用户认证

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

// PerRPCCredentials defines the common interface for the credentials which need to
// attach security information to every RPC (e.g., oauth2).
type PerRPCCredentials interface {
    // GetRequestMetadata gets the current request metadata, refreshing tokens
    // if required. This should be called by the transport layer on each
    // request, and the data should be populated in headers or other
    // context. If a status code is returned, it will be used as the status for
    // the RPC (restricted to an allowable set of codes as defined by gRFC
    // A54). uri is the URI of the entry point for the request.  When supported
    // by the underlying implementation, ctx can be used for timeout and
    // cancellation. Additionally, RequestInfo data will be available via ctx
    // to this call.  TODO(zhaoq): Define the set of the qualified keys instead
    // of leaving it as an arbitrary string.
    GetRequestMetadata(ctx context.Context, uri ...string) (map[string]string, error)
    // RequireTransportSecurity indicates whether the credentials requires
    // transport security.
    RequireTransportSecurity() bool
}

1
2
3
4
5
6

type PerRPCCredentials interface {
    // GetRequestMetadata 获取当前请求的metadata
    GetRequestMetadata(ctx context.Context, uri ...string) (map[string]string, error)
    // RequireTransportSecurity 是否使用安全的传输协议
    RequireTransportSecurity() bool
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

var _ credentials.PerRPCCredentials = BasicAuthentication{}

type BasicAuthentication struct {
    password string
    username string
}

func (b BasicAuthentication) GetRequestMetadata(ctx context.Context, uri ...string) (map[string]string, error) {
    auth := b.username + ":" + b.password
    enc := base64.StdEncoding.EncodeToString([]byte(auth))

    return map[string]string{
    "authorization": "Basic " + enc,
    }, nil
}

func (b BasicAuthentication) RequireTransportSecurity() bool {
    return true
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

func main() {
    ctx, cancel := context.WithTimeout(context.Background(), time.Second)
    defer cancel()

    auth := BasicAuthentication{
        username: "admin",
        password: "admin",
    }

    creds, err := credentials.NewClientTLSFromFile("./x509/rootCa.crt", "www.example.com")
    if err != nil {
        panic(err)
    }

    conn, err := grpc.Dial("localhost:8009",
    grpc.WithTransportCredentials(creds),
    grpc.WithPerRPCCredentials(auth))
    if err != nil {
        panic(err)
    }
    defer conn.Close()

    client := pb.NewOrderManagementClient(conn)

    // Get Order
    retrievedOrder, err := client.GetOrder(ctx, &wrapperspb.StringValue{Value: "101"})
    if err != nil {
        panic(err)
    }

    log.Print("GetOrder Response -> : ", retrievedOrder)
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

auth := BasicAuthentication{
    username: "admin",
    password: "admin",
}

conn, err := grpc.Dial("localhost:8009",
                       grpc.WithTransportCredentials(insecure.NewCredentials()),
                       grpc.WithPerRPCCredentials(auth))
if err != nil {
    panic(err)
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

var (
 errMissingMetadata = status.Errorf(codes.InvalidArgument, "missing metadata")
 errInvalidToken    = status.Errorf(codes.Unauthenticated, "invalid credentials")
)

func ensureValidBasicCredentials(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (resp interface{}, err error) {
    md, ok := metadata.FromIncomingContext(ctx)
    if !ok {
        return nil, errMissingMetadata
    }

    authorization := md["authorization"]

    if len(authorization) < 1 {
        return nil, errInvalidToken
    }

    token := strings.TrimPrefix(authorization[0], "Basic ")
    if token != base64.StdEncoding.EncodeToString([]byte("admin:admin")) {
        return nil, errInvalidToken
    }

    return handler(ctx, req)
}

func main() {
    l, err := net.Listen("tcp", ":8009")
        if err != nil {
        panic(err)
    }

    creds, err := credentials.NewServerTLSFromFile("./x509/server.crt", "./x509/server.key")
    s := grpc.NewServer(
        grpc.UnaryInterceptor(ensureValidBasicCredentials),
        grpc.Creds(creds),
    )

    pb.RegisterOrderManagementServer(s, &server{})

    if err := s.Serve(l); err != nil {
        panic(err)
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72

package main

import (
 "context"
 "log"
 "time"

