Page MenuHomePhabricator
Differential D14465

[identity] Support service-to-service token in auth RPCs
ClosedPublic
Actions

Authored by bartek on Thu, Mar 20, 3:58 AM.
Tags
None
Referenced Files
F5054210: D14465.id47475.diff
Tue, Mar 25, 5:31 AM
F5050640: D14465.id.diff
Tue, Mar 25, 2:36 AM
F5026277: D14465.id47475.diff
Mon, Mar 24, 11:57 AM
Unknown Object (File)
Mon, Mar 24, 8:16 AM
Unknown Object (File)
Sun, Mar 23, 9:56 PM
Subscribers
ashoat

Details

Reviewers
kamil
tomek
Commits
rCOMMa241d420bbb6: [identity] Support service-to-service token in auth RPCs
Summary

To call authenticated RPCs from other services, we have to support providing s2s token.
Modified the interceptor to look for the token, in addition to traditional Auth Metadata (uid + did + csat).

Test Plan

Tested locally, using GUI gRPC client and default localstack-stored service-to-service token.

Diff Detail

Repository
rCOMM Comm
Lint
No Lint Coverage
Unit
No Test Coverage

Event Timeline

bartek created this revision.Thu, Mar 20, 3:58 AM
bartek held this revision as a draft.
Herald added a subscriber: ashoat. · View Herald TranscriptThu, Mar 20, 3:58 AM
bartek added a child revision: D14466: [grpc-clients] Add helpers for services grpc client.Thu, Mar 20, 3:59 AM
Harbormaster completed remote builds in B33771: Diff 47475.Thu, Mar 20, 4:16 AM
bartek published this revision for review.Sun, Mar 23, 11:48 PM
kamil accepted this revision.Mon, Mar 24, 3:13 AM
kamil added inline comments.
services/identity/src/grpc_services/authenticated.rs
101–107

Why are we not using verify_auth_credential here? It seems to be doing the same thing as for AuthorizationCredential::UserToken. Maybe this could make the code simpler.

This revision is now accepted and ready to land.Mon, Mar 24, 3:13 AM
bartek added inline comments.Mon, Mar 24, 6:04 AM
services/identity/src/grpc_services/authenticated.rs
101–107

verify_auth_credential is for non-Identity services. It calls the VerifyUserAccessToken Identity RPC which does this DDB call internally. It would create an unnecessary network call to self.

Closed by commit rCOMMa241d420bbb6: [identity] Support service-to-service token in auth RPCs (authored by bartek). · Explain WhyMon, Mar 24, 6:55 AM
This revision was automatically updated to reflect the committed changes.
bartek added a commit: rCOMMa241d420bbb6: [identity] Support service-to-service token in auth RPCs.

Revision Contents
Changeset List

PathSize
services/
identity/
src/
1 line
grpc_services/
44 lines
10 lines

Diff 47475

View Options

services/identity/src/constants.rs

Show First 20 Lines • Show All 97 Lines • ▼ Show 20 Lines [
identityClient, identityClient,
primaryDeviceRequestedLogOut, primaryDeviceRequestedLogOut,
], ],
); );
} }
function usePeerToPeerMessageHandler(): ( function usePeerToPeerMessageHandler(): (
message: PeerToPeerMessage, message: PeerToPeerMessage,
messageID: string,
) => Promise<void> { ) => Promise<void> {
const { olmAPI, sqliteAPI } = getConfig(); const { olmAPI, sqliteAPI } = getConfig();
const identityContext = React.useContext(IdentityClientContext); const identityContext = React.useContext(IdentityClientContext);
invariant(identityContext, 'Identity context should be set'); invariant(identityContext, 'Identity context should be set');
const { identityClient, getAuthMetadata } = identityContext; const { identityClient, getAuthMetadata } = identityContext;
const foreignPeerDevices = useSelector(getForeignPeerDevices); const foreignPeerDevices = useSelector(getForeignPeerDevices);
const broadcastDeviceListUpdates = useBroadcastDeviceListUpdates(); const broadcastDeviceListUpdates = useBroadcastDeviceListUpdates();
const getAndUpdateDeviceListsForUsers = useGetAndUpdateDeviceListsForUsers(); const getAndUpdateDeviceListsForUsers = useGetAndUpdateDeviceListsForUsers();
const handleOlmMessageToDevice = useHandleOlmMessageToDevice(); const handleOlmMessageToDevice = useHandleOlmMessageToDevice();
return React.useCallback( return React.useCallback(
async (message: PeerToPeerMessage, messageID: string) => { async (message: PeerToPeerMessage) => {
if (message.type === peerToPeerMessageTypes.OUTBOUND_SESSION_CREATION) { if (message.type === peerToPeerMessageTypes.OUTBOUND_SESSION_CREATION) {
const { senderInfo, encryptedData, sessionVersion } = message; const { senderInfo, encryptedData, sessionVersion } = message;
const { userID: senderUserID, deviceID: senderDeviceID } = senderInfo; const { userID: senderUserID, deviceID: senderDeviceID } = senderInfo;
let deviceKeys: ?DeviceOlmInboundKeys = null; let deviceKeys: ?DeviceOlmInboundKeys = null;
try { try {
const { keys } = const { keys } =
await identityClient.getInboundKeysForUser(senderUserID); await identityClient.getInboundKeysForUser(senderUserID);
▲ Show 20 Lines • Show All 59 Lines • ▼ Show 20 Lines async (message: PeerToPeerMessage) => {
`${senderDeviceID}: ${e.message}, ` + `${senderDeviceID}: ${e.message}, ` +
`session version: ${sessionVersion}`, `session version: ${sessionVersion}`,
); );
} }
} }
} else if (message.type === peerToPeerMessageTypes.ENCRYPTED_MESSAGE) { } else if (message.type === peerToPeerMessageTypes.ENCRYPTED_MESSAGE) {
try { try {
await olmAPI.initializeCryptoAccount(); await olmAPI.initializeCryptoAccount();
const decrypted = await olmAPI.decryptSequentialAndPersist( const decrypted = await olmAPI.decrypt(
message.encryptedData, message.encryptedData,
message.senderInfo.deviceID, message.senderInfo.deviceID,
messageID,
); );
console.log( console.log(
'Decrypted message from device ' + 'Decrypted message from device ' +
`${message.senderInfo.deviceID}: ${decrypted}`, `${message.senderInfo.deviceID}: ${decrypted}`,
); );
try { try {
await handleOlmMessageToDevice(decrypted, message.senderInfo); await handleOlmMessageToDevice(decrypted, message.senderInfo);
▲ Show 20 Lines • Show All 119 Lines • Show Last 20 Lines
View Options

