Azure / Azure/azure-functions-openapi-extension

Document about "Configure Authorization Level" is not clear

Open
#422 2 comments 1 reaction 0 assignees View on GitHub
Dominant language
C#
Stars
388
Forks
202
PR merge metrics
No merged PRs in 30d

Description

**Describe the issue**
I need to configure the authorization level of my Swagger pages. So, I follow this document [here](https://github.com/Azure/azure-functions-openapi-extension/blob/main/docs/openapi.md#configure-authorization-level).

First, there is a confusion in the name. In the example code block, the variable name is `OpenApi__ApiKey`. But in the text below, it says
`Make sure that you MUST provide the OpenApi__AuthKey value, if you choose the`. So, `ApiKey` or `AuthKey`?

Secondly, how do we query the secured page now? There is no explanation of how to do this. So, I imply that I can use the same method of azure functions. It means `x-functions-key` header or `?code={KEY}` in query string. I tried both, it does not work. The swagger page only returns 401.

**To Reproduce**
Steps to reproduce the behavior:

Configure my local.settings.json (and for Function App on Azure portal as well)
```json
{
"IsEncrypted": false,
"Values": {
"OpenApi__AuthKey": "Test.123",
"OpenApi__AuthLevel__Document": "Function",
"OpenApi__AuthLevel__UI": "Function"
}
}
```

Go to `mysite.com/api/swagger/ui?code=Test.123` --> 401 Error

Go to `mysite.com/api/swagger/ui` with request header `x-functions-key: Test.123` --> 401 Error

**Expected behavior**
The swagger page is secured now. But I should be able to see the page with my given key. It is not clear how I do that.

**Screenshots**
![image](https://user-images.githubusercontent.com/20963684/164176279-fd137f32-ecc6-48d9-b4c0-9c2a45b0d453.png)

**Environment (please complete the following information, if applicable):**
- OS: Windows
- Browser: Chrome
- Version 100.0.4896.127

Contributor guide

Open the contributing guide

Research direction

Start with docs/openapi.md at the "Configure Authorization Level" section and compare the OpenApi__ApiKey example with the OpenApi__AuthKey text. Reproduce the documented local.settings.json configuration and the two 401 requests, then update the section so the setting name and the way to access a secured Swagger page are consistent and explicit.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure
Domain
authentication, documentation
Issue type
Documentation
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.