如何使用用户名/密码作为 nodejs grpc 的凭据？

Question

I'm trying to access the gNMI API on an Arista router. The interface is configured with only username/password (admin/admin) and no certificate.

This CLI command returns the capabilities

$ gnmic -a 10.72.47.100:32232 --username admin --password admin --skip-verify capabilities

I'm using @grpc/grpc-js and ts-proto for typescript model generation.
I have not been able to figure out how to make the same API call from node/typescript.

Trying to combine an insecure with a call credentials gives this error Error: Cannot compose insecure credentials

import * as grpc from '@grpc/grpc-js';
import * as gnmi from './proto/github.com/openconfig/gnmi/proto/gnmi/gnmi';


    const meta = new grpc.Metadata();
    meta.add('username', 'admin');
    meta.add('password', 'admin');

    const channelCredentials = grpc.credentials.createInsecure();
    const callCredentials = grpc.credentials.createFromMetadataGenerator( (options, callback) => {
        callback(null, meta);
    });
    const credentials = grpc.credentials.combineChannelCredentials(
        channelCredentials,
        // callCredentials, <-- ** gives error: Error: Cannot compose insecure credentials **
    );

    const client = new gnmi.gNMIClient('10.72.47.100:32232', credentials);
    const req: gnmi.CapabilityRequest = { extension: [] };

    client.capabilities(req,
        (error, response) => {
        if (error) {
            console.error(error);
            process.exit(1);
        }
        console.info(response.gNMIVersion);
    })

And passing the meta to the call gives me this error Error: 14 UNAVAILABLE: Connection dropped . I assume this is due to missing credentials

    const meta = new grpc.Metadata();
    meta.add('username', 'admin');
    meta.add('password', 'admin');

    const Credentials = grpc.credentials.createInsecure();

    const client = new gnmi.gNMIClient('10.72.47.100:32232', credentials);
    const req: gnmi.CapabilityRequest = { extension: [] };

    client.capabilities(req, meta
        (error, response) => {
        if (error) {
            console.error(error);
            process.exit(1);
        }
        console.info(response.gNMIVersion);
    })

    code: 14, details: 'Connection dropped',
    metadata: Metadata, stack: 'Error: 14 UNAVAILABLE: Connection dropped

Any suggestions as how I can do this ?

Thanks

Answer 1

gRPC does not allow composing call credentials with insecure channel credentials because call credentials generally contain sensitive information that should only be transmitted over secure connections. The simplest way to handle this is to secure the connection with TLS by using secure credentials on both the client and the server. If that is not an option, you can also pass the metadata directly to each individual request instead of using call credentials.