[REQ] Better authentication support to C# generators

[wing328]

Is your feature request related to a problem? Please describe.

Add Bearer authentication support to C# generators

• C# client
• C# NET core
• C# ASPNET
• C# Nancy

References:

• Use oauth token for basic bearer auth in Rust. #2161
• Add Bearer authentication support to JS client #2020
• Add Bearer authentication to PHP API client #2013
• Add Bearer authentication support to Python client #1999

[wing328]

To add better OAuth support to aspnetcore,

openapi-generator/modules/openapi-generator/src/main/resources/JavaSpring/libraries/spring-cloud/clientConfiguration.mustache

Lines 51 to 103 in 0eb385c

	{{#isOAuth}}
	@Bean
	@ConditionalOnProperty("{{{title}}}.security.{{{name}}}.client-id")
	public OAuth2FeignRequestInterceptor {{{name}}}RequestInterceptor() {
	return new OAuth2FeignRequestInterceptor(new DefaultOAuth2ClientContext(), {{{name}}}ResourceDetails());
	}
	{{#isCode}}
	@Bean
	@ConditionalOnProperty("{{{title}}}.security.{{{name}}}.client-id")
	@ConfigurationProperties("{{{title}}}.security.{{{name}}}")
	public AuthorizationCodeResourceDetails {{{name}}}ResourceDetails() {
	AuthorizationCodeResourceDetails details = new AuthorizationCodeResourceDetails();
	details.setAccessTokenUri("{{{tokenUrl}}}");
	details.setUserAuthorizationUri("{{{authorizationUrl}}}");
	return details;
	}
	{{/isCode}}
	{{#isPassword}}
	@Bean
	@ConditionalOnProperty("{{{title}}}.security.{{{name}}}.client-id")
	@ConfigurationProperties("{{{title}}}.security.{{{name}}}")
	public ResourceOwnerPasswordResourceDetails {{{name}}}ResourceDetails() {
	ResourceOwnerPasswordResourceDetails details = new ResourceOwnerPasswordResourceDetails();
	details.setAccessTokenUri("{{{tokenUrl}}}");
	return details;
	}
	{{/isPassword}}
	{{#isApplication}}
	@Bean
	@ConditionalOnProperty("{{{title}}}.security.{{{name}}}.client-id")
	@ConfigurationProperties("{{{title}}}.security.{{{name}}}")
	public ClientCredentialsResourceDetails {{{name}}}ResourceDetails() {
	ClientCredentialsResourceDetails details = new ClientCredentialsResourceDetails();
	details.setAccessTokenUri("{{{tokenUrl}}}");
	return details;
	}
	{{/isApplication}}
	{{#isImplicit}}
	@Bean
	@ConditionalOnProperty("{{{title}}}.security.{{{name}}}.client-id")
	@ConfigurationProperties("{{{title}}}.security.{{{name}}}")
	public ImplicitResourceDetails {{{name}}}ResourceDetails() {
	ImplicitResourceDetails details = new ImplicitResourceDetails();
	details.setUserAuthorizationUri("{{{authorizationUrl}}}");
	return details;
	}
	{{/isImplicit}}
	{{/isOAuth}}

(in the spring template) is a good starting point.

[SeanFarrow]

@wing328, In order to do this we'll probably need to keep track of whether the security is being set at a global level or on a specific API resource. We'll also need to add specific packages if bearer/oauth is being used at all, particularly on the client side.
How are controllers mapped to api resources in terms of the name?

[wing328]

In order to do this we'll probably need to keep track of whether the security is being set at a global level or on a specific API resource

I think we've taken care of this. The security definition in the endpoint level has already taken into account the global setting.

We'll also need to add specific packages if bearer/oauth is being used at all, particularly on the client side.

Yup, we can use {{#hasOAuthMethods}} ... {{/hasOAuthMethods}}

How are controllers mapped to api resources in terms of the name?

Please elaborate with an example.

[SeanFarrow]

Do we just need to add packages then? From: William Cheng <notifications@github.com> Sent: 28 March 2019 16:45 To: OpenAPITools/openapi-generator <openapi-generator@noreply.github.com> Cc: Sean Farrow <sean.farrow@seanfarrow.co.uk>; Comment <comment@noreply.github.com> Subject: Re: [OpenAPITools/openapi-generator] [REQ] Better authentication support to C# generators (#2352) In order to do this we'll probably need to keep track of whether the security is being set at a global level or on a specific API resource I think we've taken care of this. The security definition in the endpoint level has already taken into account the global setting. We'll also need to add specific packages if bearer/oauth is being used at all, particularly on the client side. Yup, we can use {{#hasOAuthMethods}} ... {{/hasOAuthMethods}} — You are receiving this because you commented. Reply to this email directly, view it on GitHub<#2352 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/ABY1fgeUIZgezT-OvlWM2sai3TkovDzIks5vbPGVgaJpZM4bnYk6>.

[wing328]

Do we just need to add packages then?

Sorry I still don't understand the question. We can start with cloning the existing ASP.net Core 2.x generator and make it works with ASP.NET Core 3.0

cc @A-Joshi

[SeanFarrow]

I wouldn’t necessarily just clone the existing one, as there are plenty of things we might want to enable, such as the new json serializer. From: William Cheng <notifications@github.com> Sent: 30 March 2019 01:21 To: OpenAPITools/openapi-generator <openapi-generator@noreply.github.com> Cc: Sean Farrow <sean.farrow@seanfarrow.co.uk>; Comment <comment@noreply.github.com> Subject: Re: [OpenAPITools/openapi-generator] [REQ] Better authentication support to C# generators (#2352) Do we just need to add packages then? Sorry I still don't understand the question. We can start with cloning the existing ASP.net Core 2.x generator and make it works with ASP.NET Core 3.0 cc @A-Joshi<https://github.com/A-Joshi> — You are receiving this because you commented. Reply to this email directly, view it on GitHub<#2352 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/ABY1fiRQK7okr1W_N03nG170ZUBjpDECks5vbrwOgaJpZM4bnYk6>.

[SeanFarrow]

What do we need to do to get auth working in C#?

[SeanFarrow]

@wing328 I'm getting back in to development and able to look at this.
Does the oas spec differentiate between OAuth and OpenIDConnect?
If yes, we should probably do that.

[wing328]

What do we need to do to get auth working in C#?

Which C# generators?

Again clientConfiguration.mustache#L51-L103 is a good starting point, which has better authentication support.

[wing328]

openapi-generator/modules/openapi-generator/src/main/java/org/openapitools/codegen/DefaultGenerator.java

Line 1196 in c88174e

.openIdConnectUrl(securityScheme.getOpenIdConnectUrl())

That's the only line I found related to OpenIDConnect support and I agree with you we should support that as well.

[SeanFarrow]

@wing328 That makes sense from a client perspective, is there a sample server that implements authentication?

From looking at the C# asp.net core stuff, I don't think we support any authentication at all, so my question is how is authentication surfaced in properties within the generators on either an individual path, a specific http verb of a path (books/get) for example and then the whole API.

Once I understand all of this/have referenced code to look at, I should be able to crack on with authentication schemes in the next few days. I need this for a project asap.

[FredCni]

I'm using aspnetcore generator (server generator)

I have added this into my controller mustache at the method level

{{#hasOAuthMethods}}
        [Authorize("aScope")]
{{/hasOAuthMethods}}

This works fine when I have one scope.

But I'd like to use the scopes defined on each method in the specification.
Is this doable in the mustache in version 6.4.0 or would this require changes to the generator?
If the latter then where to start?

[hae-andrew-young]

This would be really nice to have!