Skip to content

Commit b277316

Browse files
committed
Cleanup, update since annotations, updates to match spec API
1 parent 0f0a5ef commit b277316

File tree

3 files changed

+88
-56
lines changed

3 files changed

+88
-56
lines changed

driver-core/src/main/com/mongodb/MongoCredential.java

Lines changed: 38 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -194,23 +194,23 @@ public final class MongoCredential {
194194
* must not be provided.
195195
*
196196
* @see #createOidcCredential(String)
197-
* @since 4.10
197+
* @since 5.1
198198
*/
199199
public static final String ENVIRONMENT_KEY = "ENVIRONMENT";
200200

201201
/**
202202
* This callback is invoked when the OIDC-based authenticator requests
203203
* a token. The type of the value must be {@link OidcCallback}.
204204
* {@link IdpInfo} will not be supplied to the callback,
205-
* and a {@linkplain OidcCallbackResult#getRefreshToken() refresh token}
205+
* and a {@linkplain com.mongodb.MongoCredential.OidcTokens#getRefreshToken() refresh token}
206206
* must not be returned by the callback.
207207
* <p>
208208
* If this is provided, {@link MongoCredential#ENVIRONMENT_KEY}
209209
* and {@link MongoCredential#OIDC_HUMAN_CALLBACK_KEY}
210210
* must not be provided.
211211
*
212212
* @see #createOidcCredential(String)
213-
* @since 4.10
213+
* @since 5.1
214214
*/
215215
public static final String OIDC_CALLBACK_KEY = "OIDC_CALLBACK";
216216

@@ -225,7 +225,7 @@ public final class MongoCredential {
225225
* must not be provided.
226226
*
227227
* @see #createOidcCredential(String)
228-
* @since 4.10
228+
* @since 5.1
229229
*/
230230
public static final String OIDC_HUMAN_CALLBACK_KEY = "OIDC_HUMAN_CALLBACK";
231231

@@ -238,7 +238,7 @@ public final class MongoCredential {
238238
*
239239
* @see MongoCredential#DEFAULT_ALLOWED_HOSTS
240240
* @see #createOidcCredential(String)
241-
* @since 4.10
241+
* @since 5.1
242242
*/
243243
public static final String ALLOWED_HOSTS_KEY = "ALLOWED_HOSTS";
244244

@@ -249,15 +249,15 @@ public final class MongoCredential {
249249
* {@code "*.mongodb.net", "*.mongodb-qa.net", "*.mongodb-dev.net", "*.mongodbgov.net", "localhost", "127.0.0.1", "::1"}
250250
*
251251
* @see #createOidcCredential(String)
252-
* @since 4.10
252+
* @since 5.1
253253
*/
254254
public static final List<String> DEFAULT_ALLOWED_HOSTS = Collections.unmodifiableList(Arrays.asList(
255255
"*.mongodb.net", "*.mongodb-qa.net", "*.mongodb-dev.net", "*.mongodbgov.net", "localhost", "127.0.0.1", "::1"));
256256

257257
/**
258258
* The token resource.
259259
*
260-
* @since TODO-OIDC update all
260+
* @since 5.1
261261
*/
262262
public static final String TOKEN_RESOURCE_KEY = "TOKEN_RESOURCE";
263263

@@ -414,7 +414,7 @@ public static MongoCredential createAwsCredential(@Nullable final String userNam
414414
*
415415
* @param userName the user name, which may be null. This is the OIDC principal name.
416416
* @return the credential
417-
* @since 4.10
417+
* @since 5.1
418418
* @see #withMechanismProperty(String, Object)
419419
* @see #ENVIRONMENT_KEY
420420
* @see #OIDC_CALLBACK_KEY
@@ -650,14 +650,16 @@ public String toString() {
650650

651651
/**
652652
* The context for the {@link OidcCallback#onRequest(OidcCallbackContext) OIDC request callback}.
653+
*
654+
* @since 5.1
653655
*/
654656
@Evolving
655657
public interface OidcCallbackContext {
656658
/**
657-
* @return The OIDC Identity Provider's configuration that can be used to acquire an Access Token.
659+
* @return Convenience method to obtain the username.
658660
*/
659661
@Nullable
660-
IdpInfo getIdpInfo();
662+
String getUserName();
661663

662664
/**
663665
* @return The timeout that this callback must complete within.
@@ -669,6 +671,12 @@ public interface OidcCallbackContext {
669671
*/
670672
int getVersion();
671673

674+
/**
675+
* @return The OIDC Identity Provider's configuration that can be used to acquire an Access Token.
676+
*/
677+
@Nullable
678+
IdpInfo getIdpInfo();
679+
672680
/**
673681
* @return The OIDC Refresh token supplied by a prior callback invocation.
674682
*/
@@ -682,17 +690,21 @@ public interface OidcCallbackContext {
682690
* <p>
683691
* It does not have to be thread-safe, unless it is provided to multiple
684692
* MongoClients.
693+
*
694+
* @since 5.1
685695
*/
686696
public interface OidcCallback {
687697
/**
688698
* @param context The context.
689699
* @return The response produced by an OIDC Identity Provider
690700
*/
691-
OidcCallbackResult onRequest(OidcCallbackContext context);
701+
OidcTokens onRequest(OidcCallbackContext context);
692702
}
693703

