Implementing gRPC Authentication

1. Understanding gRPC Security Model

LayerMechanism
TransportTLS/mTLS
Per-callMetadata credentials (Bearer, JWT)
ClusterALTS (Google), Service Mesh (Istio/Linkerd)
App-levelInterceptors

2. Implementing TLS for gRPC

Example: Server TLS

Server server = ServerBuilder.forPort(9090)
  .useTransportSecurity(new File("server.crt"), new File("server.key"))
  .addService(new MyService())
  .build();

3. Using Token-Based Authentication

Example: Bearer in metadata

Metadata md = new Metadata();
md.put(Metadata.Key.of("authorization", ASCII_STRING_MARSHALLER), "Bearer " + jwt);
MyServiceGrpc.newBlockingStub(channel)
  .withCallCredentials(MoreCallCredentials.from(googleCreds))
  .myMethod(req);

4. Implementing Metadata Credentials

APIDetail
CallCredentialsPer-RPC token attachment
ChannelCredentialsTransport-level (TLS)
CompositeCallCredentialsCombine multiple

5. Using Client Certificates

StepDetail
Server.clientAuth(REQUIRE) with trust manager
ClientProvide cert+key chain
SANSPIFFE ID in SubjectAltName URI

6. Implementing Interceptors for Authorization

Example: ServerInterceptor

public class AuthInterceptor implements ServerInterceptor {
  public <Req, Resp> Listener<Req> interceptCall(ServerCall<Req,Resp> call, Metadata headers, ServerCallHandler<Req,Resp> next) {
    String auth = headers.get(AUTH_KEY);
    if (auth == null || !auth.startsWith("Bearer ")) {
      call.close(Status.UNAUTHENTICATED, new Metadata()); return new NoopListener<>();
    }
    Context ctx = Context.current().withValue(USER_CTX, verify(auth.substring(7)));
    return Contexts.interceptCall(ctx, call, headers, next);
  }
}

7. Using Per-RPC Credentials

Attached to individual calls via withCallCredentials — useful when single channel serves multiple identities.

8. Implementing ALTS

AspectDetail
Full nameApplication Layer Transport Security (Google)
UseGCP service-to-service inside Google infra
IdentityService account-based

9. Handling Errors in gRPC

Status CodeMaps to
UNAUTHENTICATED (16)HTTP 401
PERMISSION_DENIED (7)HTTP 403
UNAVAILABLE (14)HTTP 503

10. Implementing Service-to-Service Auth

PatternDetail
SPIFFE/SPIREWorkload identity with X.509-SVID/JWT-SVID
mTLS via meshIstio peer authentication
Token exchangeRFC 8693 for user context propagation