Authorization Manager Plugin#

Plugin Descriptor interface:

AuthorizationManagerPluginDescriptor

An Authorization Manager Plugin can be used to provide an authorization policy for the different kinds of endpoints supported by the Curity Identity Server:

  • SCIM - protect SCIM endpoints.
  • GraphQL - protect a GraphQL API.
  • OAuth - protect OAuth resources (e.g. the userinfo endpoint).

The following interfaces are implemented in each case, respectively:

At least an implementation for one of these interfaces should be supplied by this plugin.

Basing a GraphQL decision on the HTTP request#

Since 11.5, a GraphQL Authorization Manager may also base its decision on the HTTP request being authorized, for example on a header carrying a CAPTCHA token. To do so, implement the getGraphQLAuthorizationResult method that takes a single GraphQLAuthorizationRequest, which provides the Request being authorized in addition to the subject, action, resource and context attributes:

@Override
public AuthorizationResult<GraphQLObligation> getGraphQLAuthorizationResult(GraphQLAuthorizationRequest request)
{
    @Nullable String captchaToken = request.getHttpRequest().getHeaders().firstValue("X-Captcha-Token");

    if (captchaToken == null || !_captchaValidator.isValid(captchaToken))
    {
        return AuthorizationResult.deny("A valid CAPTCHA token is required");
    }

    return AuthorizationResult.allow();
}

Implement one of the two methods, not both: the one taking the request is called, and its default implementation delegates to the other one. Note that everything read from the HTTP request is supplied by the caller of the GraphQL API, and therefore has to be validated by the manager.

A decision that has to be made per GraphQL operation rather than per request can be deferred to an obligation: the manager may capture the request in the GraphQLObligation it returns, and the obligation is invoked while that same request is being processed.

Was this helpful?