GNOME.org
 

[Notes] [Git][BuildGrid/buildgrid][mablanch/144-jwt-authentication] 9 commits: server/_authentication.py: New JWT based gRPC interceptor

Title: GitLab

Martin Blanchard pushed to branch mablanch/144-jwt-authentication at BuildGrid / buildgrid

Commits:

21 changed files:

Changes:

  • buildgrid/_app/commands/cmd_capabilities.py
    ... ... @@ -13,13 +13,12 @@
    13 13 
     # limitations under the License.
    14 14
    15 15
    16 
    -import sys
    17 
    -from urllib.parse import urlparse
    18 
    -
    19 16 
     import click
    20 
    -import grpc
    17 
    +from google.protobuf import json_format
    21 18
    19 
    +from buildgrid.client.authentication import setup_channel
    22 20 
     from buildgrid.client.capabilities import CapabilitiesInterface
    21 
    +from buildgrid._exceptions import InvalidArgumentError
    23 22
    24 23 
     from ..cli import pass_context
    25 24
    ... ... @@ -27,32 +26,29 @@ from ..cli import pass_context
    27 26 
     @click.command(name='capabilities', short_help="Capabilities service.")
    28 27 
     @click.option('--remote', type=click.STRING, default='http://localhost:50051', show_default=True,
    29 28 
                   help="Remote execution server's URL (port defaults to 50051 if no specified).")
    29 
    +@click.option('--auth-token', type=click.Path(exists=True, dir_okay=False), default=None,
    30 
    +              help="Authorization token for the remote.")
    30 31 
     @click.option('--client-key', type=click.Path(exists=True, dir_okay=False), default=None,
    31 
    -              help="Private client key for TLS (PEM-encoded)")
    32 
    +              help="Private client key for TLS (PEM-encoded).")
    32 33 
     @click.option('--client-cert', type=click.Path(exists=True, dir_okay=False), default=None,
    33 
    -              help="Public client certificate for TLS (PEM-encoded)")
    34 
    +              help="Public client certificate for TLS (PEM-encoded).")
    34 35 
     @click.option('--server-cert', type=click.Path(exists=True, dir_okay=False), default=None,
    35 
    -              help="Public server certificate for TLS (PEM-encoded)")
    36 
    +              help="Public server certificate for TLS (PEM-encoded).")
    36 37 
     @click.option('--instance-name', type=click.STRING, default='main', show_default=True,
    37 38 
                   help="Targeted farm instance name.")
    38 39 
     @pass_context
    39 
    -def cli(context, remote, instance_name, client_key, client_cert, server_cert):
    40 
    -    click.echo("Getting capabilities...")
    41 
    -    url = urlparse(remote)
    42 
    -
    43 
    -    remote = '{}:{}'.format(url.hostname, url.port or 50051)
    44 
    -    instance_name = instance_name
    45 
    -
    46 
    -    if url.scheme == 'http':
    47 
    -        channel = grpc.insecure_channel(remote)
    48 
    -    else:
    49 
    -        credentials = context.load_client_credentials(client_key, client_cert, server_cert)
    50 
    -        if not credentials:
    51 
    -            click.echo("ERROR: no TLS keys were specified and no defaults could be found.", err=True)
    52 
    -            sys.exit(-1)
    53 
    -
    54 
    -        channel = grpc.secure_channel(remote, credentials)
    55 
    -
    56 
    -    interface = CapabilitiesInterface(channel)
    57 
    -    response = interface.get_capabilities(instance_name)
    58 
    -    click.echo(response)
    40 
    +def cli(context, remote, instance_name, auth_token, client_key, client_cert, server_cert):
    41 
    +    """Entry point for the bgd-capabilities CLI command group."""
    42 
    +    try:
    43 
    +        context.channel = setup_channel(remote, authorization_token=auth_token,
    44 
    +                                        client_key=client_key, client_cert=client_cert)
    45 
    +
    46 
    +    except InvalidArgumentError as e:
    47 
    +        click.echo("Error: {}.".format(e), err=True)
    48 
    +
    49 
    +    context.instance_name = instance_name
    50 
    +
    51 
    +    interface = CapabilitiesInterface(context.channel)
    52 
    +    response = interface.get_capabilities(context.instance_name)
    53 
    +
    54 
    +    click.echo(json_format.MessageToJson(response))

  • buildgrid/_app/commands/cmd_cas.py
    ... ... @@ -21,13 +21,12 @@ Request work to be executed and monitor status of jobs.
    21 21 
     """
    22 22
    23 23 
     import os
    24 
    -import sys
    25 
    -from urllib.parse import urlparse
    26 24
    27 25 
     import click
    28 
    -import grpc
    29 26
    27 
    +from buildgrid.client.authentication import setup_channel
    30 28 
     from buildgrid.client.cas import download, upload
    29 
    +from buildgrid._exceptions import InvalidArgumentError
    31 30 
     from buildgrid._protos.build.bazel.remote.execution.v2 import remote_execution_pb2
    32 31 
     from buildgrid.utils import create_digest, merkle_tree_maker, read_file
    33 32
    ... ... @@ -37,32 +36,27 @@ from ..cli import pass_context
    37 36 
     @click.group(name='cas', short_help="Interact with the CAS server.")
    38 37 
     @click.option('--remote', type=click.STRING, default='http://localhost:50051', show_default=True,
    39 38 
                   help="Remote execution server's URL (port defaults to 50051 if no specified).")
    39 
    +@click.option('--auth-token', type=click.Path(exists=True, dir_okay=False), default=None,
    40 
    +              help="Authorization token for the remote.")
    40 41 
     @click.option('--client-key', type=click.Path(exists=True, dir_okay=False), default=None,
    41 
    -              help="Private client key for TLS (PEM-encoded)")
    42 
    +              help="Private client key for TLS (PEM-encoded).")
    42 43 
     @click.option('--client-cert', type=click.Path(exists=True, dir_okay=False), default=None,
    43 
    -              help="Public client certificate for TLS (PEM-encoded)")
    44 
    +              help="Public client certificate for TLS (PEM-encoded).")
    44 45 
     @click.option('--server-cert', type=click.Path(exists=True, dir_okay=False), default=None,
    45 46 
                   help="Public server certificate for TLS (PEM-encoded)")
    46 47 
     @click.option('--instance-name', type=click.STRING, default='main', show_default=True,
    47 48 
                   help="Targeted farm instance name.")
    48 49 
     @pass_context
    49 
    -def cli(context, remote, instance_name, client_key, client_cert, server_cert):
    50 
    -    url = urlparse(remote)
    50 
    +def cli(context, remote, instance_name, auth_token, client_key, client_cert, server_cert):
    51 
    +    """Entry point for the bgd-cas CLI command group."""
    52 
    +    try:
    53 
    +        context.channel = setup_channel(remote, authorization_token=auth_token,
    54 
    +                                        client_key=client_key, client_cert=client_cert)
    51 55
    52 
    -    context.remote = '{}:{}'.format(url.hostname, url.port or 50051)
    53 
    -    context.instance_name = instance_name
    54 
    -
    55 
    -    if url.scheme == 'http':
    56 
    -        context.channel = grpc.insecure_channel(context.remote)
    57 
    -    else:
    58 
    -        credentials = context.load_client_credentials(client_key, client_cert, server_cert)
    59 
    -        if not credentials:
    60 
    -            click.echo("ERROR: no TLS keys were specified and no defaults could be found.", err=True)
    61 
    -            sys.exit(-1)
    56 
    +    except InvalidArgumentError as e:
    57 
    +        click.echo("Error: {}.".format(e), err=True)
    62 58
    63 
    -        context.channel = grpc.secure_channel(context.remote, credentials)
    64 
    -
    65 
    -    click.echo("Starting for remote=[{}]".format(context.remote))
    59 
    +    context.instance_name = instance_name
    66 60
    67 61
    68 62 
     @cli.command('upload-dummy', short_help="Upload a dummy action. Should be used with `execute dummy-request`")

