permit some services from custom authentication [need help]

I need help with custom authentication

I know we can use metadata and inspectors to support custom authorizations like basic authentication but how we can exclude some services from being authenticated in inspectors.

is there something like @PermitAll in JAX-RS (jersey framework implementation) which we can use and check the destination endpoint has this annotation or not in provider?

[dapengzhang0]

The metadata example does use interceptor together: https://github.com/grpc/grpc-java/tree/master/examples/src/main/java/io/grpc/examples/header

The HeaderServerInterceptor.java in the example synthesizes the response headers, whereas your usecase is to inspect the request headers which is easier than the example. For authentication failure, in ServerInterceptor.interceptCall() method you can probably call

call.close(Status.UNAUTHENTICATED.withDescription("..."), new Metadata());
return next.startCall(call);

[dapengzhang0]

@MetaiR in the grpc library we don’t have out of box high level tools like @PermitAll. Here’s an example using interceptor (with pseudocod needAuthentication(), authnPassed()):

public class AuthenticationServerInterceptor implements ServerInterceptor {
  @Override
  public <ReqT, RespT> ServerCall.Listener<ReqT> interceptCall(
      ServerCall<ReqT, RespT> call,
      Metadata requestHeaders,
      ServerCallHandler<ReqT, RespT> next) {
    String methodName = call.getMethodDescriptor().getFullMethodName();
    if (needAuthentication(methodName) && !authnPassed(requestHeaders)) {
      call.close(Status.UNAUTHENTICATED.withDescription("..."), new Metadata());
    }
    return next.startCall(call);
  }
}