Skip to content

Commit ba8ab79

Browse files
rocksporerockspore
authoredOct 24, 2024··
alts: support altsCallCredentials in GoogleDefaultChannelCredentials (#11634)
·
v1.71.0v1.69.0
1 parent 31dad6a commit ba8ab79

File tree

4 files changed

+191
-16
lines changed

4 files changed

+191
-16
lines changed
 

‎alts/src/main/java/io/grpc/alts/AltsContextUtil.java

+14-4
Original file line numberDiff line numberDiff line change
@@ -14,9 +14,9 @@
1414
* limitations under the License.
1515
*/
1616

17-
1817
package io.grpc.alts;
1918

19+
import io.grpc.Attributes;
2020
import io.grpc.ExperimentalApi;
2121
import io.grpc.ServerCall;
2222
import io.grpc.alts.internal.AltsInternalContext;
@@ -35,7 +35,7 @@ private AltsContextUtil() {}
3535
* @return the created {@link AltsContext}
3636
* @throws IllegalArgumentException if the {@link ServerCall} has no ALTS information.
3737
*/
38-
public static AltsContext createFrom(ServerCall<?,?> call) {
38+
public static AltsContext createFrom(ServerCall<?, ?> call) {
3939
Object authContext = call.getAttributes().get(AltsProtocolNegotiator.AUTH_CONTEXT_KEY);
4040
if (!(authContext instanceof AltsInternalContext)) {
4141
throw new IllegalArgumentException("No ALTS context information found");
@@ -49,8 +49,18 @@ public static AltsContext createFrom(ServerCall<?,?> call) {
4949
* @param call the {@link ServerCall} to check
5050
* @return true, if the {@link ServerCall} contains ALTS information and false otherwise.
5151
*/
52-
public static boolean check(ServerCall<?,?> call) {
53-
Object authContext = call.getAttributes().get(AltsProtocolNegotiator.AUTH_CONTEXT_KEY);
52+
public static boolean check(ServerCall<?, ?> call) {
53+
return check(call.getAttributes());
54+
}
55+
56+
/**
57+
* Checks if the {@link Attributes} contains ALTS information.
58+
*
59+
* @param attributes the {@link Attributes} to check
60+
* @return true, if the {@link Attributes} contains ALTS information and false otherwise.
61+
*/
62+
public static boolean check(Attributes attributes) {
63+
Object authContext = attributes.get(AltsProtocolNegotiator.AUTH_CONTEXT_KEY);
5464
return authContext instanceof AltsInternalContext;
5565
}
5666
}

‎alts/src/main/java/io/grpc/alts/DualCallCredentials.java

+46
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
/*
2+
* Copyright 2024 The gRPC Authors
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package io.grpc.alts;
18+
19+
import io.grpc.CallCredentials;
20+
import java.util.concurrent.Executor;
21+
22+
/**
23+
* {@code CallCredentials} that will pick the right credentials based on whether the established
24+
* connection is ALTS or TLS.
25+
*/
26+
final class DualCallCredentials extends CallCredentials {
27+
private final CallCredentials tlsCallCredentials;
28+
private final CallCredentials altsCallCredentials;
29+
30+
public DualCallCredentials(CallCredentials tlsCallCreds, CallCredentials altsCallCreds) {
31+
tlsCallCredentials = tlsCallCreds;
32+
altsCallCredentials = altsCallCreds;
33+
}
34+
35+
@Override
36+
public void applyRequestMetadata(
37+
CallCredentials.RequestInfo requestInfo,
38+
Executor appExecutor,
39+
CallCredentials.MetadataApplier applier) {
40+
if (AltsContextUtil.check(requestInfo.getTransportAttrs())) {
41+
altsCallCredentials.applyRequestMetadata(requestInfo, appExecutor, applier);
42+
} else {
43+
tlsCallCredentials.applyRequestMetadata(requestInfo, appExecutor, applier);
44+
}
45+
}
46+
}

‎alts/src/main/java/io/grpc/alts/GoogleDefaultChannelCredentials.java

+22-12
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,7 @@ public static Builder newBuilder() {
6363
*/
6464
public static final class Builder {
6565
private CallCredentials callCredentials;
66+
private CallCredentials altsCallCredentials;
6667

6768
private Builder() {}
6869

@@ -72,23 +73,32 @@ public Builder callCredentials(CallCredentials callCreds) {
7273
return this;
7374
}
7475