services/identity/src/grpc_services/authenticated.rs

Show First 20 Lines • Show All 97 Lines • ▼ Show 20 Lines [
identityClient, identityClient,
primaryDeviceRequestedLogOut, primaryDeviceRequestedLogOut,
], ],
); );
} }
function usePeerToPeerMessageHandler(): ( function usePeerToPeerMessageHandler(): (
message: PeerToPeerMessage, message: PeerToPeerMessage,
messageID: string,
) => Promise<void> { ) => Promise<void> {
const { olmAPI, sqliteAPI } = getConfig(); const { olmAPI, sqliteAPI } = getConfig();
const identityContext = React.useContext(IdentityClientContext); const identityContext = React.useContext(IdentityClientContext);
invariant(identityContext, 'Identity context should be set'); invariant(identityContext, 'Identity context should be set');
const { identityClient, getAuthMetadata } = identityContext; const { identityClient, getAuthMetadata } = identityContext;
const foreignPeerDevices = useSelector(getForeignPeerDevices); const foreignPeerDevices = useSelector(getForeignPeerDevices);
const broadcastDeviceListUpdates = useBroadcastDeviceListUpdates(); const broadcastDeviceListUpdates = useBroadcastDeviceListUpdates();
const getAndUpdateDeviceListsForUsers = useGetAndUpdateDeviceListsForUsers(); const getAndUpdateDeviceListsForUsers = useGetAndUpdateDeviceListsForUsers();
const handleOlmMessageToDevice = useHandleOlmMessageToDevice(); const handleOlmMessageToDevice = useHandleOlmMessageToDevice();
return React.useCallback( return React.useCallback(
async (message: PeerToPeerMessage, messageID: string) => { async (message: PeerToPeerMessage) => {
if (message.type === peerToPeerMessageTypes.OUTBOUND_SESSION_CREATION) { if (message.type === peerToPeerMessageTypes.OUTBOUND_SESSION_CREATION) {
const { senderInfo, encryptedData, sessionVersion } = message; const { senderInfo, encryptedData, sessionVersion } = message;
const { userID: senderUserID, deviceID: senderDeviceID } = senderInfo; const { userID: senderUserID, deviceID: senderDeviceID } = senderInfo;
let deviceKeys: ?DeviceOlmInboundKeys = null; let deviceKeys: ?DeviceOlmInboundKeys = null;
try { try {
const { keys } = const { keys } =
await identityClient.getInboundKeysForUser(senderUserID); await identityClient.getInboundKeysForUser(senderUserID);
▲ Show 20 Lines • Show All 59 Lines • ▼ Show 20 Lines async (message: PeerToPeerMessage) => {
`${senderDeviceID}: ${e.message}, ` + `${senderDeviceID}: ${e.message}, ` +
`session version: ${sessionVersion}`, `session version: ${sessionVersion}`,
); );
} }
} }
} else if (message.type === peerToPeerMessageTypes.ENCRYPTED_MESSAGE) { } else if (message.type === peerToPeerMessageTypes.ENCRYPTED_MESSAGE) {
try { try {
await olmAPI.initializeCryptoAccount(); await olmAPI.initializeCryptoAccount();
const decrypted = await olmAPI.decryptSequentialAndPersist( const decrypted = await olmAPI.decrypt(
message.encryptedData, message.encryptedData,
message.senderInfo.deviceID, message.senderInfo.deviceID,
messageID,
); );
console.log( console.log(
'Decrypted message from device ' + 'Decrypted message from device ' +
`${message.senderInfo.deviceID}: ${decrypted}`, `${message.senderInfo.deviceID}: ${decrypted}`,
); );
try { try {
await handleOlmMessageToDevice(decrypted, message.senderInfo); await handleOlmMessageToDevice(decrypted, message.senderInfo);
▲ Show 20 Lines • Show All 119 Lines • Show Last 20 Lines
View Options

