### 2. Configure WSO2

Once WSO2 is up and running, configure WSO2 to generate Self contained id_tokens. In OAuth 2.0 specification there are primarily two ways to provide id_tokens

1. The id_token is an identifier that is hard to guess. For example, a randomly generated string of sufficient length, that the server handling the protected resource can use to lookup the associated authorization information.

/// info | Informação

Se você estiver usando contêineres, por exemplo com Docker ou Kubernetes, falarei mais sobre isso no próximo capítulo: [FastAPI em contêineres - Docker](docker.md){.internal-link target=_blank}.

/**
 * Marks a dependency injection point for constructor, method, or field injection.
 * <p>
 * This annotation is used to identify injection points where the container should
 * provide an instance of the requested type. It can be applied to:
 * <ul>
 *   <li>Constructors</li>
 *   <li>Methods</li>
 *   <li>Fields</li>
 * </ul>
 * <p>
 * Example usage:
 * <pre>
 * public class MyService {

 * under the License.
 */
package org.apache.maven.lifecycle.internal;

import java.util.ArrayList;
import java.util.Arrays;
import java.util.List;

/**
 * Describes the required task segment as provided on the maven command line; i.e. "clean jetty:run install"
 *
 * <strong>NOTE:</strong> This class is not part of any public api and can be changed or deleted without prior notice.
 *
 * @since 3.0
 */

def process_auth(
    credentials: Annotated[Union[str, None], Security(oauth2_scheme)],
    security_scopes: SecurityScopes,
):
    # This is an incorrect way of using it, this is not checking if the scopes are
    # provided by the token, only if the endpoint is requesting them, but the test
    # here is just to check if FastAPI is indeed registering and passing the scopes
    # correctly when using Security with parameterless dependencies.

 * types, and also for interfaces and public classes that have public parameter-less constructors.
 * When the non-null default value for a particular parameter type cannot be provided by {@code
 * NullPointerTester}, the caller can provide a custom non-null default value for the parameter type
 * via {@link #setDefault}.
 *
 * @author Kevin Bourrillion
 * @since 10.0
 */
@GwtIncompatible
@J2ktIncompatible
@NullMarked

        Artifact artifact = getArtifact("c", res.getArtifacts());
        // local wins now, and irrelevant if not local as test/provided aren't transitive
        // assertEquals( Artifact.SCOPE_COMPILE, artifact.getArtifactScope(), "Check artifactScope" );
        assertEquals(Artifact.SCOPE_TEST, artifact.getScope(), "Check artifactScope");
    }

        def extraAttribute = new ExtraAttributeDoc(parse('<td>Extra column</td>'), parse('<td>some value</td>'))
        ClassDoc classDoc = classDoc('Class', content: content)
        PropertyDoc propDoc = propertyDoc('propName', id: 'propId', description: 'prop description', comment: 'prop comment', type: 'org.gradle.Type', attributes: [extraAttribute])
        _ * classDoc.classProperties >> [propDoc]
        _ * classDoc.classMethods >> []

    void testGetUserPrincipal() {
        // Act: Call the method under test
        Principal actualPrincipal = ntlmRequest.getUserPrincipal();

        // Assert: Verify that the returned principal is the same as the one provided in the constructor
        assertSame(mockPrincipal, actualPrincipal, "getUserPrincipal should return the principal object.");
    }

    /**
     * Test method for {@link NtlmHttpServletRequest#getAuthType()}.

    }

    @Override
    public List<Dependency> getManagedDependencies() {
        return Collections.emptyList();
    }

    // TODO: this is duplicate of MavenPluginArtifactHandlerProvider provided one
    static class PluginArtifactHandler implements ArtifactHandler {
        @Override
        public String getClassifier() {
            return null;
        }

        @Override