Swagger Basic Authorization

[alabotski]

SwagerUI still displays all the services and types

How to properly configure it?

Where to register the default logins and password for logging in?

And whether it is necessary to change SwaggerUI for authorization

Swagger - 1.5.16
SwaggerUI - 3.0.21

public class Bootstrap extends HttpServlet {
	@Override
	public void init(ServletConfig config) throws ServletException {
		Info info = new Info().title(DBO_REST).version(DBO_REST_VERSION);

		Swagger swagger = new Swagger().info(info);
		swagger.securityDefinition(BASIC_AUTH_SCHEME, new BasicAuthDefinition());
		swagger.tag(new Tag().name(REST_TAG_TRANSFER).description(REST_TAG_TRANSFER_DESCRIPTION).externalDocs(new ExternalDocs("Find out more", "http://swagger.io")));

		new SwaggerContextService().withServletConfig(config).updateSwagger(swagger);
	}
}
.................
@ApplicationPath("/dbo/rest")
public class Application extends Application {
	HashSet<Object> singletons = new HashSet<>();

	public Application() {
		String packages = ClassUtils.getPackageName(RestRoot.class);
		String filter = ApiAuthorizationFilterImpl.class.getCanonicalName();

		BeanConfig beanConfig = new BeanConfig();
		beanConfig.setFilterClass("by.swagger.ApiAuthorizationFilterImpl");
		beanConfig.setVersion(DBO_REST_VERSION);
		beanConfig.setSchemes(new String[] { DBO_REST_SCHEMES });
		beanConfig.setHost(DBO_REST_HOST);
		beanConfig.setBasePath(DBO_REST_PATH);
		beanConfig.setResourcePackage(packages);
		beanConfig.setTitle(DBO_REST);
		beanConfig.setPrettyPrint(true);
		beanConfig.setScan(true);
	}

	@Override
	public Set<Class<?>> getClasses() {
		HashSet<Class<?>> set = new HashSet<Class<?>>();
		set.add(io.swagger.jaxrs.listing.ApiListingResource.class);
		set.add(io.swagger.jaxrs.listing.SwaggerSerializers.class);

		return set;
	}

	@Override
	public Set<Object> getSingletons() {
		return singletons;
	}
}
.................

@Path("/transfer")
@Produces({ MediaType.APPLICATION_JSON, MediaType.APPLICATION_XML })
@Consumes({ MediaType.APPLICATION_JSON, MediaType.APPLICATION_XML })
@Api(value = "/transfer", produces = "application/json, application/xml", consumes = "application/json, application/xml", authorizations = {
								@Authorization(value = BASIC_AUTH_SCHEME) }, tags = REST_TAG_TRANSFER)
public class TransferMoneyService {...
}

And another question

For what you need to set these values?

		beanConfig.setHost(DBO_REST_HOST);
		beanConfig.setBasePath(DBO_REST_PATH);

If the url is taken from index.html SwaggerUI
url: "https://localhost:8443/dbo/rest/swagger.json",

[webron]

I don't understand the first question - what are you trying to do?

As for the second question - those are different. The url in SwaggerUI is where the API definition is hosted. The setHost/setBasePath is where your API is hosted.

[alabotski]

Sorry for my English
If I understand correctly basic authorization

The user goes to the link. For example http://petstore.swagger.io
And does not see anything

Next, he is authorized (login + password) (button Authorize)
And he is invited to view the documentation ...

Or did I misunderstand the meaning of authorization?

[alabotski]

As for the second question - those are different. The url in SwaggerUI is where the API definition is hosted. The setHost/setBasePath is where your API is hosted.

What's the difference?
I tried not to specify

beanConfig.setHost(DBO_REST_HOST);
beanConfig.setBasePath(DBO_REST_PATH);

And everything works

[webron]

For the first question - no. That's basic authentication for accessing your API, not accessing the UI and seeing the documentation.

For the second question - the spec allows you to not specify the host and basePath, and the tools will default to the location hosting the API definition. It's up to you whether to provide it or not.

[alabotski]

Good. Thank you
Then my question on the other

Is it possible to do authorization?
If the user is authorized, he does not see the documentation.
If all is authorized, he is available

In what direction should I look?

[webron]

That's outside of our scope. You should control it in your own application - like you would any other web application.

[shockey]

Closing due to inactivity.

This is simply to keep our issue tracker clean - feel free to comment if there are any further thoughts or concerns, and we'll be happy to reopen this issue.