76+
/** Constructs GoogleDefaultChannelCredentials with an ALTS-specific call credential. */
77+
public Builder altsCallCredentials(CallCredentials callCreds) {
78+
altsCallCredentials = callCreds;
79+
return this;
80+
}
81+
7582
/** Builds a GoogleDefaultChannelCredentials instance. */
7683
public ChannelCredentials build() {
7784
ChannelCredentials nettyCredentials =
7885
InternalNettyChannelCredentials.create(createClientFactory());
79-
if (callCredentials != null) {
80-
return CompositeChannelCredentials.create(nettyCredentials, callCredentials);
81-
}
82-
CallCredentials callCreds;
83-
try {
84-
callCreds = MoreCallCredentials.from(GoogleCredentials.getApplicationDefault());
85-
} catch (IOException e) {
86-
callCreds =
87-
new FailingCallCredentials(
88-
Status.UNAUTHENTICATED
89-
.withDescription("Failed to get Google default credentials")
90-
.withCause(e));
86+
CallCredentials tlsCallCreds = callCredentials;
87+
if (tlsCallCreds == null) {
88+
try {
89+
tlsCallCreds = MoreCallCredentials.from(GoogleCredentials.getApplicationDefault());
90+
} catch (IOException e) {
91+
tlsCallCreds =
92+
new FailingCallCredentials(
93+
Status.UNAUTHENTICATED
94+
.withDescription("Failed to get Google default credentials")
95+
.withCause(e));
96+
}
9197
}
98+
CallCredentials callCreds =
99+
altsCallCredentials == null
100+
? tlsCallCreds
101+
: new DualCallCredentials(tlsCallCreds, altsCallCredentials);
92102
return CompositeChannelCredentials.create(nettyCredentials, callCreds);
93103
}
94104

‎alts/src/test/java/io/grpc/alts/DualCallCredentialsTest.java

+109
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
/*
2+
* Copyright 2024 The gRPC Authors
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package io.grpc.alts;
18+
19+
import static org.mockito.Mockito.any;
20+
import static org.mockito.Mockito.never;
21+
import static org.mockito.Mockito.times;
22+
import static org.mockito.Mockito.verify;
23+
24+
import io.grpc.Attributes;
25+
import io.grpc.CallCredentials;
26+
import io.grpc.CallCredentials.RequestInfo;
27+
import io.grpc.MethodDescriptor;
28+
import io.grpc.SecurityLevel;
29+
import io.grpc.alts.internal.AltsInternalContext;
30+
import io.grpc.alts.internal.AltsProtocolNegotiator;
31+
import io.grpc.testing.TestMethodDescriptors;
32+
import org.junit.Rule;
33+
import org.junit.Test;
34+
import org.junit.runner.RunWith;
35+
import org.junit.runners.JUnit4;
36+
import org.mockito.Mock;
37+
import org.mockito.junit.MockitoJUnit;
38+
import org.mockito.junit.MockitoRule;
39+
40+
/** Unit tests for {@link DualCallCredentials}. */
41+
@RunWith(JUnit4.class)
42+
public class DualCallCredentialsTest {
43+
44+
@Rule public final MockitoRule mocks = MockitoJUnit.rule();
45+
46+
@Mock CallCredentials tlsCallCredentials;
47+
48+
@Mock CallCredentials altsCallCredentials;
49+
50+
private static final String AUTHORITY = "testauthority";
51+
private static final SecurityLevel SECURITY_LEVEL = SecurityLevel.PRIVACY_AND_INTEGRITY;
52+
53+
@Test
54+
public void invokeTlsCallCredentials() {
55+
DualCallCredentials callCredentials =
56+
new DualCallCredentials(tlsCallCredentials, altsCallCredentials);
57+
RequestInfo requestInfo = new RequestInfoImpl(false);
58+
callCredentials.applyRequestMetadata(requestInfo, null, null);
59+
60+
verify(altsCallCredentials, never()).applyRequestMetadata(any(), any(), any());
61+
verify(tlsCallCredentials, times(1)).applyRequestMetadata(requestInfo, null, null);
62+
}
63+
64+
@Test
65+
public void invokeAltsCallCredentials() {
66+
DualCallCredentials callCredentials =
67+
new DualCallCredentials(tlsCallCredentials, altsCallCredentials);
68+
RequestInfo requestInfo = new RequestInfoImpl(true);
69+
callCredentials.applyRequestMetadata(requestInfo, null, null);
70+
71+
verify(altsCallCredentials, times(1)).applyRequestMetadata(requestInfo, null, null);
72+
verify(tlsCallCredentials, never()).applyRequestMetadata(any(), any(), any());
73+
}
74+
75+
private static final class RequestInfoImpl extends CallCredentials.RequestInfo {
76+
private Attributes attrs;
77+
78+
RequestInfoImpl(boolean hasAltsContext) {
79+
attrs =
80+
hasAltsContext
81+
? Attributes.newBuilder()
82+
.set(
83+
AltsProtocolNegotiator.AUTH_CONTEXT_KEY,
84+
AltsInternalContext.getDefaultInstance())
85+
.build()
86+
: Attributes.EMPTY;
87+
}
88+
89+
@Override
90+
public MethodDescriptor<?, ?> getMethodDescriptor() {
91+
return TestMethodDescriptors.voidMethod();
92+
}
93+
94+
@Override
95+
public SecurityLevel getSecurityLevel() {
96+
return SECURITY_LEVEL;
97+
}
98+
99+
@Override
100+
public String getAuthority() {
101+
return AUTHORITY;
102+
}
103+
104+
@Override
105+
public Attributes getTransportAttrs() {
106+
return attrs;
107+
}
108+
}
109+
}

0 commit comments

Comments
 (0)
Please sign in to comment.