Initial OIDC support (#15417)

jtama · web-flow · commit 6e747259ae71 · 2023-05-10T16:51:37.000+08:00
* Initial OIDC support

* Removes 'println'
Changes OIDC to OpenIdConnect
Adds generated files

* fix rebase errors
diff --git a/docs/generators/apex.md b/docs/generators/apex.md
@@ -290,7 +290,7 @@ These options may be applied as additional-properties (cli) or configOptions (pl
 | ---- | --------- | ---------- |
 |BasicAuth|✓|OAS2,OAS3
 |ApiKey|✓|OAS2,OAS3
-|OpenIDConnect|✗|OAS3
+|OpenIDConnect|✓|OAS3
 |BearerToken|✓|OAS3
 |OAuth2_Implicit|✓|OAS2,OAS3
 |OAuth2_Password|✓|OAS2,OAS3
diff --git a/docs/generators/cpp-tiny.md b/docs/generators/cpp-tiny.md
@@ -247,7 +247,7 @@ These options may be applied as additional-properties (cli) or configOptions (pl
 | ---- | --------- | ---------- |
 |BasicAuth|✓|OAS2,OAS3
 |ApiKey|✓|OAS2,OAS3
-|OpenIDConnect|✗|OAS3
+|OpenIDConnect|✓|OAS3
 |BearerToken|✓|OAS3
 |OAuth2_Implicit|✓|OAS2,OAS3
 |OAuth2_Password|✓|OAS2,OAS3
diff --git a/docs/generators/cpp-ue4.md b/docs/generators/cpp-ue4.md
@@ -258,7 +258,7 @@ These options may be applied as additional-properties (cli) or configOptions (pl
 | ---- | --------- | ---------- |
 |BasicAuth|✓|OAS2,OAS3
 |ApiKey|✓|OAS2,OAS3
-|OpenIDConnect|✗|OAS3
+|OpenIDConnect|✓|OAS3
 |BearerToken|✓|OAS3
 |OAuth2_Implicit|✓|OAS2,OAS3
 |OAuth2_Password|✓|OAS2,OAS3
diff --git a/docs/generators/fsharp-giraffe-server.md b/docs/generators/fsharp-giraffe-server.md
@@ -305,7 +305,7 @@ These options may be applied as additional-properties (cli) or configOptions (pl
 | ---- | --------- | ---------- |
 |BasicAuth|✓|OAS2,OAS3
 |ApiKey|✓|OAS2,OAS3
-|OpenIDConnect|✗|OAS3
+|OpenIDConnect|✓|OAS3
 |BearerToken|✓|OAS3
 |OAuth2_Implicit|✓|OAS2,OAS3
 |OAuth2_Password|✓|OAS2,OAS3
diff --git a/docs/generators/javascript-apollo-deprecated.md b/docs/generators/javascript-apollo-deprecated.md
@@ -258,7 +258,7 @@ These options may be applied as additional-properties (cli) or configOptions (pl
 | ---- | --------- | ---------- |
 |BasicAuth|✓|OAS2,OAS3
 |ApiKey|✓|OAS2,OAS3
-|OpenIDConnect|✗|OAS3
+|OpenIDConnect|✓|OAS3
 |BearerToken|✓|OAS3
 |OAuth2_Implicit|✓|OAS2,OAS3
 |OAuth2_Password|✓|OAS2,OAS3
diff --git a/docs/generators/javascript-closure-angular.md b/docs/generators/javascript-closure-angular.md
@@ -204,7 +204,7 @@ These options may be applied as additional-properties (cli) or configOptions (pl
 | ---- | --------- | ---------- |
 |BasicAuth|✓|OAS2,OAS3
 |ApiKey|✓|OAS2,OAS3
-|OpenIDConnect|✗|OAS3
+|OpenIDConnect|✓|OAS3
 |BearerToken|✓|OAS3
 |OAuth2_Implicit|✓|OAS2,OAS3
 |OAuth2_Password|✓|OAS2,OAS3
diff --git a/docs/generators/javascript.md b/docs/generators/javascript.md
@@ -259,7 +259,7 @@ These options may be applied as additional-properties (cli) or configOptions (pl
 | ---- | --------- | ---------- |
 |BasicAuth|✓|OAS2,OAS3
 |ApiKey|✓|OAS2,OAS3
-|OpenIDConnect|✗|OAS3
+|OpenIDConnect|✓|OAS3
 |BearerToken|✓|OAS3
 |OAuth2_Implicit|✓|OAS2,OAS3
 |OAuth2_Password|✓|OAS2,OAS3
diff --git a/docs/generators/jetbrains-http-client.md b/docs/generators/jetbrains-http-client.md
@@ -151,7 +151,7 @@ These options may be applied as additional-properties (cli) or configOptions (pl
 | ---- | --------- | ---------- |
 |BasicAuth|✓|OAS2,OAS3
 |ApiKey|✓|OAS2,OAS3
-|OpenIDConnect|✗|OAS3
+|OpenIDConnect|✓|OAS3
 |BearerToken|✓|OAS3
 |OAuth2_Implicit|✓|OAS2,OAS3
 |OAuth2_Password|✓|OAS2,OAS3
