io.swagger.v3.oas.models.security.OAuthFlow Java Exaples

Source File: OpenApiObjectGenerator.java From flow with Apache License 2.0

6 votes

private OpenAPI createBasicModel() {
    OpenAPI openAPI = new OpenAPI();

    Info info = new Info();
    info.setTitle(configuration.getApplicationTitle());
    info.setVersion(configuration.getApplicationApiVersion());
    openAPI.setInfo(info);

    Paths paths = new Paths();
    openAPI.setPaths(paths);

    Server server = new Server();
    server.setUrl(configuration.getServerUrl());
    server.setDescription(configuration.getServerDescription());
    openAPI.setServers(Collections.singletonList(server));
    Components components = new Components();
    SecurityScheme vaadinConnectOAuth2Scheme = new SecurityScheme()
            .type(SecurityScheme.Type.OAUTH2)
            .flows(new OAuthFlows().password(new OAuthFlow()
                    .tokenUrl(VAADIN_CONNECT_OAUTH2_TOKEN_URL)
                    .scopes(new Scopes())));
    components.addSecuritySchemes(VAADIN_CONNECT_OAUTH2_SECURITY_SCHEME,
            vaadinConnectOAuth2Scheme);
    openAPI.components(components);
    return openAPI;
}

Source File: JaxRsActivatorNew.java From pnc with Apache License 2.0

6 votes

private SecurityScheme getAuthScheme() {
    try {
        final KeycloakClientConfig keycloakConfig = systemConfig.getKeycloakServiceAccountConfig();
        if (keycloakConfig == null || StringUtils.isEmpty(keycloakConfig.getAuthServerUrl())) {
            return null;
        }
        URI keycloakURL = new URI(keycloakConfig.getAuthServerUrl() + "/")
                .resolve("realms/" + keycloakConfig.getRealm() + "/protocol/openid-connect/auth");

        final OAuthFlow implicitFlow = new OAuthFlow().authorizationUrl(keycloakURL.toString());

        SecurityScheme scheme = new SecurityScheme();
        scheme.type(SecurityScheme.Type.OAUTH2)
                .description("This application uses Keycloak oauth authentication")
                .flows(new OAuthFlows().implicit(implicitFlow));
        return scheme;
    } catch (URISyntaxException ex) {
        logger.warn("Failed to parse Keycloak setting", ex);
        return null;
    }
}

Source File: OASParserUtil.java From carbon-apimgt with Apache License 2.0

6 votes

private static void setScopes(final OpenAPI destOpenAPI, final Set<Scope> aggregatedScopes) {
    Map<String, SecurityScheme> securitySchemes;
    SecurityScheme securityScheme;
    OAuthFlow oAuthFlow;
    Scopes scopes = new Scopes();
    if (destOpenAPI.getComponents() != null &&
            (securitySchemes = destOpenAPI.getComponents().getSecuritySchemes()) != null &&
            (securityScheme = securitySchemes.get(OAS3Parser.OPENAPI_SECURITY_SCHEMA_KEY)) != null &&
            (oAuthFlow = securityScheme.getFlows().getImplicit()) != null) {

        Map<String, String> scopeBindings = new HashMap<>();

        for (Scope scope : aggregatedScopes) {
            scopes.addString(scope.getKey(), scope.getDescription());
            scopeBindings.put(scope.getKey(), scope.getRoles());
        }

        oAuthFlow.setScopes(scopes);

        Map<String, Object> extensions = new HashMap<>();
        extensions.put(APIConstants.SWAGGER_X_SCOPES_BINDINGS, scopeBindings);
        oAuthFlow.setExtensions(extensions);
    }
}

Source File: SecurityParser.java From springdoc-openapi with Apache License 2.0

5 votes

/**
 * Is empty boolean.
 *
 * @param oAuthFlow the o auth flow
 * @return the boolean
 */
private static boolean isEmpty(io.swagger.v3.oas.annotations.security.OAuthFlow oAuthFlow) {
	boolean result;
	if (oAuthFlow == null)
		result = true;
	else if (!StringUtils.isBlank(oAuthFlow.authorizationUrl()) || !StringUtils.isBlank(oAuthFlow.refreshUrl()) || !StringUtils.isBlank(oAuthFlow.tokenUrl()) || !isEmpty(oAuthFlow.scopes()))
		result = false;
	else result = oAuthFlow.extensions().length <= 0;
	return result;
}

