lasdf1234 opened a new issue, #14571: URL: https://github.com/apache/gravitino/issues/14571
### What would you like to be improved? `docs/open-api/idp/idp.yaml` (included by `docs/open-api/idp/openapi.yaml`) under-documents content negotiation and misstates what unauthenticated callers receive for local user store IdP APIs. Observed against the `idp-basic` plugin REST surface (all operations produce only `application/vnd.gravitino.v1+json`): | Call | Actual | Spec today | |---|---|---| | Any `/idp/...` path without `Authorization` | **401** `UnauthorizedException` | `IdpForbiddenErrorResponse` text says unauthenticated requests receive the **403** Forbidden response | | Bad Basic password | **401** | Same 403-oriented Forbidden wording | | `Accept: application/json` | **406** `RESTException` | Not listed on IdP operations (only `application/vnd.gravitino.v1+json` success media type). `Accept: */*` succeeds | Authenticated non-admins correctly get **403** for management APIs; that part of the Forbidden response is fine. Affected operations: `addIdpUser`, `getIdpUser`, `removeIdpUser`, `changeIdpUserPassword`, `updateIdpUserEnabled`, `addIdpGroup`, `getIdpGroup`, `removeIdpGroup`, `changeIdpGroupMembership`. ### How should we improve? 1. Document **401** on IdP operations for missing/invalid Basic credentials. 2. Narrow `IdpForbiddenErrorResponse` so it does **not** claim unauthenticated callers get 403; keep it for authenticated non-admins (and other true Forbidden cases). 3. Document **406** when `Accept` is incompatible with `application/vnd.gravitino.v1+json`. ### Additional context Product behavior for authn (401) vs authz (403) and Accept (406) matches the rest of Gravitino REST; this is OpenAPI contract accuracy only. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