diff --git a/docs/generators/julia-client.md b/docs/generators/julia-client.md
@@ -203,7 +203,7 @@ These options may be applied as additional-properties (cli) or configOptions (pl
 | ---- | --------- | ---------- |
 |BasicAuth|✓|OAS2,OAS3
 |ApiKey|✓|OAS2,OAS3
-|OpenIDConnect|✗|OAS3
+|OpenIDConnect|✓|OAS3
 |BearerToken|✓|OAS3
 |OAuth2_Implicit|✗|OAS2,OAS3
 |OAuth2_Password|✗|OAS2,OAS3
diff --git a/docs/generators/julia-server.md b/docs/generators/julia-server.md
@@ -202,7 +202,7 @@ These options may be applied as additional-properties (cli) or configOptions (pl
 | ---- | --------- | ---------- |
 |BasicAuth|✓|OAS2,OAS3
 |ApiKey|✓|OAS2,OAS3
-|OpenIDConnect|✗|OAS3
+|OpenIDConnect|✓|OAS3
 |BearerToken|✓|OAS3
 |OAuth2_Implicit|✗|OAS2,OAS3
 |OAuth2_Password|✗|OAS2,OAS3
diff --git a/docs/generators/k6.md b/docs/generators/k6.md
@@ -151,7 +151,7 @@ These options may be applied as additional-properties (cli) or configOptions (pl
 | ---- | --------- | ---------- |
 |BasicAuth|✓|OAS2,OAS3
 |ApiKey|✓|OAS2,OAS3
-|OpenIDConnect|✗|OAS3
+|OpenIDConnect|✓|OAS3
 |BearerToken|✓|OAS3
 |OAuth2_Implicit|✓|OAS2,OAS3
 |OAuth2_Password|✓|OAS2,OAS3
diff --git a/docs/generators/markdown.md b/docs/generators/markdown.md
@@ -168,7 +168,7 @@ These options may be applied as additional-properties (cli) or configOptions (pl
 | ---- | --------- | ---------- |
 |BasicAuth|✓|OAS2,OAS3
 |ApiKey|✓|OAS2,OAS3
-|OpenIDConnect|✗|OAS3
+|OpenIDConnect|✓|OAS3
 |BearerToken|✓|OAS3
 |OAuth2_Implicit|✓|OAS2,OAS3
 |OAuth2_Password|✓|OAS2,OAS3
diff --git a/docs/generators/plantuml.md b/docs/generators/plantuml.md
@@ -150,7 +150,7 @@ These options may be applied as additional-properties (cli) or configOptions (pl
 | ---- | --------- | ---------- |
 |BasicAuth|✓|OAS2,OAS3
 |ApiKey|✓|OAS2,OAS3
-|OpenIDConnect|✗|OAS3
+|OpenIDConnect|✓|OAS3
 |BearerToken|✓|OAS3
 |OAuth2_Implicit|✓|OAS2,OAS3
 |OAuth2_Password|✓|OAS2,OAS3
diff --git a/docs/generators/python-fastapi.md b/docs/generators/python-fastapi.md
@@ -217,7 +217,7 @@ These options may be applied as additional-properties (cli) or configOptions (pl
 | ---- | --------- | ---------- |
 |BasicAuth|✓|OAS2,OAS3
 |ApiKey|✓|OAS2,OAS3
-|OpenIDConnect|✗|OAS3
+|OpenIDConnect|✓|OAS3
 |BearerToken|✓|OAS3
 |OAuth2_Implicit|✓|OAS2,OAS3
 |OAuth2_Password|✓|OAS2,OAS3
diff --git a/docs/generators/python-flask.md b/docs/generators/python-flask.md
@@ -223,7 +223,7 @@ These options may be applied as additional-properties (cli) or configOptions (pl
 | ---- | --------- | ---------- |
 |BasicAuth|✓|OAS2,OAS3
 |ApiKey|✓|OAS2,OAS3
-|OpenIDConnect|✗|OAS3
+|OpenIDConnect|✓|OAS3
 |BearerToken|✓|OAS3
 |OAuth2_Implicit|✓|OAS2,OAS3
 |OAuth2_Password|✓|OAS2,OAS3
diff --git a/docs/generators/swift5.md b/docs/generators/swift5.md
@@ -339,7 +339,7 @@ These options may be applied as additional-properties (cli) or configOptions (pl
 | ---- | --------- | ---------- |
 |BasicAuth|✓|OAS2,OAS3
 |ApiKey|✓|OAS2,OAS3
-|OpenIDConnect|✗|OAS3
+|OpenIDConnect|✓|OAS3
 |BearerToken|✓|OAS3
 |OAuth2_Implicit|✓|OAS2,OAS3
 |OAuth2_Password|✓|OAS2,OAS3
diff --git a/docs/generators/wsdl-schema.md b/docs/generators/wsdl-schema.md
@@ -156,7 +156,7 @@ These options may be applied as additional-properties (cli) or configOptions (pl
 | ---- | --------- | ---------- |
 |BasicAuth|✓|OAS2,OAS3
 |ApiKey|✓|OAS2,OAS3
-|OpenIDConnect|✗|OAS3
+|OpenIDConnect|✓|OAS3