  • buildgrid/_app/commands/cmd_execute.py
    ... ... @@ -23,12 +23,12 @@ Request work to be executed and monitor status of jobs.
    23 23 
     import os
    24 24 
     import stat
    25 25 
     import sys
    26 
    -from urllib.parse import urlparse
    27 26
    28 27 
     import click
    29 
    -import grpc
    30 28
    29 
    +from buildgrid.client.authentication import setup_channel
    31 30 
     from buildgrid.client.cas import download, upload
    31 
    +from buildgrid._exceptions import InvalidArgumentError
    32 32 
     from buildgrid._protos.build.bazel.remote.execution.v2 import remote_execution_pb2, remote_execution_pb2_grpc
    33 33 
     from buildgrid.utils import create_digest
    34 34
    ... ... @@ -38,32 +38,27 @@ from ..cli import pass_context
    38 38 
     @click.group(name='execute', short_help="Execute simple operations.")
    39 39 
     @click.option('--remote', type=click.STRING, default='http://localhost:50051', show_default=True,
    40 40 
                   help="Remote execution server's URL (port defaults to 50051 if no specified).")
    41 
    +@click.option('--auth-token', type=click.Path(exists=True, dir_okay=False), default=None,
    42 
    +              help="Authorization token for the remote.")
    41 43 
     @click.option('--client-key', type=click.Path(exists=True, dir_okay=False), default=None,
    42 
    -              help="Private client key for TLS (PEM-encoded)")
    44 
    +              help="Private client key for TLS (PEM-encoded).")
    43 45 
     @click.option('--client-cert', type=click.Path(exists=True, dir_okay=False), default=None,
    44 
    -              help="Public client certificate for TLS (PEM-encoded)")
    46 
    +              help="Public client certificate for TLS (PEM-encoded).")
    45 47 
     @click.option('--server-cert', type=click.Path(exists=True, dir_okay=False), default=None,
    46 
    -              help="Public server certificate for TLS (PEM-encoded)")
    48 
    +              help="Public server certificate for TLS (PEM-encoded).")
    47 49 
     @click.option('--instance-name', type=click.STRING, default='main', show_default=True,
    48 50 
                   help="Targeted farm instance name.")
    49 51 
     @pass_context
    50 
    -def cli(context, remote, instance_name, client_key, client_cert, server_cert):
    51 
    -    url = urlparse(remote)
    52 
    +def cli(context, remote, instance_name, auth_token, client_key, client_cert, server_cert):
    53 
    +    """Entry point for the bgd-execute CLI command group."""
    54 
    +    try:
    55 
    +        context.channel = setup_channel(remote, authorization_token=auth_token,
    56 
    +                                        client_key=client_key, client_cert=client_cert)
    52 57
    53 
    -    context.remote = '{}:{}'.format(url.hostname, url.port or 50051)
    54 
    -    context.instance_name = instance_name
    55 
    -
    56 
    -    if url.scheme == 'http':
    57 
    -        context.channel = grpc.insecure_channel(context.remote)
    58 
    -    else:
    59 
    -        credentials = context.load_client_credentials(client_key, client_cert, server_cert)
    60 
    -        if not credentials:
    61 
    -            click.echo("ERROR: no TLS keys were specified and no defaults could be found.", err=True)
    62 
    -            sys.exit(-1)
    58 
    +    except InvalidArgumentError as e:
    59 
    +        click.echo("Error: {}.".format(e), err=True)
    63 60
    64 
    -        context.channel = grpc.secure_channel(context.remote, credentials)
    65 
    -
    66 
    -    click.echo("Starting for remote=[{}]".format(context.remote))
    61 
    +    context.instance_name = instance_name
    67 62
    68 63
    69 64 
     @cli.command('request-dummy', short_help="Send a dummy action.")

