grpc-ecosystem / grpc-ecosystem/grpc-spring
Configure AccessPredicate based on Custom method level annotation
- Dominant language
- Java
- Stars
- 3.7k
- Forks
- 858
- PR merge metrics
- No merged PRs in 30d
Description
**The context**
I wish to use a custom Annotation to tag gRPC service methods to enable custom authentication logic on them, specifically to use a specific `AccessPredicate` for that given method if the annotation is present.
Example of desired implementation, where `@CustomPermitAll` would be the custom annotation:
```
@GrpcService
class SomeService : SomeServiceCoroutineImplBase() {
@CustomPermitAll
override suspend fun someMethod(request: Empty) {...}
}
```
**The question**
Does the library provide some way to implement these kind of custom method level security on RPCs? Or is there any component the library provides to safely do the scan of the `GrpcService`s to identify the annotated methods when setting up the `GrpcSecurityMetadataSource` bean?
For the moment I've tried using the Spring context and getting the `GrpcService` annotated beans and then going trough the methods using Java reflection by my own implementation, but wanted to know if there is a better way anyone knows to achieve what I want.
Sorry if it is not explained that well, please ask me for more info if needed.
Any help will be greatly appreciated!
Contributor guide
Research direction
Start with GrpcSecurityMetadataSource and the library's GrpcService integration, then review how Spring context beans and method annotations are currently handled. Determine whether custom method-level annotations can select an AccessPredicate safely, and document or implement a supported extension path for the annotated SomeService example.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- grpc, java, spring-boot
- Domain
- authentication, backend-api-design
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100