
-
-                ***********************
-                ** Endpoints:        **
-                ***********************
-
-                Basic authentication, user role required, will use symmetric signatures for outbound:
-                  http://localhost:%2$d/service1
-                Basic authentication, user role required, will use asymmetric signatures for outbound:
-                  http://localhost:%3$d/service1-rsa
-
-                """, TimeUnit.MILLISECONDS.convert(time, TimeUnit.NANOSECONDS), server.port(), server.port("service2"));
-    }
-
-    static void setup(WebServerConfig.Builder server) {
-        server.routing(SignatureMain::routing1)
-                .putSocket("service2", socket -> socket
-                        .routing(SignatureMain::routing2));
-    }
-
-    private static void routing2(HttpRouting.Builder routing) {
-        SecurityHttpFeature security = SecurityHttpFeature.create(security2())
-                .securityDefaults(SecurityFeature.authenticate());
-
-        routing.addFeature(security)
-                .get("/service2*", SecurityFeature.rolesAllowed("user"))
-                .register(new Service2());
-    }
-
-    private static void routing1(HttpRouting.Builder routing) {
-        SecurityHttpFeature security = SecurityHttpFeature.create(security1())
-                .securityDefaults(SecurityFeature.authenticate());
-        routing.addFeature(security)
-                .get("/service1*", SecurityFeature.rolesAllowed("user"))
-                .register(new Service1());
-    }
-
-    private static Security security2() {
-        return Security.builder()
-                .providerSelectionPolicy(CompositeProviderSelectionPolicy
-                        .builder()
-                        .addAuthenticationProvider("http-signatures", CompositeProviderFlag.OPTIONAL)
-                        .addAuthenticationProvider("basic-auth")
-                        .build())
-                .addProvider(HttpBasicAuthProvider
-                                .builder()
-                                .realm("mic")
-                                .userStore(users()),
-                        "basic-auth")
-                .addProvider(HttpSignProvider.builder()
-                                .addInbound(InboundClientDefinition
-                                        .builder("service1-hmac")
-                                        .principalName("Service1 - HMAC signature")
-                                        .hmacSecret("somePasswordForHmacShouldBeEncrypted")
-                                        .build())
-                                .addInbound(InboundClientDefinition
-                                        .builder("service1-rsa")
-                                        .principalName("Service1 - RSA signature")
-                                        .publicKeyConfig(Keys.builder()
-                                                .keystore(k -> k
-                                                        .keystore(Resource.create("keystore.p12"))
-                                                        .passphrase("password")
-                                                        .certAlias("service_cert")
-                                                        .build())
-                                                .build())
-                                        .build()),
-                        "http-signatures")
-                .build();
-    }
-
-    private static Security security1() {
-        return Security.builder()
-                .providerSelectionPolicy(CompositeProviderSelectionPolicy
-                        .builder()
-                        .addOutboundProvider("basic-auth")
-                        .addOutboundProvider("http-signatures")
-                        .build())
-                .addProvider(HttpBasicAuthProvider
-                                .builder()
-                                .realm("mic")
-                                .userStore(users())
-                                .addOutboundTarget(OutboundTarget.builder("propagate-all").build()),
-                        "basic-auth")
-                .addProvider(HttpSignProvider
-                                .builder()
-                                .outbound(OutboundConfig
-                                        .builder()
-                                        .addTarget(hmacTarget())
-                                        .addTarget(rsaTarget())
-                                        .build()),
-                        "http-signatures")
-                .build();
-    }
-
-    private static OutboundTarget rsaTarget() {
-        return OutboundTarget.builder("service2-rsa")
-                .addHost("localhost")
-                .addPath("/service2-rsa.*")
-                .customObject(OutboundTargetDefinition.class,
-                        OutboundTargetDefinition.builder("service1-rsa")
