Fusion doesn't work if both subgraphs and Fusion servers use authorisation

Is there an existing issue for this?

• I have searched the existing issues

Product

Hot Chocolate

Describe the bug

If two subgraphs and Fusion servers use authorisation, both have ApplyPolicy defined and a conflict occurs in Fusion server. Theoretically you can use IgnoreType when configuring Fusion Server, but it doesn’t work.

Steps to reproduce

1. Create two subgraphs servers, each with an AddAuthorisation configuration.
2. Create FusionServer also with AddAuthorisation configuration
3. Run Fusion server
4. Try to reload fusion schema in Banana Cake Pop
5. Error from log section appears

Relevant log output

Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware[1]
      An unhandled exception has occurred while executing the request.
      HotChocolate.SchemaException: For more details look at the `Errors` property.

      1. The name `ApplyPolicy` was already registered by another type. (HotChocolate.Authorization.ApplyPolicyType)

         at HotChocolate.Configuration.TypeRegistry.Register(String typeName, RegisteredType registeredType)
         at HotChocolate.Configuration.TypeInitializer.CompleteTypeName(RegisteredType registeredType)
         at HotChocolate.Configuration.TypeInitializer.<CompleteNames>b__23_0(RegisteredType type)
         at HotChocolate.Configuration.TypeInitializer.ProcessTypes(TypeDependencyFulfilled fulfilled, Func`2 action)
         at HotChocolate.Configuration.TypeInitializer.CompleteNames()
         at HotChocolate.Configuration.TypeInitializer.Initialize()
         at HotChocolate.SchemaBuilder.Setup.InitializeTypes(SchemaBuilder builder, IDescriptorContext context, IReadOnlyList`1 types)
         at HotChocolate.SchemaBuilder.Setup.Create(SchemaBuilder builder, LazySchema lazySchema, IDescriptorContext context)
         at HotChocolate.SchemaBuilder.Create(IDescriptorContext context)
         at HotChocolate.SchemaBuilder.HotChocolate.ISchemaBuilder.Create(IDescriptorContext context)
         at HotChocolate.Execution.RequestExecutorResolver.CreateSchemaAsync(ConfigurationContext context, RequestExecutorSetup setup, RequestExecutorOptions executorOptions, IServiceProvider schemaServices, TypeModuleChangeMonitor typeModuleChangeMonitor, CancellationToken cancellationToken)
         at HotChocolate.Execution.RequestExecutorResolver.CreateSchemaServicesAsync(ConfigurationContext context, RequestExecutorSetup setup, CancellationToken cancellationToken)
         at HotChocolate.Execution.RequestExecutorResolver.GetRequestExecutorNoLockAsync(String schemaName, CancellationToken cancellationToken)
         at HotChocolate.Execution.RequestExecutorResolver.GetRequestExecutorAsync(String schemaName, CancellationToken cancellationToken)
         at HotChocolate.Execution.RequestExecutorProxy.GetRequestExecutorAsync(CancellationToken cancellationToken)
         at HotChocolate.AspNetCore.HttpPostMiddlewareBase.HandleRequestAsync(HttpContext context)
         at HotChocolate.AspNetCore.HttpPostMiddlewareBase.InvokeAsync(HttpContext context)
         at Microsoft.AspNetCore.Builder.EndpointRouteBuilderExtensions.<>c__DisplayClass20_0.<<UseCancellation>b__1>d.MoveNext()
      --- End of stack trace from previous location ---
         at Microsoft.AspNetCore.Routing.EndpointMiddleware.<Invoke>g__AwaitRequestTask|6_0(Endpoint endpoint, Task requestTask, ILogger logger)
         at Symfonia.Admin.Api.GraphQL.Middlewares.LoadPlatformSchemaMiddleware.InvokeAsync(HttpContext context, RequestDelegate next) in C:\TFS\Core2\src\modules\Admin\Symfonia.Admin.Api.GraphQL\Middlewares\LoadPlatformSchemaMiddleware.cs:line 43
         at Microsoft.AspNetCore.Builder.UseMiddlewareExtensions.<>c__DisplayClass6_1.<<UseMiddlewareInterface>b__1>d.MoveNext()
      --- End of stack trace from previous location ---
         at Microsoft.AspNetCore.Authorization.AuthorizationMiddleware.Invoke(HttpContext context)
         at Microsoft.AspNetCore.Builder.UseMiddlewareExtensions.<>c__DisplayClass6_1.<<UseMiddlewareInterface>b__1>d.MoveNext()
      --- End of stack trace from previous location ---
         at Symfonia.Api.Middlewares.EnableRequestBodyBufferingMiddleware.InvokeAsync(HttpContext context) in C:\TFS\Core2\src\Symfonia.Api\Middlewares\EnableRequestBodyBufferingMiddleware.cs:line 14
         at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)
         at Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddlewareImpl.Invoke(HttpContext context)

Additional Context?

No response

Version

13.3.1

[michaelstaib]

Its not a bug as we have not implemented any authorization on the fusion gateway. At the moment its not supported. With the current version authorization is supposed to be handled by the subgraph.

We have a feature for authorization on the backlog for version 13.8.

I am closing this issue as it is by design that the gateway has no authorization capabilities as of now.

This is expected:

I had header propagation configured and it works fine when subgraph has authorisation and fusion server does not.

[Meh3]

Ps: I’m writing from the perspective of a larger company that has a cloud platform and many products around it with a single point of access.