dgraph-io/dgraph · error

Authorize guardian of the galaxy, extracting jwt token, erro

Error message

Authorize guardian of the galaxy, extracting jwt token, error:

What it means

AuthSuperAdmin authorizes super-admin (namespace 0, guardians) operations when ACLs are enabled. If the namespace cannot be extracted from the JWT/context, the underlying extraction error is wrapped with 'Authorize guardian of the galaxy, extracting jwt token, error:'. It means the request lacked a valid JWT carrying namespace claims.

Source

Thrown at edgraph/access.go:1128

			}
			typeNode.Fields = respFields
		}
	}

	return nil
}

// AuthSuperAdmin authorizes the operations for the users who belong to the guardians
// group in the galaxy namespace. This authorization is used for admin usages like creation and
// deletion of a namespace, resetting passwords across namespaces etc.
// NOTE: The caller should not wrap the error returned. If needed, propagate the GRPC error code.
func AuthSuperAdmin(ctx context.Context) error {
	if !x.WorkerConfig.AclEnabled {
		return nil
	}
	ns, err := x.ExtractNamespaceFrom(ctx)
	if err != nil {
		return errors.Wrap(err, "Authorize guardian of the galaxy, extracting jwt token, error:")
	}
	if ns != 0 {
		return status.Error(
			codes.PermissionDenied, "Only superadmin is allowed to do this operation")
	}
	// AuthorizeGuardians will extract (user, []groups) from the JWT claims and will check if
	// any of the group to which the user belongs is "guardians" or not.
	if err := AuthorizeGuardians(ctx); err != nil {
		s := status.Convert(err)
		return status.Error(
			s.Code(), "AuthSuperAdmin: failed to authorize guardians. "+s.Message())
	}
	glog.V(3).Info("Successfully authorised guardian of the galaxy")
	return nil
}

// AuthorizeGuardians authorizes the operation for users which belong to Guardians group.
// NOTE: The caller should not wrap the error returned. If needed, propagate the GRPC error code.

View on GitHub (pinned to 759e242be6)

Solutions

1. Login first (POST /login or dgraph acl login) to obtain a JWT and attach it as Authorization: Bearer <token> metadata on subsequent calls
2. Check the wrapped inner error: if 'jwt token expired' or invalid signature, refresh the token
3. Ensure --dir with the galaxy key (super administrators) is configured consistently on all Alphas when ACLs are enabled
4. Confirm your client SDK attaches JWT metadata on every RPC (the Go client's GetJwt/refresh token loop)
5. Temporarily disable ACL to confirm this is auth-related, then re-enable and fix credentials

Example fix

// before: no JWT attached
dg.DropNamespace(ctx, 2)
// after
tok, err := c.LoginIntoNamespace(ctx, api.UserCredentials{Userid: "gagali", Password: "pass", Namespace: 0}, 0)
ctx = metadata.AppendToOutgoingContext(ctx, "accessJwt", tok.AccessJwt)
dg.DropNamespace(ctx, 2)

// Ensure a JWT exists and ACLs require it before admin calls
if (!token) throw new Error('ACL enabled: login required before admin operations')
// attach on every RPC:
const md = new Metadata(); md.add('accessJwt', token)

try {
  await dg.createNamespace(ctx, ns)
} catch (e) {
  if (/extracting jwt token/.test(e.message) || /jwt token expired/i.test(e.message)) {
    const tok = await login(user, pass, 0) // re-login into namespace 0
    ctx = withJwt(ctx, tok.accessJwt)
    return dg.createNamespace(ctx, ns)
  }
  throw e
}

When it happens

Trigger: Calling CreateNamespace, DropNamespace, ListNamespaces, an alter operation, or a query while x.WorkerConfig.AclEnabled is true and the context has no valid/parseable JWT with namespace information (ExtractNamespaceFrom fails).

Common situations: Sending admin requests without logging in via /login; JWT actually expired or stripped by a proxy; ACLs enabled on the server but client not configured with auth; mixing anonymous and ACL-mode clients.

Related errors

• while getting jwt auth token
• cannot force namespace %#x when provided creds are not of su
• While upserting user with id %s
• Unsupported JWT signing algorithm for ACL: %v
• error parsing ACL key as ECDSA private key

AI-assisted analysis of dgraph-io/dgraph@759e242be6 (2026-09-01). Data as JSON: /api/errors/df6f2b9fa9822359. Report an issue: GitHub.