java.lang.Object
- io.helidon.security.integration.grpc.GrpcSecurity

All Implemented Interfaces:

io.grpc.ServerInterceptor, ServiceDescriptor.Configurer
```
@Priority(2000)
public final class GrpcSecurity
extends Object
implements io.grpc.ServerInterceptor, ServiceDescriptor.Configurer
```
Integration of security into the gRPC Server.
Methods that start with "from" are to register GrpcSecurity with GrpcServer - to create SecurityContext for requests:
Example:
```
 // gRPC server routing builder - this is our integration point
 GrpcRouting routing = GrpcRouting.builder()
 // register GrpcSecurity to add the security ServerInterceptor
 .intercept(GrpcSecurity.create(security))
 
```
Other methods are to create security enforcement points (gates) for specific services. These methods are starting points that provide an instance of GrpcSecurityHandler that has finer grained methods to control the gate behavior.
Note that if any gate is configured, auditing will be enabled by default if you want to audit any method, invoke audit() to create a gate that will always audit the route. If you want to create a gate and not audit it, use GrpcSecurityHandler.skipAudit() on the returned instance.
- secure() - authentication and authorization
- rolesAllowed(String...) - role based access control (implies authentication and authorization)
- authenticate() - authentication only
- authorize() - authorization only
- allowAnonymous() - authentication optional
- audit() - audit all requests
- authenticator(String) - use explicit authenticator (named - as configured in config or through builder)
- authorizer(String) - use explicit authorizer (named - as configured in config or through builder)
- enforce() - use defaults (e.g. no authentication, authorization, audit calls; this also give access to more fine-grained methods of GrpcSecurityHandler
Example:
```
 // continue from example above...
 // create a gate for method GET: authenticate all paths under /user and require role "user" for authorization
 .intercept(GrpcService, GrpcSecurity.rolesAllowed("user"))
 
```

Field Summary

Fields
Modifier and Type	Field	Description
`static String`	`ABAC_ATTRIBUTE_HEADERS`	The value used for the key of the security context environment's ABAC request headers attribute.
`static String`	`ABAC_ATTRIBUTE_METHOD`	The value used for the key of the security context environment's ABAC request method descriptor attribute.
`static String`	`ABAC_ATTRIBUTE_REMOTE_ADDRESS`	The value used for the key of the security context environment's ABAC request remote address attribute.
`static String`	`ABAC_ATTRIBUTE_REMOTE_PORT`	The value used for the key of the security context environment's ABAC request remote port attribute.
`static io.grpc.Context.Key<Map>`	`CONTEXT_ADD_HEADERS`	Security can accept additional headers to be added to security request.
`static io.grpc.Context.Key<GrpcSecurityHandler>`	`GRPC_SECURITY_HANDLER`	The default security handler gRPC metadata header key.
`static io.grpc.Context.Key<SecurityContext>`	`SECURITY_CONTEXT`	The SecurityContext gRPC metadata header key.

Method Summary

All Methods Static Methods Instance Methods Concrete Methods
Modifier and Type	Method	Description
`static GrpcSecurityHandler`	`allowAnonymous()`	If called, authentication failure will not abort request and will continue as anonymous (defaults to false).
`static GrpcSecurityHandler`	`audit()`	Whether to audit this request - defaults to false for GET and HEAD methods, true otherwise.
`static GrpcSecurityHandler`	`authenticate()`	If called, request will go through authentication process - defaults to false (even if authorize is true).
`static GrpcSecurityHandler`	`authenticator(String explicitAuthenticator)`	Use a named authenticator (as supported by security - if not defined, default authenticator is used).
`static GrpcSecurityHandler`	`authorize()`	Enable authorization for this route.
`static GrpcSecurityHandler`	`authorizer(String explicitAuthorizer)`	Use a named authorizer (as supported by security - if not defined, default authorizer is used, if none defined, all is permitted).
`void`	`configure(ServiceDescriptor.Rules rules)`	If the `config` field is set then modify the `ServiceDescriptor.Rules` with any applicable security configuration.
`static GrpcSecurity`	`create(Config config)`	Create a consumer of gRPC routing config to be `registered` with gRPC server routing to process security requests.
`static GrpcSecurity`	`create(Security security)`	Create a consumer of gRPC routing config to be `GrpcRouting.Builder.register(GrpcService)`) registered} with gRPC server routing to process security requests.
`static GrpcSecurity`	`create(Security security, Config config)`	Create a consumer of gRPC routing config to be `registered` with gRPC server routing to process security requests.
`static GrpcSecurityHandler`	`enforce()`	Return a default instance to create a default enforcement point (or modify the result further).
`<ReqT,RespT> io.grpc.ServerCall.Listener<ReqT>`	`interceptCall(io.grpc.ServerCall<ReqT,RespT> call, io.grpc.Metadata headers, io.grpc.ServerCallHandler<ReqT,RespT> next)`
`static GrpcSecurityHandler`	`rolesAllowed(String... roles)`	An array of allowed roles for this path - must have a security provider supporting roles.
`static GrpcSecurityHandler`	`secure()`	Secure access using authentication and authorization.
`GrpcSecurity`	`securityDefaults(GrpcSecurityHandler defaultHandler)`	Create a new gRPC security instance using the default handler as base defaults for all handlers used.

Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

- Field Detail
  - CONTEXT_ADD_HEADERS
```
public static final io.grpc.Context.Key<Map> CONTEXT_ADD_HEADERS
```
    Security can accept additional headers to be added to security request. This will be used to obtain multi-value string map (a map of string to list of strings) from context (appropriate to the integration).
  - SECURITY_CONTEXT
```
public static final io.grpc.Context.Key<SecurityContext> SECURITY_CONTEXT
```
    The SecurityContext gRPC metadata header key.
  - GRPC_SECURITY_HANDLER
```
public static final io.grpc.Context.Key<GrpcSecurityHandler> GRPC_SECURITY_HANDLER
```
    The default security handler gRPC metadata header key.
  - ABAC_ATTRIBUTE_REMOTE_ADDRESS
```
public static final String ABAC_ATTRIBUTE_REMOTE_ADDRESS
```
    The value used for the key of the security context environment's ABAC request remote address attribute.
    
    See Also:
    
    Constant Field Values
  - ABAC_ATTRIBUTE_REMOTE_PORT
```
public static final String ABAC_ATTRIBUTE_REMOTE_PORT
```
    The value used for the key of the security context environment's ABAC request remote port attribute.
    
    See Also:
    
    Constant Field Values
  - ABAC_ATTRIBUTE_HEADERS
```
public static final String ABAC_ATTRIBUTE_HEADERS
```
    The value used for the key of the security context environment's ABAC request headers attribute.
    
    See Also:
    
    Constant Field Values
  - ABAC_ATTRIBUTE_METHOD
```
public static final String ABAC_ATTRIBUTE_METHOD
```
    The value used for the key of the security context environment's ABAC request method descriptor attribute.
    
    See Also:
    
    Constant Field Values
- Method Detail
  - create
```
public static GrpcSecurity create(Security security)
```
    Create a consumer of gRPC routing config to be GrpcRouting.Builder.register(GrpcService)) registered} with gRPC server routing to process security requests. This method is to be used together with other routing methods to protect gRPC service or methods programmatically. Example:
    .intercept(GrpcSecurity.authenticate().rolesAllowed("user"))
    Parameters:
    
    security - initialized security
    
    Returns:
    
    routing config consumer
  - create
```
public static GrpcSecurity create(Config config)
```
    Create a consumer of gRPC routing config to be registered with gRPC server routing to process security requests. This method configures security and gRPC server integration from a config instance
    
    Parameters:
    
    config - Config instance to load security and gRPC server integration from configuration
    
    Returns:
    
    routing config consumer
  - create
```
public static GrpcSecurity create(Security security,
                                  Config config)
```
    Create a consumer of gRPC routing config to be registered with gRPC server routing to process security requests. This method expects initialized security and creates gRPC server integration from a config instance
    
    Parameters:
    
    security - Security instance to use
    
    config - Config instance to load security and gRPC server integration from configuration
    
    Returns:
    
    routing config consumer
  - secure
```
public static GrpcSecurityHandler secure()
```
    Secure access using authentication and authorization. Auditing is enabled by default for methods modifying content. When using RBAC (role based access control), just use rolesAllowed(String...). If you use a security provider, that requires additional data, use GrpcSecurityHandler.customObject(Object).
    Behavior:
    
    Authentication: enabled and required
    
    Authorization: enabled if provider configured
    
    Audit: not modified
    Returns:
    
    GrpcSecurityHandler instance configured with authentication and authorization
  - authenticate
```
public static GrpcSecurityHandler authenticate()
```
    If called, request will go through authentication process - defaults to false (even if authorize is true).
    Behavior:
    
    Authentication: enabled and required
    
    Authorization: not modified (default: disabled)
    
    Audit: not modified
    Returns:
    
