Skip to content
GitLab
Projects Groups Snippets
  • /
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Sign in / Register
  • O openapi-generator
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
  • Issues 3,476
    • Issues 3,476
    • List
    • Boards
    • Service Desk
    • Milestones
  • Merge requests 402
    • Merge requests 402
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Schedules
  • Deployments
    • Deployments
    • Environments
    • Releases
  • Packages and registries
    • Packages and registries
    • Package Registry
    • Infrastructure Registry
  • Monitor
    • Monitor
    • Incidents
  • Analytics
    • Analytics
    • Value stream
    • CI/CD
    • Repository
  • Wiki
    • Wiki
  • Snippets
    • Snippets
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • OpenAPI Tools
  • openapi-generator
  • Issues
  • #6833
Closed
Open
Issue created Jul 01, 2020 by Administrator@rootContributor5 of 6 checklist items completed5/6 checklist items

[BUG] [Authentication] OR'ing duplicate authMethods

Created by: nhomble

Bug Report Checklist

  • Have you provided a full/minimal spec to reproduce the issue?
  • Have you validated the input using an OpenAPI validator (example)?
  • What's the version of OpenAPI Generator used?
  • Have you search for related issues/PRs?
  • What's the actual output vs expected output?
  • [Optional] Bounty to sponsor the fix (example)
Description

Based off discussion in the spec in here and the Use Multiple Authentication Types section, I should be able to reuse authMethods in the security section of my path.

openapi-generator version

Off master

OpenAPI declaration file content or url

https://github.com/nhomble/repro-multiple-authmethods

components:
  securitySchemes:
    myAuth:
      type: oauth2
      flows:
        authorizationCode:
          scopes:
            read: ability to read
            write: ability to write
            pet: ability on pet
paths:
  /pets
    get:
      summary: get pets
      security:
        - myAuth: [ read, pet ]
        - myAuth: [ write, pet ] # if you can update we'll let you read too
Command line used for generation

The investigation has lead me to the generator, but I was reproducing this off of tests in SpringCodegenTest

Steps to reproduce
  1. define oauth2 scopes in security schemes
  2. use the same securityScheme on an api (with different scopes)
  3. Eval the spring code generator
  4. notice how we lose reference in the swagger annotations

And this has caused issues for me in https://github.com/OpenAPITools/openapi-generator/pull/6358

Suggest a fix

Debugging has brought us to the line

Map<String, SecurityScheme> authMethods = getAuthMethods(securities, securitySchemes); 

in DefaultGenerator.java

the loops blindly put auth methods into the authMethods map by name even if the key exists. Maybe we need to consider accumulating collisions in the value and then iterate later in generation.

Assignee
Assign to
Time tracking