-                                .privateKeyConfig(Keys.builder()
-                                        .keystore(k -> k
-                                                .keystore(Resource.create("keystore.p12"))
-                                                .passphrase("password")
-                                                .keyAlias("myPrivateKey")
-                                                .build())
-                                        .build())
-                                .build())
-                .build();
-    }
-
-    private static OutboundTarget hmacTarget() {
-        return OutboundTarget.builder("service2")
-                .addHost("localhost")
-                .addPath("/service2")
-                .customObject(
-                        OutboundTargetDefinition.class,
-                        OutboundTargetDefinition
-                                .builder("service1-hmac")
-                                .hmacSecret("somePasswordForHmacShouldBeEncrypted")
-                                .build())
-                .build();
-    }
-
-    private static SecureUserStore users() {
-        return login -> Optional.ofNullable(USERS.get(login));
-    }
-}
diff --git a/archetypes/helidon/src/main/archetype/se/custom/files/src/main/resources/WEB/index-google.html b/archetypes/helidon/src/main/archetype/se/custom/files/src/main/resources/WEB/google-login.html
similarity index 100%
rename from archetypes/helidon/src/main/archetype/se/custom/files/src/main/resources/WEB/index-google.html
rename to archetypes/helidon/src/main/archetype/se/custom/files/src/main/resources/WEB/google-login.html
diff --git a/archetypes/helidon/src/main/archetype/se/custom/files/src/test/java/__pkg__/GoogleMainTest.java.mustache b/archetypes/helidon/src/main/archetype/se/custom/files/src/test/java/__pkg__/GoogleMainTest.java.mustache
deleted file mode 100644
index 38071538e0f..00000000000
--- a/archetypes/helidon/src/main/archetype/se/custom/files/src/test/java/__pkg__/GoogleMainTest.java.mustache
+++ /dev/null
@@ -1,44 +0,0 @@
-
-package {{package}};
-
-import io.helidon.http.HeaderNames;
-import io.helidon.http.Status;
-import io.helidon.webserver.testing.junit5.ServerTest;
-import io.helidon.webserver.testing.junit5.SetUpServer;
-import io.helidon.webclient.http1.Http1Client;
-import io.helidon.webclient.http1.Http1ClientResponse;
-import io.helidon.webserver.WebServerConfig;
-
-import org.junit.jupiter.api.Test;
-
-import static io.helidon.common.testing.junit5.OptionalMatcher.optionalValue;
-import static org.hamcrest.CoreMatchers.is;
-import static org.hamcrest.MatcherAssert.assertThat;
-
-/**
- * Unit test for {@link GoogleBuilderMain}.
- */
-@ServerTest
-public class GoogleMainTest {
-
-    private final Http1Client client;
-
-    GoogleMainTest(Http1Client client) {
-        this.client = client;
-    }
-
-    @SetUpServer
-    public static void setup(WebServerConfig.Builder server) {
-        GoogleMain.setup(server);
-    }
-
-    @Test
-    public void testEndpoint() {
-        try (Http1ClientResponse response = client.get("/rest/profile").request()) {
-
-            assertThat(response.status(), is(Status.UNAUTHORIZED_401));
-            assertThat(response.headers().first(HeaderNames.WWW_AUTHENTICATE),
-                    optionalValue(is("Bearer realm=\"helidon\",scope=\"openid profile email\"")));
-        }
-    }
-}
diff --git a/archetypes/helidon/src/main/archetype/se/custom/security-outputs.xml b/archetypes/helidon/src/main/archetype/se/custom/security-outputs.xml
index fc134386516..ea13511f7da 100644
--- a/archetypes/helidon/src/main/archetype/se/custom/security-outputs.xml
+++ b/archetypes/helidon/src/main/archetype/se/custom/security-outputs.xml
@@ -141,20 +141,13 @@ Build and run the application and then try the endpoints:
         </method>
         <method name="security-google">
             <output if="${security.atn} contains ['google']">
-                <templates engine="mustache" transformations="mustache,packaged">
-                    <directory>files</directory>
-                    <includes>
-                        <include>src/*/java/**/GoogleMain.java.mustache</include>
-                        <include>src/*/java/**/GoogleMainTest.java.mustache</include>
-                    </includes>
-                </templates>
                 <files>
                     <directory>files</directory>
                     <includes>
                         <include>src/*/resources/**/static.js/google-app.js</include>
                     </includes>
                 </files>
-                <file source="files/src/main/resources/WEB/index-google.html" target="src/main/resources/WEB/index.html"/>
+                <file source="files/src/main/resources/WEB/google-login.html" target="src/main/resources/WEB/google-login.html"/>
                 <model>
                     <list key="dependencies">
                         <map>
