import ballerina/graphql;
listener graphql:Listener securedEP = new(9090,
secureSocket = {
key: {
certFile: "../resource/path/to/public.crt",
keyFile: "../resource/path/to/private.key"
}
}
);
// The service can be secured with Basic Auth and can be authorized optionally.
// Basic Auth using the LDAP user store can be enabled by setting the
// `graphql:LdapUserStoreConfig` configurations.
// Authorization is based on scopes. A scope maps to one or more groups.
// Authorization can be enabled by setting the `string|string[]` type
// configurations for `scopes` field.
@graphql:ServiceConfig {
auth: [
{
ldapUserStoreConfig: {
domainName: "avix.lk",
connectionUrl: "ldap://localhost:389",
connectionName: "cn=admin,dc=avix,dc=lk",
connectionPassword: "avix123",
userSearchBase: "ou=Users,dc=avix,dc=lk",
userEntryObjectClass: "inetOrgPerson",
userNameAttribute: "uid",
userNameSearchFilter: "(&(objectClass=inetOrgPerson)(uid=?))",
userNameListFilter: "(objectClass=inetOrgPerson)",
groupSearchBase: ["ou=Groups,dc=avix,dc=lk"],
groupEntryObjectClass: "groupOfNames",
groupNameAttribute: "cn",
groupNameSearchFilter: "(&(objectClass=groupOfNames)(cn=?))",
groupNameListFilter: "(objectClass=groupOfNames)",
membershipAttribute: "member",
userRolesCacheEnabled: true,
connectionPoolingEnabled: false,
connectionTimeout: 5,
readTimeout: 60
},
scopes: ["admin"]
}
]
}
service /graphql on securedEP {
resource function get greeting() returns string {
return "Hello, World!";
}
}
Service - Basic Auth LDAP user storeA GraphQL service can be secured with Basic Auth and by enforcing
authorization optionally. Then, it validates the Basic Auth token sent in
the |
import ballerina/graphql;
listener graphql:Listener securedEP = new(9090,
secureSocket = {
key: {
certFile: "../resource/path/to/public.crt",
keyFile: "../resource/path/to/private.key"
}
}
);
@graphql:ServiceConfig {
auth: [
{
ldapUserStoreConfig: {
domainName: "avix.lk",
connectionUrl: "ldap://localhost:389",
connectionName: "cn=admin,dc=avix,dc=lk",
connectionPassword: "avix123",
userSearchBase: "ou=Users,dc=avix,dc=lk",
userEntryObjectClass: "inetOrgPerson",
userNameAttribute: "uid",
userNameSearchFilter: "(&(objectClass=inetOrgPerson)(uid=?))",
userNameListFilter: "(objectClass=inetOrgPerson)",
groupSearchBase: ["ou=Groups,dc=avix,dc=lk"],
groupEntryObjectClass: "groupOfNames",
groupNameAttribute: "cn",
groupNameSearchFilter: "(&(objectClass=groupOfNames)(cn=?))",
groupNameListFilter: "(objectClass=groupOfNames)",
membershipAttribute: "member",
userRolesCacheEnabled: true,
connectionPoolingEnabled: false,
connectionTimeout: 5,
readTimeout: 60
},
scopes: ["admin"]
}
]
}
service /graphql on securedEP {
resource function get greeting() returns string {
return "Hello, World!";
}
}
The service can be secured with Basic Auth and can be authorized optionally.
Basic Auth using the LDAP user store can be enabled by setting the
graphql:LdapUserStoreConfig
configurations.
Authorization is based on scopes. A scope maps to one or more groups.
Authorization can be enabled by setting the string|string[]
type
configurations for scopes
field.
# You may need to change the certificate file path and private key file path.
bal run graphql_service_basic_auth_ldap_user_store.bal