Using Multiple Authentication Types (OR)

Description

First up, thanks for all your hard work on this! Now, on to the issue...

The following:

    public void updateParamsForAuth(String[] authNames, List<Pair> queryParams, Map<String, String> headerParams) {
        for (String authName : authNames) {
            Authentication auth = authentications.get(authName);
            if (auth == null) throw new RuntimeException("Authentication undefined: " + authName);
            auth.applyToParams(queryParams, headerParams);
        }
    }

In particular:

 if (auth == null) throw new RuntimeException("Authentication undefined: " + authName);

Is wrong per the spec:

https://swagger.io/docs/specification/authentication/

Because security definitions can be both AND or OR.

Swagger-codegen version

2.2.3 (targeting java)

Swagger declaration file content or url

swagger: '2.0'
info:
  version: 1.0.0
  title: Foo API
consumes:
  - application/json; charset=utf-8
produces:
  - application/json; charset=utf-8
securityDefinitions:
  Foo:
    description: Foo
    type: apiKey
    name: Authorization
    in: header
  Bar:
    description: Bar
    type: apiKey
    name: Authorization
    in: header
paths:
  '/foobar':
    get:
      summary: Foobar
      description: Foobar.
      operationId: foobar
      produces:
        - application/json; charset=utf-8
      security:
        - Foo: []
        - Bar: []
      responses:
        '200':
          description: Foobar
          schema: {} #Empty object

Command line used for generation

Something something something generate -l java.

Steps to reproduce

Trying to invoke the API with just Foo OR just Bar will result in java.lang.RuntimeException.

Related issues/PRs

I tried to find one and failed. Feel free to close as duplicate and reference the other.

Suggest a fix/enhancement

As a quick workaround I edited the generated code and only call auth.applyToParams if not null, but that only handles OR (not AND).

Thanks again!

Start with the generated Java client's updateParamsForAuth method and the Swagger 2.0 security declaration in the reproduction. Trace how the security array is represented during generation, then verify that clients using only Foo or only Bar work without the RuntimeException while combined requirements still work.