The name ApplyPolicy was already registered by another type

[PascalSenn]

From @mickdelaney in #4261

I have a Gateway Service, using Stitching which sits in front of 3 downstream services.
I have Authorization Policies on these downstream services.
e.g descriptor.Authorize(Policies.CanAccessProducts);

I have also added a type GlobalSettings to the Gateway itself, it then stitches that Type.
If I add an Authorize call to the ObjectType Descriptor for GlobalSettings
e.g descriptor.Authorize(Policies.CanReadGlobalSettings);

I then get an error The name ApplyPolicy was already registered by another type.

[PascalSenn]

The solution:

Define a IDirectiveMergeHanlder:

 public class IgnoreAuthroizeDirectiveHanlder
        : IDirectiveMergeHandler
    {
        private readonly MergeDirectiveRuleDelegate _next;

        public IgnoreAuthroizeHanlder(MergeDirectiveRuleDelegate next)
        {
            _next = next;
        }

        public void Merge(
            ISchemaMergeContext context,
            IReadOnlyList<IDirectiveTypeInfo> directives)
        {
            IDirectiveTypeInfo? directive = directives.First();

            if (
                !directive.Definition.Name.Value.Equals(
                    "authorize",
                    StringComparison.InvariantCultureIgnoreCase))
            {
                _next(context, directives);
            }
        }
    }

Add it to the schema:

# Startup
services
  .AddGraphQLServer()
  .AddDirectiveMergeHandler<IgnoreAuthorizeDirectiveHandler>();

[martinmesserli]

This approach does not work in my case when I implement it in the stitching server. Although the merge is not performed for the directive definition "authorize" in the IgnoreAuthorizeDirectiveHandler, it still produces the same error after startup: "The name ApplyPolicy was already registered by another type." with Status 500 Internal Server Error.

Here is the code section where the merge handler is added in the Startup.cs of the Stitching Server:

services.AddGraphQLServer()
                .AddRemoteSchema(WellKnownSchemaNames.Machines)
                .AddAuthorization()
                .AddDirectiveMergeHandler<IgnoreAuthorizeDirectiveHandler>();

What could be the cause?

Regards, Martin

[PascalSenn]

That is because of AddAuthroization on the gateway schema.
This adds the directive. The directive merge handle just ensures that there is really only one directive.
Do you need the auth directives on the gateway? Do you also define All the policies on the gateway too?

[martinmesserli]

Since I don't need authorization in the gateway (stitching server) at the moment I switched it off. I have only authentication enabled.
So when I pass on the authorization header with the Json Web Token (e.g. through the header propagation middleware) downstream to the next GraphQL server, then it works when validating the authorize roles:

[Authorize(Roles = new[] { "admin" })]
// https://graphql-aspnet.github.io/docs/controllers/authorization, attribute of namespace HotChocolate.AspNetCore.Authorization
public List<MachineState> GetMachineStates(ClaimsPrincipal claimsPrincipal) { ... }

Thx!

[pratapkumarch]

@PascalSenn, I am having the same issue. I have two services; both will use authentication configured like as below,

Service 1: Startup.cs file

services.AddAuthentication(options =>
           {
               options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
               options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
           }).AddJwtBearer(options =>
           {
               ......
               options.TokenValidationParameters.ValidateAudience = true;
               options.TokenValidationParameters.ValidAudiences = Configuration["ApiClientAuth:ValidAudiences"]
                   ?.Split(',').Select(p => p.Trim());

               options.SaveToken = true;
           });
    var hotChocolateServices = services.AddGraphQLServer()
               .AddAuthorization()
                .......
   		
      public void Configure(
           IApplicationBuilder app,
           IWebHostEnvironment env,
           IDbContextFactory<BenchmarkingDbContext> contextFactory)
       {
           if (env.IsDevelopment())
           {
               ......
               app.UseCors("MyPolicy");
           }      
          ....................
           app.UseAuthentication();
           app.UseAuthorization();

           app.UseEndpoints(endpoints =>
           {
               endpoints.MapGraphQL("/");
           });          
       }

Service 2: Startup.cs file

same code as in Service 1 

And I am using the gateway service, where I stitched both services using the HTTP client, and I have added the same configuration as in service 1 since I could not find any documentation related to auth declarations in the gateway service.

Gateway service: Startup.cs file

//services.AddAuthentication(options =>
           //{  ...  }

            ........
            .......
           var hotChocolateServices = services
               .AddGraphQLServer()
                   .AddAuthorization()

I could send the JWT token to downstream services via the HTTP client so that I do not need to use the same configuration, such as adding the authentication, but I couldn't find any example. Could you please point me in the right direction if there are any existing examples?

Do I need to remove the AddAuthroization and other auth declarations on downstream services and add this AddDirectiveMergeHandler<IgnoreAuthorizeDirectiveHandler>(); on the gateway service?

Many thanks in advance!!

[Christine-Schneidenwind]

I have the same issue.

I have a gateway running that stitches schemas from two domain services.

Setup

1. Gateway-Service Configuration

      var configurationManager = new ConfigurationManager<OpenIdConnectConfiguration>(
          openIdConfigurationUrl,
          new OpenIdConnectConfigurationRetriever(),
          new HttpDocumentRetriever()
      );
      var discoveryDocument = await configurationManager.GetConfigurationAsync();

      serviceCollection.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
          .AddJwtBearer(options => 
          {
              var signingKeys = discoveryDocument.SigningKeys;
              options.TokenValidationParameters =
                  new TokenValidationParameters
                  {
                      ....
                  };
          });
          
          ....
          
          builder.Services.AddAuthorization();

        var requestExecutionBuilder = builder.Services
            .AddGraphQLServer()
            .ModifyRequestOptions(opt => opt.IncludeExceptionDetails = true)
            .AddAuthorization()
            .AddQueryType(d => d.Name("Query"));
            .AddRemoteSchema("mySchema", true);
          
            
       builder.Services.AddHttpClient(graph.SchemaName, (sp, client) =>
        {
            client.BaseAddress = new Uri(my.graphql);

            var context = sp.GetRequiredService<IHttpContextAccessor>().HttpContext;
            if (context == null || !context.Request.Headers.ContainsKey("Authorization"))
                return;
            
            var authorization = context.Request.Headers["Authorization"].ToString();
            client.DefaultRequestHeaders.Authorization = AuthenticationHeaderValue.Parse(authorization);
        });
            
            var app = builder.Build();
            app.UseAuthentication();
            app.UseAuthorization();

2. Domain Service Configuration
The domain services are configured with authentication/authorization in the same way as the gateway

Errors/Questions

If I then start my services I will get the following error at the gateway service

1. The name authorize was already registered by another type. (HotChocolate.Types.DirectiveType)

If I use the IgnoreAuthorizeDirectiveHandler to ignore authorize then I'am getting the error at the gateway service
1. The name ApplyPolicy was already registered by another type. (HotChocolate.AspNetCore.Authorization.ApplyPolicyType)
Is a best approach to ignore the authorize directive? For what are the directives for?

If I then scipe the authorization on the graphQLServer

var requestExecutionBuilder = builder.Services
    .AddGraphQLServer()
    .AddDirectiveMergeHandler<IgnoreAuthorizeDirectiveHandler>()
    .ModifyRequestOptions(opt => opt.IncludeExceptionDetails = true)
    **//.AddAuthorization()**
    .AddQueryType(d => d.Name("Query"));

It is working, but than I also do not need the IgnoreAuthorizeDirectiveHandler.

Why can I not add the authorization at the gateway? Is that a good approach to remove the authorization at the gateway?