{"id":329555,"date":"2024-05-28T20:43:55","date_gmt":"2024-05-28T20:43:55","guid":{"rendered":"https:\/\/www.baeldung.com\/?p=182078"},"modified":"2024-05-28T20:43:55","modified_gmt":"2024-05-28T20:43:55","slug":"grpc-authentication-in-java-using-application-layer-transport-security-alts","status":"publish","type":"post","link":"https:\/\/itteacheritfreelance.hk\/wordpress\/index.php\/2024\/05\/28\/grpc-authentication-in-java-using-application-layer-transport-security-alts\/","title":{"rendered":"gRPC Authentication in Java Using Application Layer Transport Security (ALTS)"},"content":{"rendered":"

<\/p>\n

\"start<\/p>\n

1.\u00a0 Overview<\/h2>\n
<\/div>\n

In this tutorial, we’ll explore the role of ALTS (Application Layer Transport Security)<\/a> in gRPC<\/a> applications. As we know, ensuring authentication and data security is difficult but essential in a distributed architecture.<\/p>\n

ALTS is a custom built-in mutual authentication and transport encryption solution from Google that is available exclusively in Google’s cloud infrastructure. ALTS simplifies authentication and data encryption between gRPC services and can be enabled with minimal code changes. Hence, it’s popular among developers as they can focus more on writing business logic.<\/p>\n

2. Key Differences Between ALTS and TLS<\/h2>\n
<\/div>\n

ALTS is similar to TLS<\/a> but has a different trust model optimized for Google’s infrastructure.<\/strong> Let’s quickly take a look at the key differences between them:<\/p>\n\n\n\n\n\n\n\n\n\n
Features<\/th>\nALTS<\/th>\nTLS<\/th>\n<\/tr>\n<\/thead>\n
Trust Model<\/td>\nIdentity-based relying on GCP IAM Service Accounts<\/td>\nCertificate-based, requires certificate management, including renewal and revocation<\/td>\n<\/tr>\n
Design<\/td>\nSimpler<\/td>\nComplex<\/td>\n<\/tr>\n
Usage Context<\/td>\nUsed for securing gRPC services running on Google data centers<\/td>\nUsed for securing Web browsing (HTTPS), email, instant messaging, VoIP, etc.<\/td>\n<\/tr>\n
Message Serialization<\/td>\nUses Protocol Buffers<\/td>\nUses X.509 certificates encoded with ASN.1<\/td>\n<\/tr>\n
Performance<\/td>\nDesigned for general use<\/td>\nOptimized for low-latency, high-throughput communications in Google\u2019s data centers<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

3. Sample Application Using ALTS<\/h2>\n
<\/div>\n

The ALTS feature is enabled by default on the Google Cloud Platform (GCP). It uses GCP service accounts<\/a> to secure RPC calls between gRPC services.<\/strong> Specifically, it runs on Google Compute Engine<\/a> or Kubernetes Engine (GKE)<\/a> within Google’s infrastructure.<\/p>\n

Let’s assume there’s an Operation Theater (OT) booking system in a hospital that consists of a front-end and a backend service:<\/p>\n

\"\"<\/a><\/p>\n

The OT Booking system comprises two services running in the Google Cloud Platform (GCP). A front-end service makes remote procedure calls to the backend service. We’ll develop the services using the gRPC framework. Considering the sensitive nature of the data, we’ll utilize the built-in ALTS feature in GCP to enable authentication and encryption for the transit data.<\/p>\n

