A Generic Plugin for OIDC Authentication

[calloc134]

Hello.
I am a user of graphql-yoga.
For authentication, I am using OIDC, but not Auth0. Instead, I am using a different IDaaS than Auth0.

While graphql-yoga has a useAuth0 plugin, it would be nice to have a plugin that could work with IDaaS other than Auth0.
https://github.com/n1ru4l/envelop/tree/main/packages/plugins/auth0

Is there any plan to create a generic plugin for IDaaS in the future?
Is there a demand for such a plugin?

[EmrysMyrddin]

Hi! From what I know, you are the first one to ask for it, but feel free to open an issue to request this feature :-) This way we can track if other people are interested!

I don't think this will land in our immediate priorities, but PR from the community are very welcome! We try to be as supportive as possible to help anyone that want to contribute :-)

Feel free to even open a draft PR and ask for guidance there if you're unsure how to start or not sure of the direction to take :-)

[calloc134]

Thank you for your reply!
I will try to write a draft for this plugin soon.

[calloc134]

Please let me ask a question.

In graphql-yoga, there already exists a plugin for validating JWTs.
Is this plugin's use case the same as the useAuth0 plugin?

https://github.com/dotansimha/graphql-yoga/blob/main/packages/plugins/jwt/src/index.ts

[EmrysMyrddin]

The 2 plugins achieves goals that are pretty close, but differs in some extent.

First of all, useAuth0 is an Envelop plugin while useJWT is a Yoga plugin. This means that you can in theory use useAuth0 with any graphql server compatible with Envelop, while useJWT is tight to Yoga. But in fact, today, Yoga is pretty much the only graphql implementation that support Envelop.

The difference is at which level the hooks offered to plugins occurs. With Envelop, you can only hook into the GraphQL execution steps. With a Yoga plugin, you can also hook into the HTTP handling pipeline.

In particular here, the validation of the JWT is not done at the same moment during request processing:

• useAuth0: validates the JWT after operation parsing and validation, at graphql context building time
• useJWT: validates the JWT at HTTP request time, meaning that the whole request processing is skipped for invalid tokens.

The second thing that is different is that useAuth0 is very focused on Auth0 integration, and doesn't offer option and configuration outside of this usage, while useJWT is meant to be a very generic plugin allowing to handle every JWT use cases.

I hope this makes it more clear :-) Don't hesitate if you have other questions.