 |BearerToken|✓|OAS3
 |OAuth2_Implicit|✓|OAS2,OAS3
 |OAuth2_Password|✓|OAS2,OAS3
diff --git a/docs/generators/xojo-client.md b/docs/generators/xojo-client.md
@@ -281,7 +281,7 @@ These options may be applied as additional-properties (cli) or configOptions (pl
 | ---- | --------- | ---------- |
 |BasicAuth|✓|OAS2,OAS3
 |ApiKey|✓|OAS2,OAS3
-|OpenIDConnect|✗|OAS3
+|OpenIDConnect|✓|OAS3
 |BearerToken|✓|OAS3
 |OAuth2_Implicit|✓|OAS2,OAS3
 |OAuth2_Password|✓|OAS2,OAS3
diff --git a/modules/openapi-generator/src/main/java/org/openapitools/codegen/CodegenSecurity.java b/modules/openapi-generator/src/main/java/org/openapitools/codegen/CodegenSecurity.java
@@ -59,6 +59,7 @@ public CodegenSecurity filterByScopeNames(List<String> filterScopes) {
         filteredSecurity.isBasicBearer = isBasicBearer;
         filteredSecurity.isApiKey = isApiKey;
         filteredSecurity.isOAuth = isOAuth;
+        filteredSecurity.isOpenId = isOpenId;
         filteredSecurity.keyParamName = keyParamName;
         filteredSecurity.isCode = isCode;
         filteredSecurity.isImplicit = isImplicit;
@@ -103,6 +104,7 @@ public boolean equals(Object o) {
                 Objects.equals(scheme, that.scheme) &&
                 Objects.equals(isBasic, that.isBasic) &&
                 Objects.equals(isOAuth, that.isOAuth) &&
+                Objects.equals(isOpenId, that.isOpenId) &&
                 Objects.equals(isApiKey, that.isApiKey) &&
                 Objects.equals(isBasicBasic, that.isBasicBasic) &&
                 Objects.equals(isHttpSignature, that.isHttpSignature) &&
@@ -128,7 +130,7 @@ public boolean equals(Object o) {
     @Override
     public int hashCode() {
 
-        return Objects.hash(name, description, type, scheme, isBasic, isOAuth, isApiKey,
+        return Objects.hash(name, description, type, scheme, isBasic, isOAuth, isOpenId, isApiKey,
                 isBasicBasic, isHttpSignature, isBasicBearer, bearerFormat, vendorExtensions,
                 keyParamName, isKeyInQuery, isKeyInHeader, isKeyInCookie, flow,
                 authorizationUrl, tokenUrl, refreshUrl, scopes, isCode, isPassword, isApplication, isImplicit,
@@ -144,6 +146,7 @@ public String toString() {
         sb.append(", scheme='").append(scheme).append('\'');
         sb.append(", isBasic=").append(isBasic);
         sb.append(", isOAuth=").append(isOAuth);
+        sb.append(", isOpenIdConnect=").append(isOpenId);
         sb.append(", isApiKey=").append(isApiKey);
         sb.append(", isBasicBasic=").append(isBasicBasic);
         sb.append(", isHttpSignature=").append(isHttpSignature);
diff --git a/modules/openapi-generator/src/main/java/org/openapitools/codegen/DefaultCodegen.java b/modules/openapi-generator/src/main/java/org/openapitools/codegen/DefaultCodegen.java
@@ -42,7 +42,6 @@
 import io.swagger.v3.oas.models.servers.Server;
 import io.swagger.v3.oas.models.servers.ServerVariable;
 import io.swagger.v3.parser.util.SchemaTypeUtil;
-import org.apache.commons.lang3.ObjectUtils;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.commons.lang3.tuple.Pair;
 import org.apache.commons.text.StringEscapeUtils;
@@ -78,24 +77,6 @@
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
 
-import io.swagger.v3.core.util.Json;
-import io.swagger.v3.oas.models.OpenAPI;
-import io.swagger.v3.oas.models.Operation;
-import io.swagger.v3.oas.models.PathItem;
