search

astm-utm / Protocol

ASTM UTM Protocol (API and sequence diagrams)
16 stars 11 forks source link

Investigate multiple scope specification #39

Closed BenjaminPelletier closed 3 years ago

BenjaminPelletier commented 4 years ago

Currently, we map "roles" in the standard to "scopes" of authorization. The result is that sometimes it is appropriate for more than one role to be able to access an endpoint (for instance, making reports to the DSS). Currently, we list multiple scopes for these endpoints, however this may be unintentionally requiring all listed scopes per OpenAPI 3.0. We may need to change from, e.g.:

security:
  - Authority:
      - utm.constraint_management
      - utm.constraint_consumption
      - utm.strategic_coordination

to

security:
  - Authority:
      - utm.constraint_management
  - Authority:
      - utm.constraint_consumption
  - Authority:
      - utm.strategic_coordination