forward_auth_grpc_plugin

README

GRPC Forward Auth Plugin

Overview

The GRPC Forward Auth Plugin for Traefik allows validating incoming requests against a gRPC authentication service. It forwards authentication requests to the gRPC authentication service and checks the response to decide whether to allow or deny the request.

Why i created this plugin

I had the problem that my entire backend speaks grpc. all services of a microservice infrastructure communicate with each other via grpc. But I wanted to use traefik to check authentication. Otherwise I would have had to write logic for this in every service. Traefik already offers a forwardAuth for http backends. In fact, my first setup was to use this forward auth and then the plugin http2grcp, but the constant translation in protocols was a bit unpleasant :D

Installation

To install the plugin, add the following configuration to your Traefik configuration file:

experimental:
  plugins:
    grpcForwardAuth:
      moduleName: "github.com/morzan1001/forward-auth-grpc-plugin"
      version: "v0.1.0"

Configuration

The plugin is configured via the traefik.yml file. Here is an example:

http:
  middlewares:
    my-grpc-forward-auth:
      plugin:
        grpcForwardAuth:
          address: "localhost:50051"
          tokenHeader: "authorization"

Parameters

• address: The address of the gRPC authentication service.
• tokenHeader: The name of the header that contains the authentication token.

Exampe gRPC Auth Service configuration

The gRPC authentication service must implement the following endpoints to be compatible with the plugin:

proto/auth.proto

syntax = "proto3";

package auth;

option go_package = "github.com/morzan1001/forward-auth-grpc-plugin/proto";

// AuthService handles authentication requests
service AuthService {
    rpc Authenticate(AuthRequest) returns (AuthResponse);
}

// AuthRequest contains the authentication token
message AuthRequest {
    string token = 1;
}

// AuthResponse contains the authentication result
message AuthResponse {
    bool allowed = 1;
    string message = 2;
    map<string, string> metadata = 3;
}

AuthService Implementation

package main

import (
    "context"
    "net"

    pb "github.com/morzan1001/forward-auth-grpc-plugin/proto"
    "google.golang.org/grpc"
    "google.golang.org/grpc/codes"
    "google.golang.org/grpc/status"
)

type AuthServiceServer struct {
    pb.UnimplementedAuthServiceServer
}

func (s *AuthServiceServer) Authenticate(ctx context.Context, req *pb.AuthRequest) (*pb.AuthResponse, error) {
    // Implement your authentication logic here
    if req.Token == "valid-token" {
        return &pb.AuthResponse{
            Allowed: true,
            Message: "Authentication successful",
        }, nil
    }
    return &pb.AuthResponse{
        Allowed: false,
        Message: "Authentication failed",
    }, status.Error(codes.Unauthenticated, "invalid token")
}

func main() {
    lis, err := net.Listen("tcp", ":50051")
    if err != nil {
        panic(err)
    }
    grpcServer := grpc.NewServer()
    pb.RegisterAuthServiceServer(grpcServer, &AuthServiceServer{})
    if err := grpcServer.Serve(lis); err != nil {
        panic(err)
    }
}

Tests

To test the plugin, you can use the provided unit tests. Run the tests with the following command:

go test ./...

or

make test

License

This project is licensed under the MIT License. See the LICENSE file for more details.

Documentation

Index

• type Config
  • func CreateConfig() *Config
• type GRPCForwardAuth
  • func New(ctx context.Context, config *Config, name string) (*GRPCForwardAuth, error)
  • func (g *GRPCForwardAuth) InterceptRequest(ctx context.Context) error

Types

type Config

type Config struct {
	Address     string `json:"address,omitempty"`     // Auth service address
	TokenHeader string `json:"tokenHeader,omitempty"` // Name of the token metadata field
}

Config the plugin configuration.

func CreateConfig

func CreateConfig() *Config

CreateConfig creates the default plugin configuration.

type GRPCForwardAuth

type GRPCForwardAuth struct {
	// contains filtered or unexported fields
}

GRPCForwardAuth plugin.

func New

func New(ctx context.Context, config *Config, name string) (*GRPCForwardAuth, error)

New creates a new GRPCForwardAuth plugin.

func (*GRPCForwardAuth) InterceptRequest

func (g *GRPCForwardAuth) InterceptRequest(ctx context.Context) error

InterceptRequest handles the incoming gRPC request authentication