Multiple authorization using swagger OpenAPI 3.0 with Express and JSON format - node.js

The project has two authorization systems, basic auth and bearer. I need for each request after clicking on the "try it out" and "execute" buttons to attach to the request the Authorization headers, in which there will be a Basic line and a jwt header, in which there will be a bearer token. The problem is that I can attach these headers individually, but not together. There is a feeling that both authorizations want to write to the Authorization header and one of them overwrites the other, even though I explicitly indicated the header names in the schema.
My schemas:
{
"securitySchemes": {
"Bearer": {
"in": "header",
"name": "jwt",
"type": "http",
"scheme": "bearer"
},
"basicAuth": {
"type": "http",
"scheme": "basic"
}
}
}
and how I use it:
{
"/channel/base-list": {
"get": {
"tags": [
"CMS Channel"
],
"security": [
{
"Bearer": [],
"basicAuth": []
}
],
"summary": "Get _id and title of all channels",
"produces": [
"application/json"
],
"parameters": [
{
"in": "query",
"name": "count",
"required": false,
"schema": {
"type": "Integer"
},
"default": 25,
"example": 10
},
{
"in": "query",
"name": "search",
"required": false,
"schema": {
"type": "String"
},
"description": "Channel name"
}
],
"responses": {
"200": {
"description": "A list of channels",
"content": {
"application/json": {
"schema": {
"$ref": "#/definitions/get-channel-base-list"
}
}
}
}
}
}
}
}
I use swagger-ui-express for node.JS and OpenAPI 3.0

A request can contain only one Authorization header, and the Authorization header can only contain a single set of credentials (i.e. either Basic or Bearer, but not both). Your use case is not supported by the HTTP protocol.

Related

How to send to Amazon's Alexa Event Gateway?

I am trying to test sending an event to the Amazon's Event Gateway for my Alexa Smart Home skill using Postman but I keep receiving an 'invalid access token exception.' I have read the Amazon's documentation on this but apparently I am missing something.
When I enable my skill, my Smart Home Lambda receives the AcceptGrant.
{
"directive": {
"header": {
"namespace": "Alexa.Authorization",
"name": "AcceptGrant",
"messageId": "b2862179-bc56-4bb2-ac05-ce55c7a3e977",
"payloadVersion": "3"
},
"payload": {
"grant": {
"type": "OAuth2.AuthorizationCode",
"code": "ANSVjPzpTDBsdfoRSyrs"
},
"grantee": {
"type": "BearerToken",
"token": "Atza|IwEB..."
}
}
}
}
My lambda sends a POST to 'https://api.amazon.com/auth/o2/token' to receive the Access and Refresh tokens. It then stores those tokens. Next, my Lamdba responds with the following:
{
"event": {
"header": {
"namespace": "Alexa.Authorization",
"name": "AcceptGrant.Response",
"messageId": "b2862179-bc56-4bb2-ac05-ce55c7a3e977",
"payloadVersion": "3"
},
"payload": {}
}
}
I then get a message web page that I have successfully linked my skill - all is good.
Next, I try to send an event to Amazon's Alexa event gateway using the Postman app. I put the Access token (I also tried the Refresh token) in the header as a 'BearerToken' type and the in the 'scope' of the 'endpoint' object.
POST https://api.amazonalexa.com/v3/events?Content-Type=application/json&charset=UTF-8
with a header that specifies a Bearer Token (Access token received earlier) and a body that contains the following:
{
"event": {
"header": {
"messageId": "abc-123-def-456",
"namespace": "Alexa",
"name": "ChangeReport",
"payloadVersion": "3"
},
"endpoint": {
"scope": {
"type": "BearerToken",
"token": "<access token>"
},
"endpointId": "MySmartSwitch-001"
},
"payload": {
"change": {
"cause": {
"type": "RULE_TRIGGER"
},
"properties": [
{
"namespace": "Alexa.ModeController",
"name": "mode",
"value": "Backup",
"timeOfSample": "2020-01-02T09:30:00ZZ",
"uncertaintyInMilliseconds": 50
}
]
}
}
},
"context": {
"properties": [
{
"namespace": "Alexa.PowerController",
"name": "powerState",
"value": "ON",
"timeOfSample": "2020-01-02T09:30:00Z",
"uncertaintyInMilliseconds": 60000
},
{
"namespace": "Alexa.EndpointHealth",
"name": "connectivity",
"value": {
"value": "OK"
},
"timeOfSample": "2020-01-02T09:30:00Z",
"uncertaintyInMilliseconds": 0
}
]
}
}
The response received is '401 Unauthorized'
{
"header": {
"namespace": "System",
"name": "Exception",
"messageId": "95bd23c3-76e6-472b-9c6d-74d436e1eb61"
},
"payload": {
"code": "INVALID_ACCESS_TOKEN_EXCEPTION",
"description": "Access token is not valid."
}
}
I figured out the issue. I was mistakenly sending parameters: Content-Type=application/json and charset=UTF-8 as well including them in the header - my bad. You just need to include them in the header.

