Skip to content

Commit b03bfbc

Browse files
katcharovkatcharov
authored
Implement OIDC SASL mechanism in sync (#1107)
JAVA-4980
1 parent 77b549d commit b03bfbc

26 files changed

+2916
-139
lines changed

‎.evergreen/prepare-oidc-get-tokens-docker.sh

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
#!/bin/bash
2+
3+
set -o xtrace
4+
set -o errexit # Exit the script with error if any of the commands fail
5+
6+
############################################
7+
# Main Program #
8+
############################################
9+
10+
# Supported/used environment variables:
11+
# DRIVERS_TOOLS The path to evergreeen tools
12+
# OIDC_AWS_* Required OIDC_AWS_* env variables must be configured
13+
#
14+
# Environment variables used as output:
15+
# OIDC_TESTS_ENABLED Allows running OIDC tests
16+
# OIDC_TOKEN_DIR The path to generated OIDC AWS tokens
17+
# AWS_WEB_IDENTITY_TOKEN_FILE The path to AWS token for device workflow
18+
19+
if [ -z ${DRIVERS_TOOLS+x} ]; then
20+
echo "DRIVERS_TOOLS. is not set";
21+
exit 1
22+
fi
23+
24+
if [ -z ${OIDC_AWS_ROLE_ARN+x} ]; then
25+
echo "OIDC_AWS_ROLE_ARN. is not set";
26+
exit 1
27+
fi
28+
29+
if [ -z ${OIDC_AWS_SECRET_ACCESS_KEY+x} ]; then
30+
echo "OIDC_AWS_SECRET_ACCESS_KEY. is not set";
31+
exit 1
32+
fi
33+
34+
if [ -z ${OIDC_AWS_ACCESS_KEY_ID+x} ]; then
35+
echo "OIDC_AWS_ACCESS_KEY_ID. is not set";
36+
exit 1
37+
fi
38+
39+
export AWS_ROLE_ARN=${OIDC_AWS_ROLE_ARN}
40+
export AWS_SECRET_ACCESS_KEY=${OIDC_AWS_SECRET_ACCESS_KEY}
41+
export AWS_ACCESS_KEY_ID=${OIDC_AWS_ACCESS_KEY_ID}
42+
export OIDC_FOLDER=${DRIVERS_TOOLS}/.evergreen/auth_oidc
43+
export OIDC_TOKEN_DIR=${OIDC_FOLDER}/test_tokens
44+
export AWS_WEB_IDENTITY_TOKEN_FILE=${OIDC_TOKEN_DIR}/test1
45+
export OIDC_TESTS_ENABLED=true
46+
47+
echo "Configuring OIDC server for local authentication tests"
48+
49+
cd ${OIDC_FOLDER}
50+
DRIVERS_TOOLS=${DRIVERS_TOOLS} ./oidc_get_tokens.sh

