From 15db029c512ebd4d891bb8823c8d8e267765592f Mon Sep 17 00:00:00 2001 From: Chuck Heazel Date: Wed, 28 Nov 2018 18:05:48 -0500 Subject: [PATCH 1/2] Custom Security Schemes Added support for additional security schemes by adding a "custom" value to the security scheme type enumeration and a customType field to distinguish between custom schemes. --- versions/3.1.0.md | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/versions/3.1.0.md b/versions/3.1.0.md index f0c7f54abe..91bc695342 100644 --- a/versions/3.1.0.md +++ b/versions/3.1.0.md @@ -3165,12 +3165,12 @@ animals: #### Security Scheme Object Defines a security scheme that can be used by the operations. -Supported schemes are HTTP authentication, an API key (either as a header, a cookie parameter or as a query parameter), OAuth2's common flows (implicit, password, application and access code) as defined in [RFC6749](https://tools.ietf.org/html/rfc6749), and [OpenID Connect Discovery](https://tools.ietf.org/html/draft-ietf-oauth-discovery-06). +Supported schemes are HTTP authentication, an API key (either as a header, a cookie parameter or as a query parameter), OAuth2's common flows (implicit, password, application and access code) as defined in [RFC6749](https://tools.ietf.org/html/rfc6749), and [OpenID Connect Discovery](https://tools.ietf.org/html/draft-ietf-oauth-discovery-06). Additional "custom" schemes can be described but the level of tool support will be limited. ##### Fixed Fields Field Name | Type | Applies To | Description ---|:---:|---|--- -type | `string` | Any | **REQUIRED**. The type of the security scheme. Valid values are `"apiKey"`, `"http"`, `"oauth2"`, `"openIdConnect"`. +type | `string` | Any | **REQUIRED**. The type of the security scheme. Valid values are `"apiKey"`, `"http"`, `"oauth2"`, `"openIdConnect"`, `"custom"`. description | `string` | Any | A short description for security scheme. [CommonMark syntax](http://spec.commonmark.org/) MAY be used for rich text representation. name | `string` | `apiKey` | **REQUIRED**. The name of the header, query or cookie parameter to be used. in | `string` | `apiKey` | **REQUIRED**. The location of the API key. Valid values are `"query"`, `"header"` or `"cookie"`. @@ -3178,9 +3178,12 @@ Field Name | Type | Applies To | Description bearerFormat | `string` | `http` (`"bearer"`) | A hint to the client to identify how the bearer token is formatted. Bearer tokens are usually generated by an authorization server, so this information is primarily for documentation purposes. flows | [OAuth Flows Object](#oauthFlowsObject) | `oauth2` | **REQUIRED**. An object containing configuration information for the flow types supported. openIdConnectUrl | `string` | `openIdConnect` | **REQUIRED**. OpenId Connect URL to discover OAuth2 configuration values. This MUST be in the form of a URL. +extensionType | `string` | `custom` | **REQUIRED**. When the security scheme type is custom, the customType field provides an identifier for the type of custom scheme. The valid values for this field are not controlled. Use of a well known identifier or MIME Type is encouraged to avoid collisions. This object MAY be extended with [Specification Extensions](#specificationExtensions). +Custom schemes may be processed in much the same manner as extensions. Implementations shall accept "custom" as a valid value for the securitySchemeType field. They shall also validate that the customType field is present and populated when the value of securitySchemeType is "custom". Any additional data needed to describe the custom schema shall be provided using [Specification Extensions](#specificationExtensions). + ##### Security Scheme Object Example ###### Basic Authentication Sample From dc2e8b34b400a9c1b45d8a8537c239c4cfb305e0 Mon Sep 17 00:00:00 2001 From: Roberto Polli Date: Thu, 17 Jan 2019 13:18:44 +0100 Subject: [PATCH 2/2] customType mandatory with securityScheme: custom. --- versions/3.1.0.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/versions/3.1.0.md b/versions/3.1.0.md index 91bc695342..0f32fcbd98 100644 --- a/versions/3.1.0.md +++ b/versions/3.1.0.md @@ -3182,7 +3182,7 @@ Field Name | Type | Applies To | Description This object MAY be extended with [Specification Extensions](#specificationExtensions). -Custom schemes may be processed in much the same manner as extensions. Implementations shall accept "custom" as a valid value for the securitySchemeType field. They shall also validate that the customType field is present and populated when the value of securitySchemeType is "custom". Any additional data needed to describe the custom schema shall be provided using [Specification Extensions](#specificationExtensions). +Custom schemes may be processed in much the same manner as extensions. Validating implementations MUST accept "custom" as a valid value for the securitySchemeType field. They MUST also validate that the customType field is present and populated when the value of securitySchemeType is "custom". Any additional data needed to describe the custom schema SHOULD be provided using [Specification Extensions](#specificationExtensions). ##### Security Scheme Object Example