Kong / Kong/deck

openapi2kong: OpenAPI requires multiple OIDC scopes, but generated openid-connect plugin configuration requires only one scope

Open
#2,235 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
503
Forks
137
Avg merge
3d 5h
Merged PRs (30d)
20

Description

Using deck v1.66.1 on Linux amd64, with the following command line:
`deck file openapi2kong --generate-security --spec openapi.yaml`
and the following openapi.yaml file:
```
openapi: 3.0.4
info:
title: example
version: 1.2.0
servers:
- url: https://example.com
paths:
/oidc:
get:
security:
- OpenIDConnect: # The intent is that both of the below scopes should be required to execute this operation
- example:list
- example:read
responses:
'204':
description: No content
components:
securitySchemes:
OpenIDConnect:
type: openIdConnect
openIdConnectUrl: https://example.com/.well-known/openid-configuration
```
Note that the [OpenAPI 3.0.4 specification](https://spec.openapis.org/oas/v3.0.4.html#security-requirement-object) states the following about scopes in the Security Requirement Object:
> If the security scheme is of type "oauth2" or "openIdConnect", then the value is a list of scope names required for the execution

My intent is that both scopes will be required, and I expect that the generated openid-connect plugin configuration will use a logical AND check for these scopes. However, the generated openid-connect plugin configuration uses a logical OR check, meaning that only one of the scopes is required to execute the operation.
```
_format_version: "3.0"
services:
- host: example.com
id: 730d612d-914b-5fe8-8ead-e6aa654318ef
name: example
path: /
plugins: []
port: 443
protocol: https
routes:
- id: b6aac907-cf6d-50d7-8290-80878a483a64
methods:
- GET
name: example_oidc_get
paths:
- ~/oidc$
plugins:
- config:
issuer: https://example.com/.well-known/openid-configuration
scopes_required:
- example:list
- example:read
name: openid-connect
regex_priority: 200
strip_path: false
tags: []
tags: []
upstreams: []
```
According to the [OpenID Connect plugin documentation](https://developer.konghq.com/plugins/openid-connect/#claim-requirements), the `scopes_required` config field needs to be generated as follows to use a logical AND check:
```
scopes_required:
- example:list example:read
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by running `deck file openapi2kong --generate-security --spec openapi.yaml` with the provided OpenAPI example and inspect the implementation behind the `openapi2kong` command. Verify that the generated openid-connect configuration represents both required scopes as `example:list example:read` in one `scopes_required` entry, while preserving the generated issuer and route configuration.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, openapi
Domain
api, cli
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.