Define clearly the meaning of the Http authentication

[timotheeguerin]

Discussion opened on this pr #2639

Right now we have schema being an open value with some known ones(bearer and basic) It was previously assumed that the http authentication should format the header in this format <scheme> <value> but the spec says that bearer should be Bearer
The values we have are inline with openapi3 but we have never explicitly defined the meaning of the scheme.

Should it be a set of known values that emitters should understand or shoudl emitter just take the value as it is <scheme> <value>

[timotheeguerin]

Proposal

Http Authentication is defined as an authentication that use the Authorization header using a scheme:

• Basic
• Bearer
• other HTTP schemes as defined by RFC 7235 and HTTP Authentication Scheme Registry

The scheme value is case insensitive, typespec provided models will use the cannonical name of the authentication scheme.
By default the scheme can be used to produce the Authorization header in this format:

Authorization: <scheme> <value>

Example:

Authorization: Basic  ZGVtbzpwQDU1dzByZA==

Authorization: Bearer eyzabcdefhijk

Authorization: CustomScheme abcdef

[markcowl]

• Will helper APIs provide a canonical name for each of the known authentication types (PascalCase), or will emitters do this?
  • Emitters will do this

[markcowl]

est: 5

[markcowl]

Describe the breaking change
Although values are case-insensitive, changes templates for built-in authentication to use canonical (Pascal) casing instead of lower case

Back-compat design to avoid immediate breaking
None: since the value is mandated to be case-insensitive, no mitigation should be needed.

Impact
This change affecting:

• ARM
• Data-plane
• Existing specs: ~50
• New specs
• Emitters
• SDK

Targeted Sprint
September

Additional information
This change was requested by DPG