Package com.illumon.iris.auth

Class GrpcAuthenticationService

java.lang.Object

io.deephaven.proto.auth.grpc.AuthApiGrpc.AuthApiImplBase

com.illumon.iris.auth.GrpcAuthenticationService

All Implemented Interfaces:

AuthApiGrpc.AsyncService, io.grpc.BindableService, AutoCloseable

public class GrpcAuthenticationService
extends AuthApiGrpc.AuthApiImplBase
implements AutoCloseable

gRPC implementation of the Auth service API

Field Summary

Fields

Modifier and Type	Field	Description
static final long	AUTH_FORWARD_DEFAULT_DEADLINE_MILLIS
static final int	EXPIRED_CLIENTS_MAX_CLIENTS_CHECKED_PER_PERIOD
static final long	EXPIRED_CLIENTS_PURGE_PERIOD_MILLIS
final Thread	expiredClientsPurgeThread
static final boolean	LOG_REQUEST_ENTRY_EXIT
static final long	VERIFY_TOKEN_FORWARD_DEFAULT_DEADLINE_MILLIS

Constructor Summary

Constructors

Constructor	Description
GrpcAuthenticationService(AuthenticationServerBase server, io.deephaven.shadow.jetcd.io.etcd.jetcd.Client etcdClient, int cookieRefreshDurationSeconds, long kvDeadlinePeriodMillis, String kvKeyPrefix)	Creates a new GrpcAuthenticationService.

Method Summary

Modifier and Type	Method	Description
void	authenticateByCookie(AuthenticateByCookieRequest request, io.grpc.stub.StreamObserver<AuthenticateByCookieResponse> responseObserver)	Authenticate by providing an already existing cookie and the user context that cookie should be associated with.
void	authenticateByDelegateToken(AuthenticateByDelegateTokenRequest request, io.grpc.stub.StreamObserver<AuthenticateByDelegateTokenResponse> responseObserver)	Authenticate by delegate token; should have obtained a token earlier from another service that created it and forwarded it.
void	authenticateByExternal(AuthenticateByExternalRequest request, io.grpc.stub.StreamObserver<AuthenticateByExternalResponse> responseObserver)	Authenticate by an external method (eg, active directory).
void	authenticateByPassword(AuthenticateByPasswordRequest request, io.grpc.stub.StreamObserver<AuthenticateByPasswordResponse> responseObserver)	Authenticate by password.
void	authenticateByPublicKey(AuthenticateByPublicKeyRequest request, io.grpc.stub.StreamObserver<AuthenticateByPublicKeyResponse> responseObserver)	Authenticate by public key challenge; should have obtained a nonce earlier via getNonce rpc.
void	close()
void	getNonce(GetNonceRequest request, io.grpc.stub.StreamObserver<GetNonceResponse> responseObserver)	Get a nonce for public key authentication.
void	getToken(GetTokenRequest request, io.grpc.stub.StreamObserver<GetTokenResponse> responseObserver)	Get a token for a three-way handshake.
void	getTokenAs(GetTokenAsRequest request, io.grpc.stub.StreamObserver<GetTokenAsResponse> responseObserver)	Get a token for a three-way handshake as a particular user.
void	invalidateCookie(InvalidateCookieRequest request, io.grpc.stub.StreamObserver<InvalidateCookieResponse> responseObserver)	Clients that are about to terminate are expected to invalidate their credentials before going away.
void	ping(PingRequest request, io.grpc.stub.StreamObserver<PingResponse> responseObserver)	Implementation for the ping method in the proto service API.
void	refreshCookie(RefreshCookieRequest request, io.grpc.stub.StreamObserver<RefreshCookieResponse> responseObserver)	Refresh a cookie to maintain credentials.
void	reload(ReloadRequest request, io.grpc.stub.StreamObserver<ReloadResponse> responseObserver)	Request this server to reload its configuration.
void	verifyChallenge(VerifyChallengeRequest request, io.grpc.stub.StreamObserver<VerifyChallengeResponse> responseObserver)	Verify a nonce challenge response for another server (not used directly by clients, only server-server)
void	verifyToken(VerifyTokenRequest request, io.grpc.stub.StreamObserver<VerifyTokenResponse> responseObserver)	Verify a token provided by another service.

Methods inherited from class io.deephaven.proto.auth.grpc.AuthApiGrpc.AuthApiImplBase

bindService

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

EXPIRED_CLIENTS_PURGE_PERIOD_MILLIS

public static final long EXPIRED_CLIENTS_PURGE_PERIOD_MILLIS

EXPIRED_CLIENTS_MAX_CLIENTS_CHECKED_PER_PERIOD

public static final int EXPIRED_CLIENTS_MAX_CLIENTS_CHECKED_PER_PERIOD

AUTH_FORWARD_DEFAULT_DEADLINE_MILLIS

public static final long AUTH_FORWARD_DEFAULT_DEADLINE_MILLIS

VERIFY_TOKEN_FORWARD_DEFAULT_DEADLINE_MILLIS

public static final long VERIFY_TOKEN_FORWARD_DEFAULT_DEADLINE_MILLIS

LOG_REQUEST_ENTRY_EXIT

public static final boolean LOG_REQUEST_ENTRY_EXIT

See Also:

• Constant Field Values

expiredClientsPurgeThread

public final Thread expiredClientsPurgeThread

Constructor Details

GrpcAuthenticationService

public GrpcAuthenticationService(AuthenticationServerBase server,
 io.deephaven.shadow.jetcd.io.etcd.jetcd.Client etcdClient,
 int cookieRefreshDurationSeconds,
 long kvDeadlinePeriodMillis,
 String kvKeyPrefix)

Creates a new GrpcAuthenticationService.

