<\/div>\n
Merhaba,<\/p>\n
gRPC, her ne kadar uzak sunuculardaki metotlar\u0131 sanki kendi ortam\u0131n\u0131n birer par\u00e7as\u0131ym\u0131\u015f gibi \u00e7a\u011f\u0131rabilen sistem olsa da kimlik do\u011frulama(authentication) ve yetkilendirme(authorization) nitelikleri sayesinde bir kullan\u0131c\u0131yla ili\u015fkilendirilebilmekte ve b\u00f6ylece daha korunakl\u0131 ve tan\u0131ml\u0131 veri ak\u0131\u015f\u0131 sa\u011flayabilmektedir. \u00d6zellikle g\u00fcn\u00fcm\u00fczde olduk\u00e7a pop\u00fcler olan JWT’ye dayal\u0131 yap\u0131land\u0131r\u0131lm\u0131\u015f bir kimlik do\u011frulama sayesinde s\u00fcre\u00e7 daha dinamik hale getirilebilmektedir.<\/p>\n
gRPC, gelen istekler \u00fczerinde kimlik do\u011frulamay\u0131 ger\u00e7ekle\u015ftirebilmek i\u00e7in temel Asp.NET Core mimarisinin authentication ve authorization \u00f6zelliklerini kullanarak gerekli yap\u0131lanmay\u0131 sa\u011flamaktad\u0131r. Bunun i\u00e7in yap\u0131lmas\u0131 gereken ilk i\u015f, gRPC Server uygulamas\u0131n\u0131n ‘Startup.cs’ dosyas\u0131nda UseAuthentication<\/code> ve UseAuthorization<\/code> middleware’lerini s\u0131ras\u0131yla \u00e7a\u011f\u0131rmakt\u0131r.<\/p>\n
\n\r\n    public class Startup\r\n    {\r\n        .\r\n        .\r\n        .\r\n\r\n        public void Configure(IApplicationBuilder app, IWebHostEnvironment env)\r\n        {\r\n            .\r\n            .\r\n            .\r\n            app.UseRouting();\r\n\r\n            app.UseAuthentication();\r\n            app.UseAuthorization();\r\n\r\n            app.UseEndpoints(endpoints =>\r\n            {\r\n                endpoints.MapGrpcService<MessageService>();\r\n            });\r\n            .\r\n            .\r\n            .\r\n        }\r\n    }\r\n<\/pre>\n<\/div>\nArd\u0131ndan yap\u0131lmas\u0131 gereken ikinci i\u015flem ise kullan\u0131lacak kimlik do\u011frulama mekanizmas\u0131n\u0131n yap\u0131land\u0131rmas\u0131n\u0131 olu\u015fturmakt\u0131r. Haliyle bizler burada ilk paragrafta verdi\u011fimiz ipucundan da anla\u015f\u0131laca\u011f\u0131 \u00fczere JWT konfig\u00fcrasyonunu \u00f6rneklendirece\u011fiz.<\/p>\n
\n\r\n    public class Startup\r\n    {\r\n        public void ConfigureServices(IServiceCollection services)\r\n        {\r\n            services.AddGrpc();\r\n\r\n            services.AddAuthorization();\r\n\r\n            services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)\r\n            .AddJwtBearer(options =>\r\n            {\r\n                options.RequireHttpsMetadata = false;\r\n                options.SaveToken = true;\r\n                options.TokenValidationParameters = new()\r\n                {\r\n                    ValidateIssuerSigningKey = true,\r\n                    IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("sebepsiz bos yere ayrilacaksan...")),\r\n                    ValidateIssuer = false,\r\n                    ValidateAudience = false,\r\n                    NameClaimType = "name"\r\n                };\r\n            });\r\n        }\r\n        .\r\n        .\r\n        .\r\n    }\r\n<\/pre>\n<\/div>\nMisal olarak yukar\u0131daki gibi bir JWT konfig\u00fcrasyonunu ger\u00e7ekle\u015ftirdikten sonra base servislerimizi a\u015fa\u011f\u0131daki gibi Authorize<\/code> attribute’u ile i\u015faretleyebiliriz.<\/p>\n
\n\r\n    [Authorize]\r\n    public class MessageService : MessageBase\r\n    {\r\n        public override async Task GetMessage(MessageRequest request, IServerStreamWriter<MessageResponse> responseStream, ServerCallContext context)\r\n        {\r\n            .\r\n            .\r\n            .\r\n        }\r\n    }\r\n<\/pre>\n<\/div>\nArt\u0131k bu vaziyette, client taraf\u0131ndan gelecek olan ve do\u011frulanabilir JWT bar\u0131nd\u0131rmayan t\u00fcm istekler gRPC Server taraf\u0131ndan a\u015fa\u011f\u0131daki hatayla reddedilecektir.
