LI81939: X-IBM-OAUTH-PROVIDER OAUTH2 SECURITY PROPERTY MISSING FROM SECURITY SCHEMES WHEN PUBLISHING OAI3 SECURED WITH OAUTH2

APAR status

• Closed as program error.

Error description

• Publishing a OpenAPI v3 with oauth security enabled faisl with
  The security definition petstore_auth of the
  Openapi'swagger-petstore-openapi-3-0:1.0.3' must include the
  'x-ibm-oauth-provider' property because the gateway type
  property of the OpenAPI is set to 'datapower-api-gateway'"
  Steps to reproduce:
  1- create a new openapi v3 using the wizard
  2- create an oauth2 security scheme
  3- attempt to auto publish using the 'online' toggle'
  Result:
  It Fails to make API online and you will see the following
  error:
  ===
  Staging the product
  'swagger-petstore-openapi-3-0-auto-product:1.0.3 (Swagger
  Petstore - OpenAPI 3.0 auto product)' to the catalog failed
  with the following errors.
  ====
  If you look at the browser developer tools or the apim log you
  will see the following stack trace:
  {
    "status": 400,
    "message": [
      "Staging the product
  'swagger-petstore-openapi-3-0-auto-product:1.0.3 (Swagger
  Petstore - OpenAPI 3.0 auto product)' to the catalog failed
  with the following errors."
    ],
    "errors": [
      "The security definition petstore_auth of the
  Openapi'swagger-petstore-openapi-3-0:1.0.3' must include the
  'x-ibm-oauth-provider' property because the gateway type
  property of the OpenAPI is set to 'datapower-api-gateway'"
    ]
  }
  

Local fix

• Manually add the x-ibm-oauth-provider for your oauth provider
  under the securitySchemes.
  Example for a provider called 'petstore_auth'
  ====
    securitySchemes:
      petstore-auth:
        type: oauth2
        x-ibm-oauth-provider: petstore-auth
        flows:
          implicit:
            authorizationUrl:
  'https://petstore.swagger.io/oauth/authorize'
            scopes:
              'write:pets': modify pets in your account
              'read:pets': read your pets
   ====
  

Problem summary

• The `x-ibm-oauth-provider`/OAuth Provider field was missing in
  the design view of OAuth2 security schemes, which is required
  for<span style="background-color:rgb(255, 255, 255)"> OAuth2
  security schemes. This meant that the user would not be able to
  publish their API or any product that referenced the API since
  there would be a validation error.</span>
  

Problem conclusion

• <span style="color:#000000"><span
  style="background-color:rgba(232, 232, 232,
  0.04);font-family:monaco,menlo,consolas,courier
  new,monospace">The fix is included in IBM API Connect
  10.0.1.5.</span></span>
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  API CONNECT ENT

• Fixed component ID

  5725Z2201

Applicable component levels