@@ -166,6 +159,55 @@ Build and run the application and then try the endpoints:
                             <value key="artifactId">helidon-webserver-static-content</value>
                         </map>
                     </list>
+                    <list key="Main-helidon-imports">
+                        <value>java.util.Optional</value>
+                    </list>
+                    <list key="Main-helidon-imports">
+                        <value>io.helidon.http.HttpMediaTypes</value>
+                        <value>io.helidon.security.Security</value>
+                        <value>io.helidon.security.SecurityContext</value>
+                        <value>io.helidon.security.Subject</value>
+                        <value>io.helidon.security.providers.google.login.GoogleTokenProvider</value>
+                        <value>io.helidon.webserver.WebServer</value>
+                        <value>io.helidon.webserver.WebServerConfig</value>
+                        <value>io.helidon.webserver.context.ContextFeature</value>
+                        <value>io.helidon.webserver.security.SecurityFeature</value>
+                        <value>io.helidon.webserver.staticcontent.StaticContentService</value>
+                    </list>
+                    <list key="Main-main">
+                        <value><![CDATA[
+        Security security = Security.builder()
+                .addProvider(GoogleTokenProvider.builder()
+                        .clientId("your-client-id.apps.googleusercontent.com"))
+                .build();
+]]></value>
+                    </list>
+                    <list key="Main-server-builder">
+                        <value><![CDATA[.featuresDiscoverServices(false)
+                .addFeature(ContextFeature.create())
+                .addFeature(SecurityFeature.builder()
+                                    .security(security)
+                                    .build())
+]]></value>
+                    </list>
+                    <list key="Main-routing-builder">
+                        <value><![CDATA[.get("/rest/profile", SecurityFeature.authenticate(),
+                 (req, res) -> {
+                        Optional<SecurityContext> securityContext = req.context().get(SecurityContext.class);
+                        res.headers().contentType(HttpMediaTypes.PLAINTEXT_UTF_8);
+                        res.send("Response from builder based service, you are: \n" + securityContext
+                                .flatMap(SecurityContext::user)
+                                .map(Subject::toString)
+                                .orElse("Security context is null"));
+                        res.next();
+                    })
+            .register(StaticContentService.create("/WEB"))
+]]></value>
+                    </list>
+                    <list key="Main-logging">
+                        <value><![CDATA[
+            System.out.println("Check Google login http://localhost:" + server.port() + "/google-login.html");]]></value>
+                    </list>
                     <list key="security-properties">
                         <value><![CDATA[    google-client-id: "your-app-id.apps.googleusercontent.com"
     proxy-host: ""]]></value>
@@ -203,11 +245,6 @@ Update the following files with your client id (it should support http://localho
 1. src/main/resources/application.yaml - set security.properties.google-client-id or override it in a file in ~/helidon/examples.yaml
 2. src/main/resources/WEB/index.html - update the meta tag in header with name "google-signin-client_id"
 3. src/main/java/io/helidon/security/examples/google/GoogleMain.java - update the client id in builder of provider
-
-## Exercise Google example
-```bash
-java -cp target/{{artifactId}}.jar {{package}}.GoogleMain
-```
 ]]></value>
                     </list>
                 </model>
@@ -218,8 +255,6 @@ java -cp target/{{artifactId}}.jar {{package}}.GoogleMain
                 <templates engine="mustache" transformations="mustache,packaged">
                     <directory>files</directory>
                     <includes>
-                        <include>src/*/java/**/OutboundOverrideJwt.java.mustache</include>
-                        <include>src/*/java/**/OutboundOverrideJwtTest.java.mustache</include>
                         <include>src/*/java/**/JwtOverrideService.java.mustache</include>
                     </includes>
                 </templates>
@@ -251,8 +286,57 @@ java -cp target/{{artifactId}}.jar {{package}}.GoogleMain
                             <value key="artifactId">helidon-bundles-config</value>
                         </map>
                     </list>
-                    <list key="providers-config-entries">
-                        <value file="files/application.jwt.yaml"/>
+                    <list key="Main-helidon-imports">
+                        <value>io.helidon.config.Config</value>
+                        <value>io.helidon.config.ConfigSources</value>
