Skip to content
GitLab
Explore
Sign in
Primary navigation
Search or go to…
Project
G
Grpc
Manage
Activity
Members
Labels
Plan
Issues
Issue boards
Milestones
Wiki
Code
Merge requests
Repository
Branches
Commits
Tags
Repository graph
Compare revisions
Snippets
Build
Pipelines
Jobs
Pipeline schedules
Artifacts
Deploy
Releases
Container registry
Model registry
Operate
Environments
Monitor
Incidents
Service Desk
Analyze
Value stream analytics
Contributor analytics
CI/CD analytics
Repository analytics
Model experiments
Help
Help
Support
GitLab documentation
Compare GitLab plans
Community forum
Contribute to GitLab
Provide feedback
Keyboard shortcuts
?
Snippets
Groups
Projects
Show more breadcrumbs
tci-gateway-module
Grpc
Commits
d652a396
Commit
d652a396
authored
9 years ago
by
yang-g
Browse files
Options
Downloads
Patches
Plain Diff
Update auth tests definition
parent
5c4fa0df
No related branches found
No related tags found
No related merge requests found
Changes
1
Hide whitespace changes
Inline
Side-by-side
Showing
1 changed file
doc/interop-test-descriptions.md
+20
-69
20 additions, 69 deletions
doc/interop-test-descriptions.md
with
20 additions
and
69 deletions
doc/interop-test-descriptions.md
+
20
−
69
View file @
d652a396
...
@@ -504,50 +504,6 @@ Client asserts:
...
@@ -504,50 +504,6 @@ Client asserts:
*
clients are free to assert that the response payload body contents are zero
*
clients are free to assert that the response payload body contents are zero
and comparing the entire response message against a golden response
and comparing the entire response message against a golden response
### service_account_creds
This test is only for cloud-to-prod path.
This test verifies unary calls succeed in sending messages while using JWT
signing keys (redeemed for OAuth2 access tokens by the auth implementation)
The test uses
`--service_account_key_file`
with the path to a json key file
downloaded from https://console.developers.google.com, and
`--oauth_scope`
to the oauth scope. For testing against grpc-test.sandbox.google.com,
"https://www.googleapis.com/auth/xapi.zoo" should be passed in
as
`--oauth_scope`
.
Server features:
*
[
UnaryCall
][]
*
[
Compressable Payload
][]
*
[
Echo Authenticated Username
][]
*
[
Echo OAuth Scope
][]
Procedure:
1.
Client configures the channel to use ServiceAccountCredentials
2.
Client calls UnaryCall with:
```
{
response_type: COMPRESSABLE
response_size: 314159
payload:{
body: 271828 bytes of zeros
}
fill_username: true
fill_oauth_scope: true
}
```
Client asserts:
*
call was successful
*
received SimpleResponse.username is in the json key file read from
`--service_account_key_file`
*
received SimpleResponse.oauth_scope is in
`--oauth_scope`
*
response payload body is 314159 bytes in size
*
clients are free to assert that the response payload body contents are zero
and comparing the entire response message against a golden response
### jwt_token_creds
### jwt_token_creds
This test is only for cloud-to-prod path.
This test is only for cloud-to-prod path.
...
@@ -582,30 +538,32 @@ Procedure:
...
@@ -582,30 +538,32 @@ Procedure:
Client asserts:
Client asserts:
*
call was successful
*
call was successful
*
received SimpleResponse.username is in the json key file read from
*
received SimpleResponse.username is not empty and is in the json key file used
`--service_account_key_file`
by the auth library. The client can optionally check the username matches the
email address in the key file.
*
response payload body is 314159 bytes in size
*
response payload body is 314159 bytes in size
*
clients are free to assert that the response payload body contents are zero
*
clients are free to assert that the response payload body contents are zero
and comparing the entire response message against a golden response
and comparing the entire response message against a golden response
### oauth2_auth_token
### oauth2_auth_token
Similar to the other auth tests, t
his test is only for cloud-to-prod path.
T
his test is only for cloud-to-prod path
and runs in GCE only
.
This test verifies unary calls succeed in sending messages using an OAuth2 token
This test verifies unary calls succeed in sending messages using an OAuth2 token
that is obtained out of band. For the purpose of the test, the OAuth2 token is
that is obtained out of band. For the purpose of the test, the OAuth2 token is
actually obtained from
the
service account credentials via the
actually obtained from
a
service account credentials
or GCE credentials
via the
language-specific authorization library.
language-specific authorization library.
