add support for jwt authorization (close #186) #255

ecthiender · 2018-08-06T06:59:45Z

The API:

HGE has --jwt-secret flag or HASURA_GRAPHQL_JWT_SECRET env var. The value of which is a JSON.
The structure of this JSON is: {"type": "<standard-JWT-algorithms>", "key": "<the-key>"}
type : Standard JWT algos : HS256, RS256, RS512 etc. (see jwt.io).
key:
i. Incase of symmetric key, the key as it is.
ii. Incase of asymmetric keys, only the public key, in a PEM encoded string or as a X509 certificate.
The claims in the JWT token must contain the following:
i. x-hasura-default-role field: default role of that user
ii. x-hasura-allowed-roles : A list of allowed roles for the user. The default role is overriden by x-hasura-role header.
The claims in the JWT token, can have other x-hasura-* fields where their values can only be strings.
The JWT tokens are sent as Authorization: Bearer <token> headers.

To test:

Generate a shared secret (for HMAC-SHA256) or RSA key pair.
Goto https://jwt.io/ , add the keys
Edit the claims to have x-hasura-role (mandatory) and other x-hasura-* fields. Add permissions related to the claims to test permissions.
Start HGE with --jwt-secret flag or HASURA_GRAPHQL_JWT_SECRET env var, which takes a JSON string: {"type": "HS256", "key": "mylongsharedsecret"} or {"type":"RS256", "key": "<PEM-encoded-public-key>"}
Copy the JWT token from jwt.io and use it in the Authorization: Bearer <token> header.

TODO: Support EC public keys. It is blocked on frasertweedale/hs-jose#61

- Only supports HMAC-SHA256 right now - Cannot be present with webhook - Needs access key to be present - Needs to have better errors

- Use type synonyms instead of Text everywhere

- JWT keys are passed as JSON string passing flag to serve command, or as env variable HASURA_GRAPHQL_JWT_SECRET - Support for RSA JWKs

…6-jwt-auth Resolve Conflicts: server/src-lib/Hasura/Server/Auth.hs

hasura-bot · 2018-08-06T07:43:50Z

Review app available at: https://hge-ci-pull-255.herokuapp.com

hasura-bot · 2018-08-06T07:44:36Z

Review app available at: https://hge-ci-pull-255.herokuapp.com

hasura-bot · 2018-08-06T12:48:52Z

Review app available at: https://hge-ci-pull-255.herokuapp.com

hasura-bot · 2018-08-06T12:49:38Z

Review app available at: https://hge-ci-pull-255.herokuapp.com

…6-jwt-auth

hasura-bot · 2018-08-07T05:54:10Z

Review app available at: https://hge-ci-pull-255.herokuapp.com

0x777 · 2018-08-07T06:09:32Z

server/src-lib/Hasura/Server/Auth/JWT.hs

+  -- try to parse JWT token from Authorization header
+  let mAuthzHeader = find (\h -> fst h == CI.mk "Authorization") headers
+  (_, authzHeader) <- maybe missingAuthzHeader return mAuthzHeader
+  let tokenParts = BLC.words $ BL.fromStrict authzHeader


pattern match to throw errors instead of checking for length and accessing an element with an index

0x777 · 2018-08-07T06:10:33Z

server/src-lib/Hasura/Server/Auth/JWT.hs

+  let mRole = Map.lookup userRoleHeader metadataWithRole
+  role <- maybe missingRoleClaim return mRole
+
+  -- delete the x-hasura-role key from this map


why? Let x-hasura-role be also passed as params?

The UserInfo type already has role info. So I thought we should remove it ?

…6-jwt-auth Resolve Conflicts: server/stack.yaml

- pattern match on Authorization header rather than detecting length etc.

hasura-bot · 2018-08-09T12:13:58Z

Review app available at: https://hge-ci-pull-255.herokuapp.com

…6-jwt-auth Resolve Conflicts: server/src-lib/Hasura/RQL/Types/Error.hs

not deleting user role from UserInfo metadata headers, and deleting access key

hasura-bot · 2018-08-24T13:16:13Z

Review app available at: https://hge-ci-pull-255.herokuapp.com

…6-jwt-auth

hasura-bot · 2018-08-28T11:26:36Z

Review app available at: https://hge-ci-pull-255.herokuapp.com

hasura-bot · 2018-08-28T17:44:42Z

Review app available at: https://hge-ci-pull-255.herokuapp.com

…6-jwt-auth Resolve Conflicts: server/src-lib/Hasura/Server/Utils.hs

hasura-bot · 2018-08-29T07:27:14Z

Review app available at: https://hge-ci-pull-255.herokuapp.com

0x777 · 2018-08-30T06:25:46Z

server/src-lib/Hasura/Server/Auth.hs


-bsToTxt :: B.ByteString -> T.Text
-bsToTxt = TE.decodeUtf8With TE.lenientDecode
+type AccessKey = T.Text


Let's wrap them in newtypes. I've noticed couple of functions which seem to take .. Maybe Text -> Maybe Text ..

