openapi-oathkeeper CerberAuth

Use this command to install openapi-oathkeeper:

winget install --id=CerberAuth.openapi-oathkeeper -e

openapi-oathkeeper is a command-line tool designed to automate the generation of Ory Oathkeeper access rules from an OpenAPI 3 contract. It streamlines the process of enforcing authentication and authorization policies for API endpoints by converting OpenAPI documentation into actionable security configurations.

Key Features:

Automated Rule Generation: Converts OpenAPI contracts into Oathkeeper rules, eliminating manual setup for authentication and authorization.
Authentication Enforcement: Supports multiple authenticators, including JWT, to enforce secure access based on defined scopes and policies.
Authorization Policies: Automatically generates authorizer configurations to control access to API endpoints as specified in the OpenAPI contract.
Efficient Scaling: Ideal for large APIs with numerous endpoints or services, reducing the time and effort required to manage access controls at scale.
Integration Ready: Works seamlessly within existing development workflows, supporting CI/CD pipelines and simplifying security implementation.

Audience & Benefit:

Ideal for API developers and security teams tasked with securing RESTful APIs. By leveraging OpenAPI documentation, openapi-oathkeeper ensures consistent and scalable access control enforcement across services, reducing manual overhead while enhancing API security.

Installable via winget, the tool is cross-platform, supporting Linux, macOS, Windows, and Docker environments.

README

Ory Oathkeeper rules from OpenAPI

This CLI generates OathKeeper rules that enforce authentication and authorization policies for each API endpoint from an OpenAPI file.

This project automate the generation of Oathkeeper rules from an OpenAPI contract and save a lot of time especially for larger projects with many endpoints or many services by using the existing documentation provided in an OpenAPI contract. This can improve the overall security of the API and ensure that access is granted only to authorized parties. Additionally, this tool can simplify the development process by reducing the amount of manual work required to write and maintain OathKeeper rules.

Ory Oathkeeper

If you're not yet familiar with Ory Oathkeeper, Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. You can find more information and get started with Ory Oathkeeper.

> An Identity & Access Proxy is typically deployed in front of (think API Gateway or Service mesh) web-facing applications and is capable of authenticating and optionally authorizing access requests. The Access Control Decision API can be deployed alongside an existing API Gateway or reverse proxy.

Installation

Below are the instructions to install on Linux, Windows, MacOS, and Docker. You can choose the installation method that best suits your needs and environment.

If none of the installation methods below work for you, you can also download the binary from the latest release.

Linux (Snap)

Install using Snap.