Parameters:

server - The underlying authentication server implementation.

etcdClient - The etcdClient for persistence of cookie state and for name resolution in the auth forwarder

cookieRefreshDurationSeconds - How long each cookie refresh lasts, in seconds.

kvDeadlinePeriodMillis - RPC deadline in seconds for etcd-related RPCs

kvKeyPrefix - String prefix for storage of cookie state keys in etcd.

Method Details

ping

public void ping(PingRequest request,
 io.grpc.stub.StreamObserver<PingResponse> responseObserver)

Implementation for the ping method in the proto service API. This is a simple method allowing the client to sample the latency to the server.

Specified by:

ping in interface AuthApiGrpc.AsyncService

Parameters:

request - the request payload

responseObserver - the response

authenticateByPassword

public void authenticateByPassword(AuthenticateByPasswordRequest request,
 io.grpc.stub.StreamObserver<AuthenticateByPasswordResponse> responseObserver)

Description copied from interface: AuthApiGrpc.AsyncService

 Authenticate by password.
 

Specified by:

authenticateByPassword in interface AuthApiGrpc.AsyncService

authenticateByPublicKey

public void authenticateByPublicKey(AuthenticateByPublicKeyRequest request,
 io.grpc.stub.StreamObserver<AuthenticateByPublicKeyResponse> responseObserver)

Description copied from interface: AuthApiGrpc.AsyncService

 Authenticate by public key challenge; should have obtained a nonce earlier via getNonce rpc.
 

Specified by:

authenticateByPublicKey in interface AuthApiGrpc.AsyncService

verifyChallenge

public void verifyChallenge(VerifyChallengeRequest request,
 io.grpc.stub.StreamObserver<VerifyChallengeResponse> responseObserver)

Description copied from interface: AuthApiGrpc.AsyncService

 Verify a nonce challenge response for another server (not used directly by clients, only server-server)
 

Specified by:

verifyChallenge in interface AuthApiGrpc.AsyncService

authenticateByDelegateToken

public void authenticateByDelegateToken(AuthenticateByDelegateTokenRequest request,
 io.grpc.stub.StreamObserver<AuthenticateByDelegateTokenResponse> responseObserver)

Description copied from interface: AuthApiGrpc.AsyncService

 Authenticate by delegate token; should have obtained a token earlier from another service that
 created it and forwarded it.
 

Specified by:

authenticateByDelegateToken in interface AuthApiGrpc.AsyncService

authenticateByExternal

public void authenticateByExternal(AuthenticateByExternalRequest request,
 io.grpc.stub.StreamObserver<AuthenticateByExternalResponse> responseObserver)

Description copied from interface: AuthApiGrpc.AsyncService

 Authenticate by an external method (eg, active directory).
 

Specified by:

authenticateByExternal in interface AuthApiGrpc.AsyncService

authenticateByCookie

public void authenticateByCookie(AuthenticateByCookieRequest request,
 io.grpc.stub.StreamObserver<AuthenticateByCookieResponse> responseObserver)

Description copied from interface: AuthApiGrpc.AsyncService

 Authenticate by providing an already existing cookie and the user context that cookie should be associated with.
 

Specified by:

authenticateByCookie in interface AuthApiGrpc.AsyncService

refreshCookie

public void refreshCookie(RefreshCookieRequest request,
 io.grpc.stub.StreamObserver<RefreshCookieResponse> responseObserver)

Description copied from interface: AuthApiGrpc.AsyncService

 Refresh a cookie to maintain credentials.  Clients are expected to try to refresh cookies
 with enough time in advance before expiration; a reasonable default is half way through from the time
 the cookie was obtained with its deadline, and the actual deadline time.
 

Specified by:

refreshCookie in interface AuthApiGrpc.AsyncService

invalidateCookie

public void invalidateCookie(InvalidateCookieRequest request,
 io.grpc.stub.StreamObserver<InvalidateCookieResponse> responseObserver)

Description copied from interface: AuthApiGrpc.AsyncService

 Clients that are about to terminate are expected to invalidate their credentials before going away.
 

Specified by:

invalidateCookie in interface AuthApiGrpc.AsyncService

getNonce

public void getNonce(GetNonceRequest request,
 io.grpc.stub.StreamObserver<GetNonceResponse> responseObserver)

Description copied from interface: AuthApiGrpc.AsyncService

 Get a nonce for public key authentication.
 

Specified by:

getNonce in interface AuthApiGrpc.AsyncService

getToken

public void getToken(GetTokenRequest request,
 io.grpc.stub.StreamObserver<GetTokenResponse> responseObserver)

Description copied from interface: AuthApiGrpc.AsyncService

 Get a token for a three-way handshake.
 

Specified by:

getToken in interface AuthApiGrpc.AsyncService

getTokenAs

public void getTokenAs(GetTokenAsRequest request,
 io.grpc.stub.StreamObserver<GetTokenAsResponse> responseObserver)

Description copied from interface: AuthApiGrpc.AsyncService

 Get a token for a three-way handshake as a particular user.
 

Specified by:

getTokenAs in interface AuthApiGrpc.AsyncService

verifyToken

public void verifyToken(VerifyTokenRequest request,
 io.grpc.stub.StreamObserver<VerifyTokenResponse> responseObserver)

Description copied from interface: AuthApiGrpc.AsyncService

 Verify a token provided by another service.
 

Specified by:

verifyToken in interface AuthApiGrpc.AsyncService

reload

public void reload(ReloadRequest request,
 io.grpc.stub.StreamObserver<ReloadResponse> responseObserver)

Description copied from interface: AuthApiGrpc.AsyncService

 Request this server to reload its configuration.
 

Specified by:

reload in interface AuthApiGrpc.AsyncService

close

public void close()

Specified by:

close in interface AutoCloseable