grpc-ecosystem / grpc-ecosystem/grpc-spring
Add support for Reactive Spring Security
- Dominant language
- Java
- Stars
- 3.7k
- Forks
- 858
- PR merge metrics
- No merged PRs in 30d
Description
The [AuthenticatingServerInterceptor](https://github.com/yidongnan/grpc-spring-boot-starter/blob/master/grpc-server-spring-boot-autoconfigure/src/main/java/net/devh/boot/grpc/server/security/interceptors/AuthenticatingServerInterceptor.java) uses the `SecurityContextHolder.getContext().setAuthentication(authentication)` which won't work for Reactive Spring Security. We believe that `ReactiveSecurityContextHolder` should be used instead as shown in [this example](https://docs.spring.io/spring-security/site/docs/current/reference/htmlsingle/#jc-erms).
Perhaps one option might be to place the `Authentication` instance in the gRPC Context only and then when needed in the Reactive context, extract it and place it in the Reactive SubscriberContext.
It'd also be great to have an example of how to set this up.
Contributor guide
Research direction
Start with grpc-server-spring-boot-autoconfigure/src/main/java/net/devh/boot/grpc/server/security/interceptors/AuthenticatingServerInterceptor.java and review the linked ReactiveSecurityContextHolder example. Determine how the Authentication should move from the gRPC Context into the reactive subscriber context, then add an example showing the setup and verify reactive Spring Security can access the authentication.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- grpc, java, spring, spring-boot
- Domain
- authentication, backend
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100