openapi2kong: OpenAPI requires multiple OIDC scopes, but generated openid-connect plugin configuration requires only one scope
- Dominant language
- Go
- Stars
- 503
- Forks
- 137
- Avg merge
- 3d 5h
- Merged PRs (30d)
- 20
Description
Using deck v1.66.1 on Linux amd64, with the following command line:
`deck file openapi2kong --generate-security --spec openapi.yaml`
and the following openapi.yaml file:
```
openapi: 3.0.4
info:
title: example
version: 1.2.0
servers:
- url: https://example.com
paths:
/oidc:
get:
security:
- OpenIDConnect: # The intent is that both of the below scopes should be required to execute this operation
- example:list
- example:read
responses:
'204':
description: No content
components:
securitySchemes:
OpenIDConnect:
type: openIdConnect
openIdConnectUrl: https://example.com/.well-known/openid-configuration
```
Note that the [OpenAPI 3.0.4 specification](https://spec.openapis.org/oas/v3.0.4.html#security-requirement-object) states the following about scopes in the Security Requirement Object:
> If the security scheme is of type "oauth2" or "openIdConnect", then the value is a list of scope names required for the execution
My intent is that both scopes will be required, and I expect that the generated openid-connect plugin configuration will use a logical AND check for these scopes. However, the generated openid-connect plugin configuration uses a logical OR check, meaning that only one of the scopes is required to execute the operation.
```
_format_version: "3.0"
services:
- host: example.com
id: 730d612d-914b-5fe8-8ead-e6aa654318ef
name: example
path: /
plugins: []
port: 443
protocol: https
routes:
- id: b6aac907-cf6d-50d7-8290-80878a483a64
methods:
- GET
name: example_oidc_get
paths:
- ~/oidc$
plugins:
- config:
issuer: https://example.com/.well-known/openid-configuration
scopes_required:
- example:list
- example:read
name: openid-connect
regex_priority: 200
strip_path: false
tags: []
tags: []
upstreams: []
```
According to the [OpenID Connect plugin documentation](https://developer.konghq.com/plugins/openid-connect/#claim-requirements), the `scopes_required` config field needs to be generated as follows to use a logical AND check:
```
scopes_required:
- example:list example:read
```
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by running `deck file openapi2kong --generate-security --spec openapi.yaml` with the provided OpenAPI example and inspect the implementation behind the `openapi2kong` command. Verify that the generated openid-connect configuration represents both required scopes as `example:list example:read` in one `scopes_required` entry, while preserving the generated issuer and route configuration.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, openapi
- Domain
- api, cli
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100