gRPC Spring Security demo
This project demonstrates how to use Spring Security's method-based security mechanism to secure gRPC services. It is a gRPC server written in Java and built on Spring Boot. It uses gRPC interceptors to integrate with Spring Security, and supports two authentication mechanisms: HTTP Basic Auth and OAuth2 with JSON Web Tokens.
Within this demo, the following may be of interest:
- Package containing the gRPC interceptors
- The gRPC service endpoint implementation with method-based security
- The Spring Security configuration
- Tests demonstrating client-side code, including usage of Basic Authentication credentials
The accompanying blog post contains more details about the background and motivations for this demo.
Requirements
- Java 1.8 or newer
Usage
To start the application, run the following command in the project root directory:
./gradlew bootRun
This brings up the gRPC server, which runs on localhost port 7080.
For a simple way to interact with the gRPC server, without the need to create a client application, grpcc can be used.
With grpcc installed, start a client that connects to the gRPC server by running the following
command in the src/main/proto directory in this project:
grpcc -i -p revinate/demo/demo.proto -a localhost:7080
This command starts the grpcc shell. Once in the shell, first create a variable to hold the metadata entry for Basic Auth credentials:
var md = cm({Authorization: "Basic Z3JwY3NwcmluZzpncnBjc3ByaW5n"})Then make a call to the server using the credentials:
client.fibonacci({value: 10}, md, pr)