feat(xds): Implement CheckRequestBuilder for external authorization by sauravzg · Pull Request #12493 · grpc/grpc-java

sauravzg · 2025-11-11T08:33:52Z

This PR sits on top of #12492, so only the last commit + any fixups need to be reviewed.

This commit introduces the CheckRequestBuilder library, which is responsible for constructing the CheckRequest message sent to the external authorization service.

The CheckRequestBuilder gathers information from various sources, including:

ServerCall attributes (local and remote addresses, SSL session).
MethodDescriptor (full method name).
Request headers.

It uses this information to populate the AttributeContext of the CheckRequest message, which provides the authorization service with the necessary context to make an authorization decision.

This commit also introduces the ExtAuthzCertificateProvider, a helper class for extracting certificate information, such as the principal and PEM-encoded certificate.

The relevant section of the spec is: https://github.com/grpc/proposal/pull/481/files#diff-6bb76a24aa142cc33db9218509688f01b30c8885d2fd8849f164244e68cd54eaR196-R250

Unit tests for the new components are also included.

[] feat(xds): Update Envoy proto definitions and add ExtAuthz gRPC service #12491 feat(xds): Update Envoy proto definitions and add ExtAuthz gRPC service
[] xds: Add configuration objects for ExtAuthz, GrpcService and Bootstrap changes for GrpcService #12492 feat(xds): Add configuration objects for ExtAuthz and GrpcService
feat(xds): Implement CheckRequestBuilder for external authorization #12493 feat(xds): Implement request builder for external authorization
[] TBD: PR_LINK feat(xds): Add header mutations library
[] TBD: PR_LINK feat(xds): Implement response handling for external authorization
[] TBD: PR_LINK feat(xds): Add ExtAuthzClientInterceptor and related components
[] TBD: PR_LINK feat(xds): Add ExtAuthzServerInterceptor and tests
[] TBD: PR_LINK feat(xds): Add ExternalAuthorizationFilter

ejona86 · 2025-12-29T21:55:44Z

xds/src/main/java/io/grpc/xds/internal/extauthz/CheckRequestBuilder.java

+/**
+ * Interface for building external authorization check requests.
+ */
+public interface CheckRequestBuilder {


What is the point of this interface existing? It doesn't seem to be for injection. The only time it is used with an implementation other than CheckRequestBuilderImpl seems to be as a mock... that has no calls to it within the tests. So that means it isn't used for verification or for injection of behavior.

The Factory is even more baffling.

Removed. Had a discussion with Kannan on moving the responsibility of injection to the caller instead of the callee which somewhat made sense.

To anwer the question about FooFactory, Foo which will be a recurring pattern in the child PRs.

The idea is analogous to FilterProvider vs Filter.
Inject factories into the FilterProvider, so that when creating the interceptor these factories can return mock instances and so on. The sole advantage being unit test coverage of Interceptor construction.

xds/src/main/java/io/grpc/xds/internal/extauthz/CheckRequestBuilder.java

xds/src/main/java/io/grpc/xds/internal/extauthz/ExtAuthzCertificateProvider.java

ejona86 · 2025-12-29T22:15:47Z

xds/src/main/java/io/grpc/xds/internal/extauthz/ExtAuthzCertificateProvider.java

+          }
+        }
+      } catch (java.security.cert.CertificateParsingException e) {
+        logger.log(Level.WARNING, "Error parsing certificate SANs. " + "This is not expected,"


Remove the unnecessary string concatenation.

Have reduced the log message size. But for my education, what's the correct way to avoid checkstyle errors for long strings without concatenation?

xds/src/main/java/io/grpc/xds/internal/extauthz/ExtAuthzCertificateProvider.java

xds/src/main/java/io/grpc/xds/internal/extauthz/CheckRequestBuilder.java

ejona86 · 2025-12-29T22:49:04Z

xds/src/main/java/io/grpc/xds/internal/extauthz/CheckRequestBuilder.java

+      Iterable<byte[]> binaryValues =
+          headers.getAll(Metadata.Key.of(key, Metadata.BINARY_BYTE_MARSHALLER));
+      if (binaryValues == null) {
+        // Unreachable code, since we iterate over the keys. Exists for defensive programming.


Delete this. It means there is a bug. You've gone out of your way to use Optional for something impossible. If Optional was needed for other reasons such that you'd be reusing the error handling, I could understand it. But there's no point here, and it makes the code more likely to have bugs. Delete the Optional.

Fixed.

But wouldn't best practices dictate to defensively program and not make any assumptions about your caller situation and make sure the method works well in isolation?

There are two cases in which the current function is incorrect in isolation now

A new method decides to call this method without ensuring the key's presence.

