For the initial experimental release of extensions, the security plugin needs to support a couple dynamic configuration options to support the issuance and verification of auth tokens. All configuration options should fall under a new key in the config.dynamic portion of the security plugin config.yml file. Below is an example of the dynamic configuration options.

config:
  dynamic:
    extensions:
      signing_key: <base64_encoded_signing_key>
      encryption_key: <base64_encoded_encryption_key>

The 2 configuration options above represent 2 initial options needed to support the auth token workflows, but this extensions: area of the config.yml file may be extended in the future with more dynamic configuration options.

The 2 settings above represent:

1. signing_key - This is a base64 encoded secret that will be used to create a JWK to sign the JWTs that are issued - by default the signing is done using symmetric encryption (HMAC SHA512). More configurable keys will be supported in the future, but the default is chosen for the experimental release.
2. encryption_key - This is another base64 encoded secret, but this will be utilized to encrypt sensitive information in the payload of the JWT.

signing_key and encryption_key are also utilized for an authentication backend to support these tokens issued by the security plugin and used to verify the tokens and decrypt the encrypted sections of the payload.

There are 2 java files around config in this codebase: ConfigV6 and ConfigV7. This change will only support OS >=2 so changes can be only applied into ConfigV7.