Addressing iniitial feedback.

- Renaming default credentials -> google default credentials.
- Various other things in cpp:
  - Adding Cpp wrapping for JWT Tokens.
  - Renaming ComposeCredentials -> CompositeCredentials.
pull/710/head
Julien Boeuf 10 years ago
parent cd9b1c850d
commit c66f2a816e
  1. 28
      Makefile
  2. 6
      build.json
  3. 20
      include/grpc++/credentials.h
  4. 17
      include/grpc/grpc_security.h
  5. 2
      src/core/security/credentials.h
  6. 2
      src/core/security/credentials_posix.c
  7. 2
      src/core/security/credentials_win32.c
  8. 4
      src/core/security/google_default_credentials.c
  9. 6
      src/core/security/security_context.c
  10. 18
      src/cpp/client/credentials.cc
  11. 4
      test/core/security/print_google_default_creds_token.c
  12. 2
      test/cpp/util/create_test_channel.cc
  13. 14
      vsprojects/vs2013/Grpc.mak
  14. 4
      vsprojects/vs2013/grpc.vcxproj
  15. 4
      vsprojects/vs2013/grpc.vcxproj.filters
  16. 4
      vsprojects/vs2013/grpc_shared.vcxproj
  17. 4
      vsprojects/vs2013/grpc_shared.vcxproj.filters