The difference between this test and the other auth tests is that rather than
The difference between this test and the other auth tests is that it
configuring the test client with ServiceAccountCredentials directly, the test
first uses the authorization library to obtain an authorization token.
first uses the authorization library to obtain an authorization token.
The test
The test
-
uses the flag
`--service_account_key_file`
with the path to a json key file
-
uses the flag
`--service_account_key_file`
with the path to a json key file
downloaded from https://console.developers.google.com. Alternately, if using a
downloaded from https://console.developers.google.com. Alternately, if using a
usable auth implementation, it may specify the file location in the environment
usable auth implementation, it may specify the file location in the environment
variable GOOGLE_APPLICATION_CREDENTIALS
variable GOOGLE_APPLICATION_CREDENTIALS,
*OR*
if GCE credentials is used to
fetch the token,
`--default_service_account`
can be used to pass in GCE service
account email.
-
uses the flag
`--oauth_scope`
for the oauth scope. For testing against
-
uses the flag
`--oauth_scope`
for the oauth scope. For testing against
grpc-test.sandbox.google.com, "https://www.googleapis.com/auth/xapi.zoo" should
grpc-test.sandbox.google.com, "https://www.googleapis.com/auth/xapi.zoo" should
be passed as the
`--oauth_scope`
.
be passed as the
`--oauth_scope`
.
...
@@ -630,27 +588,23 @@ Procedure:
...
@@ -630,27 +588,23 @@ Procedure:
Client asserts:
Client asserts:
*
call was successful
*
call was successful
*
received SimpleResponse.username is in the json key file used by the auth
*
received SimpleResponse.username is valid. Depending on whether a service
library to obtain the authorization token
account key file or GCE credentials was used, client should check against the
json key file or GCE default service account email.
*
received SimpleResponse.oauth_scope is in
`--oauth_scope`
*
received SimpleResponse.oauth_scope is in
`--oauth_scope`
### per_rpc_creds
### per_rpc_creds
Similar to the other auth tests, this test is only for cloud-to-prod path.
Similar to the other auth tests, this test is only for cloud-to-prod path.
This test verifies unary calls succeed in sending messages using an OAuth2 token
This test verifies unary calls succeed in sending messages using a JWT
that is obtained out of band. For the purpose of the test, the OAuth2 token is
credentials set on the RPC.
actually obtained from the service account credentials via the
language-specific authorization library.
The test
The test
-
uses the flag
`--service_account_key_file`
with the path to a json key file
-
uses the flag
`--service_account_key_file`
with the path to a json key file
downloaded from https://console.developers.google.com. Alternately, if using a
downloaded from https://console.developers.google.com. Alternately, if using a
usable auth implementation, it may specify the file location in the environment
usable auth implementation, it may specify the file location in the environment
variable GOOGLE_APPLICATION_CREDENTIALS
variable GOOGLE_APPLICATION_CREDENTIALS
-
uses the flag
`--oauth_scope`
for the oauth scope. For testing against
grpc-test.sandbox.google.com, "https://www.googleapis.com/auth/xapi.zoo" should
be passed as the
`--oauth_scope`
.
Server features:
Server features:
*
[
UnaryCall
][]
*
[
UnaryCall
][]
...
@@ -659,24 +613,21 @@ Server features:
...
@@ -659,24 +613,21 @@ Server features:
*
[
Echo OAuth Scope
][]
*
[
Echo OAuth Scope
][]
Procedure:
Procedure:
1.
Client uses the auth library to obtain an authorization token
1.
Client configures the channel with just SSL credentials
2.
Client configures the channel with just SSL credentials
2.
Client calls UnaryCall, setting per-call credentials to
3.
Client calls UnaryCall, setting per-call credentials to
JWTTokenCredentials. The request is the following message
AccessTokenCredentials with the access token obtained in step 1. The request
is the following message
```
```
{
{
fill_username: true
fill_username: true
fill_oauth_scope: true
}
}
```
```
Client asserts:
Client asserts:
*
call was successful
*
call was successful
*
received SimpleResponse.username is in the json key file used
by the auth
*
received SimpleResponse.username is
not empty and is
in the json key file used
library to obtain the authorization token
by the auth library. The client can optionally check the username matches the
*
received SimpleResponse.oauth_scope is in
`--oauth_scope`
email address in the key file.
### custom_metadata
### custom_metadata
...
...
This diff is collapsed.
Click to expand it.
Preview
0%
Loading
Try again
or
attach a new file
.
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Save comment
Cancel
Please
register
or
sign in
to comment