Override global @SecurityRequirements with empty value on resource

[yreifschneider]

I have a JAX-RS Application with a global security configuration:

@OpenAPIDefinition(
    components = @Components(
        securitySchemes = {
            @SecurityScheme(
                securitySchemeName = "oauth2",
                type = SecuritySchemeType.OAUTH2,
                flows = @OAuthFlows(
                    password = @OAuthFlow(
                        tokenUrl = "/oauth/token",
                        scopes = {
                            @OAuthScope(name = "global", description = "access all")
                        }
                    )
                )
            )
        }
    ),
    security = {
        @SecurityRequirement(name = "oauth2", scopes = {"global"})
    }
)
public class RestApplication extends Application {

}

I want to remove this security requirement for a single resource, thus not requiring authentication for this endpoint. I tried to achieve this by specifying an empty @SecurityRequirements() annotation on the resource method like so:

@GET
@Path(value = "/view")
@SecurityRequirements
public Response view() {
// ...
}

However, this does not work. The generated specification does not reflect this annotation with an empty security requirement. Is there another way to achieve this, without removing the global security requirement definition?

I am building the application with Quarkus 1.5.2.Final which uses smallrye-open-api 1.2.4.

[MikeEdgar]

@yreifschneider - did you try using an empty @SecurityScheme? If that doesn't work, I'll need to do a bit more research.

[yreifschneider]

@MikeEdgar an empty @SecurityScheme does not work as well. I created a test case to demonstrate the desired behaviour at yreifschneider@d7aa92f. The problem is that io.smallrye.openapi.runtime.util.JandexUtil#getRepeatableAnnotation does not differentiate between an empty repeatable annotation and no annotation at all.

One possible solution would be to return an optional list to allow generation of an empty repeatable annotation. Do you think this is a viable solution?

[MikeEdgar]

@yreifschneider - please try to annotate the class that does not require authorization with @PermitAll. Are you using @RolesAllowed anywhere in your application?

[yreifschneider]

@MikeEdgar Thanks for your response. @PermitAll does not change the output of the spec file. I also do not use the @RolesAllowed and other security annotations, because security is handled outside the Quarkus application in an API gateway. I just want to change the output of the generated OpenAPI spec file, preferably through annotations inside the org.eclipse.microprofile.openapi.annotations package.

[MikeEdgar]

@yreifschneider - please look for the ability to use an empty @SecurityRequirements annotation in the next release.