@ -481,7 +481,7 @@ grpc_create_jwt: $(BINDIR)/$(CONFIG)/grpc_create_jwt
grpc_credentials_test: $(BINDIR)/$(CONFIG)/grpc_credentials_test
grpc_fetch_oauth2: $(BINDIR)/$(CONFIG)/grpc_fetch_oauth2
grpc_json_token_test: $(BINDIR)/$(CONFIG)/grpc_json_token_test
grpc_print_default_creds_token: $(BINDIR)/$(CONFIG)/grpc_print_default_creds_token
grpc_print_google_default_creds_token: $(BINDIR)/$(CONFIG)/grpc_print_google_default_creds_token
grpc_stream_op_test: $(BINDIR)/$(CONFIG)/grpc_stream_op_test
hpack_parser_test: $(BINDIR)/$(CONFIG)/hpack_parser_test
hpack_table_test: $(BINDIR)/$(CONFIG)/hpack_table_test
@ -1764,7 +1764,7 @@ test_cxx: buildtests_cxx
$(Q) $(BINDIR)/$(CONFIG)/thread_pool_test || ( echo test thread_pool_test failed ; exit 1 )
tools: privatelibs $(BINDIR)/$(CONFIG)/gen_hpack_tables $(BINDIR)/$(CONFIG)/grpc_create_jwt $(BINDIR)/$(CONFIG)/grpc_fetch_oauth2 $(BINDIR)/$(CONFIG)/grpc_print_default_creds_token
tools: privatelibs $(BINDIR)/$(CONFIG)/gen_hpack_tables $(BINDIR)/$(CONFIG)/grpc_create_jwt $(BINDIR)/$(CONFIG)/grpc_fetch_oauth2 $(BINDIR)/$(CONFIG)/grpc_print_google_default_creds_token
buildbenchmarks: privatelibs $(BINDIR)/$(CONFIG)/grpc_completion_queue_benchmark $(BINDIR)/$(CONFIG)/low_level_ping_pong_benchmark
@ -2286,8 +2286,8 @@ LIBGRPC_SRC = \
src/core/security/credentials.c \
src/core/security/credentials_posix.c \
src/core/security/credentials_win32.c \
src/core/security/default_credentials.c \
src/core/security/factories.c \
src/core/security/google_default_credentials.c \
src/core/security/json_token.c \
src/core/security/secure_endpoint.c \
src/core/security/secure_transport_setup.c \
@ -2430,8 +2430,8 @@ src/core/security/base64.c: $(OPENSSL_DEP)
src/core/security/credentials.c: $(OPENSSL_DEP)
src/core/security/credentials_posix.c: $(OPENSSL_DEP)
src/core/security/credentials_win32.c: $(OPENSSL_DEP)
src/core/security/default_credentials.c: $(OPENSSL_DEP)
src/core/security/factories.c: $(OPENSSL_DEP)
src/core/security/google_default_credentials.c: $(OPENSSL_DEP)
src/core/security/json_token.c: $(OPENSSL_DEP)
src/core/security/secure_endpoint.c: $(OPENSSL_DEP)
src/core/security/secure_transport_setup.c: $(OPENSSL_DEP)
@ -2591,8 +2591,8 @@ $(OBJDIR)/$(CONFIG)/src/core/security/base64.o:
$(OBJDIR)/$(CONFIG)/src/core/security/credentials.o:
$(OBJDIR)/$(CONFIG)/src/core/security/credentials_posix.o:
$(OBJDIR)/$(CONFIG)/src/core/security/credentials_win32.o:
$(OBJDIR)/$(CONFIG)/src/core/security/default_credentials.o:
$(OBJDIR)/$(CONFIG)/src/core/security/factories.o:
$(OBJDIR)/$(CONFIG)/src/core/security/google_default_credentials.o:
$(OBJDIR)/$(CONFIG)/src/core/security/json_token.o:
$(OBJDIR)/$(CONFIG)/src/core/security/secure_endpoint.o:
$(OBJDIR)/$(CONFIG)/src/core/security/secure_transport_setup.o:
@ -6556,33 +6556,33 @@ endif
endif
GRPC_PRINT_DEFAULT_CREDS_TOKEN_SRC = \
test/core/security/print_default_creds_token.c \
GRPC_PRINT_GOOGLE_DEFAULT_CREDS_TOKEN_SRC = \
test/core/security/print_google_default_creds_token.c \
GRPC_PRINT_DEFAULT_CREDS_TOKEN_OBJS = $(addprefix $(OBJDIR)/$(CONFIG)/, $(addsuffix .o, $(basename $(GRPC_PRINT_DEFAULT_CREDS_TOKEN_SRC))))
GRPC_PRINT_GOOGLE_DEFAULT_CREDS_TOKEN_OBJS = $(addprefix $(OBJDIR)/$(CONFIG)/, $(addsuffix .o, $(basename $(GRPC_PRINT_GOOGLE_DEFAULT_CREDS_TOKEN_SRC))))
ifeq ($(NO_SECURE),true)
# You can't build secure targets if you don't have OpenSSL with ALPN.
$(BINDIR)/$(CONFIG)/grpc_print_default_creds_token: openssl_dep_error
$(BINDIR)/$(CONFIG)/grpc_print_google_default_creds_token: openssl_dep_error
else
$(BINDIR)/$(CONFIG)/grpc_print_default_creds_token: $(GRPC_PRINT_DEFAULT_CREDS_TOKEN_OBJS) $(LIBDIR)/$(CONFIG)/libgrpc_test_util.a $(LIBDIR)/$(CONFIG)/libgrpc.a $(LIBDIR)/$(CONFIG)/libgpr_test_util.a $(LIBDIR)/$(CONFIG)/libgpr.a
$(BINDIR)/$(CONFIG)/grpc_print_google_default_creds_token: $(GRPC_PRINT_GOOGLE_DEFAULT_CREDS_TOKEN_OBJS) $(LIBDIR)/$(CONFIG)/libgrpc_test_util.a $(LIBDIR)/$(CONFIG)/libgrpc.a $(LIBDIR)/$(CONFIG)/libgpr_test_util.a $(LIBDIR)/$(CONFIG)/libgpr.a
$(E) "[LD] Linking $@"
$(Q) mkdir -p `dirname $@`
$(Q) $(LD) $(LDFLAGS) $(GRPC_PRINT_DEFAULT_CREDS_TOKEN_OBJS) $(LIBDIR)/$(CONFIG)/libgrpc_test_util.a $(LIBDIR)/$(CONFIG)/libgrpc.a $(LIBDIR)/$(CONFIG)/libgpr_test_util.a $(LIBDIR)/$(CONFIG)/libgpr.a $(LDLIBS) $(LDLIBS_SECURE) -o $(BINDIR)/$(CONFIG)/grpc_print_default_creds_token
$(Q) $(LD) $(LDFLAGS) $(GRPC_PRINT_GOOGLE_DEFAULT_CREDS_TOKEN_OBJS) $(LIBDIR)/$(CONFIG)/libgrpc_test_util.a $(LIBDIR)/$(CONFIG)/libgrpc.a $(LIBDIR)/$(CONFIG)/libgpr_test_util.a $(LIBDIR)/$(CONFIG)/libgpr.a $(LDLIBS) $(LDLIBS_SECURE) -o $(BINDIR)/$(CONFIG)/grpc_print_google_default_creds_token
endif
$(OBJDIR)/$(CONFIG)/test/core/security/print_default_creds_token.o: $(LIBDIR)/$(CONFIG)/libgrpc_test_util.a $(LIBDIR)/$(CONFIG)/libgrpc.a $(LIBDIR)/$(CONFIG)/libgpr_test_util.a $(LIBDIR)/$(CONFIG)/libgpr.a
$(OBJDIR)/$(CONFIG)/test/core/security/print_google_default_creds_token.o: $(LIBDIR)/$(CONFIG)/libgrpc_test_util.a $(LIBDIR)/$(CONFIG)/libgrpc.a $(LIBDIR)/$(CONFIG)/libgpr_test_util.a $(LIBDIR)/$(CONFIG)/libgpr.a
deps_grpc_print_default_creds_token: $(GRPC_PRINT_DEFAULT_CREDS_TOKEN_OBJS:.o=.dep)
deps_grpc_print_google_default_creds_token: $(GRPC_PRINT_GOOGLE_DEFAULT_CREDS_TOKEN_OBJS:.o=.dep)
ifneq ($(NO_SECURE),true)
ifneq ($(NO_DEPS),true)
-include $(GRPC_PRINT_DEFAULT_CREDS_TOKEN_OBJS:.o=.dep)
-include $(GRPC_PRINT_GOOGLE_DEFAULT_CREDS_TOKEN_OBJS:.o=.dep)
endif
endif

