Add required security scheme and scopes

[eric-murray]

What type of PR is this?

• correction

What this PR does / why we need it:

API security schemes and scopes must comply with agreed API design guidelines and ICM guidelines

Which issue(s) this PR fixes:

Fixes #244

Special notes for reviewers:

None

Changelog input

 release-note
 - Add security scheme and scopes for each endpoint / method

Additional documentation

None

[RandyLevensalor]

LGTM, though I'm not an expert in this area.

[jlurien]

LGTM

:create and :update could be merged in a common scope :write, if there is no use case to differentiate them

[sfnuser]

Looks good. You may want to remove lines 22-23 in quality-on-demand.yaml for completeness.

Sigh! Finally, QoD is also swallowed by this vague security schema change :-(. Apologies - nothing towards your change - I keep recording my displeasure on this change hoping that someday ICM may take this into account (i.e.) it is better to describe all applicable security schemas in the spec and MNO pick and choose schemas based on the their jurisdiction/contract.

[eric-murray]

@sfnuser
I expect documentation updates following from this proposed change will be discussed in today's meeting

Regarding the openId scheme itself, I think the point frequently overlooked is that the openIdConnectUrl has to be API specific to be useful. A common openid-configuration for all APIs will likely list all the three possible grant types, leaving the API consumer none the wiser as to which apply to which scopes.

CAMARA have only defined three grant types and, in principle, a 3-legged token could be used with any endpoint (maybe with a change in behaviour over a 2-legged token, but still used nonetheless). So the question in a developer's mind should be "which endpoints will accept an 2-legged token?". I think possibly the way to go is to try to split APIs into separate YAMLs such that all endpoints in the YAML can be accessed using the same token, as we have done here.

That can be documented, but whether the token must be a 3-legged token or could be a 2-legged token in practice, the developer will only find out when they read the openid-configuration for that YAML.

[RandyLevensalor]

FYI: I've created camaraproject/IdentityAndConsentManagement#178 to address the wording in the mandatory text.

[hdamker]

@AxelNennker @sfnuser can you please check if your comments are addressed (based on ICM v0.2.0)? I would like to merge this one, as we already end of June decided that it is ready for final review.

[sfnuser]

@AxelNennker @sfnuser can you please check if your comments are addressed (based on ICM v0.2.0)? I would like to merge this one, as we already end of June decided that it is ready for final review.

@hdamker: Please proceed.