Source File: OAuthFlowDiff.java From openapi-diff with Apache License 2.0

5 votes

public Optional<ChangedOAuthFlow> diff(OAuthFlow left, OAuthFlow right) {
  ChangedOAuthFlow changedOAuthFlow = new ChangedOAuthFlow(left, right);
  if (left != null && right != null) {
    changedOAuthFlow
        .setAuthorizationUrl(
            !Objects.equals(left.getAuthorizationUrl(), right.getAuthorizationUrl()))
        .setTokenUrl(!Objects.equals(left.getTokenUrl(), right.getTokenUrl()))
        .setRefreshUrl(!Objects.equals(left.getRefreshUrl(), right.getRefreshUrl()));
  }
  openApiDiff
      .getExtensionsDiff()
      .diff(getExtensions(left), getExtensions(right))
      .ifPresent(changedOAuthFlow::setExtensions);
  return isChanged(changedOAuthFlow);
}

Source File: V2ConverterTest.java From swagger-parser with Apache License 2.0

5 votes

@Test(description = "OAuth 2 flows and URLs were lost ")
public void testIssue28() throws Exception {
    OpenAPI oas = getConvertedOpenAPIFromJsonFile(ISSUE_28_JSON);
    OAuthFlow oAuth2Implicit = oas.getComponents().getSecuritySchemes()
            .get(SECURITY_SCHEMA_OAUTH2).getFlows().getImplicit();
    assertEquals(AUTHORIZATION_URL, oAuth2Implicit.getAuthorizationUrl());
    assertEquals(WRITE_PETS_VALUE, oAuth2Implicit.getScopes().get(SCOPE_WRITE_PETS));
    assertEquals(READ_PETS_VALUE, oAuth2Implicit.getScopes().get(SCOPE_READ_PETS));
}

Source File: OAS3Parser.java From carbon-apimgt with Apache License 2.0

5 votes

/**
 * This method returns the oauth scopes according to the given swagger
 *
 * @param resourceConfigsJSON resource json
 * @return scope set
 * @throws APIManagementException
 */
@Override
public Set<Scope> getScopes(String resourceConfigsJSON) throws APIManagementException {
    OpenAPI openAPI = getOpenAPI(resourceConfigsJSON);
    Map<String, SecurityScheme> securitySchemes;
    SecurityScheme securityScheme;
    OAuthFlow oAuthFlow;
    Scopes scopes;
    if (openAPI.getComponents() != null && (securitySchemes = openAPI.getComponents().getSecuritySchemes()) != null
            && (securityScheme = securitySchemes.get(OPENAPI_SECURITY_SCHEMA_KEY)) != null
            && (oAuthFlow = securityScheme.getFlows().getImplicit()) != null
            && (scopes = oAuthFlow.getScopes()) != null) {
        Set<Scope> scopeSet = new HashSet<>();
        for (Map.Entry<String, String> entry : scopes.entrySet()) {
            Scope scope = new Scope();
            scope.setKey(entry.getKey());
            scope.setName(entry.getKey());
            scope.setDescription(entry.getValue());
            Map<String, String> scopeBindings;
            if (oAuthFlow.getExtensions() != null && (scopeBindings =
                    (Map<String, String>) oAuthFlow.getExtensions().get(APIConstants.SWAGGER_X_SCOPES_BINDINGS))
                    != null) {
                if (scopeBindings.get(scope.getKey()) != null) {
                    scope.setRoles(scopeBindings.get(scope.getKey()));
                }
            }
            scopeSet.add(scope);
        }
        return OASParserUtil.sortScopes(scopeSet);
    } else {
        return OASParserUtil.sortScopes(getScopesFromExtensions(openAPI));
    }
}

Source File: OAS3ParserTest.java From carbon-apimgt with Apache License 2.0

5 votes

@Test
public void testUpdateAPIDefinitionWithExtensions() throws Exception {
    String relativePath = "definitions" + File.separator + "oas3" + File.separator + "oas3Resources.json";
    String oas3Resources = IOUtils.toString(getClass().getClassLoader().getResourceAsStream(relativePath), "UTF-8");
    OpenAPIV3Parser openAPIV3Parser = new OpenAPIV3Parser();

    // check remove vendor extensions
    String definition = testGenerateAPIDefinitionWithExtension(oas3Parser, oas3Resources);
    SwaggerParseResult parseAttemptForV3 = openAPIV3Parser.readContents(definition, null, null);
    OpenAPI openAPI = parseAttemptForV3.getOpenAPI();
    boolean isExtensionNotFound = openAPI.getExtensions() == null || !openAPI.getExtensions()
            .containsKey(APIConstants.SWAGGER_X_WSO2_SECURITY);
    Assert.assertTrue(isExtensionNotFound);
    Assert.assertEquals(2, openAPI.getPaths().size());

    Iterator<Map.Entry<String, PathItem>> itr = openAPI.getPaths().entrySet().iterator();
    while (itr.hasNext()) {
        Map.Entry<String, PathItem> pathEntry = itr.next();
        PathItem path = pathEntry.getValue();
        for (Operation operation : path.readOperations()) {
            Assert.assertFalse(operation.getExtensions().containsKey(APIConstants.SWAGGER_X_SCOPE));
        }
    }

    // check updated scopes in security definition
    Operation itemGet = openAPI.getPaths().get("/items").getGet();
    Assert.assertTrue(itemGet.getSecurity().get(0).get("default").contains("newScope"));

    // check available scopes in security definition
    SecurityScheme securityScheme = openAPI.getComponents().getSecuritySchemes().get("default");
    OAuthFlow implicityOauth = securityScheme.getFlows().getImplicit();
    Assert.assertTrue(implicityOauth.getScopes().containsKey("newScope"));
    Assert.assertEquals("newScopeDescription", implicityOauth.getScopes().get("newScope"));

    Assert.assertTrue(implicityOauth.getExtensions().containsKey(APIConstants.SWAGGER_X_SCOPES_BINDINGS));
    Map<String, String> scopeBinding =
            (Map<String, String>) implicityOauth.getExtensions().get(APIConstants.SWAGGER_X_SCOPES_BINDINGS);
    Assert.assertTrue(scopeBinding.containsKey("newScope"));
    Assert.assertEquals("admin", scopeBinding.get("newScope"));
}

Source File: OpenAPIResourceBeanConfigurationComponentsSecuritySchemesTest.java From springdoc-openapi with Apache License 2.0

4 votes

@Bean
public OpenAPI openApi() {
	return new OpenAPI()
			.components(new Components()

					//HTTP Basic, see: https://swagger.io/docs/specification/authentication/basic-authentication/
					.addSecuritySchemes("basicScheme", new SecurityScheme()
							.type(SecurityScheme.Type.HTTP)
							.scheme("basic")
					)

					//API Key, see: https://swagger.io/docs/specification/authentication/api-keys/
					.addSecuritySchemes("apiKeyScheme", new SecurityScheme()
							.type(SecurityScheme.Type.APIKEY)
							.in(SecurityScheme.In.HEADER)
							.name("X-API-KEY")
					)

					//OAuth 2.0, see: https://swagger.io/docs/specification/authentication/oauth2/
					.addSecuritySchemes("oAuthScheme", new SecurityScheme()
							.type(SecurityScheme.Type.OAUTH2)
							.description("This API uses OAuth 2 with the implicit grant flow. [More info](https://api.example.com/docs/auth)")
							.flows(new OAuthFlows()
									.implicit(new OAuthFlow()
											.authorizationUrl("https://api.example.com/oauth2/authorize")
											.scopes(new Scopes()
													.addString("read_pets", "read your pets")
													.addString("write_pets", "modify pets in your account")
											)
									)
							)
					)
			)
			.addSecurityItem(new SecurityRequirement()
					.addList("basicScheme")
			)
			.addSecurityItem(new SecurityRequirement()
					.addList("apiKeyScheme")
			)
			.addSecurityItem(new SecurityRequirement()
					.addList("oAuthScheme")
			)
			;
}

Source File: ChangedOAuthFlow.java From openapi-diff with Apache License 2.0

4 votes

public ChangedOAuthFlow(OAuthFlow oldOAuthFlow, OAuthFlow newOAuthFlow) {
  this.oldOAuthFlow = oldOAuthFlow;
  this.newOAuthFlow = newOAuthFlow;
}

Source File: OAuthFlowDiff.java From openapi-diff with Apache License 2.0

4 votes

private static Map<String, Object> getExtensions(OAuthFlow oAuthFlow) {
  return ofNullable(oAuthFlow).map(OAuthFlow::getExtensions).orElse(null);
}

Source File: SwaggerConverter.java From swagger-parser with Apache License 2.0

4 votes

private SecurityScheme convertOauth2SecurityScheme(SecuritySchemeDefinition definition) {
    SecurityScheme securityScheme = new SecurityScheme();
    OAuth2Definition oAuth2Definition = (OAuth2Definition) definition;
    OAuthFlows oAuthFlows = new OAuthFlows();
    OAuthFlow oAuthFlow = new OAuthFlow();

    securityScheme.setType(SecurityScheme.Type.OAUTH2);
    String flow = oAuth2Definition.getFlow();

    if (flow != null) {
        switch (flow) {
            case "implicit":
                oAuthFlow.setAuthorizationUrl(oAuth2Definition.getAuthorizationUrl());
                oAuthFlows.setImplicit(oAuthFlow);
                break;
            case "password":
                oAuthFlow.setTokenUrl(oAuth2Definition.getTokenUrl());
                oAuthFlows.setPassword(oAuthFlow);
                break;
            case "application":
                oAuthFlow.setTokenUrl(oAuth2Definition.getTokenUrl());
                oAuthFlows.setClientCredentials(oAuthFlow);
                break;
            case "accessCode":
                oAuthFlow.setAuthorizationUrl(oAuth2Definition.getAuthorizationUrl());
                oAuthFlow.setTokenUrl(oAuth2Definition.getTokenUrl());
                oAuthFlows.setAuthorizationCode(oAuthFlow);
                break;
        }
    }