694704
/**
695705
* The OIDC Identity Provider's configuration that can be used to acquire an Access Token.
706+
*
707+
* @since 5.1
696708
*/
697709
@Evolving
698710
public interface IdpInfo {
@@ -716,9 +728,11 @@ public interface IdpInfo {
716728
}
717729

718730
/**
719-
* The response produced by an OIDC Identity Provider.
731+
* The OIDC credential information.
732+
*
733+
* @since 5.1
720734
*/
721-
public static final class OidcCallbackResult {
735+
public static final class OidcTokens {
722736

723737
private final String accessToken;
724738

@@ -727,13 +741,22 @@ public static final class OidcCallbackResult {
727741
@Nullable
728742
private final String refreshToken;
729743

744+
745+
/**
746+
* An access token that does not expire.
747+
* @param accessToken The OIDC access token.
748+
*/
749+
public OidcTokens(final String accessToken) {
750+
this(accessToken, Duration.ZERO, null);
751+
}
752+
730753
/**
731754
* @param accessToken The OIDC access token.
732755
* @param expiresIn Time until the access token expires.
733756
* A {@linkplain Duration#isZero() zero-length} duration
734757
* means that the access token does not expire.
735758
*/
736-
public OidcCallbackResult(final String accessToken, final Duration expiresIn) {
759+
public OidcTokens(final String accessToken, final Duration expiresIn) {
737760
this(accessToken, expiresIn, null);
738761
}
739762

@@ -744,7 +767,7 @@ public OidcCallbackResult(final String accessToken, final Duration expiresIn) {
744767
* means that the access token does not expire.
745768
* @param refreshToken The refresh token. If null, refresh will not be attempted.
746769
*/
747-
public OidcCallbackResult(final String accessToken, final Duration expiresIn,
770+
public OidcTokens(final String accessToken, final Duration expiresIn,
748771
@Nullable final String refreshToken) {
749772
notNull("accessToken", accessToken);
750773
notNull("expiresIn", expiresIn);

driver-core/src/main/com/mongodb/internal/connection/OidcAuthenticator.java

Lines changed: 32 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@
2121
import com.mongodb.MongoCommandException;
2222
import com.mongodb.MongoConfigurationException;
2323
import com.mongodb.MongoCredential;
24-
import com.mongodb.MongoCredential.OidcCallbackResult;
24+
import com.mongodb.MongoCredential.OidcTokens;
2525
import com.mongodb.MongoException;
2626
import com.mongodb.MongoSecurityException;
2727
import com.mongodb.ServerAddress;
@@ -192,7 +192,7 @@ private OidcCallback getRequestCallback() {
192192
public static OidcCallback getTestCallback() {
193193
return (context) -> {
194194
String accessToken = readTestTokenFromFile();
195-
return new OidcCallbackResult(accessToken, Duration.ZERO);
195+
return new OidcTokens(accessToken);
196196
};
197197
}
198198

@@ -202,7 +202,7 @@ public static OidcCallback getAzureCallback(final MongoCredential credential) {
202202
String resource = assertNotNull(credential.getMechanismProperty(TOKEN_RESOURCE_KEY, null));
203203
String objectId = credential.getUserName();
204204
CredentialInfo response = AzureCredentialHelper.fetchAzureCredentialInfo(resource, objectId);
205-
return new OidcCallbackResult(response.getAccessToken(), response.getExpiresIn());
205+
return new OidcTokens(response.getAccessToken(), response.getExpiresIn());
206206
};
207207
}
208208

@@ -211,7 +211,7 @@ public static OidcCallback getGcpCallback(final MongoCredential credential) {
211211
return (context) -> {
212212
String resource = assertNotNull(credential.getMechanismProperty(TOKEN_RESOURCE_KEY, null));
213213
CredentialInfo response = GcpCredentialHelper.fetchGcpCredentialInfo(resource);
214-
return new OidcCallbackResult(response.getAccessToken(), response.getExpiresIn());
214+
return new OidcTokens(response.getAccessToken(), response.getExpiresIn());
215215
};
216216
}
217217

@@ -289,6 +289,7 @@ private byte[] evaluate(final byte[] challenge) {
289289
String cachedAccessToken = validatedCachedAccessToken();
290290
OidcCallback requestCallback = getRequestCallback();
291291
boolean isHuman = isHumanCallback();
292+
String userName = getMongoCredentialWithCache().getCredential().getUserName();
292293

293294
if (cachedAccessToken != null) {
294295
fallbackState = FallbackState.PHASE_1_CACHED_TOKEN;
@@ -299,17 +300,17 @@ private byte[] evaluate(final byte[] challenge) {
299300
assertNotNull(cachedIdpInfo);
300301
// Invoke Callback using cached Refresh Token
301302
fallbackState = FallbackState.PHASE_2_REFRESH_CALLBACK_TOKEN;
302-
OidcCallbackResult result = requestCallback.onRequest(new OidcCallbackContextImpl(
303-
CALLBACK_TIMEOUT, cachedIdpInfo, cachedRefreshToken));
303+
OidcTokens result = requestCallback.onRequest(new OidcCallbackContextImpl(
304+
CALLBACK_TIMEOUT, cachedIdpInfo, cachedRefreshToken, userName));
304305
jwt[0] = populateCacheWithCallbackResultAndPrepareJwt(cachedIdpInfo, result);
305306
} else {
306307
// cache is empty
307308

