Custom OAuth authentication with grpc

[Gutemberg Ribeiro]

Hello guys,

 

Is there any guidance on how to add support to our own OAuth authentication? Our servers today use https://github.com/IdentityServer/IdentityServer3 with client_credentials flow and we are evaluating if is feasible to make our device communication with our servers (.Net C#) by using grps but we are concerned about the authentication.

 

I saw in the docs that Oauth is used but only for google services and we would like to customize it to use our own. Is there any guidance?

 

Thanks!

Best regards,

 

Gutemberg

 

Sent from Mail for Windows 10

 

[Julien Boeuf]

Hi Gutemberg,

Which language are you using on the client side?

There is a way to extend client credentials documented here (for C++):

http://www.grpc.io/docs/guides/auth.html#extending-grpc-to-support-other-authentication-mechanisms

The other wrapped languages should be able to use a similar API.

     Julien.

[Gutemberg Ribeiro]

Hello Julien and thanks for get back.

 

Our client is basically a node.js/chromium application(electron.atom.io) embbeded on the ARM device.

 

Out server is a C# webAPI which is basically RPC and we want to move it to use a solid RPC framework, and that is why we are reaching you guys out.

 

In order to achieve that, we need to replace our server from a webAPI to a C#-based gRPC service and, implement the client, and implement the Oauth support on both ends, by integrating it with IdentityServer for client credentials so the client just make follow the client_credentials flow, and push the token to the server which in turn, should grab that token and push the IdentityServer in order to validate that token and obtains the client claims for authorization.

 

Our client application is basically Javascript code and since it is based on node.js we can (1) use any pre-existent client for node.js/JS or (2) use gRPC C++ as a node.js native plugin so we can call its native lib from the JS world.

 

Is that possible?

 

Thanks

Gutemberg

 

Sent from Mail for Windows 10

 

[Julien Boeuf]

+Michael (node)

+Jan (C#)

Hi Gutemberg,

We have a nodejs implementation of gRPC already so I guess, it would make much more sense to use this one on the client since threading is typically difficult to get right between node and C++ (2). For the oauth integration on the client, you would need an adapter similar to the one that we have for grpc.credentials.createFromGoogleCredential for our auth library.

On the server side, you would extract the metadata, get the authorization header/metadata and pass that to your external library for verification before granting access.

Cheers,

     Julien.

[and...@gmail.com]

"For the oauth integration on the client, you would need an adapter similar to the one that we have for grpc.credentials.createFromGoogleCredential for our auth library."

Is the any exampled available how to impalement it? I'm looking forward to see how to add OpenID Connect to grpc c# server with IdentityServer4.