‎.evergreen/prepare-oidc-server-docker.sh

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
#!/bin/bash
2+
3+
set -o xtrace
4+
set -o errexit # Exit the script with error if any of the commands fail
5+
6+
############################################
7+
# Main Program #
8+
############################################
9+
10+
# Supported/used environment variables:
11+
# DRIVERS_TOOLS The path to evergreeen tools
12+
# OIDC_AWS_* OIDC_AWS_* env variables must be configured
13+
#
14+
# Environment variables used as output:
15+
# OIDC_TESTS_ENABLED Allows running OIDC tests
16+
# OIDC_TOKEN_DIR The path to generated tokens
17+
# AWS_WEB_IDENTITY_TOKEN_FILE The path to AWS token for device workflow
18+
19+
if [ -z ${DRIVERS_TOOLS+x} ]; then
20+
echo "DRIVERS_TOOLS. is not set";
21+
exit 1
22+
fi
23+
24+
if [ -z ${OIDC_AWS_ROLE_ARN+x} ]; then
25+
echo "OIDC_AWS_ROLE_ARN. is not set";
26+
exit 1
27+
fi
28+
29+
if [ -z ${OIDC_AWS_SECRET_ACCESS_KEY+x} ]; then
30+
echo "OIDC_AWS_SECRET_ACCESS_KEY. is not set";
31+
exit 1
32+
fi
33+
34+
if [ -z ${OIDC_AWS_ACCESS_KEY_ID+x} ]; then
35+
echo "OIDC_AWS_ACCESS_KEY_ID. is not set";
36+
exit 1
37+
fi
38+
39+
export AWS_ROLE_ARN=${OIDC_AWS_ROLE_ARN}
40+
export AWS_SECRET_ACCESS_KEY=${OIDC_AWS_SECRET_ACCESS_KEY}
41+
export AWS_ACCESS_KEY_ID=${OIDC_AWS_ACCESS_KEY_ID}
42+
export OIDC_FOLDER=${DRIVERS_TOOLS}/.evergreen/auth_oidc
43+
export OIDC_TOKEN_DIR=${OIDC_FOLDER}/test_tokens
44+
export AWS_WEB_IDENTITY_TOKEN_FILE=${OIDC_TOKEN_DIR}/test1
45+
export OIDC_TESTS_ENABLED=true
46+
47+
echo "Configuring OIDC server for local authentication tests"
48+
49+
cd ${OIDC_FOLDER}
50+
DRIVERS_TOOLS=${DRIVERS_TOOLS} ./start_local_server.sh

‎bson/src/test/unit/util/ThreadTestHelpers.java

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -31,15 +31,19 @@ private ThreadTestHelpers() {
3131
}
3232

3333
public static void executeAll(final int nThreads, final Runnable c) {
34+
executeAll(Collections.nCopies(nThreads, c).toArray(new Runnable[0]));
35+
}
36+
37+
public static void executeAll(final Runnable... runnables) {
3438
ExecutorService service = null;
3539
try {
36-
service = Executors.newFixedThreadPool(nThreads);
37-
CountDownLatch latch = new CountDownLatch(nThreads);
40+
service = Executors.newFixedThreadPool(runnables.length);
41+
CountDownLatch latch = new CountDownLatch(runnables.length);
3842
List<Throwable> failures = Collections.synchronizedList(new ArrayList<>());
39-
for (int i = 0; i < nThreads; i++) {
43+
for (final Runnable runnable : runnables) {
4044
service.submit(() -> {
4145
try {
42-
c.run();
46+
runnable.run();
4347
} catch (Throwable e) {
4448
failures.add(e);
4549
} finally {

‎driver-core/src/main/com/mongodb/AuthenticationMechanism.java

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,13 @@ public enum AuthenticationMechanism {
3737
*/
3838
MONGODB_AWS("MONGODB-AWS"),
3939

40+
/**
41+
* The MONGODB-OIDC mechanism.
42+
* @since 4.10
43+
* @mongodb.server.release 7.0
44+
*/
45+
MONGODB_OIDC("MONGODB-OIDC"),
46+
4047
/**
4148
* The MongoDB X.509 mechanism. This mechanism is available only with client certificates over SSL.
4249
*/

‎driver-core/src/main/com/mongodb/ConnectionString.java

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@
4040
import java.util.Set;
4141
import java.util.concurrent.TimeUnit;
4242

43+
import static com.mongodb.internal.connection.OidcAuthenticator.OidcValidator.validateCreateOidcCredential;
4344
import static java.lang.String.format;
4445
import static java.util.Arrays.asList;
4546
import static java.util.Collections.singletonList;
@@ -919,6 +920,10 @@ private MongoCredential createMongoCredentialWithMechanism(final AuthenticationM
919920
case MONGODB_AWS:
920921
credential = MongoCredential.createAwsCredential(userName, password);
921922
break;
923+
case MONGODB_OIDC:
924+
validateCreateOidcCredential(password);
925+
credential = MongoCredential.createOidcCredential(userName);
926+
break;
922927
default:
923928
throw new UnsupportedOperationException(format("The connection string contains an invalid authentication mechanism'. "
924929
+ "'%s' is not a supported authentication mechanism",

0 commit comments

Comments
 (0)