Feature request: Add support for OAuth 2.0 authorization for Swagger UI

[nlykkei]

Use case

I want to protect and add authorization headers to requests sent using the Swagger UI, as endpoints are protected by an API Gateway REST Lambda authorizer:

https://docs.powertools.aws.dev/lambda/python/latest/core/event_handler/api_gateway/#enabling-swaggerui

Is this possible to achieve using the current Swagger UI implementation in powertools-lambda-python?

Solution/User Experience

I would like to provide configuration similar to how it's done for swagger-ui-py

Alternative solutions

No response

Acknowledgment

• This feature request meets Powertools for AWS Lambda (Python) Tenets
• Should this be considered in other Powertools for AWS Lambda languages? i.e. Java, TypeScript, and .NET

[leandrodamascena]

Hello @nlykkei! We currently do not support authentication and authorization in our OpenAPI utility. We already have an issue open (#3662) for this same request and plan to work on it in the coming weeks. Do you mind if I close this issue and mention you in the one that's already open?

[nlykkei]

Thank you @leandrodamascena for your clarification.

Is it possible to implement myself using?:

swagger_base_url: str, optional
     The base url for the swagger UI. If not provided, we will serve a recent version of the Swagger UI.

I don't know much about Swagger UI, but it seems it support OAuth 2.0 configuration. Could that be included into the external bundles?

swagger_js = f"{swagger_base_url}/swagger-ui-bundle.min.js"
swagger_css = f"{swagger_base_url}/swagger-ui.min.css"

https://swagger.io/docs/open-source-tools/swagger-ui/usage/configuration/

[leandrodamascena]

Thank you @leandrodamascena for your clarification.

Is it possible to implement myself using?:

swagger_base_url: str, optional
     The base url for the swagger UI. If not provided, we will serve a recent version of the Swagger UI.

Unfortunately, no. This swagger_base is specifically for when customers wants to host in a external server the JS/CSS files required to render the Swagger UI.

I don't know much about Swagger UI, but it seems it support config for OAuth 2.0 configuration. Could that be included into the external bundles?

swagger_js = f"{swagger_base_url}/swagger-ui-bundle.min.js"
swagger_css = f"{swagger_base_url}/swagger-ui.min.css"

I'm afraid you can't do that. Swagger UI is a project designed to enable developers to import OpenAPI/Swagger files and display them interactively in the browser. To incorporate support for OAuth2.0 and other authentication methods, we must change our OpenAPI utility to inject the configuration into the OpenAPI file.

Let me talk with the team to see our timeline for implementing this. I'll return here as soon as I have updates.

Thanks

[nlykkei]

Thank you.

But what's the purpose of the Swagger UI OAuth 2.0 configuration options then?

https://swagger.io/docs/open-source-tools/swagger-ui/usage/oauth2/

Would that be configuration for fetching the OpenAPI spec itself?

Open swagger-initializer.js in your text editor and replace "https://petstore.swagger.io/v2/swagger.json" with the URL for your OpenAPI 3.0 spec.

What I need is a Swagger UI for the OpenAPI spec, optionally protected by OIDC, and with an interface like the following, where users press "SSO Login", which fetches a token for calling all defined API endpoints:

[leandrodamascena]

My apologies for the misunderstanding. I realize now that what you're asking for is to protect the Swagger UI with OIDC/OAuth, rather than specific routes. Got it now.

However, I remain skeptical that this will work seamlessly without additional adjustments. We define the SwaggerUI at this line, and even if you bring your own JavaScript files and define initOAuth there, I doubt that var ui = SwaggerUIBundle(swaggerUIOptions) (here) will be able to read and embed specific OAuth configuration, at least without some hack.

The best approach here would be to introduce new parameters in the enable_swagger method, allowing customers to configure OAuth for SwaggerUI.

[leandrodamascena]

I'm adding this issue to our backlog to work on it in the next sprints.