\n<\/a>
\nHaliyle bu durumda art\u0131k client, ya gRPC Server’dan ya da farkl\u0131 bir sunucudan(auth server misali) JWT talebinde bulunmal\u0131d\u0131r. Bunun i\u00e7in a\u015fa\u011f\u0131daki gibi bir JWT handler s\u0131n\u0131f\u0131 tasarlayal\u0131m ve \u00f6rnek olarak gRPC Server uygulamas\u0131 \u00fczerinden bir API a\u00e7arak client’\u0131n talebi neticesinde JWT’yi \u00fcretip g\u00f6nderelim.
\n‘TokenHandler.cs’ :<\/p>\n
\n\r\n    public static class TokenHandler\r\n    {\r\n        public static string CreateAccessToken()\r\n        {\r\n            SymmetricSecurityKey securityKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("sebepsiz bos yere ayrilacaksan..."));\r\n            SigningCredentials signingCredentials = new SigningCredentials(securityKey, SecurityAlgorithms.HmacSha256);\r\n            JwtSecurityToken securityToken = new JwtSecurityToken(\r\n                notBefore: DateTime.Now,\r\n                signingCredentials: signingCredentials,\r\n                claims: new List<Claim> { new("name", "Gen\u00e7ay") },\r\n                expires: DateTime.Now.AddDays(1)\r\n                );\r\n            JwtSecurityTokenHandler tokenHandler = new JwtSecurityTokenHandler();\r\n            string accessToken = tokenHandler.WriteToken(securityToken);\r\n            return accessToken;\r\n        }\r\n    }\r\n<\/pre>\n<\/div>\n‘AuthController.cs’ :<\/p>\n\n\r\n    [Route("api\/[controller]")]\r\n    [ApiController]\r\n    public class AuthController : ControllerBase\r\n    {\r\n        public IActionResult GetToken()\r\n            => Ok(TokenHandler.CreateAccessToken());\r\n    }\r\n<\/pre>\n<\/div>\n‘Startup.cs’ :<\/p>\n\n\r\n    public class Startup\r\n    {\r\n        public void ConfigureServices(IServiceCollection services)\r\n        {\r\n            .\r\n            .\r\n            .\r\n            services.AddGrpc();\r\n            services.AddControllers();\r\n            .\r\n            .\r\n            .\r\n        }\r\n\r\n        public void Configure(IApplicationBuilder app, IWebHostEnvironment env)\r\n        {\r\n            .\r\n            .\r\n            .\r\n            app.UseEndpoints(endpoints =>\r\n            {\r\n                endpoints.MapGrpcService<MessageService>();\r\n                endpoints.MapControllers();\r\n            });\r\n            .\r\n            .\r\n            .\r\n        }\r\n    }\r\n<\/pre>\n<\/div>\nYukar\u0131daki \u00e7al\u0131\u015fmadan da anla\u015f\u0131laca\u011f\u0131 \u00fczere client, https:\/\/localhost:5001\/api\/auth adresinden JWT talebinde bulunabilecek ve elde etti\u011fi JWT ile a\u015fa\u011f\u0131daki gibi istek g\u00f6nderebilecektir.<\/p>\n\n\r\n    class Program\r\n    {\r\n        static async Task Main(string[] args)\r\n        {\r\n            var channel = GrpcChannel.ForAddress("https:\/\/localhost:5001");\r\n            var messageClient = new Message.MessageClient(channel);\r\n\r\n            var headers = new Metadata();\r\n            headers.Add("Authorization", "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoiR2Vuw6dheSIsIm5iZiI6MTYzNTAzMTQzMiwiZXhwIjoxNjM1MTE3ODMyfQ.gIiKIVZugwIcOrW-TQPls6vCvL5klhVYXQllKf1zeJw");\r\n\r\n            var