  • buildgrid/_app/commands/cmd_operation.py
    ... ... @@ -22,15 +22,14 @@ Check the status of operations
    22 22
    23 23 
     from collections import OrderedDict
    24 24 
     from operator import attrgetter
    25 
    -from urllib.parse import urlparse
    26 
    -import sys
    27 25 
     from textwrap import indent
    28 26
    29 27 
     import click
    30 28 
     from google.protobuf import json_format
    31 
    -import grpc
    32 29
    30 
    +from buildgrid.client.authentication import setup_channel
    33 31 
     from buildgrid._enums import OperationStage
    32 
    +from buildgrid._exceptions import InvalidArgumentError
    34 33 
     from buildgrid._protos.build.bazel.remote.execution.v2 import remote_execution_pb2, remote_execution_pb2_grpc
    35 34 
     from buildgrid._protos.google.longrunning import operations_pb2, operations_pb2_grpc
    36 35 
     from buildgrid._protos.google.rpc import code_pb2
    ... ... @@ -41,32 +40,27 @@ from ..cli import pass_context
    41 40 
     @click.group(name='operation', short_help="Long running operations commands.")
    42 41 
     @click.option('--remote', type=click.STRING, default='http://localhost:50051', show_default=True,
    43 42 
                   help="Remote execution server's URL (port defaults to 50051 if no specified).")
    43 
    +@click.option('--auth-token', type=click.Path(exists=True, dir_okay=False), default=None,
    44 
    +              help="Authorization token for the remote.")
    44 45 
     @click.option('--client-key', type=click.Path(exists=True, dir_okay=False), default=None,
    45 
    -              help="Private client key for TLS (PEM-encoded)")
    46 
    +              help="Private client key for TLS (PEM-encoded).")
    46 47 
     @click.option('--client-cert', type=click.Path(exists=True, dir_okay=False), default=None,
    47 
    -              help="Public client certificate for TLS (PEM-encoded)")
    48 
    +              help="Public client certificate for TLS (PEM-encoded).")
    48 49 
     @click.option('--server-cert', type=click.Path(exists=True, dir_okay=False), default=None,
    49 
    -              help="Public server certificate for TLS (PEM-encoded)")
    50 
    +              help="Public server certificate for TLS (PEM-encoded).")
    50 51 
     @click.option('--instance-name', type=click.STRING, default='main', show_default=True,
    51 52 
                   help="Targeted farm instance name.")
    52 53 
     @pass_context
    53 
    -def cli(context, remote, instance_name, client_key, client_cert, server_cert):
    54 
    -    url = urlparse(remote)
    54 
    +def cli(context, remote, instance_name, auth_token, client_key, client_cert, server_cert):
    55 
    +    """Entry point for the bgd-operation CLI command group."""
    56 
    +    try:
    57 
    +        context.channel = setup_channel(remote, authorization_token=auth_token,
    58 
    +                                        client_key=client_key, client_cert=client_cert)
    55 59
    56 
    -    context.remote = '{}:{}'.format(url.hostname, url.port or 50051)
    57 
    -    context.instance_name = instance_name
    58 
    -
    59 
    -    if url.scheme == 'http':
    60 
    -        context.channel = grpc.insecure_channel(context.remote)
    61 
    -    else:
    62 
    -        credentials = context.load_client_credentials(client_key, client_cert, server_cert)
    63 
    -        if not credentials:
    64 
    -            click.echo("ERROR: no TLS keys were specified and no defaults could be found.", err=True)
    65 
    -            sys.exit(-1)
    60 
    +    except InvalidArgumentError as e:
    61 
    +        click.echo("Error: {}.".format(e), err=True)
    66 62
    67 
    -        context.channel = grpc.secure_channel(context.remote, credentials)
    68 
    -
    69 
    -    click.echo("Starting for remote=[{}]".format(context.remote))
    63 
    +    context.instance_name = instance_name
    70 64
    71 65
    72 66 
     def _print_operation_status(operation, print_details=False):

  • buildgrid/client/authentication.py
    1 
    +# Copyright (C) 2018 Bloomberg LP
    2 
    +#
    3 
    +# Licensed under the Apache License, Version 2.0 (the "License");
    4 
    +# you may not use this file except in compliance with the License.
    5 
    +# You may obtain a copy of the License at
    6 
    +#
    7 
    +#  <http://www.apache.org/licenses/LICENSE-2.0>
    8 
    +#
    9 
    +# Unless required by applicable law or agreed to in writing, software
    10 
    +# distributed under the License is distributed on an "AS IS" BASIS,
    11 
    +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    12 
    +# See the License for the specific language governing permissions and
    13 
    +# limitations under the License.
    14 
    +
    15 
    +
    16 
    +import base64
    17 
    +from collections import namedtuple
    18 
    +from urllib.parse import urlparse
    19 
    +import os
    20 
    +
    21 
    +import grpc
    22 
    +
    23 
    +from buildgrid._exceptions import InvalidArgumentError
    24 
    +from buildgrid.utils import read_file
    25 
    +
    26 
    +
    27 
    +def load_tls_channel_credentials(client_key=None, client_cert=None, server_cert=None):
    28 
    +    """Looks-up and loads TLS gRPC client channel credentials.
    29 
    +
    30 
    +    Args:
    31 
    +        client_key(str, optional): Client certificate chain file path.
    32 
    +        client_cert(str, optional): Client private key file path.
    33 
    +        server_cert(str, optional): Serve root certificate file path.
    34 
    +
    35 
    +    Returns:
    36 
    +        ChannelCredentials: Credentials to be used for a TLS-encrypted gRPC
    37 
    +            client channel.
    38 
    +    """
    39 
    +    if server_cert and os.path.exists(server_cert):
    40 
    +        server_cert_pem = read_file(server_cert)
    41 
    +    else:
    42 
    +        server_cert_pem = None
    43 
    +
    44 
    +    if client_key and os.path.exists(client_key):
    45 
    +        client_key_pem = read_file(client_key)
    46 
    +    else:
    47 
    +        client_key_pem = None
    48 
    +
    49 
    +    if client_key_pem and client_cert and os.path.exists(client_cert):
    50 
    +        client_cert_pem = read_file(client_cert)
    51 
    +    else:
    52 
    +        client_cert_pem = None
    53 
    +
    54 
    +    credentials = grpc.ssl_channel_credentials(root_certificates=server_cert_pem,
    55 
    +                                               private_key=client_key_pem,
    56 
    +                                               certificate_chain=client_cert_pem)
    57 
    +    return credentials
    58 
    +
    59 
    +
    60 
    +def load_channel_authorization_token(auth_token=None):
    61 
    +    """Looks-up and loads client authorization token.
    62 
    +
    63 
    +    Args:
    64 
    +        auth_token (str, optional): Token file path.
    65 
    +
    66 
    +    Returns:
    67 
    +        str: Encoded token string.
    68 
    +    """
    69 
    +    if auth_token and os.path.exists(auth_token):
    70 
    +        return read_file(auth_token).decode()
    71 
    +
    72 
    +    # TODO: Try loading the token from a default location?
    73 
    +
    74 
    +    return None
    75 
    +
    76 
    +
    77 
    +def setup_channel(remote_url, authorization_token=None,
    78 
    +                  client_key=None, client_cert=None, server_cert=None):
    79 
    +    """Creates a new gRPC client communication chanel.
    80 
    +
    81 
    +    If `remote_url` does not specifies a port number, defaults 50051.
    82 
    +
    83 
    +    Args:
    84 
    +        remote_url (str): URL for the remote, including port and protocol.
    85 
    +        authorization_token (str): Authorization token file path.
    86 
    +        server_cert(str): TLS certificate chain file path.
    87 
    +        client_key(str): TLS root certificate file path.
    88 
    +        client_cert(str): TLS private key file path.
    89 
    +
    90 
    +    Returns:
    91 
    +        (str, Channel):
    92 
    +
    93 
    +    Raises:
    94 
    +        InvalidArgumentError: On any input parsing error.
    95 
    +    """
    96 
    +    url = urlparse(remote_url)
    97 
    +    remote = '{}:{}'.format(url.hostname, url.port or 50051)
    98 
    +
    99 
    +    if url.scheme == 'http':
    100 
    +        channel = grpc.insecure_channel(remote)
    101 
    +
    102 
    +    elif url.scheme == 'https':
    103 
    +        credentials = load_tls_channel_credentials(client_key, client_cert, server_cert)
    104 
    +        if not credentials:
    105 
    +            raise InvalidArgumentError("Given TLS details (or defaults) could be loaded")
    106 
    +
    107 
    +        channel = grpc.secure_channel(remote, credentials)
    108 
    +
    109 
    +    else:
    110 
    +        raise InvalidArgumentError("Given remote does not specify a protocol")
    111 
    +
    112 
    +    if authorization_token is not None:
    113 
    +        token = load_channel_authorization_token(authorization_token)
    114 
    +        if not token:
    115 
    +            raise InvalidArgumentError("Given authorization token could be loaded")
    116 
    +
    117 
    +        interpector = AuthMetadataClientInterceptor(token)
    118 
    +        channel = grpc.intercept_channel(channel, interpector)
    119 
    +
    120 
    +    return channel
    121 
    +
    122 
    +
    123 
    +class AuthMetadataClientInterceptor(
    124 
    +        grpc.UnaryUnaryClientInterceptor, grpc.UnaryStreamClientInterceptor,
    125 
    +        grpc.StreamUnaryClientInterceptor, grpc.StreamStreamClientInterceptor):
    126 
    +
    127 
    +    def __init__(self, authorization_token=None, authorization_secret=None):
    128 
    +        """Initialises a new :class:`AuthMetadataClientInterceptor`.
    129 
    +
    130 
    +        Args:
    131 
    +            authorization_token (str): Authorization token as a string.
    132 
    +        """
    133 
    +        if authorization_token:
    134 
    +            self.__secret = authorization_token.strip()
    135 
    +        else:
    136 
    +            self.__secret = base64.b64encode(authorization_secret)
    137 
    +
    138 
    +        self.__header_field_name = 'authorization'
    139 
    +        self.__header_field_value = 'Bearer {}'.format(self.__secret)
    140 
    +
    141 
    +    def intercept_unary_unary(self, continuation, client_call_details, request):
    142 
    +        new_details = self._amend_call_details(client_call_details)
    143 
    +
    144 
    +        return continuation(new_details, request)
    145 
    +
    146 
    +    def intercept_unary_stream(self, continuation, client_call_details, request):
    147 
    +        new_details = self._amend_call_details(client_call_details)
    148 
    +
    149 
    +        return continuation(new_details, request)
    150 
    +
    151 
    +    def intercept_stream_unary(self, continuation, client_call_details, request_iterator):
    152 
    +        new_details = self._amend_call_details(client_call_details)
    153 
    +
    154 
    +        return continuation(new_details, request_iterator)
    155 
    +
    156 
    +    def intercept_stream_stream(self, continuation, client_call_details, request_iterator):
    157 
    +        new_details = self._amend_call_details(client_call_details)
    158 
    +
    159 
    +        return continuation(new_details, request_iterator)
    160 
    +
    161 
    +    def _amend_call_details(self, client_call_details):
    162 
    +        if client_call_details.metadata is not None:
    163 
    +            new_metadata = list(client_call_details.metadata)
    164 
    +        else:
    165 
    +            new_metadata = []
    166 
    +
    167 
    +        new_metadata.append((self.__header_field_name, self.__header_field_value,))
    168 
    +
    169 
    +        class _ClientCallDetails(
    170 
    +                namedtuple('_ClientCallDetails',
    171 
    +                           ('method', 'timeout', 'credentials', 'metadata')),
    172 
    +                grpc.ClientCallDetails):
    173 
    +            pass
    174 
    +
    175 
    +        return _ClientCallDetails(client_call_details.method,
    176 
    +                                  client_call_details.timeout,
    177 
    +                                  client_call_details.credentials,
    178 
    +                                  new_metadata)

