grpc-ecosystem / grpc-ecosystem/grpc-spring

Add support for Reactive Spring Security

Open
#247 6 comments 0 reactions 0 assignees View on GitHub
enhancement help wanted
Dominant language
Java
Stars
3.7k
Forks
858
PR merge metrics
No merged PRs in 30d

Description

The [AuthenticatingServerInterceptor](https://github.com/yidongnan/grpc-spring-boot-starter/blob/master/grpc-server-spring-boot-autoconfigure/src/main/java/net/devh/boot/grpc/server/security/interceptors/AuthenticatingServerInterceptor.java) uses the `SecurityContextHolder.getContext().setAuthentication(authentication)` which won't work for Reactive Spring Security. We believe that `ReactiveSecurityContextHolder` should be used instead as shown in [this example](https://docs.spring.io/spring-security/site/docs/current/reference/htmlsingle/#jc-erms).

Perhaps one option might be to place the `Authentication` instance in the gRPC Context only and then when needed in the Reactive context, extract it and place it in the Reactive SubscriberContext.

It'd also be great to have an example of how to set this up.

Contributor guide

Open the contributing guide

Research direction

Start with grpc-server-spring-boot-autoconfigure/src/main/java/net/devh/boot/grpc/server/security/interceptors/AuthenticatingServerInterceptor.java and review the linked ReactiveSecurityContextHolder example. Determine how the Authentication should move from the gRPC Context into the reactive subscriber context, then add an example showing the setup and verify reactive Spring Security can access the authentication.

Written by the indexing model from the issue text.

Assessment

Tech stack
grpc, java, spring, spring-boot
Domain
authentication, backend
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.