Authorization in GraphQL

Hello,

Is there any way to introduce authorization in GraphQL ?

So i have for example

  @GraphQLMutation(name = "createUser")
    @ValidationGroups(CreateChecks.class)
    public User createUser(@GraphQLArgument(name = "userRequest") @Valid UserRequest userRequest) throws ServiceException 
   
   @GraphQLQuery(name = "getUserById")
    public User getUserById(@GraphQLArgument(name = "id") @NotNull Integer id) throws ServiceException {
 

I want only users with a specific role (CREATE_USEr) can execute createUser.

I have the authorzation in the web tier (JAX-RS), but the entry point for all operation in GraphQL is in a single point, so i can’t do:

    @RolesAllowed(CREATE_USER)
    @POST
    @Path("/gql")
    public Object graphQL(GQLQuery gqlQuery) throws Exception { 
       //Executes the graph (invoques the service)
   }

because then only user with role CREATE_USER could execute getUserById and that’s not what i want- So is there any way to do that with graphQL ?

Thank you!

[ferguardiola]

Hello again,

Well looking it can be done in guice with Interceptors.

1. First we need an AuthFilter (I’m usgin JwtAuthFilter (JsonWebToken) in the filter we set the authentication we want. In that authenticator we load the user on a ThreadLocal variable

public class MyAuthenticator implements Authenticator<Map<String, ?>, User> {

 public Optional<User> authenticate(Map<String, ?> params) throws AuthenticationException {
   //Authenticate the user using the params in the map.. then you got the object User
  ActiveUser.set(user);
}


public class ActiveUser {

    private static InheritableThreadLocal<User> userThreadLocal = new InheritableThreadLocal<>();

    public static void set(User user) {
        userThreadLocal.set(user);
    }

    public static User get() {
        return userThreadLocal.get();
    }
}

1. Create the Interceptor where we will check if the user has the roles we want. The roles are obtained from the annotated method in our service

public class AuthorizerInterceptor implements MethodInterceptor {

    public Object invoke(MethodInvocation invocation) throws Throwable {
        RolesAllowed rolesAllowed = invocation.getMethod().getAnnotation(RolesAllowed.class);
        if (ActiveUser.get().getAuthorizations().stream()
                .anyMatch(authorization -> Arrays.asList(rolesAllowed.value()).contains(authorization.getRole().getName()))) {
            return invocation.proceed();
        } else {
            throw new AuthorizationException("User " + ActiveUser.get().getUserName() + " not authorized");
        }
    }

}

1. Annotae the service with the annotation we want to check (RolesAllowed) in this case

@RolesAllowed("MyRole")
@GraphQLMutation(name = "createUser")
 public User createUser(@GraphQLArgument(name = "userRequest") @Valid UserRequest userRequest) throws ServiceException {
   

1. Bind the injector with GUICE

In the AbstractModule in GUICE

bindInterceptor(Matchers.any(), Matchers.annotatedWith(RolesAllowed.class), new AuthorizerInterceptor ());

Then it works!

[ashifqureshi]

Hi Kaqqao,

When are you planning to release Authentication and Authorization support.

Thank you!