package org.apereo.cas.configuration.model.support.azuread;

import org.apereo.cas.configuration.model.core.authentication.AuthenticationHandlerStates;
import org.apereo.cas.configuration.model.core.authentication.PasswordEncoderProperties;
import org.apereo.cas.configuration.model.core.authentication.PrincipalTransformationProperties;
import org.apereo.cas.configuration.support.RequiredProperty;
import org.apereo.cas.configuration.support.RequiresModule;

import com.fasterxml.jackson.annotation.JsonFilter;
import lombok.Getter;
import lombok.Setter;
import lombok.experimental.Accessors;
import org.springframework.boot.context.properties.NestedConfigurationProperty;

import java.io.Serial;
import java.io.Serializable;

/**
 * This is {@link AzureActiveDirectoryAuthenticationProperties}.
 *
 * @author Misagh Moayyed
 * @since 6.2.0
 */
@RequiresModule(name = "cas-server-support-azuread-authentication")
@Getter
@Setter
@Accessors(chain = true)
@JsonFilter("AzureActiveDirectoryAuthenticationProperties")
public class AzureActiveDirectoryAuthenticationProperties implements Serializable {
    @Serial
    private static final long serialVersionUID = -21355975558426360L;

    /**
     * The name of the authentication handler.
     */
    private String name;

    /**
     * The order of this authentication handler in the chain.
     */
    private int order = Integer.MAX_VALUE;

    /**
     * Password encoding properties.
     */
    @NestedConfigurationProperty
    private PasswordEncoderProperties passwordEncoder = new PasswordEncoderProperties();

    /**
     * Principal transformation properties.
     */
    @NestedConfigurationProperty
    private PrincipalTransformationProperties principalTransformation = new PrincipalTransformationProperties();

    /**
     * Client id of the application.
     */
    @RequiredProperty
    private String clientId;

    /**
     * Login url including the tenant id.
     */
    private String loginUrl = "https://login.microsoftonline.com/common/";

    /**
     * Resource url for the graph API to fetch attributes.
     */
    private String resource = "https://graph.microsoft.com/";

    /**
     * A number of authentication handlers are allowed to determine whether they can operate on the provided credential
     * and as such lend themselves to be tried and tested during the authentication handler selection phase.
     * The credential criteria may be one of the following options:<ul>
     * <li>1) A regular expression pattern that is tested against the credential identifier.</li>
     * <li>2) A fully qualified class name of your own design that implements {@code Predicate}.</li>
     * <li>3) Path to an external Groovy script that implements the same interface.</li>
     * </ul>
     */
    private String credentialCriteria;

    /**
     * Define the scope and state of this authentication handler
     * and the lifecycle in which it can be invoked or activated.
     */
    private AuthenticationHandlerStates state = AuthenticationHandlerStates.ACTIVE;
}

@@ -1894,42 +1894,1630 @@
   * 
-Login url including the tenant id.
+This URL of the security token service that CAS goes to for acquiring%0A     * tokens for resources and users%0A     * This URL allows CAS to establish what is called an 'authority'.%0A     * You can think of the authority as the%0A     * directory issuing the identities/tokens. The login URL here is then composed of%0A     * %7B@code https://%3Cinstance%3E/%3Ctenant%3E%7D, where 'instance' is the Azure AD host%0A     * (such as %7B@code https://login.microsoftonline.com%7D) and 'tenant' is the domain name%0A     * (such as %7B@code contoso.onmicrosoft.com%7D) or tenant ID of the directory.%0A     * Examples of authority URL are:%0A     *%0A     * %3Cul%3E%0A     *     %3Cli%3E%7B@code https://login.microsoftonline.com/f31e6716-26e8-4651-b323-2563936b4163%7D: for a single tenant application defined in the tenant%3C/li%3E%0A     *     %3Cli%3E%7B@code https://login.microsoftonline.com/contoso.onmicrosoft.com%7D: This representation is like the previous one, but uses the tenant domain name instead of the tenant Id.%3C/li%3E%0A     *     %3Cli%3E%7B@code https://login.microsoftonline.de/contoso.de%7D: also uses a domain name, but in this case the Azure AD tenant admins have set a custom domain for their tenant, and the%0A     *     instance URL here is for the German national cloud.%3C/li%3E%0A     *     %3Cli%3E%7B@code https://login.microsoftonline.com/common%7D: in the case of a multi-tenant application, that is an application available in several Azure AD tenants.%3C/li%3E%0A     *     %3Cli%3EIt can finally be an Active Directory Federation Services (ADFS) URL, which is recognized%0A     *     with the convention that the URL should contain adfs like %7B@code https://contoso.com/adfs%7D.%3C/li%3E%0A     * %3C/ul%3E
 %0A   

update docs