Wrong error issued with OpenID Connect security schema

An OpenID Connect schema does require only two fields:

  securitySchemes:
    OpenIdC:  
      type: openIdConnect
      openIdConnectUrl: http://172.17.0.2:8080/.well-known/openid-configuration

Then in a Path we need to refer to a security schema using securitytag:

      security:
        - OpenIdC: 
          - admin   <------ error issued here 

But editor is wrongly issuing an error as the schema were oAuth2: "admin" does not match any scope name defined in the OpenIdC security scheme.

[cvgaviao]

@tedepstein, for me actually just not throw an error when not providing a scope its ok for now.

But as I’m moving my application to OID, I investigated many OpenID Connect standard providers and all of then uses the /.well-known/openid-configuration

for example, take a look on the path provided by MS Azzure: https://login.windows.net/common/.well-known/openid-configuration

and for google: https://accounts.google.com/.well-known/openid-configuration

[tedepstein]

@cvgaviao , sorry for the delay. I have opened an issue here to get some clarification on the spec:

• https://github.com/OAI/OpenAPI-Specification/issues/1889

These other open issues suggest that OpenAPI may still be trying to figure out how to model the complex relationship between OIDC and OAuth, and the meaning of the scopes array in Security Requirements Object:

• https://github.com/OAI/OpenAPI-Specification/issues/1751
• https://github.com/OAI/OpenAPI-Specification/issues/1393
• https://github.com/OAI/OpenAPI-Specification/issues/1731

Maybe we’ll see some refinements to this in future versions of the OpenAPI spec.

In the meantime, I think the safe thing to do is to limit the validation to apply only to security requirements for oauth2-typed security schemes. We will try to get this fix into the next patch release.