 "github.com/golang-jwt/jwt/v4"
 pb "github.com/liangwt/note/grpc/authentication/ecommerce"
 "google.golang.org/grpc"
 "google.golang.org/grpc/credentials"
 "google.golang.org/protobuf/types/known/wrapperspb"
)

var _ credentials.PerRPCCredentials = JwtAuthentication{}

type JwtAuthentication struct {
    Key []byte
}

func (a JwtAuthentication) GetRequestMetadata(ctx context.Context, uri ...string) (map[string]string, error) {
    // Create a new token object, specifying signing method and the claims
    // you would like it to contain.
    token := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.RegisteredClaims{
    ID:        "example",
    ExpiresAt: jwt.NewNumericDate(time.Now().Add(-2 * time.Hour)),
    })

    // Sign and get the complete encoded token as a string using the secret
    tokenString, err := token.SignedString(a.Key)
    if err != nil {
    return nil, err
    }

    return map[string]string{
    "authorization": "Bearer " + tokenString,
    }, nil
}

func (b JwtAuthentication) RequireTransportSecurity() bool {
    return true
}

func main() {
    ctx, cancel := context.WithTimeout(context.Background(), time.Second)
    defer cancel()

    creds, err := credentials.NewClientTLSFromFile("./x509/rootCa.crt", "www.example.com")
    if err != nil {
    panic(err)
    }

    jwtAuth := JwtAuthentication{[]byte("154a8b3aa89d3d4c49826f6dbbbe5542b5a9fbbb")}

    conn, err := grpc.Dial("localhost:8009",
    grpc.WithTransportCredentials(creds),
    grpc.WithPerRPCCredentials(jwtAuth))
    if err != nil {
    panic(err)
    }
    defer conn.Close()

    client := pb.NewOrderManagementClient(conn)

    // Get Order
    retrievedOrder, err := client.GetOrder(ctx, &wrapperspb.StringValue{Value: "101"})
    if err != nil {
    panic(err)
    }

    log.Printf("GetOrder Response -> : %+v\n", retrievedOrder)
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66

package main

import (
 "context"
 "fmt"
 "net"
 "strings"

 "github.com/golang-jwt/jwt/v4"
 pb "github.com/liangwt/note/grpc/authentication/ecommerce"
 "google.golang.org/grpc"
 "google.golang.org/grpc/codes"
 "google.golang.org/grpc/credentials"
 "google.golang.org/grpc/metadata"
 "google.golang.org/grpc/status"
)

var (
    errMissingMetadata = status.Errorf(codes.InvalidArgument, "missing metadata")
)

func ensureValidBasicCredentials(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (resp interface{}, err error) {
    md, ok := metadata.FromIncomingContext(ctx)
    if !ok {
    return nil, errMissingMetadata
    }

    tokenString := strings.TrimPrefix(md["authorization"][0], "Bearer ")

    token, err := jwt.ParseWithClaims(tokenString, &jwt.RegisteredClaims{}, func(token *jwt.Token) (interface{}, error) {
    // Don't forget to validate the alg is what you expect:
    if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
    return nil, fmt.Errorf("Unexpected signing method: %v", token.Header["alg"])
    }

    return []byte("154a8b3aa89d3d4c49826f6dbbbe5542b5a9fbbb"), nil
    })

    claims, ok := token.Claims.(*jwt.RegisteredClaims)
    if !ok || !token.Valid {
    return nil, status.Errorf(codes.Unauthenticated, err.Error())
    }

    fmt.Println(claims.ID)

    return handler(ctx, req)
}

func main() {
    l, err := net.Listen("tcp", ":8009")
    if err != nil {
    panic(err)
    }

    creds, err := credentials.NewServerTLSFromFile("./x509/server.crt", "./x509/server.key")
    s := grpc.NewServer(
    grpc.UnaryInterceptor(ensureValidBasicCredentials),
    grpc.Creds(creds),
    )

    pb.RegisterOrderManagementServer(s, &server{})

    if err := s.Serve(l); err != nil {
    panic(err)
    }
}