  • buildgrid/server/_authentication.py
    1 
    +# Copyright (C) 2018 Bloomberg LP
    2 
    +#
    3 
    +# Licensed under the Apache License, Version 2.0 (the "License");
    4 
    +# you may not use this file except in compliance with the License.
    5 
    +# You may obtain a copy of the License at
    6 
    +#
    7 
    +#  <http://www.apache.org/licenses/LICENSE-2.0>
    8 
    +#
    9 
    +# Unless required by applicable law or agreed to in writing, software
    10 
    +# distributed under the License is distributed on an "AS IS" BASIS,
    11 
    +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    12 
    +# See the License for the specific language governing permissions and
    13 
    +# limitations under the License.
    14 
    +
    15 
    +
    16 
    +from datetime import datetime
    17 
    +from enum import Enum
    18 
    +import logging
    19 
    +
    20 
    +import grpc
    21 
    +
    22 
    +from buildgrid._exceptions import InvalidArgumentError
    23 
    +
    24 
    +
    25 
    +try:
    26 
    +    import jwt
    27 
    +except ImportError:
    28 
    +    HAVE_JWT = False
    29 
    +else:
    30 
    +    HAVE_JWT = True
    31 
    +
    32 
    +
    33 
    +class AuthMetadataMethod(Enum):
    34 
    +    # No authentication:
    35 
    +    NONE = 'none'
    36 
    +    # JWT based authentication:
    37 
    +    JWT = 'JWT'
    38 
    +
    39 
    +
    40 
    +class AuthMetadataAlgorithm(Enum):
    41 
    +    # No encryption involved:
    42 
    +    NONE = 'none'
    43 
    +    # JWT related algorithms:
    44 
    +    JWT_ES256 = 'ES256'  # ECDSA signature algorithm using SHA-256 hash algorithm
    45 
    +    JWT_ES384 = 'ES384'  # ECDSA signature algorithm using SHA-384 hash algorithm
    46 
    +    JWT_ES512 = 'ES512'  # ECDSA signature algorithm using SHA-512 hash algorithm
    47 
    +    JWT_HS256 = 'HS256'  # HMAC using SHA-256 hash algorithm
    48 
    +    JWT_HS384 = 'HS384'  # HMAC using SHA-384 hash algorithm
    49 
    +    JWT_HS512 = 'HS512'  # HMAC using SHA-512 hash algorithm
    50 
    +    JWT_PS256 = 'PS256'  # RSASSA-PSS using SHA-256 and MGF1 padding with SHA-256
    51 
    +    JWT_PS384 = 'PS384'  # RSASSA-PSS signature using SHA-384 and MGF1 padding with SHA-384
    52 
    +    JWT_PS512 = 'PS512'  # RSASSA-PSS signature using SHA-512 and MGF1 padding with SHA-512
    53 
    +    JWT_RS256 = 'RS256'  # RSASSA-PKCS1-v1_5 signature algorithm using SHA-256 hash algorithm
    54 
    +    JWT_RS384 = 'RS384'  # RSASSA-PKCS1-v1_5 signature algorithm using SHA-384 hash algorithm
    55 
    +    JWT_RS512 = 'RS512'  # RSASSA-PKCS1-v1_5 signature algorithm using SHA-512 hash algorithm
    56 
    +
    57 
    +
    58 
    +class _InvalidTokenError(Exception):
    59 
    +    pass
    60 
    +
    61 
    +
    62 
    +class _ExpiredTokenError(Exception):
    63 
    +    pass
    64 
    +
    65 
    +
    66 
    +class _UnboundedTokenError(Exception):
    67 
    +    pass
    68 
    +
    69 
    +
    70 
    +class AuthMetadataServerInterceptor(grpc.ServerInterceptor):
    71 
    +
    72 
    +    __auth_errors = {
    73 
    +        'missing-bearer': 'Missing authentication header field',
    74 
    +        'invalid-bearer': 'Invalid authentication header field',
    75 
    +        'invalid-token': 'Invalid authentication token',
    76 
    +        'expired-token': 'Expired authentication token',
    77 
    +        'unbounded-token': 'Unbounded authentication token',
    78 
    +    }
    79 
    +
    80 
    +    def __init__(self, method, secret=None, algorithm=AuthMetadataAlgorithm.NONE):
    81 
    +        """Initialises a new :class:`AuthMetadataServerInterceptor`.
    82 
    +
    83 
    +        Args:
    84 
    +            method (AuthMetadataMethod): Type of authorization method.
    85 
    +            secret (str): The secret or key to be used for validating request,
    86 
    +                depending on `method`. Defaults to ``None``.
    87 
    +            algorithm (AuthMetadataAlgorithm): The crytographic algorithm used
    88 
    +                to encode `secret`. Defaults to ``AuthMetadataAlgorithm.NONE``.
    89 
    +
    90 
    +        Raises:
    91 
    +            InvalidArgumentError: If `method` is not supported or if `algorithm`
    92 
    +                is not supported for the given `method`.
    93 
    +        """
    94 
    +        self.__logger = logging.getLogger(__name__)
    95 
    +
    96 
    +        self.__bearer_cache = {}
    97 
    +        self.__terminators = {}
    98 
    +        self.__validator = None
    99 
    +        self.__secret = secret
    100 
    +
    101 
    +        self._method = method
    102 
    +        self._algorithm = algorithm
    103 
    +
    104 
    +        if self._method == AuthMetadataMethod.JWT:
    105 
    +            if not HAVE_JWT:
    106 
    +                raise InvalidArgumentError("JWT authorization method requires PyJWT")
    107 
    +
    108 
    +            try:
    109 
    +                jwt.register_algorithm(self._algorithm.value, None)
    110 
    +            except TypeError:
    111 
    +                raise InvalidArgumentError("Algorithm not supported for JWT decoding: [{}]"
    112 
    +                                           .format(self._algorithm))
    113 
    +            except ValueError:
    114 
    +                pass
    115 
    +
    116 
    +            self.__validator = self._validate_jwt_token
    117 
    +
    118 
    +        for code, message in self.__auth_errors.items():
    119 
    +            self.__terminators[code] = _unary_unary_rpc_terminator(message)
    120 
    +
    121 
    +    @property
    122 
    +    def method(self):
    123 
    +        return self._method
    124 
    +
    125 
    +    @property
    126 
    +    def algorithm(self):
    127 
    +        return self._algorithm
    128 
    +
    129 
    +    def intercept_service(self, continuation, handler_call_details):
    130 
    +        try:
    131 
    +            # Reject requests not carrying a token:
    132 
    +            bearer = dict(handler_call_details.invocation_metadata)['authorization']
    133 
    +
    134 
    +        except KeyError:
    135 
    +            self.__logger.error("Rejecting '{}' request: {}"
    136 
    +                                .format(handler_call_details.method.split('/')[-1],
    137 
    +                                        self.__auth_errors['missing-bearer']))
    138 
    +            return self.__terminators['missing-bearer']
    139 
    +
    140 
    +        # Reject requests with malformated bearer:
    141 
    +        if not bearer.startswith('Bearer '):
    142 
    +            self.__logger.error("Rejecting '{}' request: {}"
    143 
    +                                .format(handler_call_details.method.split('/')[-1],
    144 
    +                                        self.__auth_errors['invalid-bearer']))
    145 
    +            return self.__terminators['invalid-bearer']
    146 
    +
    147 
    +        try:
    148 
    +            # Hit the cache for already validated token:
    149 
    +            expiration_time = self.__bearer_cache[bearer]
    150 
    +
    151 
    +            # Accept request if cached token hasn't expired yet:
    152 
    +            if expiration_time < datetime.utcnow():
    153 
    +                return continuation(handler_call_details)  # Accepted
    154 
    +
    155 
    +        except KeyError:
    156 
    +            pass
    157 
    +
    158 
    +        assert self.__validator is not None
    159 
    +
    160 
    +        try:
    161 
    +            # Decode and validate the new token:
    162 
    +            expiration_time = self.__validator(bearer[7:])
    163 
    +
    164 
    +        except _InvalidTokenError as e:
    165 
    +            self.__logger.error("Rejecting '{}' request: {}; {}"
    166 
    +                                .format(handler_call_details.method.split('/')[-1],
    167 
    +                                        self.__auth_errors['invalid-token'], str(e)))
    168 
    +            return self.__terminators['invalid-token']
    169 
    +
    170 
    +        except _ExpiredTokenError as e:
    171 
    +            self.__logger.error("Rejecting '{}' request: {}; {}"
    172 
    +                                .format(handler_call_details.method.split('/')[-1],
    173 
    +                                        self.__auth_errors['expired-token'], str(e)))
    174 
    +            return self.__terminators['expired-token']
    175 
    +
    176 
    +        except _UnboundedTokenError as e:
    177 
    +            self.__logger.error("Rejecting '{}' request: {}; {}"
    178 
    +                                .format(handler_call_details.method.split('/')[-1],
    179 
    +                                        self.__auth_errors['unbounded-token'], str(e)))
    180 
    +            return self.__terminators['unbounded-token']
    181 
    +
    182 
    +        # Cache the validated token and store expiration time:
    183 
    +        self.__bearer_cache[bearer] = expiration_time
    184 
    +
    185 
    +        return continuation(handler_call_details)  # Accepted
    186 
    +
    187 
    +    def _validate_jwt_token(self, token):
    188 
    +        try:
    189 
    +            payload = jwt.decode(
    190 
    +                token, self.__secret, algorithms=[self._algorithm.value])
    191 
    +
    192 
    +        except jwt.exceptions.ExpiredSignatureError as e:
    193 
    +            raise _ExpiredTokenError(e)
    194 
    +
    195 
    +        except jwt.exceptions.InvalidTokenError as e:
    196 
    +            raise _InvalidTokenError(e)
    197 
    +
    198 
    +        if 'exp' not in payload or not isinstance(payload['exp'], int):
    199 
    +            raise _UnboundedTokenError("Missing 'exp' in payload")
    200 
    +
    201 
    +        return datetime.fromtimestamp(payload['exp'])
    202 
    +
    203 
    +
    204 
    +def _unary_unary_rpc_terminator(details):
    205 
    +
    206 
    +    def terminate(ignored_request, context):
    207 
    +        context.abort(grpc.StatusCode.UNAUTHENTICATED, details)
    208 
    +
    209 
    +    return grpc.unary_unary_rpc_method_handler(terminate)

