From my medium post on Keycloak auth in GraphQL

keycloak-connect-graphql-subscriptions-resolvers.js

const resolvers = {
  Subscription: {
    commentAdded: {
      subscribe: () => pubsub.asyncIterator(COMMENT_ADDED)
    },
    messageAdded: {
      subscribe: auth(() => pubsub.asyncIterator(COMMENT_ADDED))
    },
    alertAdded: {
      subscribe: hasRole('admin')(() => pubsub.asyncIterator(ALERT_ADDED))
    }
  }
}