-
Notifications
You must be signed in to change notification settings - Fork 532
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
RUBY-3303 Add OIDC machine workflow auth
- Loading branch information
Showing
43 changed files
with
2,333 additions
and
379 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| #!/bin/bash | ||
| set -o xtrace # Write all commands first to stderr | ||
| set -o errexit # Exit the script with error if any of the commands fail | ||
|
|
||
| export AZUREOIDC_DRIVERS_TAR_FILE=/tmp/mongo-ruby-driver.tgz | ||
| tar czf $AZUREOIDC_DRIVERS_TAR_FILE . | ||
| export AZUREOIDC_TEST_CMD="source ./env.sh && ENVIRONMENT=azure RVM_RUBY=${RVM_RUBY} ./.evergreen/${TEST_SCRIPT}" | ||
| export PROJECT_DIRECTORY=$PROJECT_DIRECTORY | ||
| bash $DRIVERS_TOOLS/.evergreen/auth_oidc/azure/run-driver-test.sh |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| #!/bin/bash | ||
| set -o xtrace # Write all commands first to stderr | ||
| set -o errexit # Exit the script with error if any of the commands fail | ||
|
|
||
| export GCPOIDC_DRIVERS_TAR_FILE=/tmp/mongo-ruby-driver.tgz | ||
| tar czf $GCPOIDC_DRIVERS_TAR_FILE . | ||
| export GCPOIDC_TEST_CMD="source ./secrets-export.sh drivers/gcpoidc && ENVIRONMENT=gcp RVM_RUBY=${RVM_RUBY} ./.evergreen/${TEST_SCRIPT}" | ||
| export PROJECT_DIRECTORY=$PROJECT_DIRECTORY | ||
| bash $DRIVERS_TOOLS/.evergreen/auth_oidc/gcp/run-driver-test.sh |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,24 @@ | ||
| #!/bin/bash | ||
|
|
||
| set -ex | ||
|
|
||
| ENVIRONMENT=${ENVIRONMENT:-"test"} | ||
|
|
||
| . `dirname "$0"`/../spec/shared/shlib/distro.sh | ||
| . `dirname "$0"`/../spec/shared/shlib/set_env.sh | ||
| . `dirname "$0"`/functions.sh | ||
|
|
||
| set_env_vars | ||
| set_env_python | ||
| set_env_ruby | ||
|
|
||
| sudo apt-get -y install libyaml-dev cmake | ||
|
|
||
| bundle_install | ||
| bundle exec rspec -fd spec/integration/oidc/${ENVIRONMENT}_machine_auth_flow_prose_spec.rb | ||
|
|
||
| test_status=$? | ||
|
|
||
| kill_jruby | ||
|
|
||
| exit ${test_status} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| #!/bin/bash | ||
| set -o xtrace # Write all commands first to stderr | ||
| set -o errexit # Exit the script with error if any of the commands fail | ||
|
|
||
| source $DRIVERS_TOOLS/.evergreen/auth_oidc/secrets-export.sh | ||
| export PROJECT_DIRECTORY=$PROJECT_DIRECTORY | ||
| export ENVIRONMENT=$ENVIRONMENT | ||
| export AWS_WEB_IDENTITY_TOKEN_FILE=$OIDC_TOKEN_FILE | ||
| bash ./.evergreen/${TEST_SCRIPT} |
Empty file.
Submodule drivers-evergreen-tools
updated
57 files
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,94 @@ | ||
| # frozen_string_literal: true | ||
| # rubocop:todo all | ||
|
|
||
| # Copyright (C) 2024 MongoDB, Inc. | ||
| # | ||
| # Licensed under the Apache License, Version 2.0 (the "License"); | ||
| # you may not use this file except in compliance with the License. | ||
| # You may obtain a copy of the License at | ||
| # | ||
| # http://www.apache.org/licenses/LICENSE-2.0 | ||
| # | ||
| # Unless required by applicable law or agreed to in writing, software | ||
| # distributed under the License is distributed on an "AS IS" BASIS, | ||
| # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| # See the License for the specific language governing permissions and | ||
| # limitations under the License. | ||
|
|
||
| module Mongo | ||
| module Auth | ||
|
|
||
| # Defines behavior for OIDC authentication. | ||
| # | ||
| # @api private | ||
| class Oidc < Base | ||
| attr_reader :speculative_auth_result, :cache, :machine_workflow | ||
|
|
||
| # The authentication mechanism string. | ||
| # | ||
| # @since 2.20.0 | ||
| MECHANISM = 'MONGODB-OIDC'.freeze | ||
|
|
||
| # Initializes the OIDC authenticator. | ||
| # | ||
| # @param [ Auth::User ] user The user to authenticate. | ||
| # @param [ Mongo::Connection ] connection The connection to authenticate over. | ||
| # | ||
| # @option opts [ BSON::Document | nil ] speculative_auth_result The | ||
| # value of speculativeAuthenticate field of hello response of | ||
| # the handshake on the specified connection. | ||
| def initialize(user, connection, **opts) | ||
| super | ||
| @cache = TokenCache.new | ||
| @speculative_auth_result = opts[:speculative_auth_result] | ||
| @machine_workflow = MachineWorkflow::new( | ||
| auth_mech_properties: user.auth_mech_properties, | ||
| username: user.name | ||
| ) | ||
| end | ||
|
|
||
| # Log the user in on the current connection. | ||
| # | ||
| # @return [ BSON::Document ] The document of the authentication response. | ||
| def login | ||
| execute_workflow(connection: connection, conversation: conversation) | ||
| end | ||
|
|
||
| private | ||
|
|
||
| def execute_workflow(connection:, conversation:) | ||
| # If there is a cached access token, try to authenticate with it. If | ||
| # authentication fails with an Authentication error (18), | ||
| # invalidate the access token, fetch a new access token, and try | ||
| # to authenticate again. | ||
| # If the server fails for any other reason, do not clear the cache. | ||
| if cache.access_token? | ||
| token = cache.access_token | ||
| msg = conversation.start(connection: connection, token: token) | ||
| begin | ||
| dispatch_msg(connection, conversation, msg) | ||
| rescue AuthError => error | ||
| cache.invalidate(token: token) | ||
| execute_workflow(connection: connection, conversation: conversation) | ||
| end | ||
| end | ||
| # This is the normal flow when no token is in the cache. Execute the | ||
| # machine callback to get the token, put it in the caches, and then | ||
| # send the saslStart to the server. | ||
| token = machine_workflow.execute | ||
| if token.nil? || !token[:access_token] | ||
| raise Error::OidcError, | ||
| "OIDC machine workflows must return a valid response with an access token but #{token} was returned" | ||
| end | ||
| cache.access_token = token[:access_token] | ||
| connection.access_token = token[:access_token] | ||
| msg = conversation.start(connection: connection, token: token[:access_token]) | ||
| dispatch_msg(connection, conversation, msg) | ||
| end | ||
| end | ||
| end | ||
| end | ||
|
|
||
| require 'mongo/auth/oidc/conversation' | ||
| require 'mongo/auth/oidc/machine_workflow' | ||
| require 'mongo/auth/oidc/token_cache' |
Oops, something went wrong.