envoyproxy/envoy

Pass gRPC metadata to ext_authz

Open

#7,272 opened on Jun 14, 2019

View on GitHub
 (2 comments) (11 reactions) (0 assignees)C++ (5,373 forks)batch import
enhancementhelp wanted

Repository metrics

Stars
 (27,997 stars)
PR merge metrics
 (Avg merge 8d) (378 merged PRs in 30d)

Description

Title: Pass gRPC metadata to ext_authz

Description: With current ext_authz filter implementation an external grpc_service receives only subset of request information, such as IPs and TLS details. It would be really helpful to have ability to access gRPC metadata headers as well.

Our current authorization schema is based on metadata fields added to grpc calls. Metadata is checked on server side, and we would like to move it out to Envoy filters.

It seems to be possible for http_service to configure which http headers will be passed to authz service, but nothing like that is configurable for grpc_service type.

Contributor guide

Research direction
Investigate how ext authz filter constructs the CheckRequest for gRPC service and modify it to include gRPC metadata from the original request. Focus on the proto definition and the filter implementation in source/extensions/filters/http/ext authz/.
Tech stack
cppgrpc
Domain
backendsecurityapi
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-2 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Mostly clear
Prerequisites
C++
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
20