grpc-java icon indicating copy to clipboard operation
grpc-java copied to clipboard

Feat/server interceptor

Open sauravzg opened this issue 1 month ago • 0 comments

This PR sits on top of https://github.com/grpc/grpc-java/pull/12496, so only the last commit + any fixups need to be reviewed.

This commit introduces the ExtAuthzServerInterceptor, a server interceptor that performs external authorization for incoming RPCs.

The interceptor checks if the external authorization filter is enabled. If it is, it calls the external authorization service and handles the response. It supports both unary and streaming RPCs.

The interceptor handles the following scenarios:

  • Allow responses: The RPC is allowed to proceed.
  • Deny responses: The RPC is denied with a PERMISSION_DENIED status.
  • Authorization service errors: The RPC is either denied or allowed to proceed based on the failure_mode_allow configuration.

This commit also includes comprehensive integration tests for the ExtAuthzServerInterceptor, covering various scenarios and configurations.

  • [] #12491 feat(xds): Update Envoy proto definitions and add ExtAuthz gRPC service
  • [] #12492 feat(xds): Add configuration objects for ExtAuthz and GrpcService
  • [] #12493 feat(xds): Implement request builder for external authorization
  • [] #12494 feat(xds): Add header mutations library
  • [] #12495 feat(xds): Implement response handling for external authorization
  • [] #12496 feat(xds): Add ExtAuthzClientInterceptor and related components
  • [x] #12497 feat(xds): Add ExtAuthzServerInterceptor and tests
  • [] TBD: PR_LINK feat(xds): Add ExternalAuthorizationFilter

sauravzg avatar Nov 11 '25 09:11 sauravzg