OpenAPI Generator调用Stoplight共享模型遇401/SSL认证问题求助

我在开发Stoplight项目时引入了共享模型Model_1，YAML中自动生成了指向远程地址的$ref配置：

title: Myapi
x-stoplight:
  type: object
  x-internal: false
  properties:
    id:
      type: string
      x-stoplight:
        id: env6e1e1evebr
      readOnly: true
    model2:
      $ref: 'https://path/common/models/Model_1.v1.yaml?deref=bundle'

使用openapi-generator-maven-plugin生成代码时，遇到SSL证书错误：

[ERROR] unable to read
javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.ssl.Alert.createSSLException (Alert.java:131)

尝试改用仓库原始路径甚至在$ref中携带凭证：

model2:    $ref: 'https://path/ccommon/models/Model_1.v1.yaml#master'
# 或者携带凭证
model2:    $ref: 'https://${AR_USER}:${AR_PASSWORD}path/ccommon/models/Model_1.v1.yaml#master' 

但无论是否传凭证，都返回401未授权错误：

-[ERROR] unable to readjava.io.IOException: Server returned HTTP response code: 401 for URL: https://path/ccommon/models/Model_1.v1.yaml#master
at jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0 (Native Method)
at jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance (NativeConstructorAccessorImpl.java:77)
at jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance (DelegatingConstructorAccessorImpl.java:45)
at java.lang.reflect.Constructor.newInstanceWithCaller (Constructor.java:500)
at java.lang.reflect.Constructor.newInstance (Constructor.java:481)

我的openapi-generator-maven-plugin配置如下：

<plugin>
    <groupId>org.openapitools</groupId>
    <artifactId>openapi-generator-maven-plugin</artifactId>
    <version>7.10.0</version>
    <configuration>
        <!-- https://github.com/OpenAPITools/openapi-generator/blob/master/docs/generators/jaxrs-spec.md -->
        <generatorName>jaxrs-spec</generatorName>
        <generateApiTests>false</generateApiTests>
        <inputSpec>${project.basedir}/reference/myApi.yaml</inputSpec>
        <modelPackage>package.dto</modelPackage>
        <configOptions>
            <sourceFolder>src</sourceFolder>
            <apiPackage>path.api</apiPackage>
            <useTags>true</useTags>
            <dateLibrary>java8-localdatetime</dateLibrary>
            <interfaceOnly>true</interfaceOnly>
            <returnResponse>true</returnResponse>
            <generateBuilders>true</generateBuilders>
            <serializableModel>true</serializableModel>
            <useJakartaEe>true</useJakartaEe>
        </configOptions>
    </configuration>
    <executions>
        <execution>
            <id>generate-api</id>
            <goals>
                <goal>generate</goal>
            </goals>
        </execution>
    </executions>
</plugin>

请问如何传递令牌或凭证访问共享模型，或者有没有其他避免模型重复的方案？

1. 配置Maven插件的HTTP认证参数 #

直接在openapi-generator-maven-plugin的<configuration>中添加认证配置，支持两种方式：

• 用户名密码认证：

<configuration>
    <!-- 保留原有配置 -->
    <auth>
        <username>${AR_USER}</username>
        <password>${AR_PASSWORD}</password>
    </auth>
</configuration>

• Bearer令牌认证：
  如果远程仓库用令牌验证，添加请求头配置：

<configuration>
    <!-- 保留原有配置 -->
    <httpHeaders>
        <property>
            <name>Authorization</name>
            <value>Bearer ${AR_TOKEN}</value>
        </property>
    </httpHeaders>
</configuration>

注意：${AR_USER}、${AR_PASSWORD}、${AR_TOKEN}建议在Maven的settings.xml或项目<properties>中定义，不要硬编码在配置里。

2. 解决SSL证书信任问题 #

如果是内部CA签发的证书，需要把证书导入Java信任库：

1. 从浏览器导出远程地址的SSL证书
2. 用keytool命令导入到Java默认信任库：

keytool -importcert -file /path/to/certificate.crt -alias stoplight-model -keystore $JAVA_HOME/jre/lib/security/cacerts

默认信任库密码是changeit。也可以在Maven运行时指定自定义信任库：

<plugin>
    <!-- 保留原有配置 -->
    <executions>
        <execution>
            <id>generate-api</id>
            <goals>
                <goal>generate</goal>
            </goals>
            <configuration>
                <jvmArgs>-Djavax.net.ssl.trustStore=/path/to/your/truststore.jks -Djavax.net.ssl.trustStorePassword=your-password</jvmArgs>
            </configuration>
        </execution>
    </executions>
</plugin>

3. 本地引入共享模型，规避远程依赖 #

把共享模型Model_1.v1.yaml下载到本地项目目录，修改$ref指向本地文件：

model2:
  $ref: './common/models/Model_1.v1.yaml' # 根据实际本地路径调整

要保持模型同步，可以用两种方式管理：

• Git子模块：把共享模型仓库作为子模块引入项目，构建前拉取最新版本
• Maven依赖：把共享模型打包成jar传到内部仓库，用dependency:unpack插件解压到项目目录后引用

4. 预合并模型文件 #

用Stoplight的bundle功能，把所有依赖模型合并成一个完整的OpenAPI YAML文件，再将这个合并后的文件作为openapi-generator-maven-plugin的inputSpec，这样就不用处理远程引用的认证和SSL问题。

内容的提问来源于stack exchange，提问作者sonia belhadj