swagger-api / swagger-api/swagger-ui

How to specify OAuth 'realm'

Open
#3,406 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

cat: auth type: enhancement
Dominant language
JavaScript
Stars
29k
Forks
9.3k
Avg merge
2d 23h
Merged PRs (30d)
25

Description

I am using the latest version of Swagger UI (cloned from master yesterday 👍 ). I love Swagger it is fantastic. I use it for testing as well as documentation.

I have been setting up authorization using OAuth2 with Keycloak as the backend. It's a rocky ride due to fragmented / outdated / missing documentation but I got things to work. But there is this one thing I can't wrap my head around.

In my swagger.json I have a securitydefinitions section that looks like this:

{
	"securityDefinitions": {
		"oauth2": {
			"type": "oauth2",
			"flow": "accessCode",
			"authorizationUrl": "http://localhost:8080/auth/realms/master/protocol/openid-connect/auth",
			"tokenUrl": "http://localhost:8080/auth/realms/master/protocol/openid-connect/token",
			"scopes": {
				"supervisor": "Supervisor",
				"admin": "Admin"
			}
		}
	}
}

In the index.html file, I made some changes to set the URL of the definition and the oauth redirect URL, like so:

window.onload = function() {
  var a = document.createElement('a');
  a.href = 'swagger.json'
  var r = document.createElement('a');
  r.href = 'oauth2-redirect.html'
  // Build a system
  const ui = SwaggerUIBundle({
    url: a.href,  
    oauth2RedirectUrl: r.href,
    dom_id: '#swagger-ui',
    presets: [
      SwaggerUIBundle.presets.apis,
      SwaggerUIStandalonePreset
    ],
    plugins: [
      SwaggerUIBundle.plugins.DownloadUrl
    ],
    layout: "StandaloneLayout"
  })

  window.ui = ui

  ui.initOAuth({
    clientId: "api-docs",
    realm: "myrealm",
    appName: "api-docs",
    scopeSeparator: " ",
    additionalQueryStringParams: {test: "hello"},
  })
}

This shows my API as expected with an Authorize button at the top. When I press it I get the dialog as expected. The client ID is prefilled as I like it and when I hit the button I go to my login page and all is well.... As long as I make sure I configure everything in the master realm on Keycloak.

As you can see the config has a field for realm and it's actually set to 'myrealm'. However when I configure stuff in Keycloak under 'myrealm', it does not work. It has to be under the 'master' realm.

I figure this is because Keycloak mentions the realm in the path part of the authorization / token URLs:

"authorizationUrl": "http://localhost:8080/auth/realms/master/protocol/openid-connect/auth",
                                                         ^
                                                       realm

I can of course change these URLs in the definition. But it would be much nicer imho if the definition could be independent of the actual auth implementation, same as is done for clientId.

So finally, my question / feature request:

Is it possible to specify a parameter in the URL where realm should be filled in?

Something like this perhaps?:

"authorizationUrl": "http://localhost:8080/auth/realms/${realm}/protocol/openid-connect/auth",
                                                          ^
                                                        parameter

If this stuff is in the docs then sorry for bothering you. I did search, I swear! 👍

EDIT:
I just found this related closed issue:
https://github.com/swagger-api/swagger-ui/issues/1424

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reading index.html and the initOAuth configuration, then compare the requested realm behavior with the linked issue 1424. Trace how authorizationUrl and tokenUrl are handled; done means establishing whether parameterized realm values are supported and documenting or defining the required behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
authentication
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.