  • buildgrid/server/instance.py
    ... ... @@ -26,6 +26,7 @@ import grpc
    26 26 
     from buildgrid._enums import BotStatus, MetricRecordDomain, MetricRecordType
    27 27 
     from buildgrid._protos.buildgrid.v2 import monitoring_pb2
    28 28 
     from buildgrid.server.actioncache.service import ActionCacheService
    29 
    +from buildgrid.server._authentication import AuthMetadataMethod, AuthMetadataAlgorithm, AuthMetadataServerInterceptor
    29 30 
     from buildgrid.server.bots.service import BotsService
    30 31 
     from buildgrid.server.cas.service import ByteStreamService, ContentAddressableStorageService
    31 32 
     from buildgrid.server.execution.service import ExecutionService
    ... ... @@ -44,11 +45,21 @@ class BuildGridServer:
    44 45 
         requisite services.
    45 46 
         """
    46 47
    47 
    -    def __init__(self, max_workers=None, monitor=False):
    48 
    +    def __init__(self, max_workers=None, monitor=False, auth_method=AuthMetadataMethod.NONE,
    49 
    +                 auth_secret=None, auth_algorithm=AuthMetadataAlgorithm.NONE):
    48 50 
             """Initializes a new :class:`BuildGridServer` instance.
    49 51
    50 52 
             Args:
    51 53 
                 max_workers (int, optional): A pool of max worker threads.
    54 
    +            monitor (bool, optional): Whether or not to globally activate server
    55 
    +                monitoring. Defaults to ``False``.
    56 
    +            auth_method (AuthMetadataMethod, optional): Authentication method to
    57 
    +                be used for request authorization. Defaults to ``NONE``.
    58 
    +            auth_secret (str, optional): The secret or key to be used for
    59 
    +                authorizing request using `auth_method`. Defaults to ``None``.
    60 
    +            auth_algorithm (AuthMetadataAlgorithm, optional): The crytographic
    61 
    +                algorithm to be uses in combination with `auth_secret` for
    62 
    +                authorizing request using `auth_method`. Defaults to ``NONE``.
    52 63 
             """
    53 64 
             self.__logger = logging.getLogger(__name__)
    54 65
    ... ... @@ -56,8 +67,17 @@ class BuildGridServer:
    56 67 
                 # Use max_workers default from Python 3.5+
    57 68 
                 max_workers = (os.cpu_count() or 1) * 5
    58 69
    70 
    +        self.__grpc_auth_interceptor = None
    71 
    +        if auth_method != AuthMetadataMethod.NONE:
    72 
    +            self.__grpc_auth_interceptor = AuthMetadataServerInterceptor(
    73 
    +                method=auth_method, secret=auth_secret, algorithm=auth_algorithm)
    59 74 
             self.__grpc_executor = futures.ThreadPoolExecutor(max_workers)
    60 
    -        self.__grpc_server = grpc.server(self.__grpc_executor)
    75 
    +
    76 
    +        if self.__grpc_auth_interceptor is not None:
    77 
    +            self.__grpc_server = grpc.server(
    78 
    +                self.__grpc_executor, interceptors=(self.__grpc_auth_interceptor,))
    79 
    +        else:
    80 
    +            self.__grpc_server = grpc.server(self.__grpc_executor)
    61 81
    62 82 
             self.__main_loop = asyncio.get_event_loop()
    63 83 
             self.__monitoring_bus = None