+                        <value>io.helidon.http.HeaderNames</value>
+                        <value>io.helidon.security.Principal</value>
+                        <value>io.helidon.security.SecurityContext</value>
+                        <value>io.helidon.security.Subject</value>
+                        <value>io.helidon.webserver.WebServer</value>
+                        <value>io.helidon.webserver.WebServerConfig</value>
+                        <value>io.helidon.webserver.security.SecurityHttpFeature</value>
+                    </list>
+                    <list key="Main-main">
+                        <value><![CDATA[
+        Config clientConfig = Config.create(ConfigSources.classpath("client-service-jwt.yaml"));
+        Config backendConfig = Config.create(ConfigSources.classpath("backend-service-jwt.yaml"));
+]]></value>
+                    </list>
+                    <list key="Main-after-server">
+                        <value><![CDATA[
+        server.context().register(server);
+]]></value>
+                    </list>
+                    <list key="Main-server-builder">
+                        <value><![CDATA[// backend that prints the current user
+                .putSocket("backend", socket -> socket
+                        .routing(routing -> routing
+                                .addFeature(SecurityHttpFeature.create(backendConfig.get("security.web-server")))
+                                .get("/hello", (req, res) -> {
+
+                                    // This is the token. It should be bearer <signed JWT base64 encoded>
+                                    req.headers().first(HeaderNames.AUTHORIZATION)
+                                            .ifPresent(System.out::println);
+
+                                    String username = req.context()
+                                            .get(SecurityContext.class)
+                                            .flatMap(SecurityContext::user)
+                                            .map(Subject::principal)
+                                            .map(Principal::getName)
+                                            .orElse("Anonymous");
+
+                                    res.send(username);
+                                })))
+]]></value>
+                    </list>
+                    <list key="Main-routing-builder">
+                        <value><![CDATA[.addFeature(SecurityHttpFeature.create(clientConfig.get("security.web-server")))
+                .register(new JwtOverrideService())
+]]></value>
+                    </list>
+                    <list key="Main-routing">
+                        <value><![CDATA[        Config clientConfig = Config.create(ConfigSources.classpath("client-service-jwt.yaml"));]]></value>
                     </list>
                     <list key="module-requires">
                         <value>io.helidon.webclient.security</value>
@@ -263,12 +347,6 @@ java -cp target/{{artifactId}}.jar {{package}}.GoogleMain
                         <value template="mustache"><![CDATA[
 ## Try JWT
 
-Run the application:
-```bash
-java -cp target/{{artifactId}}.jar {{package}}.OutboundOverrideJwt
-```
-
-Try the endpoints:
 ```bash
 curl -u "jack:password" http://localhost:8080/propagate
 curl -u "jack:password" http://localhost:8080/override
@@ -287,8 +365,6 @@ curl -u "jill:anotherPassword" http://localhost:8080/override
                     <includes>
                         <include>src/*/java/**/Service1.java.mustache</include>
                         <include>src/*/java/**/Service2.java.mustache</include>
-                        <include>src/*/java/**/SignatureMain.java.mustache</include>
-                        <include>src/*/java/**/SignatureMainTest.java.mustache</include>
                     </includes>
                 </templates>
                 <model>
@@ -306,6 +382,186 @@ curl -u "jill:anotherPassword" http://localhost:8080/override
                             <value key="artifactId">helidon-config-hocon</value>
                         </map>
                     </list>
+                    <list key="Main-java-imports">
+                        <value>java.util.Arrays</value>
+                        <value>java.util.Collection</value>
+                        <value>java.util.HashMap</value>
+                        <value>java.util.List</value>
+                        <value>java.util.Map</value>
+                        <value>java.util.Optional</value>
+                    </list>
+                    <list key="Main-helidon-imports">
+                        <value>io.helidon.common.configurable.Resource</value>
+                        <value>io.helidon.common.pki.Keys</value>
+                        <value>io.helidon.security.CompositeProviderFlag</value>
+                        <value>io.helidon.security.CompositeProviderSelectionPolicy</value>
+                        <value>io.helidon.security.Security</value>