-import io.swagger.v3.oas.models.callbacks.Callback;
-import io.swagger.v3.oas.models.examples.Example;
-import io.swagger.v3.oas.models.headers.Header;
-import io.swagger.v3.oas.models.media.*;
-import io.swagger.v3.oas.models.parameters.*;
-import io.swagger.v3.oas.models.responses.ApiResponse;
-import io.swagger.v3.oas.models.responses.ApiResponses;
-import io.swagger.v3.oas.models.security.OAuthFlow;
-import io.swagger.v3.oas.models.security.OAuthFlows;
-import io.swagger.v3.oas.models.security.SecurityScheme;
-import io.swagger.v3.oas.models.servers.Server;
-import io.swagger.v3.oas.models.servers.ServerVariable;
-import io.swagger.v3.parser.util.SchemaTypeUtil;
-
 import static org.openapitools.codegen.CodegenConstants.UNSUPPORTED_V310_SPEC_MSG;
 import static org.openapitools.codegen.utils.OnceLogger.once;
 import static org.openapitools.codegen.utils.StringUtils.*;
@@ -148,8 +129,8 @@ public class DefaultCodegen implements CodegenConfig {
                 .includeSecurityFeatures(
                         SecurityFeature.BasicAuth, SecurityFeature.ApiKey, SecurityFeature.BearerToken,
                         SecurityFeature.OAuth2_Implicit, SecurityFeature.OAuth2_Password,
-                        SecurityFeature.OAuth2_ClientCredentials, SecurityFeature.OAuth2_AuthorizationCode
-                        // OpenIDConnect not yet supported
+                        SecurityFeature.OAuth2_ClientCredentials, SecurityFeature.OAuth2_AuthorizationCode,
+                        SecurityFeature.OpenIDConnect
                 )
                 .includeWireFormatFeatures(
                         WireFormatFeature.JSON, WireFormatFeature.XML
@@ -5293,7 +5274,7 @@ public List<CodegenSecurity> fromSecurity(Map<String, SecurityScheme> securitySc
             final SecurityScheme securityScheme = securitySchemeMap.get(key);
             if (SecurityScheme.Type.APIKEY.equals(securityScheme.getType())) {
                 final CodegenSecurity cs = defaultCodegenSecurity(key, securityScheme);
-                cs.isBasic = cs.isOAuth = false;
+                cs.isBasic = cs.isOAuth = cs.isOpenId = false;
                 cs.isApiKey = true;
                 cs.keyParamName = securityScheme.getName();
                 cs.isKeyInHeader = securityScheme.getIn() == SecurityScheme.In.HEADER;
@@ -5302,7 +5283,7 @@ public List<CodegenSecurity> fromSecurity(Map<String, SecurityScheme> securitySc
                 codegenSecurities.add(cs);
             } else if (SecurityScheme.Type.HTTP.equals(securityScheme.getType())) {
                 final CodegenSecurity cs = defaultCodegenSecurity(key, securityScheme);
-                cs.isKeyInHeader = cs.isKeyInQuery = cs.isKeyInCookie = cs.isApiKey = cs.isOAuth = false;
+                cs.isKeyInHeader = cs.isKeyInQuery = cs.isKeyInCookie = cs.isApiKey = cs.isOAuth = cs.isOpenId = false;
                 cs.isBasic = true;
                 if ("basic".equalsIgnoreCase(securityScheme.getScheme())) {
                     cs.isBasicBasic = true;
@@ -5321,11 +5302,6 @@ public List<CodegenSecurity> fromSecurity(Map<String, SecurityScheme> securitySc
                     once(LOGGER).warn("Unknown scheme `{}` found in the HTTP security definition.", securityScheme.getScheme());
                 }
                 codegenSecurities.add(cs);
