grpc-ecosystem / grpc-ecosystem/grpc-spring
Disable `SecurityFilterChain` for `@GrpcService` by default
- Dominant language
- Java
- Stars
- 3.7k
- Forks
- 858
- PR merge metrics
- No merged PRs in 30d
Description
I'm facing problems with disabling `SecurityFilterChain` for the gRPC service.
I wanted to integrate gRPC service into the existing Spring Web server project, but it failed to start due to the following:
` Found WebSecurityConfigurerAdapter as well as SecurityFilterChain. Please select just one.`
The project I'm trying to integrate with contains `WebSecurityConfigurerAdapter` already. We use it for authentications.
I tried to disable `spring-security` in the `grpc-spring-boot-starter` like this but unsuccessfully:
```
net.devh
grpc-spring-boot-starter
2.13.1.RELEASE
org.springframework.security
spring-security-web
org.springframework.security
spring-security-config
```
The server is executed as `grpc-netty-shaded`.
I don't understand why your starter insists on initializing the filter chain and there is no way to disable it?
Is there any way to disable security for grpc starter?
### Project dependencies
Spring Boot Starter Parent: 2.6.7
gRPC Spring Boot Starter: 2.13.1.RELEASE
io.grpc: 1.50.2
Google Protobuf: 3.21.8
Contributor guide
Research direction
Start by tracing the starter's security auto-configuration and how it applies to @GrpcService, using the reported Spring Boot 2.6.7 and grpc-spring-boot-starter 2.13.1.RELEASE setup as a reproduction. Identify the configuration point that creates the SecurityFilterChain and verify that an application can disable it while retaining its existing WebSecurityConfigurerAdapter.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- grpc, java, spring, spring-boot
- Domain
- api, backend, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100