308309
if (!isHuman) {
309310
// no principal request
310311
fallbackState = FallbackState.PHASE_3B_CALLBACK_TOKEN;
311-
OidcCallbackResult result = requestCallback.onRequest(new OidcCallbackContextImpl(
312-
CALLBACK_TIMEOUT));
312+
OidcTokens result = requestCallback.onRequest(new OidcCallbackContextImpl(
313+
CALLBACK_TIMEOUT, userName));
313314
jwt[0] = populateCacheWithCallbackResultAndPrepareJwt(null, result);
314315
if (result.getRefreshToken() != null) {
315316
throw new MongoConfigurationException(
@@ -333,13 +334,13 @@ private byte[] evaluate(final byte[] challenge) {
333334
if (!alreadyTriedPrincipal && idpInfoNotPresent) {
334335
// request for idp info, only in the human workflow
335336
fallbackState = FallbackState.PHASE_3A_PRINCIPAL;
336-
jwt[0] = prepareUsername(getMongoCredentialWithCache().getCredential().getUserName());
337+
jwt[0] = prepareUsername(userName);
337338
} else {
338339
IdpInfo idpInfo = toIdpInfo(challenge);
339340
// there is no cached refresh token
340341
fallbackState = FallbackState.PHASE_3B_CALLBACK_TOKEN;
341-
OidcCallbackResult result = requestCallback.onRequest(new OidcCallbackContextImpl(
342-
CALLBACK_TIMEOUT, idpInfo, null));
342+
OidcTokens result = requestCallback.onRequest(new OidcCallbackContextImpl(
343+
CALLBACK_TIMEOUT, idpInfo, null, userName));
343344
jwt[0] = populateCacheWithCallbackResultAndPrepareJwt(idpInfo, result);
344345
}
345346
}
@@ -499,14 +500,14 @@ private static String readTestTokenFromFile() {
499500

500501
private byte[] populateCacheWithCallbackResultAndPrepareJwt(
501502
@Nullable final IdpInfo serverInfo,
502-
@Nullable final OidcCallbackResult oidcCallbackResult) {
503-
if (oidcCallbackResult == null) {
503+
@Nullable final OidcTokens oidcTokens) {
504+
if (oidcTokens == null) {
504505
throw new MongoConfigurationException("Result of callback must not be null");
505506
}
506-
OidcCacheEntry newEntry = new OidcCacheEntry(oidcCallbackResult.getAccessToken(),
507-
oidcCallbackResult.getRefreshToken(), serverInfo);
507+
OidcCacheEntry newEntry = new OidcCacheEntry(oidcTokens.getAccessToken(),
508+
oidcTokens.getRefreshToken(), serverInfo);
508509
getMongoCredentialWithCache().setOidcCacheEntry(newEntry);
509-
return prepareTokenAsJwt(oidcCallbackResult.getAccessToken());
510+
return prepareTokenAsJwt(oidcTokens.getAccessToken());
510511
}
511512

512513
private static byte[] prepareUsername(@Nullable final String username) {
@@ -663,20 +664,26 @@ static class OidcCallbackContextImpl implements OidcCallbackContext {
663664
private final IdpInfo idpInfo;
664665
@Nullable
665666
private final String refreshToken;
667+
@Nullable
668+
private final String userName;
666669

667-
OidcCallbackContextImpl(final Duration timeout) {
670+
OidcCallbackContextImpl(final Duration timeout, @Nullable final String userName) {
668671
this.timeout = assertNotNull(timeout);
669672
this.idpInfo = null;
670673
this.refreshToken = null;
674+
this.userName = userName;
671675
}
672676

673-
OidcCallbackContextImpl(final Duration timeout, final IdpInfo idpInfo, @Nullable final String refreshToken) {
677+
OidcCallbackContextImpl(final Duration timeout, final IdpInfo idpInfo,
678+
@Nullable final String refreshToken, @Nullable final String userName) {
674679
this.timeout = assertNotNull(timeout);
675680
this.idpInfo = assertNotNull(idpInfo);
676681
this.refreshToken = refreshToken;
682+
this.userName = userName;
677683
}
678684

679685
@Override
686+
@Nullable
680687
public IdpInfo getIdpInfo() {
681688
return idpInfo;
682689
}
@@ -692,9 +699,16 @@ public int getVersion() {
692699
}
693700

694701
@Override
702+
@Nullable
695703
public String getRefreshToken() {
696704
return refreshToken;
697705
}
706+
707+
@Override
708+
@Nullable
709+
public String getUserName() {
710+
return userName;
711+
}
698712
}
699713

700714
@VisibleForTesting(otherwise = VisibleForTesting.AccessModifier.PRIVATE)

0 commit comments

Comments
 (0)