diff --git a/src/core/lib/security/credentials/composite/composite_credentials.c b/src/core/lib/security/credentials/composite/composite_credentials.c
index 850e41e6460b41bfc40251fd7606281fbc781c8c..d55d00b7b6638c25fff68cd406c3c56aa0312382 100644
--- a/src/core/lib/security/credentials/composite/composite_credentials.c
+++ b/src/core/lib/security/credentials/composite/composite_credentials.c
@@ -242,8 +242,17 @@ static grpc_security_status composite_channel_create_security_connector(
return status;
}
+static grpc_channel_credentials *
+composite_channel_duplicate_without_call_credentials(
+ grpc_channel_credentials *creds) {
+ grpc_composite_channel_credentials *c =
+ (grpc_composite_channel_credentials *)creds;
+ return grpc_channel_credentials_ref(c->inner_creds);
+}
+
static grpc_channel_credentials_vtable composite_channel_credentials_vtable = {
- composite_channel_destruct, composite_channel_create_security_connector};
+ composite_channel_destruct, composite_channel_create_security_connector,
+ composite_channel_duplicate_without_call_credentials};
grpc_channel_credentials *grpc_composite_channel_credentials_create(
grpc_channel_credentials *channel_creds, grpc_call_credentials *call_creds,
diff --git a/src/core/lib/security/credentials/composite/composite_credentials.h b/src/core/lib/security/credentials/composite/composite_credentials.h
index 0d8966f464d331c795f0e31eab4f3916b5a59bc9..f8425c2b765042c4c1a6bdcfd0dcd06cf0a66c8c 100644
--- a/src/core/lib/security/credentials/composite/composite_credentials.h
+++ b/src/core/lib/security/credentials/composite/composite_credentials.h
@@ -53,7 +53,7 @@ grpc_call_credentials *grpc_credentials_contains_type(
grpc_call_credentials *creds, const char *type,
grpc_call_credentials **composite_creds);
-/* -- Channel composite credentials. -- */
+/* -- Composite channel credentials. -- */
typedef struct {
grpc_channel_credentials base;
@@ -61,7 +61,7 @@ typedef struct {
grpc_call_credentials *call_creds;
} grpc_composite_channel_credentials;
-/* -- Composite credentials. -- */
+/* -- Composite call credentials. -- */
typedef struct {
grpc_call_credentials base;
diff --git a/src/core/lib/security/credentials/credentials.c b/src/core/lib/security/credentials/credentials.c
index 029a357261644dbf001078992ad10d47cda440f0..1149e5c2edb012b81205ce271a1115196c7775c0 100644
--- a/src/core/lib/security/credentials/credentials.c
+++ b/src/core/lib/security/credentials/credentials.c
@@ -138,6 +138,18 @@ grpc_security_status grpc_channel_credentials_create_security_connector(
channel_creds, NULL, target, args, sc, new_args);
}
+grpc_channel_credentials *
+grpc_channel_credentials_duplicate_without_call_credentials(
+ grpc_channel_credentials *channel_creds) {
+ if (channel_creds != NULL && channel_creds->vtable != NULL &&
+ channel_creds->vtable->duplicate_without_call_credentials != NULL) {
+ return channel_creds->vtable->duplicate_without_call_credentials(
+ channel_creds);
+ } else {
+ return grpc_channel_credentials_ref(channel_creds);
+ }
+}
+
grpc_server_credentials *grpc_server_credentials_ref(
grpc_server_credentials *creds) {
if (creds == NULL) return NULL;
diff --git a/src/core/lib/security/credentials/credentials.h b/src/core/lib/security/credentials/credentials.h
index 8e9d842eaddddcc483625a2d41c892b135a2842a..6fb5b5b15ad8dd748d2ef13db23f81b0acc0bef0 100644
--- a/src/core/lib/security/credentials/credentials.h
+++ b/src/core/lib/security/credentials/credentials.h
@@ -107,6 +107,9 @@ typedef struct {
grpc_channel_credentials *c, grpc_call_credentials *call_creds,
const char *target, const grpc_channel_args *args,
grpc_channel_security_connector **sc, grpc_channel_args **new_args);
+
+ grpc_channel_credentials *(*duplicate_without_call_credentials)(
+ grpc_channel_credentials *c);
} grpc_channel_credentials_vtable;
struct grpc_channel_credentials {
@@ -128,6 +131,13 @@ grpc_security_status grpc_channel_credentials_create_security_connector(
const grpc_channel_args *args, grpc_channel_security_connector **sc,
grpc_channel_args **new_args);
+/* Creates a version of the channel credentials without any attached call
+ credentials. This can be used in order to open a channel to a non-trusted
+ gRPC load balancer. */
+grpc_channel_credentials *
+grpc_channel_credentials_duplicate_without_call_credentials(
+ grpc_channel_credentials *creds);
+
/* --- grpc_credentials_md. --- */
typedef struct {
