Wsrtjtyk

I am attempting to include multiple Security Schemes to be used by the authentication piece of Swagger UI. Each Security Scheme needs to have a different client-id/client-secret. I cannot figure out a way to provide multiple different client-id/client-secret, because the single SecurityConfiguration loads for all those fields.

I am aware as a security concern, it is not wise to include the client-id/client-secret. These values are only going to be available in our Dev and QA environments and only internal to our network.

@Autowired(required = false)

private ClientCredentialsResourceDetails clientCredentials;



@Bean

public SecurityConfiguration security() {

    // Here we are loading the client-id/client-secret into the UI

    // Apparently, this can only be configured for a single client-id/client-secret

    SecurityConfigurationBuilder config = SecurityConfigurationBuilder.builder()

        .clientId(clientCredentials.getClientId())

        .clientSecret(clientCredentials.getClientSecret())

        .scopeSeparator(" ")

        .useBasicAuthenticationWithAccessCodeGrant(true);

    return config.build();

}



@Bean

public Docket docket() {

    ApiSelectorBuilder apiBuilder = new Docket(DocumentationType.SWAGGER_2).select()

        .apis(RequestHandlerSelectors.any());



    for (String endpoint : swaggerProperties.getDocumentedEndpoints()) {

        apiBuilder.paths(PathSelectors.regex(endpoint));

    }

    return apiBuilder.build()

        .apiInfo(apiInfo())

       // Setup different security schemes .securitySchemes(Arrays.asList(clientCredentialsSecurityScheme(), passwordSecurityScheme()))

        .securityContexts(Arrays.asList(securityContext()));

}



private ApiInfo apiInfo() {

    return new ApiInfo(swaggerProperties.getApiLongName(),

        swaggerProperties.getApiDescription(),

        swaggerProperties.getApiVersion(),

        swaggerProperties.getTermsOfServiceUrl(),

        new Contact("", "", swaggerProperties.getDeveloperEmail()),

        swaggerProperties.getLicense(), swaggerProperties.getLicenseUrl(), Arrays.asList());

}



private String getAccessTokenUri() {

    String accessTokenUri = null;

    if(clientCredentials != null) {

        accessTokenUri = clientCredentials.getAccessTokenUri();

    }

    return accessTokenUri;

}



private SecurityScheme clientCredentialsSecurityScheme() {

    ClientCredentialsGrant grantType2 = new ClientCredentialsGrant(getAccessTokenUri());



    SecurityScheme oauth = new OAuthBuilder().name("client_credential_scheme")

        .grantTypes(Arrays.asList(grantType2))

        .scopes(Arrays.asList(scopes()))

        .build();

    return oauth;

}



private SecurityScheme passwordSecurityScheme() {

    GrantType grantType = new ResourceOwnerPasswordCredentialsGrant(getAccessTokenUri());



    SecurityScheme oauth = new OAuthBuilder().name("password_scheme")

        .grantTypes(Arrays.asList(grantType))

        .build();

    return oauth;

}



private SecurityContext securityContext() {

    return SecurityContext.builder()

        .securityReferences(

                    Arrays.asList(new SecurityReference("client_credential_scheme", scopes()),

                            new SecurityReference("password_scheme", scopes())))

        .forPaths(PathSelectors.regex("/v.*"))

        .build();

}



private AuthorizationScope scopes() {

    AuthorizationScope scopes = {};

    return scopes;

}