C#实现etcd v3+ gRPC客户端基础认证的token使用问题求助

我最近在给etcd v3+实现C# gRPC客户端，无认证和SSL通道认证都顺利搞定了，但卡在基础认证机制这块——现在能通过Authenticate()方法从etcd服务器拿到token，可不知道怎么把这个token用到后续的Get、Put等调用里。以下是我的实现代码：

using System;
using System.Threading.Tasks;
using System.Collections.Generic;
using Grpc.Core;
using Etcdserverpb;
using Google.Protobuf;
using System.Runtime.CompilerServices;
using Grpc.Auth;
using Grpc.Core.Interceptors;

namespace myproj.etcd
{
    public class EtcdClient
    {
        Channel channel;
        KV.KVClient kvClient;
        string host;
        string username;
        string password;
        string authToken;
        Auth.AuthClient authClient;

        public EtcdClient(string host, string username, string password)
        {
            this.username = username;
            this.password = password;
            this.host = host;
            Authenticate(); // 尝试用token实现认证，还没找到正确方式

            channel = new Channel(host, ChannelCredentials.Create(ChannelCredentials.Insecure, GoogleGrpcCredentials.FromAccessToken(this.authToken))); // 这个写法没生效
            //channel = new Channel(host, ChannelCredentials.Insecure);
            kvClient = new KV.KVClient(channel);
        }

        void Authenticate()
        {
            authClient = new Auth.AuthClient(new Channel(host,ChannelCredentials.Insecure));
            var authRes = authClient.Authenticate(new AuthenticateRequest { Name = username, Password = password });
            this.authToken = authRes.Token;
        }

        public string Get(string key)
        {
            try
            {
                var rangeRequest = new RangeRequest { Key = ByteString.CopyFromUtf8(key) };
                var rangeResponse = kvClient.Range(rangeRequest);
                if (rangeResponse.Count != 0)
                {
                    return rangeResponse.Kvs[0].Value.ToStringUtf8().Trim();
                }
            }
            catch (Exception ex)
            {
            }
            return String.Empty;
        }
    }
}

更新： 完整源代码可查看我的dotnet-etcd项目。

问题分析与解决方案 #

你当前用GoogleGrpcCredentials.FromAccessToken创建Channel凭证的方式不适用etcd——这个方法是针对Google云服务的认证逻辑，而etcd的基础认证是通过在gRPC请求的Metadata中添加Bearer Token实现的。下面给你两种可行的解决方案：

方案1：手动给每个请求添加认证头

适合快速测试，直接在每次调用Get/Put等方法时，手动构造包含Token的Metadata：

修改Get方法，添加带认证头的CallOptions：

public string Get(string key)
{
    try
    {
        var rangeRequest = new RangeRequest { Key = ByteString.CopyFromUtf8(key) };
        // 构造Bearer Token认证头
        var authHeaders = new Metadata();
        authHeaders.Add("Authorization", $"Bearer {this.authToken}");
        
        // 调用时传入带认证头的CallOptions
        var rangeResponse = kvClient.Range(rangeRequest, new CallOptions(headers: authHeaders));
        
        if (rangeResponse.Count != 0)
        {
            return rangeResponse.Kvs[0].Value.ToStringUtf8().Trim();
        }
    }
    catch (Exception ex)
    {
        // 建议添加日志记录异常信息
    }
    return String.Empty;
}

同理，Put等其他方法也需要做同样修改，确保每次调用都带上认证头。

方案2：用Interceptor自动给所有请求添加Token

如果不想每个方法重复写认证逻辑，推荐用gRPC的Interceptor统一处理，让所有请求自动带上Token：

首先创建认证拦截器：

public class EtcdAuthInterceptor : Interceptor
{
    private readonly string _bearerToken;

    public EtcdAuthInterceptor(string bearerToken)
    {
        _bearerToken = bearerToken;
    }

    // 覆盖同步Unary调用逻辑
    public override TResponse BlockingUnaryCall<TRequest, TResponse>(
        TRequest request,
        ClientInterceptorContext<TRequest, TResponse> context,
        BlockingUnaryCallContinuation<TRequest, TResponse> continuation)
    {
        var modifiedContext = UpdateContextWithAuthHeader(context);
        return continuation(request, modifiedContext);
    }

    // 覆盖异步Unary调用逻辑
    public override AsyncUnaryCall<TResponse> AsyncUnaryCall<TRequest, TResponse>(
        TRequest request,
        ClientInterceptorContext<TRequest, TResponse> context,
        AsyncUnaryCallContinuation<TRequest, TResponse> continuation)
    {
        var modifiedContext = UpdateContextWithAuthHeader(context);
        return continuation(request, modifiedContext);
    }

    // 统一添加认证头的私有方法
    private ClientInterceptorContext<TRequest, TResponse> UpdateContextWithAuthHeader<TRequest, TResponse>(
        ClientInterceptorContext<TRequest, TResponse> context)
    {
        var authHeaders = new Metadata();
        authHeaders.Add("Authorization", $"Bearer {_bearerToken}");
        return new ClientInterceptorContext<TRequest, TResponse>(
            context.Method,
            context.Host,
            context.CallOptions.WithHeaders(authHeaders));
    }

    // 注意：还需要覆盖AsyncServerStreamingCall、AsyncClientStreamingCall等其他调用类型的方法，确保所有请求都能带上认证头
}

然后修改EtcdClient，把同步认证改成异步（避免阻塞线程），并提供静态异步创建方法（构造函数不能是async）：

namespace myproj.etcd
{
    public class EtcdClient
    {
        Channel channel;
        KV.KVClient kvClient;
        string host;
        string username;
        string password;
        string authToken;

        // 私有构造函数，避免直接实例化
        private EtcdClient(string host, string username, string password)
        {
            this.username = username;
            this.password = password;
            this.host = host;
        }

        // 异步认证方法
        private async Task AuthenticateAsync()
        {
            using var authChannel = new Channel(host, ChannelCredentials.Insecure);
            var authClient = new Auth.AuthClient(authChannel);
            var authRes = await authClient.AuthenticateAsync(new AuthenticateRequest 
            { 
                Name = username, 
                Password = password 
            });
            this.authToken = authRes.Token;
        }

        // 静态异步创建方法，供外部调用
        public static async Task<EtcdClient> CreateAsync(string host, string username, string password)
        {
            var client = new EtcdClient(host, username, password);
            await client.AuthenticateAsync();
            
            // 创建带认证拦截器的Channel调用器
            client.channel = new Channel(host, ChannelCredentials.Insecure);
            var interceptedInvoker = client.channel.Intercept(new EtcdAuthInterceptor(client.authToken));
            client.kvClient = new KV.KVClient(interceptedInvoker);
            
            return client;
        }

        public async Task<string> GetAsync(string key)
        {
            try
            {
                var rangeRequest = new RangeRequest { Key = ByteString.CopyFromUtf8(key) };
                var rangeResponse = await kvClient.RangeAsync(rangeRequest);
                if (rangeResponse.Count != 0)
                {
                    return rangeResponse.Kvs[0].Value.ToStringUtf8().Trim();
                }
            }
            catch (Exception ex)
            {
                // 添加日志记录
            }
            return string.Empty;
        }
    }
}

外部使用时只需：

var etcdClient = await EtcdClient.CreateAsync("your-etcd-host:2379", "username", "password");
var value = await etcdClient.GetAsync("your-key");

这种方式更优雅，能确保所有gRPC请求自动带上认证Token，不用在每个业务方法里重复处理。

内容的提问来源于stack exchange，提问作者shubhamr