@@ -11,12 +11,12 @@ properties:
1111 description : " List of authentication information for different users."
1212 type : array
1313 items :
14- $ref : " #/$def /AuthenticationInfo"
14+ $ref : " #/$defs /AuthenticationInfo"
1515 authTemplate :
1616 description : " Optional authentication information template. This is used to avoid duplication in the auth list. \
1717 Entries defined in the template will be applied to all elements in the auth list that do not specify them."
1818 allOf :
19- - $ref : " #/$def /AuthenticationInfo"
19+ - $ref : " #/$defs /AuthenticationInfo"
2020 - type : object
2121 configs :
2222 description : " Optional map of configuration parameters, in the form key:value strings. \
@@ -26,9 +26,140 @@ properties:
2626 additionalProperties :
2727 type : string
2828required : ["auth"]
29- $def :
29+ $defs :
30+ # TODO unfortunately, tools like jsonschema2pojo-maven-plugin have major limitations when dealing with enums.
31+ # This is not created as a top-level class
32+ HttpVerb :
33+ type : string
34+ enum :
35+ - POST
36+ - GET
37+ - PATCH
38+ - DELETE
39+ - PUT
40+ Header :
41+ description : " HTTP header information"
42+ type : object
43+ properties :
44+ name :
45+ description : " The header name, e.g., 'Authorization'."
46+ type : string
47+ value :
48+ description : " The value of the header"
49+ type : string
50+ required : ["name","value"]
3051 AuthenticationInfo :
3152 type : object
32-
33-
34-
53+ properties :
54+ name :
55+ description : " The name given to this authentication info. \
56+ This works as a unique id for this authentication configuration."
57+ type : string
58+ requireMockHandling :
59+ description : " Specify that the authentication for this user requires setting up mock responses from an external service. \
60+ This will be done as part of the fuzzing, although only possible for white-box testing. \
61+ One consequence here is that, even if we provide correct auth info as input, then a request might still \
62+ fail due to unauthorized access if the fuzzing process does not properly set up these mocked responses in the API itself."
63+ type : boolean
64+ fixedHeaders :
65+ description : " The headers needed for authentication. \
66+ This is used to represent cases in which auth info is static/fixed, e.g., \
67+ when passing an id or username/password through a HTTP header (and not \
68+ using for example a dynamically generated token from a login endpoint first)."
69+ type : array
70+ items :
71+ $ref : " #/$defs/Header"
72+ loginEndpointAuth :
73+ $ref : " #/$defs/LoginEndpoint"
74+ required : ["name"]
75+ # ##
76+ LoginEndpoint :
77+ description : " Used to represent the case in which a login endpoint is used to obtain the authentication credentials. \
78+ These can be cookies, or a token extracted from the login endpoint's response. \
79+ This token can then be added to an HTTP header in the following requests."
80+ type : object
81+ properties :
82+ endpoint :
83+ description : " The endpoint path (eg '/login') where to execute the login. \
84+ It assumes it is on same server of API.\
85+ If not, rather use 'externalEndpointURL'."
86+ type : string
87+ externalEndpointURL :
88+ description : " If the login endpoint is on a different server, here can rather specify the full URL for it."
89+ type : string
90+ payloadRaw :
91+ description : " The raw payload to send, as a string."
92+ type : string
93+ payloadUserPwd :
94+ $ref : " #/$defs/PayloadUsernamePassword"
95+ headers :
96+ description : " HTTP headers needed when calling the login endpoint. \
97+ Username/password could be passed by headers instead of by the body payload."
98+ type : array
99+ items :
100+ $ref : " #/$defs/Header"
101+ verb :
102+ # description: "The verb used to connect to the login endpoint. \
103+ # Most of the time, this will be a 'POST'."
104+ # type: string
105+ # enum:
106+ # - POST
107+ # - GET
108+ # - PATCH
109+ # - DELETE
110+ # - PUT
111+ $ref : " #/$defs/HttpVerb"
112+ # # FIXME: unfortunately, plugin is not able to handle this... need new schema version with $ref not replacing everything
113+ # description: "The verb used to connect to the login endpoint. \
114+ # Most of the time, this will be a 'POST'."
115+ # allOf:
116+ # - $ref: "#/$defs/HttpVerb"
117+ # - type: string
118+ contentType :
119+ description : " Specify the format in which the payload is sent to the login endpoint. \
120+ A common example is 'application/json'."
121+ type : string
122+ token :
123+ $ref : " #/$defs/TokenHandling"
124+ expectCookies :
125+ description : " Specify if we are expecting to get cookies from the login endpoint. \
126+ If so, a fuzzer can use those as auth info in following requests, instead of trying to extract \
127+ an auth token from the response payload."
128+ type : boolean
129+ required : ["verb"]
130+ # ##
131+ TokenHandling :
132+ description : " Specify how to extract token from response, and how to use it for auth in following requests. \
133+ Not needed if rather expect to get back a cookie."
134+ type : object
135+ properties :
136+ extractFromField :
137+ description : " How to extract the token from a JSON response, as such JSON could have few fields, possibly nested. \
138+ It is expressed as a JSON Pointer (RFC 6901)."
139+ type : string
140+ httpHeaderName :
141+ description : " When sending a token in an HTTP header, specify to which header to add it (e.g., 'Authorization')."
142+ type : string
143+ headerPrefix :
144+ description : " When sending out the obtained token in an HTTP header, specify if there should be any \
145+ prefix (e.g., 'Bearer ' or 'JWT '). If needed, make sure it has trailing space(s)."
146+ type : string
147+ # ##
148+ PayloadUsernamePassword :
149+ description : " Payload with username and password information. \
150+ It will be automatically formatted in a proper payload based on content type."
151+ type : object
152+ properties :
153+ username :
154+ description : " The id of the user."
155+ type : string
156+ password :
157+ description : " The password of the user, in plain-text. This must NOT be hashed."
158+ type : string
159+ usernameField :
160+ description : " The name of the field in the body payload containing the username."
161+ type : string
162+ passwordField :
163+ description : " The name of the field in the body payload containing the password"
164+ type : string
165+ required : ["username","usernameField","password","passwordField"]
0 commit comments