hasura-bot · 2018-08-30T08:42:31Z

Review app available at: https://hge-ci-pull-255.herokuapp.com

hasura-bot · 2018-08-30T09:44:13Z

Review app available at: https://hge-ci-pull-255.herokuapp.com

hasura-bot · 2018-08-30T10:31:15Z

Review app available at: https://hge-ci-pull-255.herokuapp.com

hasura-bot · 2018-08-30T10:32:11Z

Review app https://hge-ci-pull-255.herokuapp.com is deleted

* add a query to reload schema cache (metadata), close hasura#292 * minor code refactor * simpler root level select fields using primary keys (fix hasura#304) (hasura#306) * select fields by primary key col values as argument values, fix hasura#304 * change field name 'table_by_pkey' to 'table_by_pk' * add links to share and help (hasura#303) * add req_user_id as alias to x-hasura-user-id (fix hasura#317) (hasura#320) * fix insert fails for non-admin roles on v1/query (fix hasura#327) (hasura#328) * fix insert fails for non-admin roles on v1/query, fix hasura#327 * add test case for user role upsert usint constraint name * mutation return type and query type are same (close hasura#315) (hasura#324) * add support for jwt authorization (close hasura#186) (hasura#255) The API: 1. HGE has `--jwt-secret` flag or `HASURA_GRAPHQL_JWT_SECRET` env var. The value of which is a JSON. 2. The structure of this JSON is: `{"type": "<standard-JWT-algorithms>", "key": "<the-key>"}` `type` : Standard JWT algos : `HS256`, `RS256`, `RS512` etc. (see jwt.io). `key`: i. Incase of symmetric key, the key as it is. ii. Incase of asymmetric keys, only the public key, in a PEM encoded string or as a X509 certificate. 3. The claims in the JWT token must contain the following: i. `x-hasura-default-role` field: default role of that user ii. `x-hasura-allowed-roles` : A list of allowed roles for the user. The default role is overriden by `x-hasura-role` header. 4. The claims in the JWT token, can have other `x-hasura-*` fields where their values can only be strings. 5. The JWT tokens are sent as `Authorization: Bearer <token>` headers. --- To test: 1. Generate a shared secret (for HMAC-SHA256) or RSA key pair. 2. Goto https://jwt.io/ , add the keys 3. Edit the claims to have `x-hasura-role` (mandatory) and other `x-hasura-*` fields. Add permissions related to the claims to test permissions. 4. Start HGE with `--jwt-secret` flag or `HASURA_GRAPHQL_JWT_SECRET` env var, which takes a JSON string: `{"type": "HS256", "key": "mylongsharedsecret"}` or `{"type":"RS256", "key": "<PEM-encoded-public-key>"}` 5. Copy the JWT token from jwt.io and use it in the `Authorization: Bearer <token>` header. --- TODO: Support EC public keys. It is blocked on frasertweedale/hs-jose#61 * compare only major and minor versions for cli-server (fix hasura#331) (hasura#332) * Revert "add links to share and help (hasura#303)" (hasura#334) This reverts commit 798efdd. * update tests to use access key (close hasura#113) (hasura#296) Closes hasura#113 * generate a returning field in a mutation only when the select permission is defined (fix hasura#340) (hasura#341) * allow selectively updating columns on a conflict during insert (fix hasura#342) * fix primary key changing on upsert, fix hasura#342 * add 'update_columns' in 'on_conflict' object, consider 'allowUpsert' * 'ConflictCtx' type should respect upsert cases * validation for not null fields in an object * console: fix error notification non json, auto height css (hasura#354)

…vice Accessing postgres from service

Co-authored-by: Abhinav Gupta <127770473+abhinav-hasura@users.noreply.github.com> Co-authored-by: Brandon Martin <brandon@codedmart.com> V3_GIT_ORIGIN_REV_ID: 4f4674c5bad551afa7ed718ae78c281b6f571a62

ecthiender added 7 commits August 1, 2018 04:49

JWT Auth mode for server

1d82191

- Only supports HMAC-SHA256 right now - Cannot be present with webhook - Needs access key to be present - Needs to have better errors

implement JWT specific errors

8f9b3c4

Improve auth mode types

556c4f5

- Use type synonyms instead of Text everywhere

Fix an issue parsing x-hasura-* claims from JWT

1ba7d1e

add support for RSA JWK; add JWT secret as JSON

e1fbf50

- JWT keys are passed as JSON string passing flag to serve command, or as env variable HASURA_GRAPHQL_JWT_SECRET - Support for RSA JWKs

support RSA JWKs in PKCS8/PKCS1/X509 format

ec495d6

Merge branch 'master' of github.com:hasura/graphql-engine into fix-18…

6c1b6b9

…6-jwt-auth Resolve Conflicts: server/src-lib/Hasura/Server/Auth.hs

ecthiender added s/do-not-merge Do not merge this pull request to master c/server Related to server labels Aug 6, 2018

ecthiender removed the s/do-not-merge Do not merge this pull request to master label Aug 6, 2018

ecthiender requested a review from 0x777 August 6, 2018 13:07

ecthiender added 2 commits August 6, 2018 19:35

minor refactor and fix help text for jwt secret

bc90347

Merge branch 'master' of github.com:hasura/graphql-engine into fix-18…

4511d30

…6-jwt-auth

0x777 reviewed Aug 7, 2018

View reviewed changes

ecthiender added 2 commits August 9, 2018 15:57

Merge branch 'master' of github.com:hasura/graphql-engine into fix-18…

8b28a28

…6-jwt-auth Resolve Conflicts: server/stack.yaml

code review fix for JWT support

7bf4e0a

- pattern match on Authorization header rather than detecting length etc.