[ { "id": "addPet", "version": "", "description": "Add a new pet to the store", "match": { "methods": [ "POST" ], "url": "<(https://cerberauth\\.com/api/v3|http://swagger\\.io/api/v3)>/pet" }, "authenticators": [ { "handler": "jwt", "config": { "required_scope": [ "write:pets", "read:pets" ] } } ], "authorizer": { "handler": "allow", "config": null }, "mutators": null, "errors": null, "upstream": { "preserve_host": false, "strip_path": "", "url": "" } }, { "id": "createUser", "version": "", "description": "This can only be done by the logged in user.", "match": { "methods": [ "POST" ], "url": "<(https://cerberauth\\.com/api/v3|http://swagger\\.io/api/v3)>/user" }, "authenticators": [ { "handler": "noop", "config": null } ], "authorizer": { "handler": "allow", "config": null }, "mutators": null, "errors": null, "upstream": { "preserve_host": false, "strip_path": "", "url": "" } }, { "id": "createUsersWithListInput", "version": "", "description": "Creates list of users with given input array", "match": { "methods": [ "POST" ], "url": "<(https://cerberauth\\.com/api/v3|http://swagger\\.io/api/v3)>/user/createWithList" }, "authenticators": [ { "handler": "noop", "config": null } ], "authorizer": { "handler": "allow", "config": null }, "mutators": null, "errors": null, "upstream": { "preserve_host": false, "strip_path": "", "url": "" } }, { "id": "deleteOrder", "version": "", "description": "For valid response try integer IDs with value < 1000. Anything above 1000 or nonintegers will generate API errors", "match": { "methods": [ "DELETE" ], "url": "<(https://cerberauth\\.com/api/v3|http://swagger\\.io/api/v3)>/store/order/<\\d+>" }, "authenticators": [ { "handler": "noop", "config": null } ], "authorizer": { "handler": "allow", "config": null }, "mutators": null, "errors": null, "upstream": { "preserve_host": false, "strip_path": "", "url": "" } }, { "id": "deletePet", "version": "", "description": "", "match": { "methods": [ "DELETE" ], "url": "<(https://cerberauth\\.com/api/v3|http://swagger\\.io/api/v3)>/pet/<\\d+>" }, "authenticators": [ { "handler": "jwt", "config": { "required_scope": [ "write:pets", "read:pets" ] } } ], "authorizer": { "handler": "allow", "config": null }, "mutators": null, "errors": null, "upstream": { "preserve_host": false, "strip_path": "", "url": "" } }, { "id": "deleteUser", "version": "", "description": "This can only be done by the logged in user.", "match": { "methods": [ "DELETE" ], "url": "<(https://cerberauth\\.com/api/v3|http://swagger\\.io/api/v3)>/user/<.+>" }, "authenticators": [ { "handler": "noop", "config": null } ], "authorizer": { "handler": "allow", "config": null }, "mutators": null, "errors": null, "upstream": { "preserve_host": false, "strip_path": "", "url": "" } }, { "id": "findPetsByStatus", "version": "", "description": "Multiple status values can be provided with comma separated strings", "match": { "methods": [ "GET" ], "url": "<(https://cerberauth\\.com/api/v3|http://swagger\\.io/api/v3)>/pet/findByStatus" }, "authenticators": [ { "handler": "jwt", "config": { "required_scope": [ "write:pets", "read:pets" ] } } ], "authorizer": { "handler": "allow", "config": null }, "mutators": null, "errors": null, "upstream": { "preserve_host": false, "strip_path": "", "url": "" } }, { "id": "findPetsByTags", "version": "", "description": "Multiple tags can be provided with comma separated strings. Use tag1, tag2, tag3 for testing.", "match": { "methods": [ "GET" ], "url": "<(https://cerberauth\\.com/api/v3|http://swagger\\.io/api/v3)>/pet/findByTags" }, "authenticators": [ { "handler": "jwt", "config": { "required_scope": [ "write:pets", "read:pets" ] } } ], "authorizer": { "handler": "allow", "config": null }, "mutators": null, "errors": null, "upstream": { "preserve_host": false, "strip_path": "", "url": "" } }, { "id": "getInventory", "version": "", "description": "Returns a map of status codes to quantities", "match": { "methods": [ "GET" ], "url": "<(https://cerberauth\\.com/api/v3|http://swagger\\.io/api/v3)>/store/inventory" }, "authenticators": [ { "handler": "noop", "config": null } ], "authorizer": { "handler": "allow", "config": null }, "mutators": null, "errors": null, "upstream": { "preserve_host": false, "strip_path": "", "url": "" } }, { "id": "getOrderById", "version": "", "description": "For valid response try integer IDs with value <= 5 or > 10. Other values will generate exceptions.", "match": { "methods": [ "GET" ], "url": "<(https://cerberauth\\.com/api/v3|http://swagger\\.io/api/v3)>/store/order/<\\d+>" }, "authenticators": [ { "handler": "noop", "config": null } ], "authorizer": { "handler": "allow", "config": null }, "mutators": null, "errors": null, "upstream": { "preserve_host": false, "strip_path": "", "url": "" } }, { "id": "getPetById", "version": "", "description": "Returns a single pet", "match": { "methods": [ "GET" ], "url": "<(https://cerberauth\\.com/api/v3|http://swagger\\.io/api/v3)>/pet/<\\d+>" }, "authenticators": [ { "handler": "jwt", "config": { "required_scope": [ "write:pets", "read:pets" ] } } ], "authorizer": { "handler": "allow", "config": null }, "mutators": null, "errors": null, "upstream": { "preserve_host": false, "strip_path": "", "url": "" } }, { "id": "getUserByName", "version": "", "description": "", "match": { "methods": [ "GET" ], "url": "<(https://cerberauth\\.com/api/v3|http://swagger\\.io/api/v3)>/user/<.+>" }, "authenticators": [ { "handler": "noop", "config": null } ], "authorizer": { "handler": "allow", "config": null }, "mutators": null, "errors": null, "upstream": { "preserve_host": false, "strip_path": "", "url": "" } }, { "id": "loginUser", "version": "", "description": "", "match": { "methods": [ "GET" ], "url": "<(https://cerberauth\\.com/api/v3|http://swagger\\.io/api/v3)>/user/login" }, "authenticators": [ { "handler": "noop", "config": null } ], "authorizer": { "handler": "allow", "config": null }, "mutators": null, "errors": null, "upstream": { "preserve_host": false, "strip_path": "", "url": "" } }, { "id": "logoutUser", "version": "", "description": "", "match": { "methods": [ "GET" ], "url": "<(https://cerberauth\\.com/api/v3|http://swagger\\.io/api/v3)>/user/logout" }, "authenticators": [ { "handler": "noop", "config": null } ], "authorizer": { "handler": "allow", "config": null }, "mutators": null, "errors": null, "upstream": { "preserve_host": false, "strip_path": "", "url": "" } }, { "id": "placeOrder", "version": "", "description": "Place a new order in the store", "match": { "methods": [ "POST" ], "url": "<(https://cerberauth\\.com/api/v3|http://swagger\\.io/api/v3)>/store/order" }, "authenticators": [ { "handler": "noop", "config": null } ], "authorizer": { "handler": "allow", "config": null }, "mutators": null, "errors": null, "upstream": { "preserve_host": false, "strip_path": "", "url": "" } }, { "id": "updatePet", "version": "", "description": "Update an existing pet by Id", "match": { "methods": [ "PUT" ], "url": "<(https://cerberauth\\.com/api/v3|http://swagger\\.io/api/v3)>/pet" }, "authenticators": [ { "handler": "jwt", "config": { "required_scope": [ "write:pets", "read:pets" ] } } ], "authorizer": { "handler": "allow", "config": null }, "mutators": null, "errors": null, "upstream": { "preserve_host": false, "strip_path": "", "url": "" } }, { "id": "updatePetWithForm", "version": "", "description": "", "match": { "methods": [ "POST" ], "url": "<(https://cerberauth\\.com/api/v3|http://swagger\\.io/api/v3)>/pet/<\\d+>" }, "authenticators": [ { "handler": "jwt", "config": { "required_scope": [ "write:pets", "read:pets" ] } } ], "authorizer": { "handler": "allow", "config": null }, "mutators": null, "errors": null, "upstream": { "preserve_host": false, "strip_path": "", "url": "" } }, { "id": "updateUser", "version": "", "description": "This can only be done by the logged in user.", "match": { "methods": [ "PUT" ], "url": "<(https://cerberauth\\.com/api/v3|http://swagger\\.io/api/v3)>/user/<.+>" }, "authenticators": [ { "handler": "noop", "config": null } ], "authorizer": { "handler": "allow", "config": null }, "mutators": null, "errors": null, "upstream": { "preserve_host": false, "strip_path": "", "url": "" } }, { "id": "uploadFile", "version": "", "description": "", "match": { "methods": [ "POST" ], "url": "<(https://cerberauth\\.com/api/v3|http://swagger\\.io/api/v3)>/pet/<\\d+>/uploadImage" }, "authenticators": [ { "handler": "jwt", "config": { "required_scope": [ "write:pets", "read:pets" ] } } ], "authorizer": { "handler": "allow", "config": null }, "mutators": null, "errors": null, "upstream": { "preserve_host": false, "strip_path": "", "url": "" } } ]

