Help Configuring OAuth2 Client Credentials Flow for OpenAPI

[dpbevin]

I've been reading up on how to configure authentication and plugins to work with securitySchemes in an OpenAPI definition but I'm struggling to see how to configure the Playground to work with OAuth2 Client Credentials Flow.

The "Login" button seems to trigger an interaction redirect to the Identity Provider (IdP), which wouldn't be the case for client credentials.

I've gone through the docs pretty well but I could have also missed something.

Please can I get some help on how to configure this?

If there's a way to do this though plugins/customisation/etc, without modding the core zudoku, then I'm also open to that approach.

Expected Behaviour

If the OpenAPI definition supports OAuth Client Credentials flow, the user should be prompted to enter the following:

• Client ID
• Client Secret
• Scopes - either a basic string or checkboxes for all scopes listed in the securitySchemes.

This comment describes the problem quite well: #695 (comment)

See Also

• OAS Security Schemes? #695
• Support root level security schemes  #189

[dpbevin]

I did some more digging and I was able to adjust an OpenAPI spec to trigger an Authorize dialog for HTTP Bearer security.

Looking at the SchemeEntry in AuthorizeDialog, there's an opportunity to introduce a new dialog for client credentials flow.

[dpbevin]

PR submitted #2531

[mosch]

@dpbevin thanks for digging into this!

In general we'd recommend people to setup Zudoku in a way that the user can login and use the API Identities feature – but we do understand that this is not always possible.

We'll do some testing an get back to this asap. Thanks for you contribution!