Skip to content

Commit 35879f6

Browse files
durrandurran
authored
feat(NODE-5035): enable OIDC authentication (#3577)
1 parent 9f32721 commit 35879f6

23 files changed

+1847
-659
lines changed

‎.evergreen/config.in.yml‎

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -106,11 +106,6 @@ functions:
106106
shell: bash
107107
script: |
108108
${PREPARE_SHELL}
109-
110-
# TODO(NODE-5035): Remove when merged - need to replace with branch just for OIDC.
111-
rm -rf "${DRIVERS_TOOLS}"
112-
git clone --branch DRIVERS-2415 https://github.com/blink1073/drivers-evergreen-tools.git "${DRIVERS_TOOLS}"
113-
114109
cd "${DRIVERS_TOOLS}"/.evergreen/auth_oidc
115110
116111
# This is a bit confusing but the ec2.assume_role command before
@@ -121,9 +116,9 @@ functions:
121116
export AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID}
122117
export AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY}
123118
export AWS_SESSION_TOKEN=${AWS_SESSION_TOKEN}
124-
export AWS_TOKEN_DIR=/tmp/tokens
119+
export OIDC_TOKEN_DIR=/tmp/tokens
125120
126-
. ./activate_venv.sh
121+
. ./activate-authoidcvenv.sh
127122
python oidc_write_orchestration.py
128123
python oidc_get_tokens.py
129124
@@ -147,6 +142,7 @@ functions:
147142
script: |
148143
${PREPARE_SHELL}
149144
145+
OIDC_TOKEN_DIR="/tmp/tokens" \
150146
AWS_WEB_IDENTITY_TOKEN_FILE="/tmp/tokens/test1" \
151147
PROJECT_DIRECTORY="${PROJECT_DIRECTORY}" \
152148
bash ${PROJECT_DIRECTORY}/.evergreen/run-oidc-tests.sh

‎.evergreen/config.yml‎

Lines changed: 23 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -79,11 +79,6 @@ functions:
7979
shell: bash
8080
script: |
8181
${PREPARE_SHELL}
82-
83-
# TODO(NODE-5035): Remove when merged - need to replace with branch just for OIDC.
84-
rm -rf "${DRIVERS_TOOLS}"
85-
git clone --branch DRIVERS-2415 https://github.com/blink1073/drivers-evergreen-tools.git "${DRIVERS_TOOLS}"
86-
8782
cd "${DRIVERS_TOOLS}"/.evergreen/auth_oidc
8883
8984
# This is a bit confusing but the ec2.assume_role command before
@@ -94,9 +89,9 @@ functions:
9489
export AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID}
9590
export AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY}
9691
export AWS_SESSION_TOKEN=${AWS_SESSION_TOKEN}
97-
export AWS_TOKEN_DIR=/tmp/tokens
92+
export OIDC_TOKEN_DIR=/tmp/tokens
9893
99-
. ./activate_venv.sh
94+
. ./activate-authoidcvenv.sh
10095
python oidc_write_orchestration.py
10196
python oidc_get_tokens.py
10297
setup oidc roles:
@@ -118,6 +113,7 @@ functions:
118113
script: |
119114
${PREPARE_SHELL}
120115
116+
OIDC_TOKEN_DIR="/tmp/tokens" \
121117
AWS_WEB_IDENTITY_TOKEN_FILE="/tmp/tokens/test1" \
122118
PROJECT_DIRECTORY="${PROJECT_DIRECTORY}" \
123119
bash ${PROJECT_DIRECTORY}/.evergreen/run-oidc-tests.sh
@@ -1478,6 +1474,22 @@ tasks:
14781474
commands:
14791475
- func: install dependencies
14801476
- func: run ldap tests
1477+
- name: test-auth-oidc
1478+
tags:
1479+
- latest
1480+
- replica_set
1481+
- oidc
1482+
commands:
1483+
- func: install dependencies
1484+
- func: bootstrap oidc
1485+
- func: bootstrap mongo-orchestration
1486+
vars:
1487+
VERSION: latest
1488+
TOPOLOGY: replica_set
1489+
AUTH: auth
1490+
ORCHESTRATION_FILE: auth-oidc.json
1491+
- func: setup oidc roles
1492+
- func: run oidc tests aws
14811493
- name: test-socks5
14821494
tags: []
14831495
commands:
@@ -3137,6 +3149,7 @@ buildvariants:
31373149
- test-latest-load-balanced
31383150
- test-auth-kerberos
31393151
- test-auth-ldap
3152+
- test-auth-oidc
31403153
- test-socks5
31413154
- test-socks5-csfle
31423155
- test-socks5-tls
@@ -3186,6 +3199,7 @@ buildvariants:
31863199
- test-latest-load-balanced
31873200
- test-auth-kerberos
31883201
- test-auth-ldap
3202+
- test-auth-oidc
31893203
- test-socks5
31903204
- test-socks5-csfle
31913205
- test-socks5-tls
@@ -3233,6 +3247,7 @@ buildvariants:
32333247
- test-latest-load-balanced
32343248
- test-auth-kerberos
32353249
- test-auth-ldap
3250+
- test-auth-oidc
32363251
- test-socks5
32373252
- test-socks5-csfle
32383253
- test-socks5-tls
@@ -3279,6 +3294,7 @@ buildvariants:
32793294
- test-6.0-load-balanced
32803295
- test-latest-load-balanced
32813296
- test-auth-ldap
3297+
- test-auth-oidc
32823298
- test-socks5-csfle
32833299
- test-socks5-tls
32843300
- test-tls-support-latest