@ -322,8 +322,8 @@
"src/core/security/credentials.c",
"src/core/security/credentials_posix.c",
"src/core/security/credentials_win32.c",
"src/core/security/default_credentials.c",
"src/core/security/factories.c",
"src/core/security/google_default_credentials.c",
"src/core/security/json_token.c",
"src/core/security/secure_endpoint.c",
"src/core/security/secure_transport_setup.c",
@ -1190,11 +1190,11 @@
]
},
{
"name": "grpc_print_default_creds_token",
"name": "grpc_print_google_default_creds_token",
"build": "tool",
"language": "c",
"src": [
"test/core/security/print_default_creds_token.c"
"test/core/security/print_google_default_creds_token.c"
],
"deps": [
"grpc_test_util",

@ -86,17 +86,23 @@ struct SslCredentialsOptions {
// fail on it.
class CredentialsFactory {
public:
// Builds credentials with reasonable defaults.
static std::unique_ptr<Credentials> DefaultCredentials();
// Builds google credentials with reasonable defaults.
// WARNING: Do NOT use this credentials to connect to a non-google service as
// this could result in an oauth2 token leak.
static std::unique_ptr<Credentials> GoogleDefaultCredentials();
// Builds SSL Credentials given SSL specific options
static std::unique_ptr<Credentials> SslCredentials(
const SslCredentialsOptions& options);
// Builds credentials for use when running in GCE
// WARNING: Do NOT use this credentials to connect to a non-google service as
// this could result in an oauth2 token leak.
static std::unique_ptr<Credentials> ComputeEngineCredentials();
// Builds service account credentials.
// WARNING: Do NOT use this credentials to connect to a non-google service as
// this could result in an oauth2 token leak.
// json_key is the JSON key string containing the client's private key.
// scope is a space-delimited list of the requested permissions.
// token_lifetime is the lifetime of each token acquired through this service
@ -106,13 +112,21 @@ class CredentialsFactory {
const grpc::string& json_key, const grpc::string& scope,
std::chrono::seconds token_lifetime);
// Builds JWT credentials.
// json_key is the JSON key string containing the client's private key.
// token_lifetime is the lifetime of each Json Web Token (JWT) created with
// this credentials. It should not exceed grpc_max_auth_token_lifetime or
// will be cropped to this value.
static std::unique_ptr<Credentials> JWTCredentials(
const grpc::string& json_key, std::chrono::seconds token_lifetime);
// Builds IAM credentials.
static std::unique_ptr<Credentials> IAMCredentials(
const grpc::string& authorization_token,
const grpc::string& authority_selector);
// Combines two credentials objects into a composite credentials
static std::unique_ptr<Credentials> ComposeCredentials(
static std::unique_ptr<Credentials> CompositeCredentials(
const std::unique_ptr<Credentials>& creds1,
const std::unique_ptr<Credentials>& creds2);
};

