Add authorization for puppet server to make sure the puppet service consumer is valid

[huan]

To be designed and implemented.

Related PRs:

• Add grpc.default_authority option for authorization #78

Bad news

• Cannot compose insecure credential: combinedChannelCredentials w/ createFromMetadataGenerator + createInsecure grpc/grpc-node#567

Links

• gRPC authenticated channel using custom access token
• Add Authorization with Wechaty gRPC grpc#147

Resources

• https://github.com/grpc/grpc-go/blob/9280052d36656451dd7568a18a836c2a74edaf6c/examples/features/authentication/server/main.go#L96-L100
• https://github.com/grpc-ecosystem/grpc-gateway/blob/a8f25bd1ab549f8b87afd48aa9181221e9d439bb/runtime/context.go#L51
• https://github.com/johanbrandhorst/grpc-auth-example/blob/1990afcec34fef940ab029340e4f1f616cfcb6ce/auth/auth.go#L24
• gRPC Client Authentication: A crash course in different auth methods
• How Unsecure gRPC Implementations Can Compromise APIs

[huan]

What is the grpc.default_authority

• Node.js docs : http2_request_authority
• Should the HTTP/2 :authority header include port number?
• gRPC Name Resolution

From @grpc/grpc-js/url-parser.ts

export function uriToString(uri: GrpcUri): string {
  let result = '';
  if (uri.scheme !== undefined) {
    result += uri.scheme + ':';
  }
  if (uri.authority !== undefined) {
    result += '//' + uri.authority + '/';
  }
  result += uri.path;
  return result;
}

[huan]

gRPC: The "xds" URI scheme does not support any authority

xds Resolver

Clients will enable use of xDS by using the xds resolver in the target URI used to create the gRPC channel. For example, a user may create a channel using the URI "xds:example.com:123" or "xds:///example.com:123", which will use xDS to establish contact with the server "example.com:123". The "xds" URI scheme does not support any authority.

Source: https://github.com/grpc/proposal/blob/master/A27-xds-global-load-balancing.md#xds-resolver

[huan]

Final solution

We finally decided to use the Authorization key in gRPC call metadata with Wechaty: ${TOKEN} to authorize the client, with the SSL enabled.

To be deprecated

We have put the TOKEN to the grpc.default_authority in the previous merged #78 to identify the client.

However, this is not secure and should be deprecated after Dec 31, 2022.

This method will be supported for now as a workaround when the client can not establish an SSL connection.