I do no get a GraphQL context for subscriptions

[gerald24]

In my Spring WebFlux app I use spring security with OAuth2:

@EnableWebFluxSecurity
@Configuration
class SecurityConfiguration(
    // ...,
    private val graphQLConfigurationProperties: GraphQLConfigurationProperties
) {

    @Bean
    fun corsWebFilter(): CorsWebFilter {
    // ...
    }

    @Bean
    fun securityWebFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
        return http {
            httpBasic { }
            oauth2ResourceServer {
                // activate query parameter parsing (this is not an issue for secure connections, such as wss://)
                bearerTokenConverter = ServerBearerTokenAuthenticationConverter().apply { setAllowUriQueryParameter(true) }

                jwt { jwtAuthenticationConverter = KeycloakJwtAuthenticationConverter() }
            }
            csrf { disable() }

            authorizeExchange {
                // actuator and monitoring
                authorize(EndpointRequest.to("health", "ping", "info"), permitAll)
                // ...

                authorize(ServerWebExchangeMatchers.pathMatchers(HttpMethod.OPTIONS, "/${graphQLConfigurationProperties.endpoint}"), permitAll)
                authorize(antPattern = "/${graphQLConfigurationProperties.endpoint}", hasAuthority(ROLE_ACCESS_USER))
                authorize(antPattern = "/${graphQLConfigurationProperties.subscriptions.endpoint}", hasAuthority(ROLE_ACCESS_USER))
                if (graphQLConfigurationProperties.playground.enabled) {
                    authorize(antPattern = "/${graphQLConfigurationProperties.playground.endpoint}", permitAll)
                }
                if (graphQLConfigurationProperties.sdl.enabled) {
                    authorize(antPattern = "/${graphQLConfigurationProperties.sdl.endpoint}", permitAll)
                }
                authorize(anyExchange, denyAll)
            }
            requestCache { disable() }
        }
    }

Note: KeycloakJwtAuthenticationConverter converts OAuth2 token to a new AuthenticationToken with a principal of type AuthenticatedUser, containing name, etc. but also realm roles, such as ROLE_ACCESS_USER

I added a GraphQLContextFactory:

@Component
class AuthenticatedGraphQLContextFactory : GraphQLContextFactory<AuthenticatedGraphQLContext> {

    override suspend fun generateContext(request: ServerHttpRequest, response: ServerHttpResponse): AuthenticatedGraphQLContext {
        val reactorContext = coroutineContext[ReactorContext]
        val securityContext = reactorContext?.context?.getOrDefault<Mono<SecurityContext>>(SecurityContext::class.java, null)?.awaitFirstOrNull()
        val user = securityContext?.authentication?.principal as? AuthenticatedUser

        logger().debug("generate context for request ${request.path} with user $user")

        return AuthenticatedGraphQLContext(
            user = user
        )
    }
}

class AuthenticatedGraphQLContext(
    val user: AuthenticatedUser?) : GraphQLContext

For any query I get the context injected:

@Component
class MyQuery : Query {

    fun demo1(context: AuthenticatedGraphQLContext): List<MyValue> {
        val user = context.user ?: return emptyList()
        // ...
    }

But for subscriptions no context will be injected:

@Component
class MySubscription : Subscription {

    fun demo2(context: AuthenticatedGraphQLContext): Publisher<List<MyValue>> {
        val user = context.user ?: return Flux.empty()
        // ...
    }

Currently I get a class cast exception, but this is just another bug due to no context was found in mono's subscriber context and the wrong default context will be injected (see #945). Removing the AuthenticatedGraphQLContext parameter, the subscription-handler will be called without any issue.

In my application, the debug log of the GraphQLContextFactory will correctly print out the security context for '/graphql' requests, as well as for '/subscription' requests. But on the way from the ContextWebFilter (which calls the factory) to the subscription handler, the context get lost, and I do not find the location where.

Just to compare with the examples:

Recently I added a new test verify subscriptionContext query with connectionParams read by MySubscriptionHooks to https://github.com/ExpediaGroup/graphql-kotlin/blob/master/examples/server/spring-server/src/test/kotlin/com/expediagroup/graphql/examples/subscriptions/SimpleSubscriptionIT.kt, which works fine, but also uses a different setup.

Just for debugging I modified SimpleSubscriptionHooks and print out the subscriber context:

    fun onOperation(
        operationMessage: SubscriptionOperationMessage,
        session: WebSocketSession,
        graphQLContext: Any?
    ): Mono<Unit> = mono{}.subscriberContext {
        println(it)
        it
    }

For the examples I got Context1{graphQLContext=com.expediagroup.graphql.examples.context.MyGraphQLContext@1ba16a7b}. While running the tests, only ContextWebFilter is active, and only ApolloSubscriptionHooks#onOperation will be called.

In my application ApolloSubscriptionHooks#onConnect and #onOperation will be called, but with no subscriber context. Also ApolloSubscriptionProtocolHandler will not get a context. I also tried to evaluate the context in SubscriptionWebSocketHandler#handle, but it is also empty.

I guess that during the protocol upgrade to the web socket connection, the context gets lost.

I prefer a spring security configuration, that blocks requests for a web socket connection before handshake over sending a token as payload after handshake. That is the reason why I use query params method.

And since the ContextWebFilter will create the GraphQL context for '/graphql' request as well as for '/subscription' I guess the way is correct.

Does anyone knows any solution how to get the security context / graphql context to the handlers?
Any help would be appreciated.

[gerald24]

This seems to be an issue with dependencies

Working Example for whom it may be helpful:
react-graphql-webflux-keycloak.zip