services/identity/src/main.rs

Show First 20 Lines • Show All 97 Lines • ▼ Show 20 Lines [
identityClient, identityClient,
primaryDeviceRequestedLogOut, primaryDeviceRequestedLogOut,
], ],
); );
} }
function usePeerToPeerMessageHandler(): ( function usePeerToPeerMessageHandler(): (
message: PeerToPeerMessage, message: PeerToPeerMessage,
messageID: string,
) => Promise<void> { ) => Promise<void> {
const { olmAPI, sqliteAPI } = getConfig(); const { olmAPI, sqliteAPI } = getConfig();
const identityContext = React.useContext(IdentityClientContext); const identityContext = React.useContext(IdentityClientContext);
invariant(identityContext, 'Identity context should be set'); invariant(identityContext, 'Identity context should be set');
const { identityClient, getAuthMetadata } = identityContext; const { identityClient, getAuthMetadata } = identityContext;
const foreignPeerDevices = useSelector(getForeignPeerDevices); const foreignPeerDevices = useSelector(getForeignPeerDevices);
const broadcastDeviceListUpdates = useBroadcastDeviceListUpdates(); const broadcastDeviceListUpdates = useBroadcastDeviceListUpdates();
const getAndUpdateDeviceListsForUsers = useGetAndUpdateDeviceListsForUsers(); const getAndUpdateDeviceListsForUsers = useGetAndUpdateDeviceListsForUsers();
const handleOlmMessageToDevice = useHandleOlmMessageToDevice(); const handleOlmMessageToDevice = useHandleOlmMessageToDevice();
return React.useCallback( return React.useCallback(
async (message: PeerToPeerMessage, messageID: string) => { async (message: PeerToPeerMessage) => {
if (message.type === peerToPeerMessageTypes.OUTBOUND_SESSION_CREATION) { if (message.type === peerToPeerMessageTypes.OUTBOUND_SESSION_CREATION) {
const { senderInfo, encryptedData, sessionVersion } = message; const { senderInfo, encryptedData, sessionVersion } = message;
const { userID: senderUserID, deviceID: senderDeviceID } = senderInfo; const { userID: senderUserID, deviceID: senderDeviceID } = senderInfo;
let deviceKeys: ?DeviceOlmInboundKeys = null; let deviceKeys: ?DeviceOlmInboundKeys = null;
try { try {
const { keys } = const { keys } =
await identityClient.getInboundKeysForUser(senderUserID); await identityClient.getInboundKeysForUser(senderUserID);
▲ Show 20 Lines • Show All 59 Lines • ▼ Show 20 Lines async (message: PeerToPeerMessage) => {
`${senderDeviceID}: ${e.message}, ` + `${senderDeviceID}: ${e.message}, ` +
`session version: ${sessionVersion}`, `session version: ${sessionVersion}`,
); );
} }
} }
} else if (message.type === peerToPeerMessageTypes.ENCRYPTED_MESSAGE) { } else if (message.type === peerToPeerMessageTypes.ENCRYPTED_MESSAGE) {
try { try {
await olmAPI.initializeCryptoAccount(); await olmAPI.initializeCryptoAccount();
const decrypted = await olmAPI.decryptSequentialAndPersist( const decrypted = await olmAPI.decrypt(
message.encryptedData, message.encryptedData,
message.senderInfo.deviceID, message.senderInfo.deviceID,
messageID,
); );
console.log( console.log(
'Decrypted message from device ' + 'Decrypted message from device ' +
`${message.senderInfo.deviceID}: ${decrypted}`, `${message.senderInfo.deviceID}: ${decrypted}`,
); );
try { try {
await handleOlmMessageToDevice(decrypted, message.senderInfo); await handleOlmMessageToDevice(decrypted, message.senderInfo);
▲ Show 20 Lines • Show All 119 Lines • Show Last 20 Lines