[
  {root_resource_server,
       "auth_oauth2.resource_server_id = new_resource_server_id
        auth_oauth2.scope_prefix = new_resource_server_id.
        auth_oauth2.resource_server_type = new_resource_server_type
        auth_oauth2.additional_scopes_key = my_custom_scope_key
        auth_oauth2.preferred_username_claims.1 = user_name
        auth_oauth2.preferred_username_claims.2 = username
        auth_oauth2.preferred_username_claims.3 = email
        auth_oauth2.verify_aud = true
        auth_oauth2.default_key = id1
        auth_oauth2.signing_keys.id1 = test/config_schema_SUITE_data/certs/key.pem
        auth_oauth2.signing_keys.id2 = test/config_schema_SUITE_data/certs/cert.pem
        auth_oauth2.jwks_uri = https://my-jwt-issuer/jwks.json
        auth_oauth2.jwks_url = https://my-jwt-issuer/jwks.json
        auth_oauth2.issuer = https://my-jwt-issuer
        auth_oauth2.https.cacertfile = test/config_schema_SUITE_data/certs/cacert.pem
        auth_oauth2.https.peer_verification = verify_none
        auth_oauth2.https.depth = 5
        auth_oauth2.https.fail_if_no_peer_cert = false
        auth_oauth2.https.hostname_verification = wildcard
        auth_oauth2.discovery_endpoint_path = /.well-known/openid-configuration
        auth_oauth2.discovery_endpoint_params.param1 = value1
        auth_oauth2.https.crl_check = true
        auth_oauth2.algorithms.1 = HS256
        auth_oauth2.algorithms.2 = RS256",
        [
        {rabbitmq_auth_backend_oauth2, [
            {resource_server_id,<<"new_resource_server_id">>},
            {scope_prefix,<<"new_resource_server_id.">>},
            {resource_server_type,<<"new_resource_server_type">>},
            {extra_scopes_source, <<"my_custom_scope_key">>},
            {preferred_username_claims, [<<"user_name">>, <<"username">>, <<"email">>]},
            {verify_aud, true},
            {issuer, "https://my-jwt-issuer"},
            {discovery_endpoint_path, "/.well-known/openid-configuration"},
            {discovery_endpoint_params, [
                {<<"param1">>, <<"value1">>}
            ]},
            {jwks_uri, "https://my-jwt-issuer/jwks.json"},
            {key_config, [
              {default_key, <<"id1">>},
              {signing_keys,
                  #{
                      <<"id1">> => {pem, <<"I'm not a certificate">>},
                      <<"id2">> => {pem, <<"I'm not a certificate">>}
                  }
              },
              {jwks_url, "https://my-jwt-issuer/jwks.json"},
              {cacertfile, "test/config_schema_SUITE_data/certs/cacert.pem"},
              {peer_verification, verify_none},
              {depth, 5},
              {fail_if_no_peer_cert, false},
              {hostname_verification, wildcard},
              {crl_check, true},
              {algorithms, [<<"HS256">>, <<"RS256">>]}
            ]
            }
        ]}
        ],[]
  },
  {multiple_resource_servers,
       "auth_oauth2.resource_server_id = new_resource_server_id
        auth_oauth2.scope_prefix = new_resource_server_id.
        auth_oauth2.resource_server_type = new_resource_server_type
        auth_oauth2.additional_scopes_key = my_custom_scope_key
        auth_oauth2.preferred_username_claims.1 = user_name
        auth_oauth2.preferred_username_claims.2 = username
        auth_oauth2.preferred_username_claims.3 = email
        auth_oauth2.verify_aud = true
        auth_oauth2.default_key = id1
        auth_oauth2.signing_keys.id1 = test/config_schema_SUITE_data/certs/key.pem
        auth_oauth2.signing_keys.id2 = test/config_schema_SUITE_data/certs/cert.pem
        auth_oauth2.jwks_uri = https://my-jwt-issuer/jwks.json
        auth_oauth2.jwks_url = https://my-jwt-issuer/jwks.json
        auth_oauth2.https.cacertfile = test/config_schema_SUITE_data/certs/cacert.pem
        auth_oauth2.https.peer_verification = verify_none
        auth_oauth2.https.depth = 5
        auth_oauth2.https.fail_if_no_peer_cert = false
        auth_oauth2.https.hostname_verification = wildcard
        auth_oauth2.https.crl_check = true
        auth_oauth2.algorithms.1 = HS256
        auth_oauth2.algorithms.2 = RS256
        auth_oauth2.resource_servers.1.id = rabbitmq-operations
        auth_oauth2.resource_servers.1.scope_prefix = api://
        auth_oauth2.resource_servers.customers.id = rabbitmq-customers
        auth_oauth2.resource_servers.customers.additional_scopes_key = roles",
        [
        {rabbitmq_auth_backend_oauth2, [
            {resource_server_id,<<"new_resource_server_id">>},
            {scope_prefix,<<"new_resource_server_id.">>},
            {resource_server_type,<<"new_resource_server_type">>},
            {extra_scopes_source, <<"my_custom_scope_key">>},
            {preferred_username_claims, [<<"user_name">>, <<"username">>, <<"email">>]},
            {verify_aud, true},