[ { "id": "cerberauth:getUserById", "version": "", "description": "", "match": { "methods": [ "GET" ], "url": "<^(https://www\\.cerberauth\\.com/api|https://api\\.cerberauth\\.com/api)(/users/(?:[[:alnum:]]?\\x2D?=?\\??&?_?)+/?)$>" }, "authenticators": [ { "handler": "jwt", "config": { "jwks_urls": [ "https://console.ory.sh/.well-known/jwks.json" ], "required_scope": [ "user:read" ], "target_audience": [ "https://api.cerberauth.com" ], "trusted_issuers": [ "https://console.ory.sh" ] } } ], "authorizer": { "handler": "allow", "config": null }, "mutators": [ { "handler": "noop", "config": null } ], "errors": [ { "handler": "json", "config": null } ], "upstream": { "preserve_host": false, "strip_path": "", "url": "" } }, { "id": "cerberauth:updateUser", "version": "", "description": "This can only be done by the logged in user.", "match": { "methods": [ "PUT" ], "url": "<^(https://www\\.cerberauth\\.com/api|https://api\\.cerberauth\\.com/api)(/users/(?:[[:alnum:]]?\\x2D?=?\\??&?_?)+/?)$>" }, "authenticators": [ { "handler": "jwt", "config": { "jwks_urls": [ "https://console.ory.sh/.well-known/jwks.json" ], "required_scope": [ "user:write" ], "target_audience": [ "https://api.cerberauth.com" ], "trusted_issuers": [ "https://console.ory.sh" ] } } ], "authorizer": { "handler": "allow", "config": null }, "mutators": [ { "handler": "noop", "config": null } ], "errors": [ { "handler": "json", "config": null } ], "upstream": { "preserve_host": false, "strip_path": "", "url": "" } } ]

