使用火库身份验证从飞镖调用谷歌云运行gRPC：由未知颁发机构签名的证书

Question

服务器

我使用 gRPC 中间件来检查流中的火库身份验证令牌：

package main

...

func main() {

    port := os.Getenv("PORT")

    if port == "" {

        port = "8080"

    }

    grpcEndpoint := fmt.Sprintf(":%s", port)

    log.Printf("gRPC endpoint [%s]", grpcEndpoint)

    logger, err := zap.NewProduction()

    if err != nil {

        log.Fatalf("Failed to init logger: %v", err)

    }

    defer logger.Sync() // flushes buffer, if any

    grpcServer := grpc.NewServer(

        grpc.StreamInterceptor(grpc_middleware.ChainStreamServer(

            grpc_ctxtags.StreamServerInterceptor(),

            grpc_zap.StreamServerInterceptor(logger),

            grpc_auth.StreamServerInterceptor(server.AuthFunc))),

    )

    ctx := context.Background()

    fb, err := firebase.NewApp(ctx, &firebase.Config{

        ProjectID: "my-firebase-project",

    })

    server.App = fb

    if err != nil {

        panic(fmt.Sprintf("Failed to init firebase: %v", err))

    }

    pb.RegisterMyAwesomeServer(grpcServer, server.NewServer())

    listen, err := net.Listen("tcp", grpcEndpoint)

    if err != nil {

        log.Fatal(err)

    }

    log.Printf("Starting: gRPC Listener [%s]\n", grpcEndpoint)

    log.Fatal(grpcServer.Serve(listen))

}

package server

...

func parseToken(ctx context.Context, token string) (*auth.Token, error) {

    client, err := App.Auth(ctx)

    if err != nil {

        return nil, err

    }

    nt, err := client.VerifyIDToken(ctx, token)

    if err != nil {

        return nil, err

    }

    return nt, nil

}

type AuthToken string

func AuthFunc(ctx context.Context) (context.Context, error) {

    token, err := grpc_auth.AuthFromMD(ctx, "bearer")

    if err != nil {

        return nil, err

    }

    tokenInfo, err := parseToken(ctx, token)

    if err != nil {

        return nil, status.Errorf(codes.Unauthenticated, "invalid auth token: %v", err)

    }

    grpc_ctxtags.Extract(ctx).Set("auth.uid", tokenInfo.UID)

    newCtx := context.WithValue(ctx, AuthToken("tokenInfo"), tokenInfo)

    return newCtx, nil

}

Answer 1

实际上，后端缺少证书...通过使用以下方法解决：COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/在泊坞窗文件中FROM golang as buildWORKDIR /allCOPY . .# Build static binaryRUN CGO_ENABLED=0 GOOS=linux \    go build -a -installsuffix cgo \    -o /go/bin/server \    cmd/main/main.goFROM scratchCOPY --from=build /go/bin/server /serverCOPY --from=build /all/config.yaml /config.yamlCOPY --from=build /all/svc.dev.json /svc.dev.json### THIS SOLVEDCOPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/###ENV GOOGLE_APPLICATION_CREDENTIALS /svc.dev.jsonENTRYPOINT ["/server", "./config.yaml"]