Need for fine-grained per-channel authn/authz

[jstoiko]

The current authn/authz mechanism described with securitySchemes in AsyncAPI 2.0 works at a global level, i.e. it is definable inside the server node. oAuth2 “scopes” allows to provide some authz metadata related to specific channels however 1) it only applies to oAuth2 and 2) it applied to the entire API.

Sometimes, an API may have different channels supporting a different set of permissions. Those permissions are usually reflected in the security scheme being used. Therefor, it would be nice to have the ability to set securitySchemes at the channel level.

[derberg]

@jstoiko have you seen #584 ?

[devthejo]

this isn't anymore possible to implement security at channel level in the asyncapi spec version 3 ?

[derberg]

@devthejo it was also not possible on channel level prior v3

v2 and v3 are not different in that aspect, security is either on server level or fine grained on operation level.

I will close this issue as it is super old, before we added security on operation level. Also @jstoiko is no longer active in community for over 3 years.

@devthejo if in your opinion security is not enough to be fine grained on operation level, please open a separate issue with detailed explanation for the use case and explanation why current functionality is not good enough for your use case