First, let’s define the protobuf<\/a> ot_booking.proto<\/em> file:<\/p>\n

syntax = "proto3";\r\npackage otbooking;\r\noption java_multiple_files = true;\r\noption java_package = "com.baeldung.grpc.alts.otbooking";\r\nservice OtBookingService {\r\n  rpc getBookingInfo(BookingRequest) returns (BookingResponse) {}\r\n}\r\nmessage BookingRequest {\r\n  string patientID = 1;\r\n  string doctorID = 2;\r\n  string description = 3;\r\n}\r\nmessage BookingResponse {\r\n  string bookingDate = 1;\r\n  string condition = 2;\r\n}<\/code><\/pre>\n
Basically, we declared a service OtBookingService<\/em> with the RPC getBookingInfo()<\/em>, and two DTOs BookingRequest<\/em> and BookingResponse<\/em> in the protobuf file.<\/p>\n
Next, let’s have a look at the important classes of this application:<\/p>\n
 <\/p>\n
\"\"<\/a><\/p>\n
The Maven<\/a> plugin compiles the protobuf file and auto-generates some classes such as OtBookingServiceGrpc<\/em>, OtBookingServiceImplBase<\/em>, BookingRequest,<\/em> and BookingResponse<\/em>. We’ll use the gRPC library class AltsChannelBuilder<\/em><\/a> to enable ALTS to create the ManagedChannel<\/em><\/a> object on the client side<\/strong>. Finally, we’ll use OtBookingServiceGrpc<\/em> to generate the OtBookingServiceBlockingStub<\/em> to call the RPC getBookingInfo()<\/em> method running on the server side.<\/p>\n
Like AltsChannelBuilder<\/em>,<\/strong> the AltsServerBuilder<\/em><\/a> class helps enable ALTS on the server side. We register the interceptor ClientAuthInterceptor<\/em> to help authenticate the client<\/strong>. Finally, we register the OtBookingService<\/em> to the io.grpc.Server<\/em><\/a> object and then start the service.<\/p>\n
Furthermore, we’ll discuss the implementation in the next section.<\/p>\n
4. Application Implementation Using ALTS<\/h2>\n
<\/div>\n
Let’s implement the classes we discussed earlier. Then, we’ll demonstrate by running the services on the GCP virtual machines.<\/p>\n
4.1. Prerequisite<\/h3>\n
<\/div>\n
Since ALTS is a built-in feature in GCP, we’ll have to provision a few cloud resources for running the sample application.<\/p>\n
First, we’ll create two IAM service accounts to associate them with the front-end and back-end servers respectively:<\/p>\n
 <\/p>\n
\"\"<\/a><\/p>\n
Then, we’ll create two virtual machines hosting the front-end and back-end services respectively:<\/p>\n
\"\"<\/a><\/p>\n
The virtual machine prod-booking-client-vm<\/em> is associated with prod-ot-booking-client-svc<\/em> service account. Similarly, prod-booking-service-vm<\/em> is associated with prod-ot-booking-svc<\/em> service account. The service accounts serve as the servers’ identities and ALTS uses them for authorization and encryption.<\/p>\n
4.2. Implementation<\/h3>\n
<\/div>\n
Let’s first start with an entry into the pom.xml<\/em> file to resolve the Maven dependency<\/a>:<\/p>\n
<dependency>\r\n    <groupId>io.grpc<\/groupId>\r\n    <artifactId>grpc-alts<\/artifactId>\r\n    <version>1.63.0<\/version>\r\n<\/dependency><\/code><\/pre>\n
Then, we’ll implement the backend, starting with the AltsBookingServer<\/em> class:<\/p>\n
public class AltsOtBookingServer {\r\n    public static void main(String[] args) throws IOException, InterruptedException {\r\n        final String CLIENT_SERVICE_ACCOUNT = args[0];\r\n        Server server = AltsServerBuilder.forPort(8080)\r\n          .intercept(new ClientAuthInterceptor(CLIENT_SERVICE_ACCOUNT))\r\n          .addService(new OtBookingService())\r\n          .build();\r\n        server.start();\r\n        server.awaitTermination();\r\n    }\r\n}<\/code><\/pre>\n
gRPC provides a special class AltsServerBuilder<\/em> for configuring the server in ALTS mode. We’ve registered the ClientAuthInterceptor<\/em> on the server to intercept all the RPCs before they hit the endpoints in the OtBookingService<\/em> class.<\/p>\n
Let’s take a look at the ClientAuthInterceptor<\/em> class:<\/p>\n
public class ClientAuthInterceptor implements ServerInterceptor {\r\n    String clientServiceAccount = null;\r\n    public ClientAuthInterceptor(String clientServiceAccount) {\r\n        this.clientServiceAccount = clientServiceAccount;\r\n    }\r\n    @Override\r\n    public <ReqT, RespT> ServerCall.Listener<ReqT> interceptCall(ServerCall<ReqT, RespT> serverCall, Metadata metadata,\r\n        ServerCallHandler<ReqT, RespT> serverCallHandler) {\r\n        Status status = AuthorizationUtil.clientAuthorizationCheck(serverCall,\r\n            Lists.newArrayList(this.clientServiceAccount));\r\n        if (!status.isOk()) {\r\n            serverCall.close(status, new Metadata());\r\n        }\r\n        return serverCallHandler.startCall(serverCall, metadata);\r\n    }\r\n}<\/code><\/pre>\n
