Open Felk opened 1 month ago
I've created a small testcase that showcases a missing authentications
entry in the ApiClient:
Subject: [PATCH] create test for issue 19168 regarding OIDC support in java CodeGen
---
Index: modules/openapi-generator/src/test/java/org/openapitools/codegen/java/JavaClientCodegenTest.java
IDEA additional info:
Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
<+>UTF-8
===================================================================
diff --git a/modules/openapi-generator/src/test/java/org/openapitools/codegen/java/JavaClientCodegenTest.java b/modules/openapi-generator/src/test/java/org/openapitools/codegen/java/JavaClientCodegenTest.java
--- a/modules/openapi-generator/src/test/java/org/openapitools/codegen/java/JavaClientCodegenTest.java (revision 304ff965776ea7c7c16e798ae1b82e31e01b5afa)
+++ b/modules/openapi-generator/src/test/java/org/openapitools/codegen/java/JavaClientCodegenTest.java (date 1721050184687)
@@ -2955,4 +2955,24 @@
}
+ @Test
+ void openidConnect_generates_authentications_entry_issue_19168() {
+ final CodegenConfigurator configurator = new CodegenConfigurator()
+ .setGeneratorName("java")
+ .setLibrary(WEBCLIENT)
+ .addGlobalProperty(CodegenConstants.MODEL_DOCS, "false")
+ .addGlobalProperty(CodegenConstants.MODEL_TESTS, "false")
+ .setInputSpec("src/test/resources/3_1/java/issue_19168_openidconnect.json")
+ .setOutputDir(newTempFolder().toString().replace("\\", "/"));
+
+ List<File> files = new DefaultGenerator().opts(configurator.toClientOptInput()).generate();
+
+ assertThat(files)
+ .filteredOn(f -> f.getName().endsWith("ApiClient.java"))
+ .hasSize(1).first(FILE).content()
+ .contains(
+ "authentications = new HashMap<String, Authentication>();",
+ "authentications.put(\"Keycloak\", new OpenIdConnectAuth());"
+ );
+ }
}
Index: modules/openapi-generator/src/test/resources/3_1/java/issue_19168_openidconnect.json
IDEA additional info:
Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
<+>UTF-8
===================================================================
diff --git a/modules/openapi-generator/src/test/resources/3_1/java/issue_19168_openidconnect.json b/modules/openapi-generator/src/test/resources/3_1/java/issue_19168_openidconnect.json
new file mode 100644
--- /dev/null (date 1721049746320)
+++ b/modules/openapi-generator/src/test/resources/3_1/java/issue_19168_openidconnect.json (date 1721049746320)
@@ -0,0 +1,34 @@
+{
+ "openapi" : "3.0.3",
+ "info" : {
+ "title" : "My API",
+ "version" : "1.0.0"
+ },
+ "security" : [ {
+ "Keycloak" : [ ]
+ } ],
+ "paths" : {
+ "/api/stuff" : {
+ "post" : {
+ "summary" : "Does something important.",
+ "responses" : {
+ "200" : {
+ "description" : "Everything went well"
+ }
+ },
+ "security" : [ {
+ "Keycloak" : [ "api_access" ]
+ } ]
+ }
+ }
+ },
+ "components" : {
+ "securitySchemes" : {
+ "Keycloak" : {
+ "type" : "openIdConnect",
+ "description" : "This service is secured through OIDC, implemented by Keycloak",
+ "openIdConnectUrl" : "https://auth.example.com/realms/myrealm/.well-known/openid-configuration"
+ }
+ }
+ }
+}
As a workaround in the meantime: Does anyone know how I could disable authentication altogether? The OpenAPI I'm consuming does have OIDC, but it's handled on a different layer so I don't actually need openapi-generator's support for it right now. The only workarounds I found so far was either downgrading to 6.5, or overriding the API template to hardcode localVarAuthNames
to an empty array
@Felk what about removing security/auth setting in the spec as a workaround?
@wing328 that's a good suggestion. Unfortunately it doesn't quite work for us since we're currently downloading and processing the OpenAPI in a build step and therefore don't have a chance to manually modify it in-between. We also can't remove the authentication from the source since other consumers of the OpenAPI spec rely on the authentication to be there.
Same error for me with this OIDC security schema:
securitySchemes:
OIDC-Auth:
bearerFormat: jwt
flows:
authorizationCode:
authorizationUrl: https://sso.project-io.eu/realms/REALM/protocol/openid-connect/auth
scopes:
email: email
openid: openid
profile: profile
tokenUrl: https://sso.project-io.eu/realms/REALM/protocol/openid-connect/token
in: header
name: OIDC-Auth
openIdConnectUrl: https://sso.project-io.eu/realms/REALM/.well-known/openid-configuration
scheme: bearer
type: openIdConnect
and this security section:
security:
- OIDC-Auth: []
Can I do something on the Java consumer side to bypass this error until this issue gets fixed ?
Bug Report Checklist
Description and Reproduction
Given an OpenAPI with a security schema of type
openIdConnect
, e.g.:and a generated Java client, e.g. through the openapi-generator maven plugin in a spring boot project:
invocation fails with the following error:
which is emitted from this generated code:
openapi-generator version and Related issues/PRs
I tested 6.6.0, 7.5.0 and 7.7.0. It worked with 6.5.0 and is "broken" since the initial OIDC support landed in 6.6.0: https://github.com/OpenAPITools/openapi-generator/pull/15417
Investigation and suggested fix
Previous to the initial OIDC support, source generation would just output the following error:
This also caused
localVarAuthNames in api/MyApi.java
to generate as follows:Starting with 6.6.0, the above error is no longer emitted during generation, and instead this code is emitted:
In another generated file, the
invoker/ApiClient.java
, the init method is generated as follows for all versions I tested:The respective mustache file
ApiClient.mustache
currently looks like this:I believe there is a case for
isOpenIdConnect
missing in this template. I don't know how easily it could be added, or whether there needs to be some fallback mechanism for authentication mechanisms that are not supported by some code generators.