How to represent custom token in header in Swagger UI(swagger.json) in nodejs

I am creating a Restful server in ExpressJs. I have integrated swagger-jsdoc. Following is the related files. Below(header.png) is how I expect my header to look like in swagger UI. But, while I open my swagger UI (http://localhost:3000/api-docs/), I am not able to see Token tags (token and Authentication) in the header.
swagger.json
{
"swagger": "2.0",
"info": {
"version": "1.0.0",
"title": "Viswa API"
},
"host": "localhost:3000",
"basePath": "/api",
"tags": [{
"name": "Customers",
"description": "API for customers in the system"
}],
"schemes": [
"http"
],
"consumes": [
"application/json"
],
"produces": [
"application/json"
],
"securityDefinitions": {
"Bearer": {
"type": "apiKey",
"name": "Authorization",
"in": "header"
},
"JWT": {
"type": "apiKey",
"name": "token",
"in": "header"
}
},
"paths": {
"/customer": {
"post": {
"tags": [
"Customers"
],
"description": "Create new customer in system",
"parameters": [{
"name": "customer",
"in": "body",
"description": "Customer that we want to create",
"schema": {
"$ref": "#/definitions/Customer"
}
}],
"produces": [
"application/json"
],
"responses": {
"201": {
"description": "New customer is created",
"schema": {
"$ref": "#/definitions/Customer"
}
}
}
}
}
},
"definitions": {
"Customer": {
"required": [
"email"
],
"properties": {
"customer_name": {
"type": "string"
},
"customer_email": {
"type": "string"
}
}
}
}
}
app.route
var apiRoutes = express.Router();
app.use('/api', apiRoutes);
// swagger definition
var swaggerUi = require('swagger-ui-express'),
swaggerDocument = require('../swagger.json');
app.use('/api-docs', swaggerUi.serve, swaggerUi.setup(swaggerDocument));
app.use('/api/v1', apiRoutes);
Current Swagger UI:
You are missing the security tag. You can define it either globally just below the securityDefinitions tag or one for each API endpoint.
Have a look at this question.
You can add a security tag
"security": [ { "Bearer": [] } ],
After adding it your path section
"paths": {
"/customer": {
"post": {
"security": [ { "Bearer": [] } ],
"tags": [
"Customers"
],
"description": "Create new customer in system",
"parameters": [{
"name": "customer",
"in": "body",
"description": "Customer that we want to create",
"schema": {
"$ref": "#/definitions/Customer"
}
}],
"produces": [
"application/json"
],
"responses": {
"201": {
"description": "New customer is created",
"schema": {
"$ref": "#/definitions/Customer"
}
}
}
}
}
},
You can define the header parameters in the path definition. like this
"paths": {
"/customer": {
parameters: [{ name: "Authorization", in: "header", type: "string", description: "auth token" }]
}
}

Missing Subscription Key field in Swagger API connector (trough Azure API Management) in Logic App

I have created a REST API with a Swagger/OPEN API specification which I will like to consume trough a Azure API Management tenant in a Logic App.
When I download the specification it looks like this:
{
"swagger": "2.0",
"info": {
"title": "Leasing",
"version": "1.0"
},
"host": "ENDPOINT.azure-api.net",
"basePath": "/leasing",
"schemes": [
"http",
"https"
],
"securityDefinitions": {
"apiKeyHeader": {
"type": "apiKey",
"name": "Ocp-Apim-Subscription-Key",
"in": "header"
},
"apiKeyQuery": {
"type": "apiKey",
"name": "subscription-key",
"in": "query"
}
},
"security": [
{
"apiKeyHeader": []
},
{
"apiKeyQuery": []
}
],
"paths": {
"/{Brand}/groups": {
"get": {
"description": "Get a list of leasing groups on a brand",
"operationId": "GetGroups",
"parameters": [
{
"name": "Brand",
"in": "path",
"description": "Selection of possible brands",
"required": true,
"type": "string",
"enum": [
"Volkswagen",
"Audi",
"Seat",
"Skoda",
"VolkswagenErhverv",
"Porsche",
"Ducati"
]
}
],
"responses": {
"200": {
"description": "Returns a list of leasing groups",
"schema": {
"$ref": "#/definitions/GroupArray"
}
},
"400": {
"description": "If the brand is not valid",
"schema": {
"$ref": "#/definitions/Error"
}
}
},
"produces": [
"application/json"
]
}
}
},
"definitions": {
"Group": {
"type": "object",
"properties": {
"id": {
"format": "int32",
"type": "integer"
},
"name": {
"type": "string"
},
"description": {
"type": "string"
},
"leasingModelCount": {
"format": "int32",
"type": "integer"
},
"lowestMonthlyFee": {
"format": "int32",
"type": "integer"
}
}
},
"Error": {
"type": "object",
"properties": {
"code": {
"enum": [
"NotValidBrand",
"NotValidGroupId"
],
"type": "string",
"x-ms-enum": {
"name": "ErrorCode",
"modelAsString": true
}
},
"message": {
"type": "string"
}
}
},
"GroupArray": {
"type": "array",
"items": {
"$ref": "#/definitions/Group"
}
}
}
}
When I add this in a Logic App with the connector HTTP + Swagger I only get to define the {Brand} query input but not the various ways of using the Subscriptions key (header or query) as defined in SecurityDefiniations.
The whole securityDefinitions and security section are automatically generated in the Azure API Management service, but not recognized in Logic App.
See image of missing subscription key field:
What am I doing wrong?
Update
I have tried the following:
Usage of the 'Authentication' field (but this field is limited to certain types of auths flows https://learn.microsoft.com/en-us/azure/connectors/connectors-native-http#authentication)
Change the Logic App 'Http + Swagger'-action in code to add the header parameter, but this action converts the action to a simple 'Http' action and therfore loosing the automatic schema generation from Swagger.
I think you need to specify this in the Authentication-field in a JSON format. Something like:
{
"apiKeyHeader" : "your Ocp-Apim-Subscription-Key",
"apiKeyQuery" : "your subscription key"
}