    GrpcSecurityHandler instance
  - audit
```
public static GrpcSecurityHandler audit()
```
    Whether to audit this request - defaults to false for GET and HEAD methods, true otherwise. Request is audited with event type "request".
    Behavior:
    
    Authentication: not modified (default: disabled)
    
    Authorization: not modified (default: disabled)
    
    Audit: enabled for any method this gate is registered on
    Returns:
    
    GrpcSecurityHandler instance
  - authenticator
```
public static GrpcSecurityHandler authenticator(String explicitAuthenticator)
```
    Use a named authenticator (as supported by security - if not defined, default authenticator is used).
    Behavior:
    
    Authentication: enabled and required
    
    Authorization: not modified (default: disabled)
    
    Audit: not modified
    Parameters:
    
    explicitAuthenticator - name of authenticator as configured in Security
    
    Returns:
    
    GrpcSecurityHandler instance
  - authorizer
```
public static GrpcSecurityHandler authorizer(String explicitAuthorizer)
```
    Use a named authorizer (as supported by security - if not defined, default authorizer is used, if none defined, all is permitted).
    Behavior:
    
    Authentication: enabled and required
    
    Authorization: enabled with explicit provider
    
    Audit: not modified
    Parameters:
    
    explicitAuthorizer - name of authorizer as configured in Security
    
    Returns:
    
    GrpcSecurityHandler instance
  - rolesAllowed
```
public static GrpcSecurityHandler rolesAllowed(String... roles)
```
    An array of allowed roles for this path - must have a security provider supporting roles.
    Behavior:
    
    Authentication: enabled and required
    
    Authorization: enabled
    
    Audit: not modified
    Parameters:
    
    roles - if subject is any of these roles, allow access
    
    Returns:
    
    GrpcSecurityHandler instance
  - allowAnonymous
```
public static GrpcSecurityHandler allowAnonymous()
```
    If called, authentication failure will not abort request and will continue as anonymous (defaults to false).
    Behavior:
    
    Authentication: enabled and optional
    
    Authorization: not modified (default: disabled)
    
    Audit: not modified
    Returns:
    
    GrpcSecurityHandler instance
  - authorize
```
public static GrpcSecurityHandler authorize()
```
    Enable authorization for this route.
    Behavior:
    
    Authentication: enabled and required
    
    Authorization: enabled if provider is present
    
    Audit: not modified
    Returns:
    
    GrpcSecurityHandler instance
  - enforce
```
public static GrpcSecurityHandler enforce()
```
    Return a default instance to create a default enforcement point (or modify the result further).
    Behavior:
    
    Authentication: not modified (default: disabled)
    
    Authorization: not modified (default: disabled)
    
    Audit: not modified
    Returns:
    
    GrpcSecurityHandler instance
  - securityDefaults
```
public GrpcSecurity securityDefaults(GrpcSecurityHandler defaultHandler)
```
    Create a new gRPC security instance using the default handler as base defaults for all handlers used. If handlers are loaded from config, than this is the least significant value.
    
    Parameters:
    
    defaultHandler - if a security handler is configured for a route, it will take its defaults from this handler
    
    Returns:
    
    new instance of gRPC security with the handler default
  - configure
```
public void configure(ServiceDescriptor.Rules rules)
```
    If the config field is set then modify the ServiceDescriptor.Rules with any applicable security configuration.
    
    Specified by:
    
    configure in interface ServiceDescriptor.Configurer
    
    Parameters:
    
    rules - the ServiceDescriptor.Rules to modify
  - interceptCall
```
public <ReqT,RespT> io.grpc.ServerCall.Listener<ReqT> interceptCall(io.grpc.ServerCall<ReqT,RespT> call,
                                                                          io.grpc.Metadata headers,
                                                                          io.grpc.ServerCallHandler<ReqT,RespT> next)
```
    Specified by:
    
    interceptCall in interface io.grpc.ServerInterceptor

Class GrpcSecurity

Field Summary

Method Summary

Methods inherited from class java.lang.Object

Field Detail

CONTEXT_ADD_HEADERS

SECURITY_CONTEXT

GRPC_SECURITY_HANDLER

ABAC_ATTRIBUTE_REMOTE_ADDRESS

ABAC_ATTRIBUTE_REMOTE_PORT

ABAC_ATTRIBUTE_HEADERS

ABAC_ATTRIBUTE_METHOD

Method Detail

create

create

create

secure

authenticate

audit

authenticator

authorizer

rolesAllowed

allowAnonymous

authorize

enforce

securityDefaults

configure

interceptCall