+                        <value>io.helidon.security.providers.common.OutboundConfig</value>
+                        <value>io.helidon.security.providers.common.OutboundTarget</value>
+                        <value>io.helidon.security.providers.httpauth.HttpBasicAuthProvider</value>
+                        <value>io.helidon.security.providers.httpauth.SecureUserStore</value>
+                        <value>io.helidon.security.providers.httpsign.HttpSignProvider</value>
+                        <value>io.helidon.security.providers.httpsign.InboundClientDefinition</value>
+                        <value>io.helidon.security.providers.httpsign.OutboundTargetDefinition</value>
+                        <value>io.helidon.webserver.security.SecurityFeature</value>
+                        <value>io.helidon.webserver.security.SecurityHttpFeature</value>
+                    </list>
+                    <list key="main-class-fields">
+                        <value><![CDATA[
+    private static final Map<String, SecureUserStore.User> USERS = new HashMap<>();
+
+    static {
+        addUser("jack", "password", List.of("user", "admin"));
+        addUser("jill", "password", List.of("user"));
+        addUser("john", "password", List.of());
+    }
+
+    private static void addUser(String user, String password, List<String> roles) {
+        USERS.put(user, new SecureUserStore.User() {
+            @Override
+            public String login() {
+                return user;
+            }
+
+            char[] password() {
+                return password.toCharArray();
+            }
+
+            @Override
+            public boolean isPasswordValid(char[] password) {
+                return Arrays.equals(password(), password);
+            }
+
+            @Override
+            public Collection<String> roles() {
+                return roles;
+            }
+        });
+    }
+]]></value>
+                    </list>
+                    <list key="Main-routing">
+                        <value><![CDATA[
+        SecurityHttpFeature security = SecurityHttpFeature.create(security1())
+                .securityDefaults(SecurityFeature.authenticate());
+]]></value>
+                    </list>
+                    <list key="Main-routing-builder">
+                        <value><![CDATA[.addFeature(security)
+                .get("/service1*", SecurityFeature.rolesAllowed("user"))
+                .register(new Service1())
+]]></value>
+                    </list>
+                    <list key="main-class-content">
+                        <value><![CDATA[
+private static void routing2(HttpRouting.Builder routing) {
+        SecurityHttpFeature security = SecurityHttpFeature.create(security2())
+                .securityDefaults(SecurityFeature.authenticate());
+
+        routing.addFeature(security)
+                .get("/service2*", SecurityFeature.rolesAllowed("user"))
+                .register(new Service2());
+    }
+
+    private static Security security2() {
+        return Security.builder()
+                .providerSelectionPolicy(CompositeProviderSelectionPolicy
+                        .builder()
+                        .addAuthenticationProvider("http-signatures", CompositeProviderFlag.OPTIONAL)
+                        .addAuthenticationProvider("basic-auth")
+                        .build())
+                .addProvider(HttpBasicAuthProvider
+                                .builder()
+                                .realm("mic")
+                                .userStore(users()),
+                        "basic-auth")
+                .addProvider(HttpSignProvider.builder()
+                                .addInbound(InboundClientDefinition
+                                        .builder("service1-hmac")
+                                        .principalName("Service1 - HMAC signature")
+                                        .hmacSecret("somePasswordForHmacShouldBeEncrypted")
+                                        .build())
+                                .addInbound(InboundClientDefinition
+                                        .builder("service1-rsa")
+                                        .principalName("Service1 - RSA signature")
+                                        .publicKeyConfig(Keys.builder()
+                                                .keystore(k -> k
+                                                        .keystore(Resource.create("keystore.p12"))
+                                                        .passphrase("password")
+                                                        .certAlias("service_cert")
+                                                        .build())
+                                                .build())
+                                        .build()),
+                        "http-signatures")
+                .build();
+    }
+
+    private static Security security1() {
