authorization

[karenetheridge]

given a request object (and operationId or path_template), determine authentication for the request.

• for each of the security schemes itemized in the operation object, evaluate the individual auth implementation against the request object.
• separate implementations required for: "apiKey", "http", "mutualTLS", "oauth2", "openIdConnect":
  • HTTP authentication
  • an API key (either as a header, a cookie parameter or as a query parameter)
  • mutual TLS (use of a client certificate)
  • OAuth2’s common flows (implicit, password, client credentials and authorization code) as defined in RFC6749 - Please note that as of 2020, the implicit flow is about to be deprecated by OAuth 2.0 Security Best Current Practice. Recommended for most use case is Authorization Code Grant flow with PKCE.
  • OpenID Connect Discovery.

[karenetheridge]

Note that a security name must be mentioned both in /components/securitySchemes/<security name> and in /security/<int>/<security name> to be effective... OR (?) in the operation itself for a local effect.

[karenetheridge]

http-basic and api key are quite straightforward - just compare values in headers.