‎.evergreen/generate_evergreen_tasks.js‎

Lines changed: 19 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -100,27 +100,6 @@ BASE_TASKS.push({
100100
]
101101
});
102102

103-
// TODO(NODE-5035): Bring back when implementing.
104-
// {
105-
// name: 'test-auth-oidc',
106-
// tags: ['latest', 'replica_set', 'oidc'],
107-
// commands: [
108-
// { func: 'install dependencies' },
109-
// { func: 'bootstrap oidc' },
110-
// {
111-
// func: 'bootstrap mongo-orchestration',
112-
// vars: {
113-
// VERSION: 'latest',
114-
// TOPOLOGY: 'replica_set',
115-
// AUTH: 'auth',
116-
// ORCHESTRATION_FILE: 'auth-oidc.json'
117-
// }
118-
// },
119-
// { func: 'setup oidc roles' },
120-
// { func: 'run oidc tests aws' }
121-
// ]
122-
// }
123-
124103
// manually added tasks
125104
TASKS.push(
126105
...[
@@ -204,6 +183,25 @@ TASKS.push(
204183
tags: ['auth', 'ldap'],
205184
commands: [{ func: 'install dependencies' }, { func: 'run ldap tests' }]
206185
},
186+
{
187+
name: 'test-auth-oidc',
188+
tags: ['latest', 'replica_set', 'oidc'],
189+
commands: [
190+
{ func: 'install dependencies' },
191+
{ func: 'bootstrap oidc' },
192+
{
193+
func: 'bootstrap mongo-orchestration',
194+
vars: {
195+
VERSION: 'latest',
196+
TOPOLOGY: 'replica_set',
197+
AUTH: 'auth',
198+
ORCHESTRATION_FILE: 'auth-oidc.json'
199+
}
200+
},
201+
{ func: 'setup oidc roles' },
202+
{ func: 'run oidc tests aws' }
203+
]
204+
},
207205
{
208206
name: 'test-socks5',
209207
tags: [],

‎.evergreen/setup-oidc-roles.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,6 @@ set -o errexit # Exit the script with error if any of the commands fail
33
set -o xtrace # Write all commands first to stderr
44

55
cd ${DRIVERS_TOOLS}/.evergreen/auth_oidc
6-
. ./activate_venv.sh
6+
. ./activate-authoidcvenv.sh
77

88
${DRIVERS_TOOLS}/mongodb/bin/mongosh setup_oidc.js

‎package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -128,7 +128,7 @@
128128
"check:atlas": "mocha --config test/manual/mocharc.json test/manual/atlas_connectivity.test.js",
129129
"check:adl": "mocha --config test/mocha_mongodb.json test/manual/atlas-data-lake-testing",
130130
"check:aws": "mocha --config test/mocha_mongodb.json test/integration/auth/mongodb_aws.test.ts",
131-
"check:oidc": "mocha --config test/mocha_mongodb.json test/integration/auth/mongodb_oidc.test.ts",
131+
"check:oidc": "mocha --config test/manual/mocharc.json test/manual/mongodb_oidc.prose.test.ts",
132132
"check:ocsp": "mocha --config test/manual/mocharc.json test/manual/ocsp_support.test.js",
133133
"check:kerberos": "mocha --config test/manual/mocharc.json test/manual/kerberos.test.js",
134134
"check:tls": "mocha --config test/manual/mocharc.json test/manual/tls_support.test.js",

