Search code examples
rubygrpcgrpc-ruby

Ruby gRPC on insecure channel but with call credentials

Is there a way to configure ruby-grpc to use per-call credentials without ChannelCredentials?

Solution

  • To answer my own question:

    You can pass additional parameters on stub methods. One of them is metadatata: which in turn can take the authorization header.

    Example for Zeebe gRPC client/endpoint (for which i tested this):

    client = Zeebe::Client::GatewayProtocol::Gateway::Stub.new(url, :this_channel_is_insecure)

request = Zeebe::Client::GatewayProtocol::CreateProcessInstanceRequest.new(
      bpmnProcessId: "someprocessid",
      version: -1,
      variables: {}.to_json)
    
token = fetch_token # e.g. keycloak
client.create_process_instance(request, metadata: {"authorization" => "Bearer #{token}"})

    Notes:

    • authorization needs to be lowercase (unlike HTTP Headers this is case sensitive)
    • For Zeebe token is the access_token that you get from Openid