diff --git a/doc/server_side_auth.md b/doc/server_side_auth.md index b4231fdfcdc..88429029121 100644 --- a/doc/server_side_auth.md +++ b/doc/server_side_auth.md @@ -12,7 +12,7 @@ The authentication context is structured as a multi-map of key-value pairs - the The contents of the *auth properties* are populated by an *auth interceptor*. The interceptor also chooses which property key will act as the peer identity (e.g. for client certificate authentication this property will be `"x509_common_name"` or `"x509_subject_alternative_name"`). -Note that AuthContext is generally not modifiable, except when used via an AuthMetadataProcessor([reference](https://github.com/grpc/grpc/blob/master/include/grpcpp/impl/codegen/security/auth_context.h)). +Note that AuthContext is generally not modifiable, except when used via an AuthMetadataProcessor([reference](https://github.com/grpc/grpc/blob/master/include/grpcpp/security/auth_context.h)). However, because the AuthContext is a connection-level object, when it is modified via an AuthMetadataProcessor, the modifications will be visible on all subsequent calls on the same connection. WARNING: AuthContext is the only reliable source of truth when it comes to authenticating RPCs. Using any other call/context properties for authentication purposes is wrong and inherently unsafe. diff --git a/include/grpcpp/impl/codegen/security/auth_context.h b/include/grpcpp/impl/codegen/security/auth_context.h index c67e1cff43c..7fd7ca10fb7 100644 --- a/include/grpcpp/impl/codegen/security/auth_context.h +++ b/include/grpcpp/impl/codegen/security/auth_context.h @@ -19,83 +19,9 @@ #ifndef GRPCPP_IMPL_CODEGEN_SECURITY_AUTH_CONTEXT_H #define GRPCPP_IMPL_CODEGEN_SECURITY_AUTH_CONTEXT_H -// IWYU pragma: private, include +// IWYU pragma: private -#include -#include - -#include -#include - -struct grpc_auth_context; -struct grpc_auth_property; -struct grpc_auth_property_iterator; - -namespace grpc { -class SecureAuthContext; - -typedef std::pair AuthProperty; - -class AuthPropertyIterator { - public: - using iterator_category = std::forward_iterator_tag; - using value_type = const AuthProperty; - using pointer = void; - using reference = void; - using difference_type = std::ptrdiff_t; - - ~AuthPropertyIterator(); - AuthPropertyIterator& operator++(); - AuthPropertyIterator operator++(int); - bool operator==(const AuthPropertyIterator& rhs) const; - bool operator!=(const AuthPropertyIterator& rhs) const; - AuthProperty operator*(); - - protected: - AuthPropertyIterator(); - AuthPropertyIterator(const grpc_auth_property* property, - const grpc_auth_property_iterator* iter); - - private: - friend class SecureAuthContext; - const grpc_auth_property* property_; - // The following items form a grpc_auth_property_iterator. - const grpc_auth_context* ctx_; - size_t index_; - const char* name_; -}; - -/// Class encapsulating the Authentication Information. -/// -/// It includes the secure identity of the peer, the type of secure transport -/// used as well as any other properties required by the authorization layer. -class AuthContext { - public: - virtual ~AuthContext() {} - - /// Returns true if the peer is authenticated. - virtual bool IsPeerAuthenticated() const = 0; - - /// A peer identity. - /// - /// It is, in general, comprised of one or more properties (in which case they - /// have the same name). - virtual std::vector GetPeerIdentity() const = 0; - virtual std::string GetPeerIdentityPropertyName() const = 0; - - /// Returns all the property values with the given name. - virtual std::vector FindPropertyValues( - const std::string& name) const = 0; - - /// Iteration over all the properties. - virtual AuthPropertyIterator begin() const = 0; - virtual AuthPropertyIterator end() const = 0; - - /// Mutation functions: should only be used by an AuthMetadataProcessor. - virtual void AddProperty(const std::string& key, const string_ref& value) = 0; - virtual bool SetPeerIdentityPropertyName(const std::string& name) = 0; -}; - -} // namespace grpc +/// TODO(chengyuc): Remove this file after solving compatibility. +#include #endif // GRPCPP_IMPL_CODEGEN_SECURITY_AUTH_CONTEXT_H diff --git a/include/grpcpp/security/auth_context.h b/include/grpcpp/security/auth_context.h index 17784508e2e..7253069768a 100644 --- a/include/grpcpp/security/auth_context.h +++ b/include/grpcpp/security/auth_context.h @@ -19,6 +19,81 @@ #ifndef GRPCPP_SECURITY_AUTH_CONTEXT_H #define GRPCPP_SECURITY_AUTH_CONTEXT_H -#include // IWYU pragma: export +#include +#include + +#include +#include + +struct grpc_auth_context; +struct grpc_auth_property; +struct grpc_auth_property_iterator; + +namespace grpc { +class SecureAuthContext; + +typedef std::pair AuthProperty; + +class AuthPropertyIterator { + public: + using iterator_category = std::forward_iterator_tag; + using value_type = const AuthProperty; + using pointer = void; + using reference = void; + using difference_type = std::ptrdiff_t; + + ~AuthPropertyIterator(); + AuthPropertyIterator& operator++(); + AuthPropertyIterator operator++(int); + bool operator==(const AuthPropertyIterator& rhs) const; + bool operator!=(const AuthPropertyIterator& rhs) const; + AuthProperty operator*(); + + protected: + AuthPropertyIterator(); + AuthPropertyIterator(const grpc_auth_property* property, + const grpc_auth_property_iterator* iter); + + private: + friend class SecureAuthContext; + const grpc_auth_property* property_; + // The following items form a grpc_auth_property_iterator. + const grpc_auth_context* ctx_; + size_t index_; + const char* name_; +}; + +/// Class encapsulating the Authentication Information. +/// +/// It includes the secure identity of the peer, the type of secure transport +/// used as well as any other properties required by the authorization layer. +class AuthContext { + public: + virtual ~AuthContext() {} + + /// Returns true if the peer is authenticated. + virtual bool IsPeerAuthenticated() const = 0; + + /// A peer identity. + /// + /// It is, in general, comprised of one or more properties (in which case they + /// have the same name). + virtual std::vector GetPeerIdentity() const = 0; + virtual std::string GetPeerIdentityPropertyName() const = 0; + + /// Returns all the property values with the given name. + virtual std::vector FindPropertyValues( + const std::string& name) const = 0; + + /// Iteration over all the properties. + virtual AuthPropertyIterator begin() const = 0; + virtual AuthPropertyIterator end() const = 0; + + /// Mutation functions: should only be used by an AuthMetadataProcessor. + virtual void AddProperty(const std::string& key, const string_ref& value) = 0; + virtual bool SetPeerIdentityPropertyName(const std::string& name) = 0; +}; + +} // namespace grpc #endif // GRPCPP_SECURITY_AUTH_CONTEXT_H