package org.synyx.urlaubsverwaltung.api;

import org.springframework.context.annotation.Configuration;
import org.springframework.core.annotation.Order;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

import static org.springframework.security.config.http.SessionCreationPolicy.NEVER;

@Configuration
@Order(1)
public class RestApiSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http
            .antMatcher("/api/**")
            .sessionManagement()
            .sessionCreationPolicy(NEVER)
            .and()
            .httpBasic()
            .and()
            .authorizeRequests()
            .antMatchers("/api/**").authenticated()
            .anyRequest().authenticated();
    }
}

@@ -328,16 +328,93 @@
 Adapter;
+%0Aimport org.synyx.urlaubsverwaltung.security.SecurityConfigurationProperties;
 %0A%0Aimport
@@ -588,24 +588,234 @@
 rAdapter %7B%0A%0A
+    private final boolean isOauth2Enabled;%0A%0A    public RestApiSecurityConfig(SecurityConfigurationProperties properties) %7B%0A        isOauth2Enabled = %22oidc%22.equalsIgnoreCase(properties.getAuth().name());%0A    %7D%0A%0A
     @Overrid
@@ -969,32 +969,34 @@
 t()%0A            
+  
 .sessionCreation
@@ -1032,52 +1032,8 @@
 d()%0A
-            .httpBasic()%0A            .and()%0A
     
@@ -1061,16 +1061,18 @@
 uests()%0A
+  
         
@@ -1127,16 +1127,18 @@
         
+  
 .anyRequ
@@ -1159,16 +1159,137 @@
 cated();
+%0A%0A        if (isOauth2Enabled) %7B%0A            http.oauth2Login();%0A        %7D else %7B%0A            http.httpBasic();%0A        %7D
 %0A    %7D%0A%7D

Add oidc for /api (swagger-ui)