[FEATURE] Authorization and ActionPlugin Wrapper Support for gRPC Endpoints

[aparajita31pandey]

Is your feature request related to a problem? Please describe
Yes.

1. With Opensearch 3.0, gRPC introduced for some of the endpoints, we need support for authorization on those gRPC endpoints.
2. OpenSearch currently provides ActionPlugin.getRestHandlerWrapper to intercept and wrap all REST requests before they are handled. However, there is no equivalent hook for gRPC endpoints.

We have a custom plugin that uses ActionPlugin.getRestHandlerWrapper to intercept all REST requests for custom processing. We need similar interception or wrapper support for gRPC endpoints as well, so we can apply the same logic to gRPC calls.
Previous ticket which added grpc-transport plugin - opensearch-project/OpenSearch#16905

[cwperks]

[Triage] Thank for you filing this issue to track the work @aparajita31pandey! I would like to see automated tests added to the security repo that demonstrate configuring an grpc aux transport and then doing simple requests that show that authc/authz is working as expected.

[aparajita31pandey]

@cwperks afaik authz for grpc doesn't exist yet. Is there is a hook for gRPC entrypoints similar to ActionPlugin.getRestHandlerWrapper for REST that we can leverage

[finnegancarroll]

Hi @aparajita31pandey. There is not currently any hook to inject a rest handler wrapper into a gRPC transport. Im actively working on client certificate authentication here and currently these transports have no authz component.

In core this rest handler wrapper (UnaryOperator<RestHandler>) is injected into the RestController which transports consume to validate and route requests as well as execute the security plugin rest handler wrapper.

My first impression looking at this previously was we could re-use much of the code in RestController by providing an alternative to RestController.dispatchRequest which is better suited to gRPC/HTTP2. Some functionality captured here such as routing requests and selecting a rest handler are maybe not necessary as gRPC services are registered directly in the transport and we don't need to handle request routing ourselves. While most header validation and executing our security plugin UnaryOperator<RestHandler> we would like to preserve.

@cwperks @expani any thoughts on how to best accomplish this? Can we re-use ActionPlugin.getRestHandlerWrapper here?

[nibix]

I am a bit confused: Is this about authorization or authentication?