-            } else if (SecurityScheme.Type.OPENIDCONNECT.equals(securityScheme.getType())) {
-                final CodegenSecurity cs = defaultCodegenSecurity(key, securityScheme);
-                cs.isOpenId = true;
-                cs.openIdConnectUrl = securityScheme.getOpenIdConnectUrl();
-                codegenSecurities.add(cs);
             } else if (SecurityScheme.Type.OAUTH2.equals(securityScheme.getType())) {
                 final OAuthFlows flows = securityScheme.getFlows();
                 boolean isFlowEmpty = true;
@@ -5368,6 +5344,15 @@ public List<CodegenSecurity> fromSecurity(Map<String, SecurityScheme> securitySc
                 if (isFlowEmpty) {
                     once(LOGGER).error("Invalid flow definition defined in the security scheme: {}", flows);
                 }
+            } else if (SecurityScheme.Type.OPENIDCONNECT.equals(securityScheme.getType())) {
+                final CodegenSecurity cs = defaultCodegenSecurity(key, securityScheme);
+                cs.isKeyInHeader = cs.isKeyInQuery = cs.isKeyInCookie = cs.isApiKey = cs.isBasic = false;
+                cs.isOpenId = true;
+                cs.openIdConnectUrl = securityScheme.getOpenIdConnectUrl();
+                if (securityScheme.getFlows() != null) {
+                    setOpenIdConnectInfo(cs, securityScheme.getFlows().getAuthorizationCode());
+                }
+                codegenSecurities.add(cs);
             } else {
                 once(LOGGER).error("Unknown type `{}` found in the security definition `{}`.", securityScheme.getType(), securityScheme.getName());
             }
@@ -5393,7 +5378,7 @@ private CodegenSecurity defaultCodegenSecurity(String key, SecurityScheme securi
 
     private CodegenSecurity defaultOauthCodegenSecurity(String key, SecurityScheme securityScheme) {
         final CodegenSecurity cs = defaultCodegenSecurity(key, securityScheme);
-        cs.isKeyInHeader = cs.isKeyInQuery = cs.isKeyInCookie = cs.isApiKey = cs.isBasic = false;
+        cs.isKeyInHeader = cs.isKeyInQuery = cs.isKeyInCookie = cs.isApiKey = cs.isBasic = cs.isOpenId = false;
         cs.isOAuth = true;
         return cs;
     }
@@ -6618,6 +6603,18 @@ private void setOauth2Info(CodegenSecurity codegenSecurity, OAuthFlow flow) {
         }
     }
 
+    private void setOpenIdConnectInfo(CodegenSecurity codegenSecurity, OAuthFlow flow) {
+        if (flow.getScopes() != null && !flow.getScopes().isEmpty()) {
+            List<Map<String, Object>> scopes = new ArrayList<>();
+            for (Map.Entry<String, String> scopeEntry : flow.getScopes().entrySet()) {
+                Map<String, Object> scope = new HashMap<>();
+                scope.put("scope", scopeEntry.getKey());
+                scopes.add(scope);
+            }
+            codegenSecurity.scopes = scopes;
+        }
+    }
+
     private void addConsumesInfo(Operation operation, CodegenOperation codegenOperation) {
         RequestBody requestBody = ModelUtils.getReferencedRequestBody(this.openAPI, operation.getRequestBody());
         if (requestBody == null || requestBody.getContent() == null || requestBody.getContent().isEmpty()) {
diff --git a/modules/openapi-generator/src/main/java/org/openapitools/codegen/DefaultGenerator.java b/modules/openapi-generator/src/main/java/org/openapitools/codegen/DefaultGenerator.java
@@ -882,6 +882,10 @@ void addAuthenticationSwitches(Map<String, Object> bundle) {