response = messageClient.GetMessage(new MessageRequest() { Message = "Messajlar\u0131 g\u00f6nder..." }, headers: headers);\r\n            var cancellationToken = new CancellationToken();\r\n            while (await response.ResponseStream.MoveNext(cancellationToken))\r\n                Console.WriteLine(response.ResponseStream.Current.Message);\r\n        }\r\n    }\r\n<\/pre>\n<\/div>\nYukar\u0131daki kod blo\u011funda 8 ile 11. sat\u0131r aral\u0131\u011f\u0131n\u0131 incelerseniz e\u011fer bir ‘Metadata’ t\u00fcr\u00fcnden nesne \u00fcretilmekte ve bu nesneye ‘Add’ fonksiyonuyla ilgili JWT verilmektedir. Ard\u0131ndan 11. sat\u0131rda ilgili client nesnesi \u00fczerinden server’da ki fonksiyonu(GetMessage) tetiklerken ‘headers’ parametresine ilgili nesne verilerek kullan\u0131c\u0131 do\u011frulamas\u0131 yap\u0131lmak istenmektedir.<\/p>\n
Kimlik do\u011frulamas\u0131 in\u015fa edildikten sonra gRPC Server’da kullan\u0131c\u0131 bilgilerine eri\u015febilmek i\u00e7in ‘ServerCallContext’ t\u00fcr\u00fcnden olan ‘context’ parametresi a\u015fa\u011f\u0131daki gibi kullan\u0131labilir.<\/p>\n\n\r\n    [Authorize]\r\n    public class MessageService : MessageBase\r\n    {\r\n        public override async Task GetMessage(MessageRequest request, IServerStreamWriter<MessageResponse> responseStream, ServerCallContext context)\r\n        {\r\n            .\r\n            .\r\n            .\r\n            var user = context.GetHttpContext().User;\r\n            .\r\n            .\r\n            .\r\n        }\r\n    }\r\n<\/pre>\n<\/div>\ngRPC Client Factory \u0130le Token Kullan\u0131m\u0131<\/h5>\ngRPC Client Factory<\/a> ile kimlik do\u011frulamay\u0131 ger\u00e7ekle\u015ftirmek istiyorsan\u0131z e\u011fer bu i\u015flem a\u015fa\u011f\u0131daki gibi basit\u00e7e halledilebilmektedir.<\/p>\n
\n\r\n        public void ConfigureServices(IServiceCollection services)\r\n        {\r\n            string token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoiR2Vuw6dheSIsIm5iZiI6MTYzNTAzMTQzMiwiZXhwIjoxNjM1MTE3ODMyfQ.gIiKIVZugwIcOrW-TQPls6vCvL5klhVYXQllKf1zeJw";\r\n            services.AddGrpcClient<MessageClient>(options =>\r\n            {\r\n                options.Address = new Uri("https:\/\/localhost:5001");\r\n            }).ConfigureChannel(options =>\r\n            {\r\n                var credentials = CallCredentials.FromInterceptor((context, metadata) =>\r\n                {\r\n                    if (!string.IsNullOrEmpty(token))\r\n                        metadata.Add("Authorization", $"Bearer {token}");\r\n                    return Task.CompletedTask;\r\n                });\r\n\r\n                options.Credentials = ChannelCredentials.Create(new SslCredentials(), credentials);\r\n            });\r\n            services.AddControllers();\r\n        }\r\n<\/pre>\n<\/div>\ngRPC Claim Tabanl\u0131 Yetkilendirme<\/h5>\ngRPC \u00e7al\u0131\u015fmalar\u0131nda t\u0131pk\u0131 Asp.NET Core uygulamalar\u0131nda oldu\u011fu gibi claim tabanl\u0131 yetkilendirme<\/a>leri kolayl\u0131kla ger\u00e7ekle\u015ftirebilmekteyiz. Bunun i\u00e7in a\u015fa\u011f\u0131daki gibi bir politika tan\u0131mlanmas\u0131 yeterlidir.<\/p>\n