All the RPCs hit the intercept()<\/em> method in ClientAuthInterceptor<\/em>. Then, we invoke the clientAuthorizationCheck()<\/em> method of the gRPC library class AuthorizationUtil<\/em> to authorize the client service account. Finally, the RPC moves further only when the authorization is successful.<\/p>\n
Next, let’s take a look at the front-end service:<\/p>\n
public class AltsOtBookingClient {\r\n    public static void main(String[] args) {\r\n        final String SERVER_ADDRESS = args[0];\r\n        final String SERVER_ADDRESS_SERVICE_ACCOUNT = args[1];\r\n        ManagedChannel managedChannel = AltsChannelBuilder.forTarget(SERVER_ADDRESS)\r\n          .addTargetServiceAccount(SERVER_ADDRESS_SERVICE_ACCOUNT)\r\n          .build();\r\n        OtBookingServiceGrpc.OtBookingServiceBlockingStub OTBookingServiceStub = OtBookingServiceGrpc\r\n          .newBlockingStub(managedChannel);\r\n        BookingResponse bookingResponse = OTBookingServiceStub.getBookingInfo(BookingRequest.newBuilder()\r\n          .setPatientID("PT-1204")\r\n          .setDoctorID("DC-3904")\r\n          .build());\r\n        managedChannel.shutdown();\r\n    }\r\n}<\/code><\/pre>\n
Similar to AltsServerBuilder<\/em>, gRPC offers an AltsChannelBuilder<\/em> class for enabling ALTS on the client side. We can call the addTargetServiceAccount()<\/em> method multiple times to add more than one potential target service account. Further, we initiate the RPC by calling the getBookingInfo()<\/em> method on the stub.<\/p>\n
The same service account can be associated with multiple virtual machines. Hence, it provides a certain degree of flexibility and agility to scale the services horizontally.<\/strong><\/p>\n
4.3. Run on Google Compute Engine<\/h3>\n
<\/div>\n
Let’s login to both servers and then clone the GitHub repository hosting the source code of the demo gRPC service:<\/p>\n
git clone https:\/\/github.com\/eugenp\/tutorials.git<\/code><\/pre>\n
After cloning, we’ll compile the code in the tutorials\/grpc<\/em> directory:<\/p>\n
mvn clean compile<\/code><\/pre>\n
Post successful compilation, we’ll start the backend service in prod-booking-service-vm<\/em>:<\/p>\n
mvn exec: java -Dexec.mainClass="com.baeldung.grpc.alts.server.AltsOtBookingServer" \\\r\n-Dexec.arguments="prod-ot-booking-client-svc@grpc-alts-demo.iam.gserviceaccount.com"<\/code><\/pre>\n
We ran the AltsOtBookingServer<\/em> class with the service account of the front-end client as an argument.<\/p>\n
Once the service is up and running, we’ll initiate an RPC from the front-end service running on the virtual machine prod-booking-client-vm<\/em>:<\/p>\n
mvn exec:java -Dexec.mainClass="com.baeldung.grpc.alts.client.AltsOtBookingClient" \\\r\n-Dexec.arguments="10.128.0.2:8080,prod-ot-booking-svc@grpc-alts-demo.iam.gserviceaccount.com"<\/code><\/pre>\n
We ran the AltsOtBookingClient<\/em> class with two arguments. The first argument is the target server where the backend service is running and the second is the service account associated with the backend server.<\/p>\n
The command runs successfully and the service returns a response after authenticating the client:<\/p>\n
\"\"<\/a><\/p>\n
Let’s suppose we disable the client service account:<\/p>\n
\"\"<\/a><\/p>\n
As a result, the ALTS prevents the RPC from reaching the backend service:<\/p>\n
\"\"<\/a><\/p>\n
The RPC fails with the status UNAVAILABLE<\/em>.<\/p>\n
Now, let’s disable the service account of the backend server:<\/p>\n
\"\"<\/a><\/p>\n
Surprisingly, the RPC goes through but after restarting the servers it fails like the earlier scenario:<\/p>\n
\"\"<\/a><\/p>\n
It seems that ALTS was caching the service account status earlier, but after the server restart, the RPC failed with the status UNKNOWN<\/em><\/strong>.<\/p>\n
5. Conclusion<\/h2>\n
<\/div>\n
In this article, we delved into the gRPC Java library supporting ALTS. With minimal code, ALTS can be enabled in gRPC services. It also provides greater flexibility in controlling the authorization of gRPC services with the help of GCP IAM service accounts.<\/p>\n
However, it works only in GCP infrastructure as it’s provided out of the box. Hence, to run gRPC services outside of GCP infrastructure, TLS support in gRPC is crucial and must be manually configured.<\/strong><\/p>\n
As usual, the code used here is available over on GitHub<\/a>.<\/p>\n
\"\"<\/p>\n
<\/a> <\/a> <\/a> <\/a> <\/a> <\/a> <\/a> <\/div>\n\n
\\\"IT\u96fb\u8166\u88dc\u7fd2
\u7acb\u523b\u8a3b\u518a\u53ca\u5831\u540d\u96fb\u8166\u88dc\u7fd2\u8ab2\u7a0b\u5427!<\/figcaption><\/figure>\r\n<\/br>Find A Teacher Form:\r\n<\/br>https:\/\/docs.google.com\/forms\/d\/1vREBnX5n262umf4wU5U2pyTwvk9O-JrAgblA-wH9GFQ\/viewform?edit_requested=true#responses\r\n<\/br><\/br>Email:\r\n<\/br>public1989two@gmail.com






