From a7d31ef7565dd7b335690956118330f29d974d9a Mon Sep 17 00:00:00 2001
From: Daniel Theuke <daniel.theuke@heuboe.de>
Date: Tue, 11 Dec 2018 18:01:21 +0100
Subject: [PATCH] Add call attributes to the authentication if no details are
 present

This allows the AuthenticationManager to decide based on attributes such
as the remote or local address. For example it could decide whether the
client originates from a blacklisted ip-range. Another example could be
using multiple inbound addresses for internal and external use which use
a different set of AuthenticationProviders.
---
 .../interceptors/AuthenticatingServerInterceptor.java      | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/grpc-server-spring-boot-autoconfigure/src/main/java/net/devh/boot/grpc/server/security/interceptors/AuthenticatingServerInterceptor.java b/grpc-server-spring-boot-autoconfigure/src/main/java/net/devh/boot/grpc/server/security/interceptors/AuthenticatingServerInterceptor.java
index 9b628b074..77d9d77a3 100644
--- a/grpc-server-spring-boot-autoconfigure/src/main/java/net/devh/boot/grpc/server/security/interceptors/AuthenticatingServerInterceptor.java
+++ b/grpc-server-spring-boot-autoconfigure/src/main/java/net/devh/boot/grpc/server/security/interceptors/AuthenticatingServerInterceptor.java
@@ -21,6 +21,7 @@
 
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.security.access.AccessDeniedException;
+import org.springframework.security.authentication.AbstractAuthenticationToken;
 import org.springframework.security.authentication.AnonymousAuthenticationToken;
 import org.springframework.security.authentication.AuthenticationManager;
 import org.springframework.security.authentication.BadCredentialsException;
@@ -69,6 +70,12 @@ public <ReqT, RespT> ServerCall.Listener<ReqT> interceptCall(final ServerCall<Re
                 throw new BadCredentialsException("No credentials found in the request", e);
             }
         }
+        if (authentication.getDetails() == null && authentication instanceof AbstractAuthenticationToken) {
+            // Append call attributes to the authentication request.
+            // This gives the AuthenticationManager access to information like remote and local address.
+            // It can then decide whether it wants to use its own user details or the attributes.
+            ((AbstractAuthenticationToken) authentication).setDetails(call.getAttributes());
+        }
         log.debug("Credentials found: Authenticating...");
         authentication = this.authenticationManager.authenticate(authentication);
         SecurityContextHolder.getContext().setAuthentication(authentication);