gRPC Authentication — Advanced Patterns with JWT, mTLS, and OAuth2

package main

import (
    "google.golang.org/grpc"
    "google.golang.org/grpc/codes"
    "google.golang.org/grpc/metadata"
    "google.golang.org/grpc/status"
    "github.com/golang-jwt/jwt/v5"
)

type Claims struct {
    jwt.RegisteredClaims
    UserID   string   `json:"user_id"`
    DeviceID string   `json:"device_id"`
    Roles    []string `json:"roles"`
    Tenant   string   `json:"tenant"`
}

func authInterceptor(ctx context.Context,
    req interface{},
    info *grpc.UnaryServerInfo,
    handler grpc.UnaryHandler,
) (interface{}, error) {
    
    // Skip auth for health check
    if info.FullMethod == "/grpc.health.v1.Health/Check" {
        return handler(ctx, req)
    }
    
    md, ok := metadata.FromIncomingContext(ctx)
    if !ok {
        return nil, status.Error(codes.Unauthenticated,
            "missing metadata")
    }
    
    authHeader := md.Get("authorization")
    if len(authHeader) == 0 {
        return nil, status.Error(codes.Unauthenticated,
            "missing authorization header")
    }
    
    token := strings.TrimPrefix(authHeader[0], "Bearer ")
    claims := &Claims{}
    
    parsedToken, err := jwt.ParseWithClaims(token, claims,
        func(token *jwt.Token) (interface{}, error) {
            return publicKey, nil
        })
    
    if err != nil || !parsedToken.Valid {
        return nil, status.Error(codes.Unauthenticated,
            "invalid token")
    }
    
    // Check required role for this method
    requiredRole := getRequiredRole(info.FullMethod)
    if requiredRole != "" && !hasRole(claims.Roles, requiredRole) {
        return nil, status.Error(codes.PermissionDenied,
            "insufficient permissions")
    }
    
    // Inject claims into context for resolvers
    newCtx := context.WithValue(ctx, "claims", claims)
    return handler(newCtx, req)
}

func getRequiredRole(method string) string {
    switch method {
    case "/threat.v1.ThreatService/DeleteThreat":
        return "threat.admin"
    case "/threat.v1.ThreatService/AnalyzeThreat":
        return "threat.analyst"
    default:
        return "threat.reader"
    }
}

import grpc
import ssl

# Server with mTLS
def create_mtls_server():
    with open("server.key") as f:
        private_key = f.read()
    with open("server.crt") as f:
        cert_chain = f.read()
    with open("ca.crt") as f:
        root_certs = f.read()
    
    credentials = grpc.ssl_server_credentials(
        [(private_key, cert_chain)],
        root_certificates=root_certs,
        require_client_auth=True,
    )
    
    server = grpc.server(
        grpc.insecure_server(),
        credentials=credentials,
    )
    return server

# Client with mTLS
def create_mtls_client(address):
    with open("client.key") as f:
        private_key = f.read()
    with open("client.crt") as f:
        cert_chain = f.read()
    with open("ca.crt") as f:
        root_certs = f.read()
    
    credentials = grpc.ssl_channel_credentials(
        root_certificates=root_certs,
        private_key=private_key,
        certificate_chain=cert_chain,
    )
    
    channel = grpc.secure_channel(address, credentials)
    return channel

# Caller identity from mTLS certificate
class CertIdentityInterceptor(ServerInterceptor):
    def intercept(self, method, request, context, method_name):
        # Extract client certificate info
        auth_context = context.auth_context()
        if auth_context:
            client_cert = auth_context.get(
                "x509_client_cert")[0]
            # Extract common name as service identity
            cn = extract_cn(client_cert)
            context.set_identity(cn)
        
        return method(request, context)

const grpc = require('@grpc/grpc-js');
const { OAuth2Client } = require('google-auth-library');

const oauth2Client = new OAuth2Client();

async function validateGoogleToken(token) {
  const ticket = await oauth2Client.verifyIdToken({
    idToken: token,
    audience: 'your-client-id',
  });
  const payload = ticket.getPayload();
  return {
    userId: payload.sub,
    email: payload.email,
    name: payload.name,
  };
}

// Auth interceptor with OAuth2
function oauthInterceptor(method, request, callback, metadata) {
  const authHeader = metadata.get('authorization')[0];
  if (!authHeader) {
    return callback({ code: grpc.status.UNAUTHENTICATED, details: 'No auth' });
  }
  
  const token = authHeader.replace('Bearer ', '');
  
  validateGoogleToken(token)
    .then((user) => {
      // Attach user info to call
      metadata.set('x-user-id', user.userId);
      metadata.set('x-user-email', user.email);
      callback(null, request);
    })
    .catch(() => {
      callback({ code: grpc.status.UNAUTHENTICATED, details: 'Invalid token' });
    });
}

// Combined auth: JWT + mTLS
function multiFactorAuth(req) {
  // Validate JWT
  const user = validateJWT(req.metadata.get('authorization')[0]);
  if (!user) throw new Error('Invalid JWT');
  
  // Validate client certificate
  const cert = req.call.getPeer();
  if (!isAllowedService(cert)) throw new Error('Untrusted certificate');
  
  return user;
}