    Scopes scopes = new Scopes();
    Map<String, String> oAuth2Scopes = oAuth2Definition.getScopes();
    if (oAuth2Scopes != null) {
        oAuth2Scopes.forEach((k, v) -> scopes.addString(k, v));
    }
    oAuthFlow.setScopes(scopes);

    securityScheme.setFlows(oAuthFlows);

    return securityScheme;
}

Source File: OpenAPIDeserializer.java From swagger-parser with Apache License 2.0

4 votes

public OAuthFlow getOAuthFlow(String oAuthFlowType, ObjectNode node, String location, ParseResult result) {
    if (node == null) {
        return null;
    }

    OAuthFlow oAuthFlow = new OAuthFlow();

    boolean authorizationUrlRequired, tokenUrlRequired, refreshUrlRequired, scopesRequired;
    authorizationUrlRequired = tokenUrlRequired = refreshUrlRequired = false;
    scopesRequired = true;
    switch (oAuthFlowType) {
      case "implicit":
        authorizationUrlRequired=true;
        break;
      case "password":
        tokenUrlRequired=true;
        break;
      case "clientCredentials":
        tokenUrlRequired=true;
        break;
      case "authorizationCode":
        authorizationUrlRequired = tokenUrlRequired=true;
        break;
    }

    String value = getString("authorizationUrl", node, authorizationUrlRequired, location, result);
    if (StringUtils.isNotBlank(value)) {
        oAuthFlow.setAuthorizationUrl(value);
    }

    value = getString("tokenUrl", node, tokenUrlRequired, location, result);
    if (StringUtils.isNotBlank(value)) {
        oAuthFlow.setTokenUrl(value);
    }

    value = getString("refreshUrl", node, refreshUrlRequired, location, result);
    if (StringUtils.isNotBlank(value)) {
        oAuthFlow.setRefreshUrl(value);
    }

    ObjectNode scopesObject = getObject("scopes",node, scopesRequired,location,result);

    Scopes scope = new Scopes();
    Set<String> keys = getKeys(scopesObject);
    for(String name : keys) {
        JsonNode scopeValue = scopesObject.get(name);
        if (scopesObject!= null){
            scope.addString(name,scopeValue.asText());
        }
    }
    oAuthFlow.setScopes(scope);

    Map <String,Object> extensions = getExtensions(node);
    if(extensions != null && extensions.size() > 0) {
        oAuthFlow.setExtensions(extensions);
    }

    Set<String> oAuthFlowKeys = getKeys(node);
    for(String key : oAuthFlowKeys) {
        if(!OAUTHFLOW_KEYS.contains(key) && !key.startsWith("x-")) {
            result.extra(location, key, node.get(key));
        }
    }

    return oAuthFlow;
}

Source File: OAS3Parser.java From carbon-apimgt with Apache License 2.0

3 votes

/**
 * This is to avoid removing the `scopes` field of default security scheme when there are no scopes present. This
 * will set an empty scope object there.
 *
 *   securitySchemes:
 *     default:
 *       type: oauth2
 *       flows:
 *         implicit:
 *           authorizationUrl: 'https://test.com'
 *           scopes: {}
 *           x-scopes-bindings: {}
 *
 * @param swagger OpenAPI object
 */
private void checkAndSetEmptyScope(OpenAPI swagger) {
    Components comp = swagger.getComponents();
    Map<String, SecurityScheme> securitySchemeMap;
    SecurityScheme securityScheme;
    OAuthFlows oAuthFlows;
    OAuthFlow implicitFlow;
    if (comp != null && (securitySchemeMap = comp.getSecuritySchemes()) != null &&
            (securityScheme = securitySchemeMap.get(OPENAPI_SECURITY_SCHEMA_KEY)) != null &&
            (oAuthFlows = securityScheme.getFlows()) != null &&
            (implicitFlow = oAuthFlows.getImplicit()) != null && implicitFlow.getScopes() == null) {
        implicitFlow.setScopes(new Scopes());
    }
}

io.swagger.v3.oas.models.security.OAuthFlow Java Examples