User authentication

[abhimanyusinghgaur]

The PR you point has 3 kinds of checks in it:

1. Guardian only access: Although it is an enterprise feature, ACL works at /graphql. Using ACL, you can set which users have what permissions on which predicates. Then you will need to log in the ACL user to get his JWT and supply the JWT at /graphql using the X-Dgraph-AccessToken header. That is one way to have DB level auth.

2. Poor man’s auth: There is nothing concrete on Poor man’s auth for /graphql yet. If you would like to have Poor man’s auth on /graphql then please upvote the RFC for that.

Poor man's auth in GraphQL

Motivation Users of the GraphQL API should have a secure way of exposing their Dgraph instance. Currently, even if the user has auth rules defined, GraphQL+- endpoints like /query, /mutate can override those rules. The user currently needs to use a firewall to disable access to the GraphQL+- endpoints. User Impact Users can expose an instance of Dgraph and use the GraphQL API without having to put them behind a firewall. Implementation We already have Poorman’s auth which can be used to secure…

3. IP whitelisting: We haven’t yet felt a need to have IP whitelisting at /graphql, because this endpoint is supposed to be publicly exposed. If you think it would make sense to have IP whitelisting too at /graphql then please let us know your use case.