Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Migrate relevant 3.2 commits to the new branch structure #4188

Draft
wants to merge 5 commits into
base: v3.2-dev
Choose a base branch
from
Draft

Migrate relevant 3.2 commits to the new branch structure #4188

Changes from 4 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
24bec7e
Let Security Schemes declare deprecation (#2532)
philsturgeon Nov 11, 2021
fe0bbac
Add Device Code authorization to the supported OAuth Flows (#2964)
LikeLakers2 May 18, 2023
4b3b2ce
add oauth2MetadataUrl (#3694)
AxelNennker Apr 18, 2024
f6bb8bf
ciba-grant-3.2.0.md
shilpa-padgaonkar Feb 29, 2024
bdfa9bf
Avoid abbreviation that is only used once
handrews Nov 12, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 20 additions & 3 deletions src/oas.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3802,7 +3802,7 @@ animals:

Defines a security scheme that can be used by the operations.

Supported schemes are HTTP authentication, an API key (either as a header, a cookie parameter or as a query parameter), mutual TLS (use of a client certificate), OAuth2's common flows (implicit, password, client credentials and authorization code) as defined in [RFC6749](https://tools.ietf.org/html/rfc6749), and [[OpenID-Connect-Core]].
Supported schemes are HTTP authentication, an API key (either as a header, a cookie parameter or as a query parameter), mutual TLS (use of a client certificate), OAuth2's common flows (implicit, password, client credentials and authorization code) as defined in [RFC6749](https://tools.ietf.org/html/rfc6749), OAuth2 device authorization flow as defined in [RFC8628](https://tools.ietf.org/html/rfc8628), and [[OpenID-Connect-Core]].
Please note that as of 2020, the implicit flow is about to be deprecated by [OAuth 2.0 Security Best Current Practice](https://tools.ietf.org/html/draft-ietf-oauth-security-topics). Recommended for most use cases is Authorization Code Grant flow with PKCE.

##### Fixed Fields
Expand All @@ -3817,6 +3817,8 @@ Please note that as of 2020, the implicit flow is about to be deprecated by [OAu
| <a name="security-scheme-bearer-format"></a>bearerFormat | `string` | `http` (`"bearer"`) | A hint to the client to identify how the bearer token is formatted. Bearer tokens are usually generated by an authorization server, so this information is primarily for documentation purposes. |
| <a name="security-scheme-flows"></a>flows | [OAuth Flows Object](#oauth-flows-object) | `oauth2` | **REQUIRED**. An object containing configuration information for the flow types supported. |
| <a name="security-scheme-open-id-connect-url"></a>openIdConnectUrl | `string` | `openIdConnect` | **REQUIRED**. [Well-known URL](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig) to discover the [[OpenID-Connect-Discovery]] [provider metadata](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata). |
| <a name="security-scheme-oauth2-metadata-url"></a>oauth2MetadataUrl | `string` | `oauth2` | URL to the oauth2 authorization server metadata [RFC8414](https://datatracker.ietf.org/doc/html/rfc8414). TLS is required. |
| <a name="security-scheme-deprecated"></a>deprecated | `boolean` | Declares this security scheme to be deprecated. Consumers SHOULD refrain from usage of the declared scheme. Default value is `false`. |

This object MAY be extended with [Specification Extensions](#specification-extensions).

Expand Down Expand Up @@ -3921,6 +3923,8 @@ Allows configuration of the supported OAuth Flows.
| <a name="oauth-flows-password"></a>password | [OAuth Flow Object](#oauth-flow-object) | Configuration for the OAuth Resource Owner Password flow |
| <a name="oauth-flows-client-credentials"></a>clientCredentials | [OAuth Flow Object](#oauth-flow-object) | Configuration for the OAuth Client Credentials flow. Previously called `application` in OpenAPI 2.0. |
| <a name="oauth-flows-authorization-code"></a>authorizationCode | [OAuth Flow Object](#oauth-flow-object) | Configuration for the OAuth Authorization Code flow. Previously called `accessCode` in OpenAPI 2.0. |
| <a name="oauth-flows-device-authorization"></s>deviceAuthorization| [OAuth Flow Object](#oauth-flow-object) | Configuration for the OAuth Device Authorization flow. |
| <a name="oauth-flows-ciba"></a>ciba | [OAuth Flow Object](#oauth-flow-object) | Configuration for the OpenID Connect Client-Initiated Backchannel Authentication Flow. |

This object MAY be extended with [Specification Extensions](#specification-extensions).