ecthiender added 3 commits August 22, 2018 14:12

Merge branch 'master' of github.com:hasura/graphql-engine into fix-18…

c20a647

…6-jwt-auth Resolve Conflicts: server/src-lib/Hasura/RQL/Types/Error.hs

bug fix in jwt metadata handling

9c6ee83

not deleting user role from UserInfo metadata headers, and deleting access key

add support for x-hasura-allowed-roles in JWT mode

ea77dbf

ecthiender added the s/do-not-merge Do not merge this pull request to master label Aug 24, 2018

ecthiender added 2 commits August 28, 2018 14:10

Merge branch 'master' of github.com:hasura/graphql-engine into fix-18…

6f1f783

…6-jwt-auth

minor refactor in jwt auth

08515ac

ecthiender removed the s/do-not-merge Do not merge this pull request to master label Aug 28, 2018

default role, when using allowed roles, should come from the jwt claims

1b2ad21

Merge branch 'master' of github.com:hasura/graphql-engine into fix-18…

312a645

…6-jwt-auth Resolve Conflicts: server/src-lib/Hasura/Server/Utils.hs

shahidhk changed the title ~~Add JWT authorization support~~ add jwt authorization support (close #186) Aug 29, 2018

ecthiender mentioned this pull request Aug 29, 2018

Add JWT docs hasura/graphql-engine-docs#81

Merged

0x777 reviewed Aug 30, 2018

View reviewed changes

change access key and webhook to newtypes

d59e3f4

0x777 approved these changes Aug 30, 2018

View reviewed changes

Merge branch 'master' into fix-186-jwt-auth

4f2a977

Merge branch 'master' into fix-186-jwt-auth

0d2326b

shahidhk approved these changes Aug 30, 2018

View reviewed changes

shahidhk changed the title ~~add jwt authorization support (close #186)~~ add support for jwt authorization (close #186) Aug 30, 2018

shahidhk merged commit b2f88ff into hasura:master Aug 30, 2018

shahidhk pushed a commit to shahidhk/graphql-engine that referenced this pull request Sep 11, 2018

Merge pull request hasura#255 from hasura/accessing-postgres-from-ser…

962502f

…vice Accessing postgres from service

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

add support for jwt authorization (close #186) #255

add support for jwt authorization (close #186) #255

ecthiender commented Aug 6, 2018 •

edited

Loading

hasura-bot commented Aug 6, 2018

hasura-bot commented Aug 6, 2018

hasura-bot commented Aug 6, 2018

hasura-bot commented Aug 6, 2018

hasura-bot commented Aug 7, 2018

0x777 Aug 7, 2018

0x777 Aug 7, 2018

ecthiender Aug 9, 2018 •

edited

Loading

hasura-bot commented Aug 9, 2018

hasura-bot commented Aug 24, 2018

hasura-bot commented Aug 28, 2018

hasura-bot commented Aug 28, 2018

hasura-bot commented Aug 29, 2018

0x777 Aug 30, 2018

hasura-bot commented Aug 30, 2018

hasura-bot commented Aug 30, 2018

hasura-bot commented Aug 30, 2018

hasura-bot commented Aug 30, 2018

add support for jwt authorization (close #186) #255

add support for jwt authorization (close #186) #255

Conversation

ecthiender commented Aug 6, 2018 • edited Loading

hasura-bot commented Aug 6, 2018

hasura-bot commented Aug 6, 2018

hasura-bot commented Aug 6, 2018

hasura-bot commented Aug 6, 2018

hasura-bot commented Aug 7, 2018

0x777 Aug 7, 2018

Choose a reason for hiding this comment

0x777 Aug 7, 2018

Choose a reason for hiding this comment

ecthiender Aug 9, 2018 • edited Loading

Choose a reason for hiding this comment

hasura-bot commented Aug 9, 2018

hasura-bot commented Aug 24, 2018

hasura-bot commented Aug 28, 2018

hasura-bot commented Aug 28, 2018

hasura-bot commented Aug 29, 2018

0x777 Aug 30, 2018

Choose a reason for hiding this comment

hasura-bot commented Aug 30, 2018

hasura-bot commented Aug 30, 2018

hasura-bot commented Aug 30, 2018

hasura-bot commented Aug 30, 2018

ecthiender commented Aug 6, 2018 •

edited

Loading

ecthiender Aug 9, 2018 •

edited

Loading