\r\nwww.itsec.hk<\/a>
\r\nwww.itsec.vip<\/a>
\r\nwww.itseceu.uk<\/a>
<\/p>","protected":false},"excerpt":{"rendered":"
\"start<\/p>\n
Explore the role of ALTS (Application Layer Transport Security) in gRPC applications.<\/p>\n
<\/a>\u00a0<\/a>\u00a0<\/a>\u00a0<\/a>\u00a0<\/a>\u00a0<\/a>\u00a0<\/a>\u00a0<\/div>\n<\/div>","protected":false},"author":2057,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"slim_seo":{"title":"gRPC Authentication in Java Using Application Layer Transport Security (ALTS) - ITTeacherITFreelance.hk","description":"Explore the role of ALTS (Application Layer Transport Security) in gRPC applications. \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0"},"footnotes":""},"categories":[6,1307],"tags":[10799],"_links":{"self":[{"href":"https:\/\/itteacheritfreelance.hk\/wordpress\/index.php\/wp-json\/wp\/v2\/posts\/329555"}],"collection":[{"href":"https:\/\/itteacheritfreelance.hk\/wordpress\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/itteacheritfreelance.hk\/wordpress\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/itteacheritfreelance.hk\/wordpress\/index.php\/wp-json\/wp\/v2\/users\/2057"}],"replies":[{"embeddable":true,"href":"https:\/\/itteacheritfreelance.hk\/wordpress\/index.php\/wp-json\/wp\/v2\/comments?post=329555"}],"version-history":[{"count":1,"href":"https:\/\/itteacheritfreelance.hk\/wordpress\/index.php\/wp-json\/wp\/v2\/posts\/329555\/revisions"}],"predecessor-version":[{"id":329556,"href":"https:\/\/itteacheritfreelance.hk\/wordpress\/index.php\/wp-json\/wp\/v2\/posts\/329555\/revisions\/329556"}],"wp:attachment":[{"href":"https:\/\/itteacheritfreelance.hk\/wordpress\/index.php\/wp-json\/wp\/v2\/media?parent=329555"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/itteacheritfreelance.hk\/wordpress\/index.php\/wp-json\/wp\/v2\/categories?post=329555"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/itteacheritfreelance.hk\/wordpress\/index.php\/wp-json\/wp\/v2\/tags?post=329555"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}