  • tests/auth/__init__.py

  • tests/auth/data/jwt-hs256-conflicting.secret
    1 
    +not-your-256-bit-secret
    \ No newline at end of file

  • tests/auth/data/jwt-hs256-expired.token
    1 
    +eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJCdWlsZEdyaWQgVGVzdCIsImlhdCI6MTM1NTMxNDMzMiwiZXhwIjoxMzU1MzE0MzMyfQ.J-YxkvVbeZFwZ2_mK1d91Wb5vm481LkuehfkUoNpLb8
    \ No newline at end of file

  • tests/auth/data/jwt-hs256-matching.secret
    1 
    +your-256-bit-secret

  • tests/auth/data/jwt-hs256-unbounded.token
    1 
    +eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJCdWlsZEdyaWQgVGVzdCIsImlhdCI6MTM1NTMxNDMzMn0.tEBYb8GM_4lmJCxrh6iMhdoxupgGTCaJR3atLxodZV8
    \ No newline at end of file

  • tests/auth/data/jwt-hs256-valid.token
    1 
    +eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJCdWlsZEdyaWQgVGVzdCIsImlhdCI6MTM1NTMxNDMzMiwiZXhwIjoyMzAxOTk5MTMyfQ.U__BJgksk65S0YuDZqU85tRWF3F03ITF9HXW1cd_Ci8
    \ No newline at end of file

  • tests/auth/data/jwt-rs256-conflicting.pub.key
    1 
    +-----BEGIN PUBLIC KEY-----
    2 
    +MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDNGWI+5SgYIiGcS5UNQzZOs5As
    3 
    +QJRsKR7bBiMjJWnqrNExn0pYrecQsBy6zgwmN6MqEPFV5A1GOEeP3FAqlwD5y+rL
    4 
    +iO2tqq0naiFiJb27qsHzgjakw7pVqgJuGuLVIWWE1RlDnhfN+auNGWyl2YjF6N2+
    5 
    +Lsl0bBX8Q8zaOxbU3wIDAQAB
    6 
    +-----END PUBLIC KEY-----

  • tests/auth/data/jwt-rs256-expired.token
    1 
    +eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJCdWlsZEdyaWQgVGVzdCIsImlhdCI6MTM1NTMxNDMzMiwiZXhwIjoxMzU1MzE0MzMyfQ.L9Wg6YDEV57_a_j_J2s6ug5eEGS80SvlwztdVFzU1ajqlfYmbF5oYq6IEMaiZq95aKkJ71xnwpGfpcuufH-xONiNoZhTg7r-lb99yvPZ8VEHwOIyt1EUEziffim9XRiuwM570fg7_HUC-ZhNJG536k1IM-6rPRnv-1Tu-MxLgvQ
    \ No newline at end of file