+        return Security.builder()
+                .providerSelectionPolicy(CompositeProviderSelectionPolicy
+                        .builder()
+                        .addOutboundProvider("basic-auth")
+                        .addOutboundProvider("http-signatures")
+                        .build())
+                .addProvider(HttpBasicAuthProvider
+                                .builder()
+                                .realm("mic")
+                                .userStore(users())
+                                .addOutboundTarget(OutboundTarget.builder("propagate-all").build()),
+                        "basic-auth")
+                .addProvider(HttpSignProvider
+                                .builder()
+                                .outbound(OutboundConfig
+                                        .builder()
+                                        .addTarget(hmacTarget())
+                                        .addTarget(rsaTarget())
+                                        .build()),
+                        "http-signatures")
+                .build();
+    }
+
+    private static OutboundTarget rsaTarget() {
+        return OutboundTarget.builder("service2-rsa")
+                .addHost("localhost")
+                .addPath("/service2-rsa.*")
+                .customObject(OutboundTargetDefinition.class,
+                        OutboundTargetDefinition.builder("service1-rsa")
+                                .privateKeyConfig(Keys.builder()
+                                        .keystore(k -> k
+                                                .keystore(Resource.create("keystore.p12"))
+                                                .passphrase("password")
+                                                .keyAlias("myPrivateKey")
+                                                .build())
+                                        .build())
+                                .build())
+                .build();
+    }
+
+    private static OutboundTarget hmacTarget() {
+        return OutboundTarget.builder("service2")
+                .addHost("localhost")
+                .addPath("/service2")
+                .customObject(
+                        OutboundTargetDefinition.class,
+                        OutboundTargetDefinition
+                                .builder("service1-hmac")
+                                .hmacSecret("somePasswordForHmacShouldBeEncrypted")
+                                .build())
+                .build();
+    }
+
+    private static SecureUserStore users() {
+        return login -> Optional.ofNullable(USERS.get(login));
+    }
+]]></value>
+                    </list>
+                    <list key="Main-server-builder">
+                        <value><![CDATA[.putSocket("service2", socket -> socket
+                        .routing(Main::routing2))]]></value>
+                    </list>
+                    <list key="Main-after-server">
+                        <value><![CDATA[server.context().register(server);]]></value>
+                    </list>
                     <list key="module-requires">
                         <value>io.helidon.webclient.http1</value>
                         <value>io.helidon.common.pki</value>
@@ -318,12 +574,6 @@ curl -u "jill:anotherPassword" http://localhost:8080/override
                         <value template="mustache"><![CDATA[
 ## Try Signature
 
-```bash
-mvn package
-java -cp target/{{artifactId}}.jar {{package}}.SignatureMain
-```
-
-Try the endpoints:
 ```bash
 curl -u "jack:password" http://localhost:8080/service1
 curl -u "jill:password" http://localhost:8080/service1-rsa
@@ -347,15 +597,22 @@ curl -v -u "john:password" http://localhost:8080/service1
                             <value key="artifactId">helidon-security-abac-role</value>
                         </map>
                     </list>
+                    <list key="providers-config-entries">
+                        <value><![CDATA[
+  - abac:
+      fail-on-unvalidated: true
+      fail-if-none-validated: true
+]]></value>
+                    </list>
                 </model>
             </output>
         </method>
     </methods>
+    <call method="security-abac"/>
     <call method="security-oidc"/>
     <call method="security-google"/>
     <call method="security-jwt"/>
     <call method="security-signature"/>
-    <call method="security-abac"/>
     <output>
         <model>
             <list key="dependencies">
@@ -374,7 +631,8 @@ security:
                 <value>io.helidon.security.integration.common</value>
                 <value>io.helidon.webserver.security</value>
             </list>
-            <list key="application-yaml-entries" if="!(${security.atn} == [ 'http-signature' ])">
+            <list key="application-yaml-entries"
+                  if="!(${security.atn} contains 'http-signature' || ${security.atn} contains 'jwt')">
                 <value template="mustache"><![CDATA[
 {{#security}}