redb.Identity Adds gRPC Transport for OpenID Server Alongside Existing HTTP Facade

redb.Identity has introduced a second transport layer using gRPC next to its existing HTTP interface, sharing the same core routes, client registry, token store, and authorization logic. The new facade exposes standard OAuth and OpenID Connect operations such as Token, Introspect, Revoke, UserInfo, Discovery, and Jwks through protobuf-defined methods under identity.v1.Identity. Both transports enforce identical verdicts based on a single centralized scope table located behind direct-vm addresses, ensuring that a client authorized via HTTP receives the same result when calling gRPC. Error handling on gRPC uses status codes and trailers to carry machine-readable OAuth error codes and retry-after values, preserving compatibility with existing interceptors and tracing. Browser-facing flows, DPoP proofs, and user self-service remain on HTTP, while administrative operations are available on a separate management port. The implementation was validated through 64 unit tests, cross-language interop with @grpc/grpc-js clients, and a conformance run against the official OpenID Foundation suite.

HabrTranslated from Russian

Read at source

redb.Identity has added a gRPC facade to its OpenID server, placing it alongside the existing HTTP transport on the same core routes. The server remains transport-agnostic: all authorization logic resides behind direct-vm://identity-* addresses, and both HTTP and gRPC now act as interchangeable facades over this kernel.

The new surface implements the protocol operations required by relying parties: Token at /identity.v1.Identity/Token (RFC 6749 §3.2), Introspect (RFC 7662), Revoke (RFC 7009), UserInfo (OIDC Core §5.3), Discovery, and Jwks (RFC 7517). A gRPC health check is also exposed via grpc.health.v1.Health/Check. Forty administrative operations across five services (Users, Applications, Groups, Scopes, Tokens) are available on a dedicated management port.

Requests accept the same key-value pairs defined by the RFCs plus a map<string, string> for extensions. Responses type the fields fixed by the specifications and place open sets such as claims into google.protobuf.Struct. OAuth errors are returned as gRPC status codes (UNAUTHENTICATED, PERMISSION_DENIED, RESOURCE_EXHAUSTED, INVALID_ARGUMENT) with the original error code and correlation identifier carried in trailers.

The same token issued through dynamic client registration over HTTP is accepted by the gRPC endpoint and yields identical authorization decisions. Scope evaluation occurs once inside the kernel at direct-vm://identity-authz-check, eliminating the risk of divergent policy between transports.

Browser flows (authorize, login, consent, MFA), DPoP proofs (RFC 9449), and user self-service remain exclusively on HTTP. The gRPC listener uses its own port because it requires HTTP/2 while the HTTP facade supports both HTTP/1.1 and HTTP/2.

Configuration is placed in the shared context.json under the identity.grpc section, allowing independent host, port, TLS, and compression settings. The EmitHttpCompatHeaders flag is enabled by default to preserve IP-based rate limiting and device metadata collection.

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Other

Mail.ru Reduces Lifetime 1TB Cloud Storage Promo to Standard 8GB Quota for Select Users
Kimi K3 Open Model Surpasses Closed AI Leaders with Million-Token Context and 896 Experts
Innostage Completes Functional Testing of PT NGFW 1.10.3 Across 156 Criteria