‎src/cmap/auth/mongo_credentials.ts‎

Lines changed: 11 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -30,25 +30,16 @@ function getDefaultAuthMechanism(hello?: Document): AuthMechanism {
3030
return AuthMechanism.MONGODB_CR;
3131
}
3232

33-
/**
34-
* TODO: NODE-5035: Make OIDC properties public.
35-
*
36-
* @public
37-
* */
33+
/** @public */
3834
export interface AuthMechanismProperties extends Document {
3935
SERVICE_HOST?: string;
4036
SERVICE_NAME?: string;
4137
SERVICE_REALM?: string;
4238
CANONICALIZE_HOST_NAME?: GSSAPICanonicalizationValue;
4339
AWS_SESSION_TOKEN?: string;
44-
/** @internal Name for the OIDC device workflow */
45-
DEVICE_NAME?: 'aws' | 'azure' | 'gcp';
46-
/** @internal Similar to a username, is require by OIDC when more than one IDP is configured. */
47-
PRINCIPAL_NAME?: string;
48-
/** @internal User provided callback to get OIDC auth credentials */
4940
REQUEST_TOKEN_CALLBACK?: OIDCRequestFunction;
50-
/** @internal User provided callback to refresh OIDC auth credentials */
5141
REFRESH_TOKEN_CALLBACK?: OIDCRefreshFunction;
42+
PROVIDER_NAME?: 'aws';
5243
}
5344

5445
/** @public */
@@ -155,21 +146,18 @@ export class MongoCredentials {
155146
}
156147

157148
if (this.mechanism === AuthMechanism.MONGODB_OIDC) {
158-
if (this.username) {
149+
if (this.username && this.mechanismProperties.PROVIDER_NAME) {
159150
throw new MongoInvalidArgumentError(
160-
`Username not permitted for mechanism '${this.mechanism}'. Use PRINCIPAL_NAME instead.`
151+
`username and PROVIDER_NAME may not be used together for mechanism '${this.mechanism}'.`
161152
);
162153
}
163154

164-
if (this.mechanismProperties.PRINCIPAL_NAME && this.mechanismProperties.DEVICE_NAME) {
165-
throw new MongoInvalidArgumentError(
166-
`PRINCIPAL_NAME and DEVICE_NAME may not be used together for mechanism '${this.mechanism}'.`
167-
);
168-
}
169-
170-
if (this.mechanismProperties.DEVICE_NAME && this.mechanismProperties.DEVICE_NAME !== 'aws') {
155+
if (
156+
this.mechanismProperties.PROVIDER_NAME &&
157+
this.mechanismProperties.PROVIDER_NAME !== 'aws'
158+
) {
171159
throw new MongoInvalidArgumentError(
172-
`Currently only a DEVICE_NAME of 'aws' is supported for mechanism '${this.mechanism}'.`
160+
`Currently only a PROVIDER_NAME of 'aws' is supported for mechanism '${this.mechanism}'.`
173161
);
174162
}
175163

@@ -183,11 +171,11 @@ export class MongoCredentials {
183171
}
184172

185173
if (
186-
!this.mechanismProperties.DEVICE_NAME &&
174+
!this.mechanismProperties.PROVIDER_NAME &&
187175
!this.mechanismProperties.REQUEST_TOKEN_CALLBACK
188176
) {
189177
throw new MongoInvalidArgumentError(
190-
`Either a DEVICE_NAME or a REQUEST_TOKEN_CALLBACK must be specified for mechanism '${this.mechanism}'.`
178+
`Either a PROVIDER_NAME or a REQUEST_TOKEN_CALLBACK must be specified for mechanism '${this.mechanism}'.`
191179
);
192180
}
193181
}

0 commit comments

Comments
 (0)