{ "openapi": "3.0.0", "info": { "title": "My API", "version": "1.0.0" }, "servers": [ { "url": "https://api.example.com", "description": "Production server" } ], "paths": { "/users/{id}": { "get": { "summary": "Get user by ID", "operationId": "getUserById", "parameters": [ { "name": "id", "in": "path", "description": "The user id. ", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "type": "integer" }, "email": { "type": "string" } } } } } } }, "security": [ { "openidconnect": [ "user:read" ] } ] }, "put": { "tags": [ "user" ], "summary": "Update user", "description": "This can only be done by the logged in user.", "operationId": "updateUser", "parameters": [ { "name": "id", "in": "path", "description": "user id that need to be updated", "required": true, "schema": { "type": "string" } } ], "requestBody": { "description": "Update an existent user in the store", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/User" } } } }, "responses": { "default": { "description": "successful operation" } }, "security": [ { "openidconnect": [ "user:write" ] } ] } } }, "components": { "schemas": { "User": { "type": "object", "properties": { "id": { "type": "integer", "format": "int64", "example": 10 }, "email": { "type": "string", "example": "john@email.com" } } } }, "securitySchemes": { "openidconnect": { "type": "openIdConnect", "openIdConnectUrl": "https://project.console.ory.sh/.well-known/openid-configuration" } } } }

Field	Type	Key
Prefix	string	"prefix"
ServerUrls	[]string	"server_urls"
Upstream	Upstream	"upstream"
Authenticators	Map of Authenticators	"authenticators"
Authorizer	Authorization Handler	"authorizer"
Mutators	Array of Mutator Handlers	"mutators"
Errors	Array of Error Handlers	"errors"

Name	Security Schemes	OpenAPI Extension Name
JWKS URI	`oauth2`, `http`	`x-authenticator-jwks-uri`
Issuer	`oauth2`, `http`	`x-authenticator-issuer`
Audience	`openIdConnect`, `oauth2`, `http`	`x-authenticator-audience`

openapi-oathkeeper CerberAuth

README

Ory Oathkeeper rules from OpenAPI

Ory Oathkeeper

Installation

Linux (Snap)

MacOS (Homebrew)

Get Started

Configuration

Configuration File

OpenAPI Extension

Example

Command line documentation

Telemetry

Roadmap

Useful Links

License