Spanner - Need to enable credentials inject at call time

[ykchen-g]

Currently for Cloud spanner java interfaces, the credential is contained in the DatabaseClient when the DatabaseClient is created. There is no way to have a databaseClient without credentials and call the method with credential context.

So if we are calling Cloud spanner via some service protocols, like gRPC, the gRPC server will have to create the databaseClient again and again whenever a new method call comes since when the server starts, it doesn't know the client's credential.

[vkedia]

Actually I thought more about this. I don't think it is feasible to do this. Cloud spanner client makes some background rpcs such as CreateSession. Those rpcs also need credentials so the credentials do need to be specified while creating the client. I think the usual model is that your server will use a single service account to talk to cloud spanner (or any other backend for that matter) irrespective fo the client that is accessing the server. But if you want to allow different level of accesses based on who the client is you will have to implement some sort of access control in your server and use that to allow/disallow requests.
@tomayles might have more suggestions here.

[ykchen-g]

I am not quite sure, is it possible to lazy call the methods like CreateSession? Only when the add/remove operations methods are called? The client constructor just do some prep work without credentials?

[vkedia]

In theory we can set it up so that the when the first request comes in to the client for a given database, we use the credentials specified in that from that point onwards. But how does that help you? You still will not be able to use the same client with different credentials?

[tomayles]

Is the use case here that you are writing a mid-layer gRPC server that you want to make Cloud Spanner calls with the credentials of the caller to your server? As Vikas mentioned, the typical case is that the server would use its own credentials - just trying to understand your needs better :)

[ykchen-g]

This is exactly our use case. We have a gRPC server that will call the Cloud Spanner. We want to have the databaseClient exist when the server starts.

As we are here, a related question, if we simply construct the databaseClient everytime our server is called and destroy the databaseClient, will that cause a huge overhead? I would suppose so since it means we will need to create sessions and connections again and again.

[garrettjonesgoogle]

@ykchen-g will you have an unbounded number of clients, or a more limited set of clients? If it's unbounded, I don't know if there's much you can do. If it's limited, couldn't you create a mapping of caller -> spanner client and keep them around?

[vkedia]

@ykchen-g For your question about creating/destroying database client on every request, yes it will add a significant overhead which would include connection setup time, session creation time and then the actual work that you need to do.
I guess you can have some sort of cache keyed on called and whose value would be DatabaseClient.
I am not sure if there is much that can be done here in the client itself. Thus I am closing. Please reopen if you disagree.