Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

UNAUTHENTICATED errors against Cloud Spanner emulator in v1.45.0 #29233

Closed
taka-oyama opened this issue Mar 28, 2022 · 14 comments
Closed

UNAUTHENTICATED errors against Cloud Spanner emulator in v1.45.0 #29233

taka-oyama opened this issue Mar 28, 2022 · 14 comments
Assignees
@stanley-cheung
Labels
kind/bug lang/php priority/P2

Comments

@taka-oyama
Copy link

We have seen this error before in v1.36 #25810

What version of gRPC and what language are you using?

grpc v1.45.0
PHP

What operating system (Linux, Windows,...) and version?

Alpine Linux

What runtime / compiler are you using (e.g. python version or version of gcc)

PHP version: 8.0.17

What did you do?

Update grpc from 1.44.0 to 1.45.0 and run it against Spanner Emulator.

What did you expect to see?

No errors.

What did you see instead?

Google\Cloud\Core\Exception\ServiceException: {
    "message": "Established channel does not have a sufficient security level to transfer call credential.",
    "code": 16,
    "status": "UNAUTHENTICATED",
    "details": []
}

/project/vendor/google/cloud-core/src/GrpcRequestWrapper.php:257
/project/vendor/google/cloud-core/src/GrpcRequestWrapper.php:146
/project/vendor/google/cloud-core/src/GrpcTrait.php:79
/project/vendor/google/cloud-spanner/src/Connection/Grpc.php:603
/project/vendor/google/cloud-spanner/src/Database.php:353
/project/vendor/google/cloud-spanner/src/Database.php:376
@PierrickVoulet
Copy link

PierrickVoulet commented Mar 28, 2022 •
edited
Loading

Same issue with https://github.com/googleads/google-ads-php.

@taka-oyama taka-oyama mentioned this issue Mar 29, 2022
Closed
@taka-oyama
Copy link
Author

Is anyone looking into this?

@stanley-cheung
Copy link
Contributor

@HannahShiSFB Can you please take a look?

@HannahShiSFB
Copy link
Collaborator

Sure

@PierrickVoulet
Copy link

@HannahShiSFB Any early thoughts you could share? Is there currently any plans to fix this?

@HannahShiSFB
Copy link
Collaborator

This is caused by #25586 which removed insecure channel.

Regardless whether Spanner connects to emulator or production server, gax-php always create a CredentialsWrapper (https://github.com/googleapis/gax-php/blob/v1.12.0/src/GapicClientTrait.php#L434) and add it to callstack (https://github.com/googleapis/gax-php/blob/v1.12.0/src/GapicClientTrait.php#L610).
When creating gRPC calls, GrpcTransport calls CredentialsWrapper (https://github.com/googleapis/gax-php/blob/v1.12.0/src/Transport/GrpcTransport.php#L258-L259) to setup a callback for auth token, which requires secure level to be equal or higher than GRPC_PRIVACY_AND_INTEGRITY which doesn’t work on an insecure channel.

This PR uses an InsecureCredentialsWrapper which return null in getAuthorizationHeaderCallback so the credential callback will not be set, so this can work for emulator via an insecure channel.

@HannahShiSFB
Copy link
Collaborator

@dennycd @stanley-cheung I want to propose an easy fix of Spanner, but I can't fork https://github.com/googleapis/google-cloud-php and create a PR there. Could you help me with it? Thanks

@saranshdhingra
Copy link

@HannahShiSFB I could probably help with it. Can you tell me what is the issue you're facing in creating a PR for google-cloud-php ?

@HannahShiSFB
Copy link
Collaborator

sorry for the confusing. It works now. I will create a PR right now

@PierrickVoulet
Copy link

sorry for the confusing. It works now. I will create a PR right now

@HannahShiSFB Could you provide the link to this PR?

@enumag
Copy link

enumag commented Apr 19, 2022 •
edited
Loading

I'm getting the same error against firestore emulator as well. Is there any workaround I can use? For instance how do I make the client use a "secured channel"?

@enumag
Copy link

enumag commented Apr 19, 2022

Based on googleapis/google-cloud-php#3911 (comment) it seems the workaround is to downgrade grpc. It did solve the problem for me.

@HannahShiSFB HannahShiSFB mentioned this issue Apr 19, 2022
Merged
@HannahShiSFB
Copy link
Collaborator

@HannahShiSFB Could you provide the link to this PR?

Thx for waiting. It's googleapis/google-cloud-php#5224

@dennycd
Copy link
Contributor

dennycd commented May 5, 2022

Closing the issue as it is fixed from cloud / spanner side.

@dennycd dennycd closed this as completed May 5, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@stanley-cheung stanley-cheung

Labels
kind/bug lang/php priority/P2
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
7 participants
@enumag @taka-oyama @dennycd @saranshdhingra @PierrickVoulet @stanley-cheung @HannahShiSFB