  • tests/auth/data/jwt-rs256-matching.priv.key
    1 
    +-----BEGIN RSA PRIVATE KEY-----
    2 
    +MIICWwIBAAKBgQDdlatRjRjogo3WojgGHFHYLugdUWAY9iR3fy4arWNA1KoS8kVw
    3 
    +33cJibXr8bvwUAUparCwlvdbH6dvEOfou0/gCFQsHUfQrSDv+MuSUMAe8jzKE4qW
    4 
    ++jK+xQU9a03GUnKHkkle+Q0pX/g6jXZ7r1/xAK5Do2kQ+X5xK9cipRgEKwIDAQAB
    5 
    +AoGAD+onAtVye4ic7VR7V50DF9bOnwRwNXrARcDhq9LWNRrRGElESYYTQ6EbatXS
    6 
    +3MCyjjX2eMhu/aF5YhXBwkppwxg+EOmXeh+MzL7Zh284OuPbkglAaGhV9bb6/5Cp
    7 
    +uGb1esyPbYW+Ty2PC0GSZfIXkXs76jXAu9TOBvD0ybc2YlkCQQDywg2R/7t3Q2OE
    8 
    +2+yo382CLJdrlSLVROWKwb4tb2PjhY4XAwV8d1vy0RenxTB+K5Mu57uVSTHtrMK0
    9 
    +GAtFr833AkEA6avx20OHo61Yela/4k5kQDtjEf1N0LfI+BcWZtxsS3jDM3i1Hp0K
    10 
    +Su5rsCPb8acJo5RO26gGVrfAsDcIXKC+bQJAZZ2XIpsitLyPpuiMOvBbzPavd4gY
    11 
    +6Z8KWrfYzJoI/Q9FuBo6rKwl4BFoToD7WIUS+hpkagwWiz+6zLoX1dbOZwJACmH5
    12 
    +fSSjAkLRi54PKJ8TFUeOP15h9sQzydI8zJU+upvDEKZsZc/UhT/SySDOxQ4G/523
    13 
    +Y0sz/OZtSWcol/UMgQJALesy++GdvoIDLfJX5GBQpuFgFenRiRDabxrE9MNUZ2aP
    14 
    +FaFp+DyAe+b4nDwuJaW2LURbr8AEZga7oQj0uYxcYw==
    15 
    +-----END RSA PRIVATE KEY-----
    \ No newline at end of file

  • tests/auth/data/jwt-rs256-matching.pub.key
    1 
    +-----BEGIN PUBLIC KEY-----
    2 
    +MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDdlatRjRjogo3WojgGHFHYLugd
    3 
    +UWAY9iR3fy4arWNA1KoS8kVw33cJibXr8bvwUAUparCwlvdbH6dvEOfou0/gCFQs
    4 
    +HUfQrSDv+MuSUMAe8jzKE4qW+jK+xQU9a03GUnKHkkle+Q0pX/g6jXZ7r1/xAK5D
    5 
    +o2kQ+X5xK9cipRgEKwIDAQAB
    6 
    +-----END PUBLIC KEY-----

  • tests/auth/data/jwt-rs256-unbounded.token
    1 
    +eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJCdWlsZEdyaWQgVGVzdCIsImlhdCI6MTM1NTMxNDMzMn0.1_yoF5Vg1fXs2SmWhYm7LbLMGbZVgBjxZkzRlw87blSG6lRgEi_R-WXKcS4n_pGynkcahJ_AqLseyHduXZveI1nVQFATXVNQQPcvmkM6pYSHPm155iqZFdYAWWVKB9ND1F3oDrXLBzqF2a4HtLNXYTu5gDStdUPkrH_FiatX79g
    \ No newline at end of file

  • tests/auth/data/jwt-rs256-valid.token
    1 
    +eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJCdWlsZEdyaWQgVGVzdCIsImlhdCI6MTM1NTMxNDMzMiwiZXhwIjoyMzAxOTk5MTMyfQ.RCbQNqPaF0mfFsUGwdb47Ga3DITAL7OjYlcWkJ2xWL61Fo9zURx_mSIVDYTgEY3nFW1cmf2r6Y2Z0rEUOY-qBl8B9Ww9jijGz7LMR4w_j8f967MjTxkyOCWZSUWazObg5jxNjLtfxPD28UbbrS_2R8BLgMQFf3ymSDXTX5lAdBY
    \ No newline at end of file