                 bundle.put("hasOAuthMethods", true);
                 bundle.put("oauthMethods", ProcessUtils.getOAuthMethods(authMethods));
             }
+            if (ProcessUtils.hasOpenIdConnectMethods(authMethods)) {
+                bundle.put("hasOpenIdConnectMethods", true);
+                bundle.put("openIdConnectMethods", ProcessUtils.getOpenIdConnectMethods(authMethods));
+            }
             if (ProcessUtils.hasHttpBearerMethods(authMethods)) {
                 bundle.put("hasHttpBearerMethods", true);
                 bundle.put("httpBearerMethods", ProcessUtils.getHttpBearerMethods(authMethods));
@@ -1296,7 +1300,7 @@ private Map<String, String> getAllImportsMappings(Set<String> allImports) {
      */
     private Set<Map<String, String>> toImportsObjects(Map<String, String> mappedImports) {
         Set<Map<String, String>> result = new TreeSet<>(
-            Comparator.comparing(o -> o.get("classname"))
+                Comparator.comparing(o -> o.get("classname"))
         );
 
         mappedImports.forEach((key, value) -> {
@@ -1409,6 +1413,32 @@ private Map<String, SecurityScheme> getAuthMethods(List<SecurityRequirement> sec
                         }
 
                         authMethods.put(key, oauthUpdatedScheme);
+                    } else if (securityScheme.getType().equals(SecurityScheme.Type.OPENIDCONNECT)) {
+                        // Security scheme only allows to add scope in Flows, so randomly using authorization code flow
+                        OAuthFlows openIdConnectUpdatedFlows = new OAuthFlows();
+                        OAuthFlow flow = new OAuthFlow();
+                        Scopes flowScopes = new Scopes();
+                        securities.stream()
+                                .map(secReq -> secReq.get(key))
+                                .filter(Objects::nonNull)
+                                .flatMap(List::stream)
+                                .forEach(value -> flowScopes.put(value, value));
+                        flow.scopes(flowScopes);
+                        openIdConnectUpdatedFlows.authorizationCode(flow);
+
+                        SecurityScheme openIdConnectUpdatedScheme = new SecurityScheme()
+                                .type(securityScheme.getType())
+                                .description(securityScheme.getDescription())
+                                .name(securityScheme.getName())
+                                .$ref(securityScheme.get$ref())
+                                .in(securityScheme.getIn())
+                                .scheme(securityScheme.getScheme())
+                                .bearerFormat(securityScheme.getBearerFormat())
+                                .openIdConnectUrl(securityScheme.getOpenIdConnectUrl())
+                                .extensions(securityScheme.getExtensions())
+                                .flows(openIdConnectUpdatedFlows);
+
+                        authMethods.put(key, openIdConnectUpdatedScheme);
                     } else {
                         authMethods.put(key, securityScheme);
                     }
diff --git a/modules/openapi-generator/src/main/java/org/openapitools/codegen/utils/ProcessUtils.java b/modules/openapi-generator/src/main/java/org/openapitools/codegen/utils/ProcessUtils.java
