Extensibility of security definitions?

I’m dealing with cases where there are a lot of extended or custom authentication systems around. Various Active Directory scenarios are the most egregious example.

In looking how to represent this in our swagger docs, the security scheme object seems pretty hard-wired to basic, api key, and oauth 2. Is there an intended way to add new authentication types to the document, even if the downstream consumers won’t understand it directly? Or should I put:

    "type": "basic",
   "x-but-actually-it-is": "someCustomAuth"

or something along those lines? Is there a recommendation or pattern I can follow here?

[ovr]

Any news on it? Latest comment 5 may in this issue, still waiting support for JWT

[webron]

Take a look at https://github.com/OAI/OpenAPI-Specification/blob/OpenAPI.next/versions/3.0.md#securitySchemeObject.

It supports extensions in general. Also, basic has been changed to http and the scheme was added. If you end up using bearer, for example, you can use that to describe JWT tokens.