Expand All @@ -3932,10 +3936,14 @@ Configuration details for a supported OAuth Flow

| Field Name | Type | Applies To | Description |
| ---- | :----: | ---- | ---- |
| <a name="oauth-flow-authorization-url"></a>authorizationUrl | `string` | `oauth2` (`"implicit"`, `"authorizationCode"`) | **REQUIRED**. The authorization URL to be used for this flow. This MUST be in the form of a URL. The OAuth2 standard requires the use of TLS. |
| <a name="oauth-flow-token-url"></a>tokenUrl | `string` | `oauth2` (`"password"`, `"clientCredentials"`, `"authorizationCode"`) | **REQUIRED**. The token URL to be used for this flow. This MUST be in the form of a URL. The OAuth2 standard requires the use of TLS. |
| <a name="oauth-flow-authorization-url"></a>authorizationUrl | `string` | `oauth2` (`"implicit"`, `"authorizationCode"`, `"ciba"`) | **REQUIRED**. The authorization URL to be used for this flow. This MUST be in the form of a URL. The OAuth2 standard requires the use of TLS. |
| <a name="oauth-flow-device-authorization-url"></s>deviceAuthorizationUrl | `string` | `oauth2` (`"deviceAuthorization"`) | **REQUIRED**. The device authorization URL to be used for this flow. This MUST be in the form of a URL. The OAuth2 standard requires the use of TLS. |
| <a name="oauth-flow-token-url"></a>tokenUrl | `string` | `oauth2` (`"password"`, `"clientCredentials"`, `"authorizationCode"`, `"deviceAuthorization"`, `"ciba"`) | **REQUIRED**. The token URL to be used for this flow. This MUST be in the form of a URL. The OAuth2 standard requires the use of TLS. |
| <a name="oauth-flow-refresh-url"></a>refreshUrl | `string` | `oauth2` | The URL to be used for obtaining refresh tokens. This MUST be in the form of a URL. The OAuth2 standard requires the use of TLS. |
| <a name="oauth-flow-scopes"></a>scopes | Map[`string`, `string`] | `oauth2` | **REQUIRED**. The available scopes for the OAuth2 security scheme. A map between the scope name and a short description for it. The map MAY be empty. |
| <a name="oauth-flow-ciba-delivery-modes"></a>cibaDeliveryModes | Array[`string`] | `oauth2` (`"ciba"`) | **REQUIRED**. JSON array containing one or more of the following values: `poll`, `ping`, and `push`. |
| <a name="oauth-flow-ciba-signing-algs"></a>cibaSigningAlgs | Array[`string`] | `oauth2` (`"ciba"`) | JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP (OpenIdConnect Provider) for signed authentication requests |
| <a name="oauth-flow-ciba-user-code"></a>cibaUserCode | `boolean` | `oauth2` (`"ciba"`) | Boolean value specifying whether the OP supports the use of the user_code parameter, with true indicating support. If omitted, the default value is false. |
handrews marked this conversation as resolved.
Show resolved Hide resolved

This object MAY be extended with [Specification Extensions](#specification-extensions).

Expand All @@ -3959,6 +3967,15 @@ This object MAY be extended with [Specification Extensions](#specification-exten
"write:pets": "modify pets in your account",
"read:pets": "read your pets"
}
},
"ciba": {
"authorizationUrl": "https://example.com/api/oauth/dialog",
"tokenUrl": "https://example.com/api/oauth/token",
"scopes": {
"write:pets": "modify pets in your account",
"read:pets": "read your pets"
},
"cibaDeliveryModes": ["poll"]
}
}
}
Expand Down