We assume "key being present" guarantees non null, which may or may not hold true depending on Metadata's implementation in theory, in which case our assumption is invalid.

This commit introduces configuration objects for the external authorization (ExtAuthz) filter and the gRPC service it uses. These classes provide a structured, immutable representation of the configuration defined in the xDS protobuf messages. The main new classes are: - `ExtAuthzConfig`: Represents the configuration for the `ExtAuthz` filter, including settings for the gRPC service, header mutation rules, and other filter behaviors. - `GrpcServiceConfig`: Represents the configuration for a gRPC service, including the target URI, credentials, and other settings. - `HeaderMutationRulesConfig`: Represents the configuration for header mutation rules. This commit also includes parsers to create these configuration objects from the corresponding protobuf messages, as well as unit tests for the new classes.

sauravzg · 2026-03-12T12:54:09Z

@ejona86 PTAL. I've addressed comments. I think it should be up to spec, but I am slightly worried about

the "certificate extraction" since I am not very familiar with them in general
null safety best practices around stdlib. I don't have a clear understanding of when to null check for standard library calls(socket , ip address etc.) . Without annotations, should I assume everything can return null or guaranteed to be non null?

… the updated requirements

This commit introduces a library for handling header mutations as specified by the xDS protocol. This library provides the core functionality for modifying request and response headers based on a set of rules. The main components of this library are: - `HeaderMutator`: Applies header mutations to `Metadata` objects. - `HeaderMutationFilter`: Filters header mutations based on a set of configurable rules, such as disallowing mutations of system headers. - `HeaderMutations`: A value class that represents the set of mutations to be applied to request and response headers. - `HeaderMutationDisallowedException`: An exception that is thrown when a disallowed header mutation is attempted. This commit also includes comprehensive unit tests for the new library.

…spec

This commit introduces the `CheckRequestBuilder` library, which is responsible for constructing the `CheckRequest` message sent to the external authorization service. The `CheckRequestBuilder` gathers information from various sources, including: - `ServerCall` attributes (local and remote addresses, SSL session). - `MethodDescriptor` (full method name). - Request headers. It uses this information to populate the `AttributeContext` of the `CheckRequest` message, which provides the authorization service with the necessary context to make an authorization decision. This commit also introduces the `ExtAuthzCertificateProvider`, a helper class for extracting certificate information, such as the principal and PEM-encoded certificate. Unit tests for the new components are also included.

sauravzg changed the title ~~Feat/request builder~~ feat(xds): Implement CheckRequestBuilder for external authorization Nov 11, 2025

sauravzg force-pushed the feat/request-builder branch 5 times, most recently from 7b5cd3c to 2d08a46 Compare November 17, 2025 10:36

ejona86 reviewed Dec 29, 2025

View reviewed changes

sauravzg added 2 commits February 2, 2026 05:09

Fixup: Address comments from grpc#12492

5654c64

sauravzg force-pushed the feat/request-builder branch 2 times, most recently from b97c3be to 7afce33 Compare March 12, 2026 12:53

Fixup: 12492 Split HeaderValueValidationUtils to GrpcService to match…

5ed6993

… the updated requirements

sauravzg force-pushed the feat/request-builder branch 2 times, most recently from ad1347d to 5669413 Compare March 12, 2026 19:09

sauravzg added 5 commits March 12, 2026 19:10

feat(xds): Add CachedChannelManager for caching channel instances

d4a7759

Fixup: 12494 address comments and bring back up to updated ext authz …

6961989

…spec

Fixup: Fixed for 12493

0e70dee

sauravzg force-pushed the feat/request-builder branch from 5669413 to 0e70dee Compare March 12, 2026 19:11

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(xds): Implement CheckRequestBuilder for external authorization #12493

feat(xds): Implement CheckRequestBuilder for external authorization #12493
sauravzg wants to merge 8 commits intogrpc:masterfrom
sauravzg:feat/request-builder

sauravzg commented Nov 11, 2025

Uh oh!

ejona86 Dec 29, 2025

Uh oh!

sauravzg Mar 12, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ejona86 Dec 29, 2025

Uh oh!

sauravzg Mar 12, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ejona86 Dec 29, 2025

Uh oh!

sauravzg Mar 12, 2026

Uh oh!

sauravzg commented Mar 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

sauravzg commented Nov 11, 2025

Uh oh!

ejona86 Dec 29, 2025

Choose a reason for hiding this comment

Uh oh!

sauravzg Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ejona86 Dec 29, 2025

Choose a reason for hiding this comment

Uh oh!

sauravzg Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ejona86 Dec 29, 2025

Choose a reason for hiding this comment

Uh oh!

sauravzg Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

sauravzg commented Mar 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants