[BUG] bearerAuth security scheme not resulting in access_token being used to create Authorization header.

[JonathanNathanson]

Bug Report Checklist

• [x] Have you provided a full/minimal spec to reproduce the issue?
• [x] Have you validated the input using an OpenAPI validator (example)?
• [x] Have you tested with the latest master to confirm the issue still exists?
• [x] Have you searched for related issues/PRs?
• [x] What's the actual output vs expected output?
• [ ] [Optional] Sponsorship to speed up the bug fix or feature request (example)

Description

Having generated a Python client from an OpenAPI spec including the following securityscheme:

  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT

It is not possible to use the access_token configuration parameter in the resulting client. Passing it to openapi_client.Configuration on instantiation, or adding it to the instantiated object, does not result in the Authorization header being passed in requests.

openapi-generator version

7.3.0

OpenAPI declaration file content or url

  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT

Generation Details

docker run --rm \
  -v ${PWD}:/local openapitools/openapi-generator-cli generate \
  -i /local/myspecification.yaml \
  -g python \
  -o /local/client

Steps to reproduce

"""Testing the OpenAPI client."""

import openapi_client
from openapi_client.rest import ApiException
from pprint import pprint


configuration = openapi_client.Configuration(
    host="https://myapi.com/v2.5.6"
    access_token="my_token"
)


configuration.debug = True

configuration.access_token = "my_token"


with openapi_client.ApiClient(
    configuration,
) as api_client:
    api_instance = openapi_client.DefaultApi(api_client)

    try:
        api_response = api_instance.get_building_by_id(20)
        pprint(api_response)
    except ApiException as e:
        print("Exception when calling DefaultApi->get_building_by_id: %s\n" % e)

Debug output:

send: b'GET /v2.5.6/buildings/20 HTTP/1.1\r\nHost: myapi.com\r\nAccept-Encoding: identity\r\nAccept: application/json\r\nUser-Agent: OpenAPI-Generator/1.0.0/python\r\n\r\n'

Related issues/PRs

Seems related:

https://github.com/OpenAPITools/openapi-generator/issues/8865

But stated fix of setting saccess_token after instantiation of the configuration class doesn't appear to work. And the issue says it was fixed in v6. Indeed, configuration.py in the generated code does seem to include the requisite fixes:

self.access_token = access_token
        """Access token
        """

...

    def auth_settings(self):
        """Gets Auth Settings dict for api client.

        :return: The Auth Settings information dict.
        """
        auth = {}
        if self.access_token is not None:
            auth['bearerAuth'] = {
                'type': 'bearer',
                'in': 'header',
                'format': 'JWT',
                'key': 'Authorization',
                'value': 'Bearer ' + self.access_token
            }
        return auth

Suggest a fix

I can't seem to trace down the code which is ignoring the auth_settings. There appears to be no other code that references auth['bearerAuth'].

[fa0311]

Are these included in the schema file?

security:
- bearerAuth: []

---

I can't seem to trace down the code which is ignoring the auth_settings. There appears to be no other code that references auth['bearerAuth']

Probably does not generate auth['bearerAuth'] even when configured correctly. Instead, these are generated:

# ./api/default_api.py
def _get_building_by_id_serialize(
        self,
        _request_auth,
        _content_type,
        _headers,
        _host_index,
) -> RequestSerialized:
        ...
        _auth_settings: List[str] = [
            'bearerAuth'
        ]

[JonathanNathanson]

Yes, the scehma includes.

security:
- bearerAuth: []

So is the behaviour I'm witnessing expected? How should I use an access_token? Currently the workaround is to set the header manually.

[lostiniceland]

We are seing this issue as well. The client generator for Java - Spring - Webclient is not adding any "authorizations" event though they are defined. Due to this we cannot call apiClient.setBearerTocken(...)

As workaround we have to use apiClient.addDefaultHeader("Authorization", ....)

[mike-gangl]

I'm also having the exact same issue. Using openapi-generator version 7.7.0.

[mike-gangl]

For those finding this issue- a work around in the previously mentioned bug (fixed) still works. Namely setting a default header on the api_client.

https://github.com/OpenAPITools/openapi-generator/issues/8865#issuecomment-810781576