  • tests/auth/test_server_interceptor.py
    1 
    +# Copyright (C) 2018 Bloomberg LP
    2 
    +#
    3 
    +# Licensed under the Apache License, Version 2.0 (the "License");
    4 
    +# you may not use this file except in compliance with the License.
    5 
    +# You may obtain a copy of the License at
    6 
    +#
    7 
    +#  <http://www.apache.org/licenses/LICENSE-2.0>
    8 
    +#
    9 
    +# Unless required by applicable law or agreed to in writing, software
    10 
    +# distributed under the License is distributed on an "AS IS" BASIS,
    11 
    +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    12 
    +# See the License for the specific language governing permissions and
    13 
    +# limitations under the License.
    14 
    +
    15 
    +# pylint: disable=redefined-outer-name
    16 
    +
    17 
    +
    18 
    +from collections import namedtuple
    19 
    +from unittest import mock
    20 
    +import os
    21 
    +
    22 
    +import grpc
    23 
    +from grpc._server import _Context
    24 
    +import pytest
    25 
    +
    26 
    +from buildgrid.server._authentication import AuthMetadataMethod, AuthMetadataAlgorithm
    27 
    +from buildgrid.server._authentication import AuthMetadataServerInterceptor
    28 
    +
    29 
    +from ..utils.utils import read_file
    30 
    +
    31 
    +
    32 
    +try:
    33 
    +    import jwt  # pylint: disable=unused-import
    34 
    +except ImportError:
    35 
    +    HAVE_JWT = False
    36 
    +else:
    37 
    +    HAVE_JWT = True
    38 
    +
    39 
    +
    40 
    +DATA_DIR = os.path.join(
    41 
    +    os.path.dirname(os.path.realpath(__file__)), 'data')
    42 
    +
    43 
    +TOKENS = [None, 'not-a-token']
    44 
    +SECRETS = [None, None]
    45 
    +ALGORITHMS = [AuthMetadataAlgorithm.NONE, AuthMetadataAlgorithm.NONE]
    46 
    +VALIDITIES = [False, False]
    47 
    +# Generic test data: token, secret, algorithm, validity:
    48 
    +DATA = zip(TOKENS, SECRETS, ALGORITHMS, VALIDITIES)
    49 
    +
    50 
    +JWT_TOKENS = [
    51 
    +    'jwt-hs256-expired.token',
    52 
    +    'jwt-hs256-unbounded.token',
    53 
    +    'jwt-hs256-valid.token',
    54 
    +    'jwt-hs256-valid.token',
    55 
    +
    56 
    +    'jwt-rs256-expired.token',
    57 
    +    'jwt-rs256-unbounded.token',
    58 
    +    'jwt-rs256-valid.token',
    59 
    +    'jwt-rs256-valid.token']
    60 
    +JWT_SECRETS = [
    61 
    +    'jwt-hs256-matching.secret',
    62 
    +    'jwt-hs256-matching.secret',
    63 
    +    'jwt-hs256-matching.secret',
    64 
    +    'jwt-hs256-conflicting.secret',
    65 
    +
    66 
    +    'jwt-rs256-matching.pub.key',
    67 
    +    'jwt-rs256-matching.pub.key',
    68 
    +    'jwt-rs256-matching.pub.key',
    69 
    +    'jwt-rs256-conflicting.pub.key']
    70 
    +JWT_ALGORITHMS = [
    71 
    +    AuthMetadataAlgorithm.JWT_HS256,
    72 
    +    AuthMetadataAlgorithm.JWT_HS256,
    73 
    +    AuthMetadataAlgorithm.JWT_HS256,
    74 
    +    AuthMetadataAlgorithm.JWT_HS256,
    75 
    +
    76 
    +    AuthMetadataAlgorithm.JWT_RS256,
    77 
    +    AuthMetadataAlgorithm.JWT_RS256,
    78 
    +    AuthMetadataAlgorithm.JWT_RS256,
    79 
    +    AuthMetadataAlgorithm.JWT_RS256]
    80 
    +JWT_VALIDITIES = [
    81 
    +    False, False, True, False,
    82 
    +    False, False, True, False]
    83 
    +# JWT test data: token, secret, algorithm, validity:
    84 
    +JWT_DATA = zip(JWT_TOKENS, JWT_SECRETS, JWT_ALGORITHMS, JWT_VALIDITIES)
    85 
    +
    86 
    +
    87 
    +_MockHandlerCallDetails = namedtuple(
    88 
    +    '_MockHandlerCallDetails', ('method', 'invocation_metadata',))
    89 
    +_MockMetadatum = namedtuple(
    90 
    +    '_MockMetadatum', ('key', 'value',))
    91 
    +
    92 
    +
    93 
    +def _mock_call_details(token, method='TestMethod'):
    94 
    +    invocation_metadata = [
    95 
    +        _MockMetadatum(
    96 
    +            key='user-agent',
    97 
    +            value='grpc-c/6.0.0 (manylinux; chttp2; gao)')]
    98 
    +
    99 
    +    if token and token.count('.') == 2:
    100 
    +        invocation_metadata.append(_MockMetadatum(
    101 
    +            key='authorization', value='Bearer {}'.format(token)))
    102 
    +
    103 
    +    elif token:
    104 
    +        invocation_metadata.append(_MockMetadatum(
    105 
    +            key='authorization', value=token))
    106 
    +
    107 
    +    return _MockHandlerCallDetails(
    108 
    +        method=method, invocation_metadata=invocation_metadata)
    109 
    +
    110 
    +
    111 
    +def _unary_unary_rpc_terminator(details):
    112 
    +
    113 
    +    def terminate(ignored_request, context):
    114 
    +        context.set_code(grpc.StatusCode.OK)
    115 
    +
    116 
    +    return grpc.unary_unary_rpc_method_handler(terminate)
    117 
    +
    118 
    +
    119 
    +@pytest.mark.parametrize('token,secret,algorithm,validity', DATA)
    120 
    +def test_authorization_rejections(token, secret, algorithm, validity):
    121 
    +    interceptor = AuthMetadataServerInterceptor(
    122 
    +        method=AuthMetadataMethod.NONE, secret=secret, algorithm=algorithm)
    123 
    +
    124 
    +    call_details = _mock_call_details(token)
    125 
    +    context = mock.create_autospec(_Context, spec_set=True)
    126 
    +
    127 
    +    try:
    128 
    +        handler = interceptor.intercept_service(None, call_details)
    129 
    +
    130 
    +    except AssertionError:
    131 
    +        context.set_code(grpc.StatusCode.OK)
    132 
    +
    133 
    +    else:
    134 
    +        handler.unary_unary(None, context)
    135 
    +
    136 
    +    if validity:
    137 
    +        context.set_code.assert_called_once_with(grpc.StatusCode.OK)
    138 
    +        context.abort.assert_not_called()
    139 
    +
    140 
    +    else:
    141 
    +        context.abort.assert_called_once_with(grpc.StatusCode.UNAUTHENTICATED, mock.ANY)
    142 
    +        context.set_code.assert_not_called()
    143 
    +
    144 
    +
    145 
    +@pytest.mark.skipif(not HAVE_JWT, reason="No pyjwt")
    146 
    +@pytest.mark.parametrize('token,secret,algorithm,validity', JWT_DATA)
    147 
    +def test_jwt_token_validation(token, secret, algorithm, validity):
    148 
    +    token = read_file(os.path.join(DATA_DIR, token), text_mode=True).strip()
    149 
    +    secret = read_file(os.path.join(DATA_DIR, secret), text_mode=True).strip()
    150 
    +
    151 
    +    interceptor = AuthMetadataServerInterceptor(
    152 
    +        method=AuthMetadataMethod.JWT, secret=secret, algorithm=algorithm)
    153 
    +
    154 
    +    continuator = _unary_unary_rpc_terminator
    155 
    +    call_details = _mock_call_details(token)
    156 
    +    context = mock.create_autospec(_Context, spec_set=True)
    157 
    +
    158 
    +    handler = interceptor.intercept_service(continuator, call_details)
    159 
    +    handler.unary_unary(None, context)
    160 
    +
    161 
    +    if validity:
    162 
    +        context.set_code.assert_called_once_with(grpc.StatusCode.OK)
    163 
    +        context.abort.assert_not_called()
    164 
    +
    165 
    +    else:
    166 
    +        context.abort.assert_called_once_with(grpc.StatusCode.UNAUTHENTICATED, mock.ANY)
    167 
    +        context.set_code.assert_not_called()

  • tests/utils/utils.py
    ... ... @@ -34,6 +34,11 @@ def kill_process_tree(pid):
    34 34 
         kill_proc(proc)
    35 35
    36 36
    37 
    +def read_file(file_path, text_mode=False):
    38 
    +    with open(file_path, 'r' if text_mode else 'r') as in_file:
    39 
    +        return in_file.read()
    40 
    +
    41 
    +
    37 42 
     def run_in_subprocess(function, *arguments, timeout=1):
    38 43 
         queue = multiprocessing.Queue()
    39 44 
         # Use subprocess to avoid creation of gRPC threads in main process

    • —
    View it on GitLab.
    You're receiving this email because of your account on gitlab.com. If you'd like to receive fewer emails, you can adjust your notification settings.

    [Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]