            {jwks_uri, "https://my-jwt-issuer/jwks.json"},
            {resource_servers,
              #{
                <<"rabbitmq-operations">> => [
                  {scope_prefix, <<"api://">>},
                  {id, <<"rabbitmq-operations">>}
                ],
                <<"rabbitmq-customers">> => [
                  {extra_scopes_source, <<"roles">>},
                  {id, <<"rabbitmq-customers">>}
                ]
              }
            },
            {key_config, [
            {default_key, <<"id1">>},
            {signing_keys,
                #{
                    <<"id1">> => {pem, <<"I'm not a certificate">>},
                    <<"id2">> => {pem, <<"I'm not a certificate">>}
                }
            },
            {jwks_url, "https://my-jwt-issuer/jwks.json"},
            {cacertfile, "test/config_schema_SUITE_data/certs/cacert.pem"},
            {peer_verification, verify_none},
            {depth, 5},
            {fail_if_no_peer_cert, false},
            {hostname_verification, wildcard},
            {crl_check, true},
            {algorithms, [<<"HS256">>, <<"RS256">>]}
            ]
            }
        ]}
        ],[]
  },
  {multiple_oauth_providers,
       "auth_oauth2.resource_server_id = new_resource_server_id
        auth_oauth2.scope_prefix = new_resource_server_id.
        auth_oauth2.resource_server_type = new_resource_server_type
        auth_oauth2.additional_scopes_key = my_custom_scope_key
        auth_oauth2.preferred_username_claims.1 = user_name
        auth_oauth2.preferred_username_claims.2 = username
        auth_oauth2.preferred_username_claims.3 = email
        auth_oauth2.verify_aud = true
        auth_oauth2.oauth_providers.uaa.issuer = https://uaa
        auth_oauth2.oauth_providers.keycloak.token_endpoint = https://keycloak/token
        auth_oauth2.oauth_providers.keycloak.jwks_uri = https://keycloak/keys
        auth_oauth2.oauth_providers.keycloak.authorization_endpoint = https://keycloak/authorize
        auth_oauth2.oauth_providers.keycloak.end_session_endpoint = https://keycloak/logout
        auth_oauth2.oauth_providers.keycloak.https.cacertfile = test/config_schema_SUITE_data/certs/cacert.pem
        auth_oauth2.oauth_providers.keycloak.https.verify = verify_none
        auth_oauth2.oauth_providers.keycloak.https.depth = 2
        auth_oauth2.oauth_providers.keycloak.default_key = token-key
        auth_oauth2.oauth_providers.keycloak.signing_keys.id1 = test/config_schema_SUITE_data/certs/key.pem
        auth_oauth2.oauth_providers.keycloak.discovery_endpoint_path = /.well-known/openid-configuration
        auth_oauth2.oauth_providers.keycloak.discovery_endpoint_params.param1 = value1
        auth_oauth2.oauth_providers.keycloak.algorithms.1 = HS256
        auth_oauth2.oauth_providers.keycloak.algorithms.2 = RS256",
        [
        {rabbitmq_auth_backend_oauth2, [
            {resource_server_id,<<"new_resource_server_id">>},
            {scope_prefix,<<"new_resource_server_id.">>},
            {resource_server_type,<<"new_resource_server_type">>},
            {extra_scopes_source, <<"my_custom_scope_key">>},
            {preferred_username_claims, [<<"user_name">>, <<"username">>, <<"email">>]},
            {verify_aud, true},
            {oauth_providers,
              #{
                <<"keycloak">> => [
                  {signing_keys,
                    #{
                        <<"id1">> => {pem, <<"I'm not a certificate">>}
                    }
                  },
                  {https, [
                    {depth, 2},
                    {verify, verify_none},
                    {cacertfile, "test/config_schema_SUITE_data/certs/cacert.pem"}
                  ]},
                  {algorithms, [<<"HS256">>, <<"RS256">>]},
                  {discovery_endpoint_params, [
                     {<<"param1">>, <<"value1">>}
                  ]},
                  {discovery_endpoint_path, "/.well-known/openid-configuration"},
                  {default_key, <<"token-key">>},
                  {end_session_endpoint, "https://keycloak/logout"},
                  {authorization_endpoint, "https://keycloak/authorize"},
                  {jwks_uri, "https://keycloak/keys"},
                  {token_endpoint, "https://keycloak/token"}
                ],
               <<"uaa">> => [
                  {issuer, "https://uaa"}
               ]

              }
            }
        ]}
        ],[]
  },
  {empty_scope_prefix,
       "auth_oauth2.resource_server_id = new_resource_server_id
        auth_oauth2.scope_prefix = '' ",
        [
        {rabbitmq_auth_backend_oauth2, [
            {resource_server_id,<<"new_resource_server_id">>},
            {scope_prefix,<<>>}
        ]}
        ],[]
  }, 
  {scope_aliases_1, 
      "auth_oauth2.resource_server_id = new_resource_server_id
