Swagger, JWT, how to use token in calls after authentication

Question

I'm new to swagger.
We have an API written already so I'm trying manually write the swagger.yaml

So far I have figured out how to do my /login route.. and get back a JWT in the response.
But I'm not sure what way to go next.
Is it possible to automatically plug the returned JWT into subsequent calls?
Or do I have to manually copy and paste the returned JWT?

If I have to manually do it.. then.. ehh.. how?
In the swagger editor an Authenticate button appears and I can click that and get an input box looking for the apikey...
But its not the same when viewing the swagger UI ... when I browse to localhost to see the swagger UI I don't get the authenticate button and don't have anywhere to paste the JWT text...

My swagger.yaml is as follows:

swagger: "2.0"
info:
  version: 1.0.0
  title: Identity Management Service
  description: API to allow JWT authentication and authorisation
  termsOfService: http://swagger.io/terms/
  
  license:
    name: MIT
    url: http://github.com/gruntjs/grunt/blob/master/LICENSE-MIT
host: localhost:8000
basePath: /
schemes:
  - http
  - https
securityDefinitions:
  Bearer:
    type: apiKey
    name: Authorization
    in: header
consumes:
  - application/json
produces:
  - application/json
paths:
  /login:
    post:
      summary: User Authentication returning a JWT.
      description: Authenticate a user.
      parameters:
        - name: credentials
          in: body
          description: maximum number of results to return
          required: false
          schema:
            $ref: '#/definitions/creds'
      responses:
        "200":
          description: will send JWT
        default:
          description: unexpected error
          schema:
            $ref: '#/definitions/Error'
  /getUsers:
    get:
      summary: Gets list of all users
      description: Authenticate a user.
      security:
        - Bearer: []
      responses:
        "200":
          description: will send JWT
        default:
          description: unexpected error
          schema:
            $ref: '#/definitions/Error'
definitions:
  creds:
    type: object
    required:
      - username
      - password
    properties:
      username:
        type: string
      password:
        type: string

  Error:
    required:
      - code
      - message
    properties:
      code:
        type: integer
        format: int32
      message:
        type: string

Obviously I'd much prefer to have it so that the response token from the /login call be stored and used in the /getUsers ...

The response from a call to /login looks like this:

{
  "token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0eXBlIjoidXNlciIsInVzZXJpZCI6InBqbWVhbHkiLCJlbWFpbCI6InBqbWVhbHlAZ21haWwuY29tIiwiZmlyc3RuYW1lIjoiUEoiLCJsYXN0bmFtZSI6Ik1lYWx5Iiwib3JnIjoib3JnMSIsInRlYW1zIjpbInRlYW0xIl0sImFjbCI6WyJlbXBsb3llZSIsInRlYW1MZWFkIl0sInRva2VuVHlwZSI6IndlYkFwcFRva2VuIiwidG9rZW5WZXJzaW9uIjoiMSIsImlhdCI6MTQ2NzkxMDkyNSwiZXhwIjoxNDY3OTk3MzI1fQ.e4Trk-0kDoid5Xr9BQ5ZP_HMBN2l8_G2pn7ac2tt4uE",
  "user": {
    "type": "user",
    "userid": "joebloggs",
    "email": "[email protected]",
    "firstname": "Joe",
    "lastname": "Bloggs",
    "org": "org1",
    "teams": [
      "team1"
    ],
    "acl": [
      "employee",
      "teamLead"
    ],
    "tokenType": "webAppToken",
    "tokenVersion": "1",
    "iat": 1467910925,
    "exp": 1467997325
  }
}

Answer 1

You can try this, it include an Authorization Header where you can save the token and it will apply to all endpoints.

@Bean
public Docket newsApi() {
    return new Docket(DocumentationType.SWAGGER_2)
            .select()
            .apis(RequestHandlerSelectors.any())
            .paths(PathSelectors.any())
            .build()
            .securitySchemes(Lists.newArrayList(apiKey()))
            .securityContexts(Lists.newArrayList(securityContext()))
            .apiInfo(generateApiInfo());
}

@Bean
SecurityContext securityContext() {
    return SecurityContext.builder()
            .securityReferences(defaultAuth())
            .forPaths(PathSelectors.any())
            .build();
}

List<SecurityReference> defaultAuth() {
    AuthorizationScope authorizationScope
            = new AuthorizationScope("global", "accessEverything");
    AuthorizationScope[] authorizationScopes = new AuthorizationScope[1];
    authorizationScopes[0] = authorizationScope;
    return Lists.newArrayList(
            new SecurityReference("JWT", authorizationScopes));
}

private ApiKey apiKey() {
    return new ApiKey("JWT", "Authorization", "header");
}