\n\r\n    public class Startup\r\n    {\r\n        public void ConfigureServices(IServiceCollection services)\r\n        {\r\n            services.AddGrpc();\r\n            .\r\n            .\r\n            .\r\n            services.AddAuthorization(options =>\r\n            {\r\n                options.AddPolicy("RolePolicy", policy => policy.RequireClaim(ClaimTypes.Role, "admin"));\r\n            });\r\n        }\r\n        .\r\n        .\r\n        .\r\n    }\r\n<\/pre>\n<\/div>\nBu tan\u0131mdan sonra art\u0131k token \u00fcreticisi, generate edilecek JWT de\u011ferine i\u00e7erisinde role de\u011feri bar\u0131nd\u0131ran bir claim eklemelidir. Farazi olarak a\u015fa\u011f\u0131daki 12. sat\u0131r buna bir \u00f6rnektir.<\/p>\n\n\r\n    public static class TokenHandler\r\n    {\r\n        public static string CreateAccessToken()\r\n        {\r\n            SymmetricSecurityKey securityKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("sebepsiz bos yere ayrilacaksan..."));\r\n            SigningCredentials signingCredentials = new SigningCredentials(securityKey, SecurityAlgorithms.HmacSha256);\r\n            JwtSecurityToken securityToken = new JwtSecurityToken(\r\n                notBefore: DateTime.Now,\r\n                signingCredentials: signingCredentials,\r\n                claims: new List<Claim> {\r\n                    new("name", "Gen\u00e7ay") ,\r\n                    new(ClaimTypes.Role,"admin")\r\n                },\r\n                expires: DateTime.Now.AddDays(1)\r\n                );\r\n            JwtSecurityTokenHandler tokenHandler = new JwtSecurityTokenHandler();\r\n            string accessToken = tokenHandler.WriteToken(securityToken);\r\n            return accessToken;\r\n        }\r\n    }\r\n<\/pre>\n<\/div>\nVe son olarak Authorize<\/code> attribute’u ile i\u015faretlenen ilgili gRPC servisinde a\u015fa\u011f\u0131daki gibi olu\u015fturulan politika belirtilmelidir.<\/p>\n\n\r\n    [Authorize(Policy = "RolePolicy")]\r\n    public class MessageService : MessageBase\r\n    {\r\n        public override async Task GetMessage(MessageRequest request, IServerStreamWriter<MessageResponse> responseStream, ServerCallContext context)\r\n        {\r\n            .\r\n            .\r\n            .\r\n        }\r\n    }\r\n<\/pre>\n<\/div>\nTabi burada yetkilendirmeyi metot bazl\u0131 olacak \u015fekilde de yapabilece\u011finizi bildi\u011finizi varsay\u0131yorum.<\/p>\ngRPC Politika Tabanl\u0131 Yetkilendirme<\/h5>\nAyr\u0131ca claim bazl\u0131 yetkilendirmenin d\u0131\u015f\u0131nda farkl\u0131 politikalar e\u015fli\u011finde de yetkilendirme usulleri olu\u015fturabilirsiniz. Buna bildi\u011finiz klasik politika bazl\u0131 yetkilendirme<\/a> denmektedir.<\/p>\n
Misal olarak hafta sonu hizmet vermeyecek olan bir gRPC servisi i\u00e7in a\u015fa\u011f\u0131daki gibi bir politika olu\u015fturabiliriz.<\/p>\n