       auth_oauth2.scope_aliases.admin = rabbitmq.tag:administrator 
       auth_oauth2.scope_aliases.developer = rabbitmq.tag:management rabbitmq.read:*/*",
       [
        {rabbitmq_auth_backend_oauth2, [
            {resource_server_id,<<"new_resource_server_id">>},
            {scope_aliases, #{
              <<"admin">> => [ 
                              <<"rabbitmq.tag:administrator">>
                              ],
              <<"developer">> => [ 
                              <<"rabbitmq.tag:management">>,
                              <<"rabbitmq.read:*/*">>
                              ]                              
            }}
        ]}
       ], []
  },
  {scope_aliases_2, 
      "auth_oauth2.resource_server_id = new_resource_server_id
       auth_oauth2.scope_aliases.1.alias = admin
       auth_oauth2.scope_aliases.1.scope = rabbitmq.tag:administrator 
       auth_oauth2.scope_aliases.2.alias = developer
       auth_oauth2.scope_aliases.2.scope = rabbitmq.tag:management rabbitmq.read:*/*",
       [
        {rabbitmq_auth_backend_oauth2, [
            {resource_server_id,<<"new_resource_server_id">>},
            {scope_aliases, #{
              <<"admin">> => [ 
                              <<"rabbitmq.tag:administrator">>
                              ],
              <<"developer">> => [ 
                              <<"rabbitmq.tag:management">>,
                              <<"rabbitmq.read:*/*">>
                              ]                              
            }}
        ]}
       ], []
  },
  {scope_aliases_3, 
      "auth_oauth2.resource_server_id = new_resource_server_id
       auth_oauth2.resource_servers.a.scope_aliases.admin = rabbitmq.tag:administrator 
       auth_oauth2.resource_servers.a.scope_aliases.developer = rabbitmq.tag:management rabbitmq.read:*/*
       auth_oauth2.resource_servers.b.scope_aliases.admin_b = rabbitmq.tag:administrator 
       auth_oauth2.resource_servers.b.scope_aliases.developer_b = rabbitmq.tag:management rabbitmq.read:*/*",
       [
        {rabbitmq_auth_backend_oauth2, [
            {resource_server_id,<<"new_resource_server_id">>},
            {resource_servers, #{
                <<"a">> => [
                    {scope_aliases, #{
                      <<"admin">> => [ 
                              <<"rabbitmq.tag:administrator">>
                              ],
                      <<"developer">> => [ 
                              <<"rabbitmq.tag:management">>,
                              <<"rabbitmq.read:*/*">>
                              ]                              
                    }},
                    {id, <<"a">>}
                ],
                <<"b">> => [
                    {scope_aliases, #{
                      <<"admin_b">> => [ 
                              <<"rabbitmq.tag:administrator">>
                              ],
                      <<"developer_b">> => [ 
                              <<"rabbitmq.tag:management">>,
                              <<"rabbitmq.read:*/*">>
                              ]                              
                    }},
                    {id, <<"b">>}
                ]
              }
            }            
        ]}
       ], []
  },
  {scope_aliases_4, 
      "auth_oauth2.resource_server_id = new_resource_server_id
       auth_oauth2.resource_servers.b.scope_aliases.1.alias = admin_b
       auth_oauth2.resource_servers.b.scope_aliases.1.scope = rabbitmq.tag:administrator 
       auth_oauth2.resource_servers.a.scope_aliases.1.alias = admin
       auth_oauth2.resource_servers.a.scope_aliases.1.scope = rabbitmq.tag:administrator 
       auth_oauth2.resource_servers.a.scope_aliases.2.alias = developer
       auth_oauth2.resource_servers.a.scope_aliases.2.scope = rabbitmq.tag:management rabbitmq.read:*/*",
       [
        {rabbitmq_auth_backend_oauth2, [
            {resource_server_id,<<"new_resource_server_id">>},
            {resource_servers, #{
                <<"a">> => [
                    {scope_aliases, #{
                      <<"admin">> => [ 
                              <<"rabbitmq.tag:administrator">>
                              ],
                      <<"developer">> => [ 
                              <<"rabbitmq.tag:management">>,
                              <<"rabbitmq.read:*/*">>
                              ]                              
                    }},
                    {id, <<"a">>}
                ],
                <<"b">> => [
                    {scope_aliases, #{
                      <<"admin_b">> => [ 
                              <<"rabbitmq.tag:administrator">>
                        ]                              
                    }},
                    {id, <<"b">>}
                ]
              }
            }            
        ]}
       ], []
  }
].
