1 files changed, 15 insertions, 13 deletions

diff --git a/src/core/lib/security/transport/server_auth_filter.cc b/src/core/lib/security/transport/server_auth_filter.cc
index 362f49a584..f93eb4275e 100644
--- a/src/core/lib/security/transport/server_auth_filter.cc
+++ b/src/core/lib/security/transport/server_auth_filter.cc
@@ -39,8 +39,12 @@ enum async_state {
 };
 
 struct channel_data {
-  grpc_auth_context* auth_context;
-  grpc_server_credentials* creds;
+  channel_data(grpc_auth_context* auth_context, grpc_server_credentials* creds)
+      : auth_context(auth_context->Ref()), creds(creds->Ref()) {}
+  ~channel_data() { auth_context.reset(DEBUG_LOCATION, "server_auth_filter"); }
+
+  grpc_core::RefCountedPtr<grpc_auth_context> auth_context;
+  grpc_core::RefCountedPtr<grpc_server_credentials> creds;
 };
 
 struct call_data {
@@ -58,7 +62,7 @@ struct call_data {
         grpc_server_security_context_create(args.arena);
     channel_data* chand = static_cast<channel_data*>(elem->channel_data);
     server_ctx->auth_context =
-        GRPC_AUTH_CONTEXT_REF(chand->auth_context, "server_auth_filter");
+        chand->auth_context->Ref(DEBUG_LOCATION, "server_auth_filter");
     if (args.context[GRPC_CONTEXT_SECURITY].value != nullptr) {
       args.context[GRPC_CONTEXT_SECURITY].destroy(
           args.context[GRPC_CONTEXT_SECURITY].value);
@@ -208,7 +212,8 @@ static void recv_initial_metadata_ready(void* arg, grpc_error* error) {
   call_data* calld = static_cast<call_data*>(elem->call_data);
   grpc_transport_stream_op_batch* batch = calld->recv_initial_metadata_batch;
   if (error == GRPC_ERROR_NONE) {
-    if (chand->creds != nullptr && chand->creds->processor.process != nullptr) {
+    if (chand->creds != nullptr &&
+        chand->creds->auth_metadata_processor().process != nullptr) {
       // We're calling out to the application, so we need to make sure
       // to drop the call combiner early if we get cancelled.
       GRPC_CLOSURE_INIT(&calld->cancel_closure, cancel_call, elem,
@@ -218,9 +223,10 @@ static void recv_initial_metadata_ready(void* arg, grpc_error* error) {
       GRPC_CALL_STACK_REF(calld->owning_call, "server_auth_metadata");
       calld->md = metadata_batch_to_md_array(
           batch->payload->recv_initial_metadata.recv_initial_metadata);
-      chand->creds->processor.process(
-          chand->creds->processor.state, chand->auth_context,
-          calld->md.metadata, calld->md.count, on_md_processing_done, elem);
+      chand->creds->auth_metadata_processor().process(
+          chand->creds->auth_metadata_processor().state,
+          chand->auth_context.get(), calld->md.metadata, calld->md.count,
+          on_md_processing_done, elem);
       return;
     }
   }
@@ -290,23 +296,19 @@ static void destroy_call_elem(grpc_call_element* elem,
 static grpc_error* init_channel_elem(grpc_channel_element* elem,
                                      grpc_channel_element_args* args) {
   GPR_ASSERT(!args->is_last);
-  channel_data* chand = static_cast<channel_data*>(elem->channel_data);
   grpc_auth_context* auth_context =
       grpc_find_auth_context_in_args(args->channel_args);
   GPR_ASSERT(auth_context != nullptr);
-  chand->auth_context =
-      GRPC_AUTH_CONTEXT_REF(auth_context, "server_auth_filter");
   grpc_server_credentials* creds =
       grpc_find_server_credentials_in_args(args->channel_args);
-  chand->creds = grpc_server_credentials_ref(creds);
+  new (elem->channel_data) channel_data(auth_context, creds);
   return GRPC_ERROR_NONE;
 }
 
 /* Destructor for channel data */
 static void destroy_channel_elem(grpc_channel_element* elem) {
   channel_data* chand = static_cast<channel_data*>(elem->channel_data);
-  GRPC_AUTH_CONTEXT_UNREF(chand->auth_context, "server_auth_filter");
-  grpc_server_credentials_unref(chand->creds);
+  chand->~channel_data();
 }
 
 const grpc_channel_filter grpc_server_auth_filter = {