diff --git a/src/core/lib/security/credentials/fake/fake_credentials.c b/src/core/lib/security/credentials/fake/fake_credentials.c
index 51cafd986fb89f6196e4d01d123786c4f2d48956..ea4cb76fb99f3fa3e464865bedd7dc899c0cc133 100644
--- a/src/core/lib/security/credentials/fake/fake_credentials.c
+++ b/src/core/lib/security/credentials/fake/fake_credentials.c
@@ -61,7 +61,7 @@ fake_transport_security_server_create_security_connector(
static grpc_channel_credentials_vtable
fake_transport_security_credentials_vtable = {
- NULL, fake_transport_security_create_security_connector};
+ NULL, fake_transport_security_create_security_connector, NULL};
static grpc_server_credentials_vtable
fake_transport_security_server_credentials_vtable = {
diff --git a/src/core/lib/security/credentials/ssl/ssl_credentials.c b/src/core/lib/security/credentials/ssl/ssl_credentials.c
index 545bca9d98b6886bfc5f506bb27eba91e8622183..0dc1fccec4a76b7f9cc772a8c2d6282ed634caaa 100644
--- a/src/core/lib/security/credentials/ssl/ssl_credentials.c
+++ b/src/core/lib/security/credentials/ssl/ssl_credentials.c
@@ -95,7 +95,7 @@ static grpc_security_status ssl_create_security_connector(
}
static grpc_channel_credentials_vtable ssl_vtable = {
- ssl_destruct, ssl_create_security_connector};
+ ssl_destruct, ssl_create_security_connector, NULL};
static void ssl_build_config(const char *pem_root_certs,
grpc_ssl_pem_key_cert_pair *pem_key_cert_pair,
diff --git a/test/core/security/credentials_test.c b/test/core/security/credentials_test.c
index 7043953154ae0515f19981e5d336b2af62b5e2ee..2f8ffe4da64f2711245b6ce45d4756ef2c6c9e6a 100644
--- a/test/core/security/credentials_test.c
+++ b/test/core/security/credentials_test.c
@@ -46,6 +46,7 @@
#include "src/core/lib/http/httpcli.h"
#include "src/core/lib/security/credentials/composite/composite_credentials.h"
+#include "src/core/lib/security/credentials/fake/fake_credentials.h"
#include "src/core/lib/security/credentials/google_default/google_default_credentials.h"
#include "src/core/lib/security/credentials/jwt/jwt_credentials.h"
#include "src/core/lib/security/credentials/oauth2/oauth2_credentials.h"
@@ -411,7 +412,7 @@ static grpc_security_status check_channel_oauth2_create_security_connector(
static void test_channel_oauth2_composite_creds(void) {
grpc_channel_args *new_args;
grpc_channel_credentials_vtable vtable = {
- NULL, check_channel_oauth2_create_security_connector};
+ NULL, check_channel_oauth2_create_security_connector, NULL};
grpc_channel_credentials *channel_creds =
grpc_mock_channel_credentials_create(&vtable);
grpc_call_credentials *oauth2_creds =
@@ -495,7 +496,7 @@ check_channel_oauth2_google_iam_create_security_connector(
static void test_channel_oauth2_google_iam_composite_creds(void) {
grpc_channel_args *new_args;
grpc_channel_credentials_vtable vtable = {
- NULL, check_channel_oauth2_google_iam_create_security_connector};
+ NULL, check_channel_oauth2_google_iam_create_security_connector, NULL};
grpc_channel_credentials *channel_creds =
grpc_mock_channel_credentials_create(&vtable);
grpc_call_credentials *oauth2_creds =
@@ -1148,6 +1149,31 @@ static void test_get_well_known_google_credentials_file_path(void) {
#endif
}
+static void test_channel_creds_duplicate_without_call_creds(void) {
+ grpc_channel_credentials *channel_creds =
+ grpc_fake_transport_security_credentials_create();
+
+ grpc_channel_credentials *dup =
+ grpc_channel_credentials_duplicate_without_call_credentials(
+ channel_creds);
+ GPR_ASSERT(dup == channel_creds);
+ grpc_channel_credentials_unref(dup);
+
+ grpc_call_credentials *call_creds =
+ grpc_access_token_credentials_create("blah", NULL);
+ grpc_channel_credentials *composite_creds =
+ grpc_composite_channel_credentials_create(channel_creds, call_creds,
+ NULL);
+ grpc_call_credentials_unref(call_creds);
+ dup = grpc_channel_credentials_duplicate_without_call_credentials(
+ composite_creds);
+ GPR_ASSERT(dup == channel_creds);
+ grpc_channel_credentials_unref(dup);
+
+ grpc_channel_credentials_unref(channel_creds);
+ grpc_channel_credentials_unref(composite_creds);
+}
+
int main(int argc, char **argv) {
grpc_test_init(argc, argv);
grpc_init();
@@ -1182,6 +1208,7 @@ int main(int argc, char **argv) {
test_metadata_plugin_success();
test_metadata_plugin_failure();
test_get_well_known_google_credentials_file_path();
+ test_channel_creds_duplicate_without_call_creds();
grpc_shutdown();
return 0;
}