@ -51,8 +51,10 @@ typedef struct grpc_credentials grpc_credentials;
The creator of the credentials object is responsible for its release. */
void grpc_credentials_release(grpc_credentials *creds);
/* Creates default credentials to connect to a google gRPC service. */
grpc_credentials *grpc_default_credentials_create(void);
/* Creates default credentials to connect to a google gRPC service.
WARNING: Do NOT use this credentials to connect to a non-google service as
this could result in an oauth2 token leak. */
grpc_credentials *grpc_google_default_credentials_create(void);
/* Environment variable that points to the default SSL roots file. This file
must be a PEM encoded file with all the roots such as the one that can be
@ -85,13 +87,17 @@ grpc_credentials *grpc_ssl_credentials_create(
grpc_credentials *grpc_composite_credentials_create(grpc_credentials *creds1,
grpc_credentials *creds2);
/* Creates a compute engine credentials object. */
/* Creates a compute engine credentials object.
WARNING: Do NOT use this credentials to connect to a non-google service as
this could result in an oauth2 token leak. */
grpc_credentials *grpc_compute_engine_credentials_create(void);
extern const gpr_timespec grpc_max_auth_token_lifetime;
/* Creates a service account credentials object. May return NULL if the input is
invalid.
WARNING: Do NOT use this credentials to connect to a non-google service as
this could result in an oauth2 token leak.
- json_key is the JSON key string containing the client's private key.
- scope is a space-delimited list of the requested permissions.
- token_lifetime is the lifetime of each token acquired through this service
@ -126,11 +132,6 @@ grpc_credentials *grpc_iam_credentials_create(const char *authorization_token,
channel, it will just be ignored. */
#define GRPC_SSL_TARGET_NAME_OVERRIDE_ARG "grpc.ssl_target_name_override"
/* Creates a default secure channel using the default credentials object using
the environment. */
grpc_channel *grpc_default_secure_channel_create(const char *target,
const grpc_channel_args *args);
/* Creates a secure channel using the passed-in credentials. */
grpc_channel *grpc_secure_channel_create(grpc_credentials *creds,
const char *target,

@ -67,7 +67,7 @@ typedef enum {
/* --- grpc_credentials. --- */
/* It is the caller's responsibility to gpr_free the result if not NULL. */
char *grpc_get_well_known_credentials_file_path(void);
char *grpc_get_well_known_google_credentials_file_path(void);
typedef void (*grpc_credentials_metadata_cb)(void *user_data,
grpc_mdelem **md_elems,

@ -43,7 +43,7 @@
#include "src/core/support/env.h"
#include "src/core/support/string.h"
char *grpc_get_well_known_credentials_file_path(void) {
char *grpc_get_well_known_google_credentials_file_path(void) {
char *result = NULL;
char *home = gpr_getenv("HOME");
if (home == NULL) {

@ -43,7 +43,7 @@
#include "src/core/support/env.h"
#include "src/core/support/string.h"
char *grpc_get_well_known_credentials_file_path(void) {
char *grpc_get_well_known_google_credentials_file_path(void) {
char *result = NULL;
char *appdata_path = gpr_getenv("APPDATA");
if (appdata_path == NULL) {

@ -138,7 +138,7 @@ static grpc_credentials *create_jwt_creds_from_path(char *creds_path) {
return result;
}
grpc_credentials *grpc_default_credentials_create(void) {
grpc_credentials *grpc_google_default_credentials_create(void) {
grpc_credentials *result = NULL;
int serving_cached_credentials = 0;
gpr_once_init(&g_once, init_default_credentials);
@ -158,7 +158,7 @@ grpc_credentials *grpc_default_credentials_create(void) {
/* Then the well-known file. */
result = create_jwt_creds_from_path(
grpc_get_well_known_credentials_file_path());
grpc_get_well_known_google_credentials_file_path());
if (result != NULL) goto end;
/* At last try to see if we're on compute engine (do the detection only once

@ -636,9 +636,3 @@ grpc_channel *grpc_secure_channel_create_with_factories(
creds->type);
return grpc_lame_client_channel_create();
}
grpc_channel *grpc_default_secure_channel_create(
const char *target, const grpc_channel_args *args) {
return grpc_secure_channel_create(grpc_default_credentials_create(), target,
args);
}

@ -45,8 +45,8 @@ Credentials::Credentials(grpc_credentials *c_creds) : creds_(c_creds) {}
Credentials::~Credentials() { grpc_credentials_release(creds_); }
grpc_credentials *Credentials::GetRawCreds() { return creds_; }
std::unique_ptr<Credentials> CredentialsFactory::DefaultCredentials() {
grpc_credentials *c_creds = grpc_default_credentials_create();
std::unique_ptr<Credentials> CredentialsFactory::GoogleDefaultCredentials() {
grpc_credentials *c_creds = grpc_google_default_credentials_create();
std::unique_ptr<Credentials> cpp_creds(new Credentials(c_creds));
return cpp_creds;
}
@ -86,6 +86,18 @@ std::unique_ptr<Credentials> CredentialsFactory::ServiceAccountCredentials(
return cpp_creds;
}
// Builds JWT credentials.
std::unique_ptr<Credentials> CredentialsFactory::JWTCredentials(
const grpc::string &json_key, std::chrono::seconds token_lifetime) {
gpr_timespec lifetime = gpr_time_from_seconds(
token_lifetime.count() > 0 ? token_lifetime.count() : 0);
grpc_credentials *c_creds =
grpc_jwt_credentials_create(json_key.c_str(), lifetime);
std::unique_ptr<Credentials> cpp_creds(
c_creds == nullptr ? nullptr : new Credentials(c_creds));
return cpp_creds;
}
// Builds IAM credentials.
std::unique_ptr<Credentials> CredentialsFactory::IAMCredentials(
const grpc::string &authorization_token,
@ -98,7 +110,7 @@ std::unique_ptr<Credentials> CredentialsFactory::IAMCredentials(
}
// Combines two credentials objects into a composite credentials.
std::unique_ptr<Credentials> CredentialsFactory::ComposeCredentials(
std::unique_ptr<Credentials> CredentialsFactory::CompositeCredentials(
const std::unique_ptr<Credentials> &creds1,
const std::unique_ptr<Credentials> &creds2) {
// Note that we are not saving unique_ptrs to the two credentials

@ -71,7 +71,7 @@ int main(int argc, char **argv) {
synchronizer sync;
grpc_credentials *creds = NULL;
char *service_url = "https://test.foo.google.com/Foo";
gpr_cmdline *cl = gpr_cmdline_create("print_default_creds_token");
gpr_cmdline *cl = gpr_cmdline_create("print_google_default_creds_token");
gpr_cmdline_add_string(cl, "service_url",
"Service URL for the token request.",
&service_url);
@ -79,7 +79,7 @@ int main(int argc, char **argv) {
grpc_init();
creds = grpc_default_credentials_create();
creds = grpc_google_default_credentials_create();
if (creds == NULL) {
fprintf(stderr, "\nCould not find default credentials.\n\n");
result = 1;

@ -75,7 +75,7 @@ std::shared_ptr<ChannelInterface> CreateTestChannel(
server.empty() ? override_hostname : server;
if (creds.get()) {
channel_creds =
CredentialsFactory::ComposeCredentials(creds, channel_creds);
CredentialsFactory::CompositeCredentials(creds, channel_creds);
}
return CreateChannel(connect_to, channel_creds, channel_args);
} else {