\n\r\n    public class DateRequirement : IAuthorizationRequirement\r\n    {\r\n    }\r\n<\/pre>\n<\/div>\n\n\r\n    public class DateHandler : AuthorizationHandler<DateRequirement>\r\n    {\r\n        protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, DateRequirement requirement)\r\n        {\r\n            if (DateTime.Now.DayOfWeek != DayOfWeek.Saturday && DateTime.Now.DayOfWeek != DayOfWeek.Sunday)\r\n                context.Succeed(requirement);\r\n            else\r\n                context.Fail();\r\n            return Task.CompletedTask;\r\n        }\r\n    }\r\n<\/pre>\n<\/div>\n\n\r\n    public class Startup\r\n    {\r\n        public void ConfigureServices(IServiceCollection services)\r\n        {\r\n            services.AddGrpc();\r\n            .\r\n            .\r\n            .\r\n            services.AddAuthorization(options =>\r\n            {\r\n                options.AddPolicy("RolePolicy", policy => policy.RequireClaim(ClaimTypes.Role, "admin"));\r\n                options.AddPolicy("DatePolicy", policy => policy.Requirements.Add(new DateRequirement()));\r\n            });\r\n            services.AddSingleton<IAuthorizationHandler, DateHandler>();\r\n        }\r\n        .\r\n        .\r\n        .\r\n    }\r\n<\/pre>\n<\/div>\nArd\u0131ndan kullan\u0131m\u0131 yine a\u015fa\u011f\u0131daki gibi olacakt\u0131r.<\/p>\n
\n\r\n    [Authorize(Policy = "DatePolicy")]\r\n    public class MessageService : MessageBase\r\n    {\r\n        public override async Task GetMessage(MessageRequest request, IServerStreamWriter<MessageResponse> responseStream, ServerCallContext context)\r\n        {\r\n            .\r\n            .\r\n            .\r\n        }\r\n    }\r\n<\/pre>\n<\/div>\n\u0130lgilenenlerin faydalanmas\u0131 dile\u011fiyle…
\nSonraki yaz\u0131lar\u0131mda g\u00f6r\u00fc\u015fmek \u00fczere…
\n\u0130yi \u00e7al\u0131\u015fmalar…<\/p>\n","protected":false},"excerpt":{"rendered":"
Merhaba, gRPC, her ne kadar uzak sunuculardaki metotlar\u0131 sanki kendi ortam\u0131n\u0131n birer par\u00e7as\u0131ym\u0131\u015f gibi \u00e7a\u011f\u0131rabilen sistem olsa da kimlik do\u011frulama(authentication) ve yetkilendirme(authorization) nitelikleri sayesinde bir kullan\u0131c\u0131yla ili\u015fkilendirilebilmekte ve b\u00f6ylece daha korunakl\u0131 ve tan\u0131ml\u0131 veri...<\/p>\n","protected":false},"author":1,"featured_media":20414,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4032],"tags":[4327,4328,4329,4325,4326,4428,4427,4429,4426],"class_list":["post-22101","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-grpc","tag-asp-net-core-grpc","tag-asp-net-core-grpc-authentication","tag-asp-net-core-grpc-authorization","tag-grpc-authentication","tag-grpc-authorization","tag-grpc-claim-base-authorization","tag-grpc-claim-tabanli-yetkilendirme","tag-grpc-policy-base-authorization","tag-grpc-politika-tabanli-yetkilendirme"],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts\/22101","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/comments?post=22101"}],"version-history":[{"count":25,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts\/22101\/revisions"}],"predecessor-version":[{"id":23448,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts\/22101\/revisions\/23448"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/media\/20414"}],"wp:attachment":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/media?parent=22101"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/categories?post=22101"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/tags?post=22101"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}