OpenAM /json/authenticate ReST api behaves differently on different servers

I am calling the OpenAM /json/authenticate api for a realm. The request details are as below. The issue is on one server the response received contains the tokenId directly and on other it gives the authId with callbacks. Both servers are exactly same with same configuration. Any help in fixing the output to get the tokenId directly would be a great help. There is limited help available on OpenAM. This has given me a couple of sleepless nights.
Method: POST
URL: http://localhost:8080/openam/json/authenticate?realm=/MYREALM
Headers:
1. Content-Type:application/json
2. X-OpenAM-Password:Wsdwe#9900
3. X-OpenAM-Username:sdf.er#dummy.com
Output on one server
{
"tokenId": "AQIC5wM2LY4SfcwB_yB8SZ5JOfJSzlbBCIb0645ky5NrwUY.*AAJTSQACMDMAAlNLADASMjExOTAwMjczNDI5Mjg0Mjc3MgACUzEAAjAy*",
"successUrl": "/openam/console"
}
Output on other server
{
"authId": "eyAidHlwIjogIkpXVCIsGHJhbGciOiAiSFMyNTYiIH0.eyAib3RrIjogImo1Y2gybnFqaGwybGhnZ250cWIzazNkMHFpIiwgInJlYWxtIjogIm89aXRzdXBwb3J0MjQ3ZGF0YXN0b3JlLG91PXNlcnZpY2VzLGRjPW9wZW5hbSxkYz1mb3JnAWEvY2ssZGM9b3JnIiwgInNlc3Npb25JZCI6ICJBUUlDNXdNMkxZNFNmY3h0UUDSFGlielFPYkJuUVUxTTNudUlab3JFdEcxX2liNC4qQUFKVFNRQUNNREVBQWxOTEFCTTRPRGcxTkRRME16STFNRFl3TXpnNE5EUTRBQUpUTVFBQSoiIH0.rWE7A_tjcsyiXpQdAXUsS6OiHi97HhXQEkYwY919ovE",
"template": "",
"stage": "IDMDataStore1",
"header": "Access Your Account",
"callbacks": [
{
"type": "NameCallback",
"output": [
{
"name": "prompt",
"value": "Email ID:"
}
],
"input": [
{
"name": "IDToken1",
"value": "sdf.er#dummy.com"
}
]
},
{
"type": "PasswordCallback",
"output": [
{
"name": "prompt",
"value": "Password:"
}
],
"input": [
{
"name": "IDToken2",
"value": ""
}
]
},
{
"type": "TextOutputCallback",
"output": [
{
"name": "message",
"value": "\n "
},
{
"name": "messageType",
"value": "0"
}
]
}
]
}
NOTE: I am using OpenAM 13.0.0

Resource not found in PowerApps when connecting to API?

I am trying to send some images to power app using a custom connector.
My OpenAPI file looks this -
{
"swagger": "2.0",
"info": {
"version": "1.0.0",
"title": "Upload To Function"
},
"host": "XXXXXXXXXXXXX/.azurewebsites.net",
"paths": {
"/api/HttpTriggerCSharp/name/{name}": {
"post": {
"tags": [
"HttpTriggerCSharp"
],
"operationId": "UploadImage",
"consumes": [
"multipart/form-data"
],
"produces": [
"application/json",
"text/json",
"application/xml",
"text/xml"
],
"parameters": [
{
"name": "file",
"in": "formData",
"required": true,
"type": "file",
"x-ms-media-kind": "image"
},
{
"name": "name",
"in": "path",
"required": true,
"type": "string"
}
],
"responses": {
"200": {
"description": "Saved successfully"
},
"400": {
"description": "Could not find file to upload"
}
},
"summary": "Image Upload",
"description": "Image Upload"
}
}
},
"definitions": {}
}
My function works as I have tested it out using POSTMAN, and also within the Azure function portal. But when I test it out on Powerapps using this swagger file, I get Status code 404, Resource not found error.
I call my function like this in Powerapps -
Uploadtofunction.uploadimage(MainimageView.image,{filename:"test")
Any idea, on why it's not working?
Edit: Here is how I tested it out on POSTMAN. I think its also related to the filename in swagger. Because when I add name/filename in the body, I get 500 internal server issue.

Resources