@ -450,13 +450,13 @@ grpc_json_token_test: grpc_json_token_test.exe
echo Running grpc_json_token_test
$(OUT_DIR)\grpc_json_token_test.exe
grpc_print_default_creds_token.exe: grpc_test_util
echo Building grpc_print_default_creds_token
$(CC) $(CFLAGS) /Fo:$(OUT_DIR)\ ..\..\test\core\security\print_default_creds_token.c
$(LINK) $(LFLAGS) /OUT:"$(OUT_DIR)\grpc_print_default_creds_token.exe" Debug\grpc_test_util.lib Debug\grpc.lib Debug\gpr_test_util.lib Debug\gpr.lib $(LIBS) $(OUT_DIR)\print_default_creds_token.obj
grpc_print_default_creds_token: grpc_print_default_creds_token.exe
echo Running grpc_print_default_creds_token
$(OUT_DIR)\grpc_print_default_creds_token.exe
grpc_print_google_default_creds_token.exe: grpc_test_util
echo Building grpc_print_google_default_creds_token
$(CC) $(CFLAGS) /Fo:$(OUT_DIR)\ ..\..\test\core\security\print_google_default_creds_token.c
$(LINK) $(LFLAGS) /OUT:"$(OUT_DIR)\grpc_print_google_default_creds_token.exe" Debug\grpc_test_util.lib Debug\grpc.lib Debug\gpr_test_util.lib Debug\gpr.lib $(LIBS) $(OUT_DIR)\print_google_default_creds_token.obj
grpc_print_google_default_creds_token: grpc_print_google_default_creds_token.exe
echo Running grpc_print_google_default_creds_token
$(OUT_DIR)\grpc_print_google_default_creds_token.exe
grpc_stream_op_test.exe: grpc_test_util
echo Building grpc_stream_op_test

@ -205,10 +205,10 @@
</ClCompile>
<ClCompile Include="..\..\src\core\security\credentials_win32.c">
</ClCompile>
<ClCompile Include="..\..\src\core\security\default_credentials.c">
</ClCompile>
<ClCompile Include="..\..\src\core\security\factories.c">
</ClCompile>
<ClCompile Include="..\..\src\core\security\google_default_credentials.c">
</ClCompile>
<ClCompile Include="..\..\src\core\security\json_token.c">
</ClCompile>
<ClCompile Include="..\..\src\core\security\secure_endpoint.c">

@ -28,10 +28,10 @@
<ClCompile Include="..\..\src\core\security\credentials_win32.c">
<Filter>src\core\security</Filter>
</ClCompile>
<ClCompile Include="..\..\src\core\security\default_credentials.c">
<ClCompile Include="..\..\src\core\security\factories.c">
<Filter>src\core\security</Filter>
</ClCompile>
<ClCompile Include="..\..\src\core\security\factories.c">
<ClCompile Include="..\..\src\core\security\google_default_credentials.c">
<Filter>src\core\security</Filter>
</ClCompile>
<ClCompile Include="..\..\src\core\security\json_token.c">

@ -209,10 +209,10 @@
</ClCompile>
<ClCompile Include="..\..\src\core\security\credentials_win32.c">
</ClCompile>
<ClCompile Include="..\..\src\core\security\default_credentials.c">
</ClCompile>
<ClCompile Include="..\..\src\core\security\factories.c">
</ClCompile>
<ClCompile Include="..\..\src\core\security\google_default_credentials.c">
</ClCompile>
<ClCompile Include="..\..\src\core\security\json_token.c">
</ClCompile>
<ClCompile Include="..\..\src\core\security\secure_endpoint.c">

@ -28,10 +28,10 @@
<ClCompile Include="..\..\src\core\security\credentials_win32.c">
<Filter>src\core\security</Filter>
</ClCompile>
<ClCompile Include="..\..\src\core\security\default_credentials.c">
<ClCompile Include="..\..\src\core\security\factories.c">
<Filter>src\core\security</Filter>
</ClCompile>
<ClCompile Include="..\..\src\core\security\factories.c">
<ClCompile Include="..\..\src\core\security\google_default_credentials.c">
<Filter>src\core\security</Filter>
</ClCompile>
<ClCompile Include="..\..\src\core\security\json_token.c">

Loading…
Cancel
Save