25
25
import java .util .Arrays ;
26
26
import java .util .Collections ;
27
27
import java .util .HashMap ;
28
+ import java .util .List ;
28
29
import java .util .Map ;
29
30
import java .util .Objects ;
30
31
@@ -187,7 +188,8 @@ public final class MongoCredential {
187
188
* The provider name. The value must be a string.
188
189
* <p>
189
190
* If this is provided,
190
- * {@link MongoCredential#OIDC_CALLBACK_KEY}
191
+ * {@link MongoCredential#OIDC_CALLBACK_KEY} and
192
+ * {@link MongoCredential#OIDC_HUMAN_CALLBACK_KEY}
191
193
* must not be provided.
192
194
*
193
195
* @see #createOidcCredential(String)
@@ -197,17 +199,59 @@ public final class MongoCredential {
197
199
198
200
/**
199
201
* This callback is invoked when the OIDC-based authenticator requests
200
- * tokens from the identity provider. The type of the value must be
201
- * {@link OidcRequestCallback}.
202
+ * a token. The type of the value must be {@link OidcCallback}.
203
+ * {@link IdpInfo} will not be supplied to the callback, and a refresh
204
+ * token must not be returned by the callback.
202
205
* <p>
203
206
* If this is provided, {@link MongoCredential#PROVIDER_NAME_KEY}
207
+ * and {@link MongoCredential#OIDC_HUMAN_CALLBACK_KEY}
204
208
* must not be provided.
205
209
*
206
210
* @see #createOidcCredential(String)
207
211
* @since 4.10
208
212
*/
209
213
public static final String OIDC_CALLBACK_KEY = "OIDC_CALLBACK" ;
210
214
215
+ /**
216
+ * This callback is invoked when the OIDC-based authenticator requests
217
+ * a token from the identity provider (IDP) using the IDP information
218
+ * from the MongoDB server. The type of the value must be
219
+ * {@link OidcCallback}.
220
+ * <p>
221
+ * If this is provided, {@link MongoCredential#PROVIDER_NAME_KEY}
222
+ * and {@link MongoCredential#OIDC_CALLBACK_KEY}
223
+ * must not be provided.
224
+ *
225
+ * @see #createOidcCredential(String)
226
+ * @since 4.10
227
+ */
228
+ public static final String OIDC_HUMAN_CALLBACK_KEY = "OIDC_HUMAN_CALLBACK" ;
229
+
230
+
231
+ /**
232
+ * Mechanism key for a list of allowed hostnames or ip-addresses for MongoDB connections. Ports must be excluded.
233
+ * The hostnames may include a leading "*." wildcard, which allows for matching (potentially nested) subdomains.
234
+ * When MONGODB-OIDC authentication is attempted against a hostname that does not match any of list of allowed hosts
235
+ * the driver will raise an error. The type of the value must be {@code List<String>}.
236
+ *
237
+ * @see MongoCredential#DEFAULT_ALLOWED_HOSTS
238
+ * @see #createOidcCredential(String)
239
+ * @since 4.10
240
+ */
241
+ public static final String ALLOWED_HOSTS_KEY = "ALLOWED_HOSTS" ;
242
+
243
+ /**
244
+ * The list of allowed hosts that will be used if no
245
+ * {@link MongoCredential#ALLOWED_HOSTS_KEY} value is supplied.
246
+ * The default allowed hosts are:
247
+ * {@code "*.mongodb.net", "*.mongodb-dev.net", "*.mongodbgov.net", "localhost", "127.0.0.1", "::1"}
248
+ *
249
+ * @see #createOidcCredential(String)
250
+ * @since 4.10
251
+ */
252
+ public static final List <String > DEFAULT_ALLOWED_HOSTS = Collections .unmodifiableList (Arrays .asList (
253
+ "*.mongodb.net" , "*.mongodb-dev.net" , "*.mongodbgov.net" , "localhost" , "127.0.0.1" , "::1" ));
254
+
211
255
/**
212
256
* Creates a MongoCredential instance with an unspecified mechanism. The client will negotiate the best mechanism based on the
213
257
* version of the server that the client is authenticating to.
@@ -365,6 +409,8 @@ public static MongoCredential createAwsCredential(@Nullable final String userNam
365
409
* @see #withMechanismProperty(String, Object)
366
410
* @see #PROVIDER_NAME_KEY
367
411
* @see #OIDC_CALLBACK_KEY
412
+ * @see #OIDC_HUMAN_CALLBACK_KEY
413
+ * @see #ALLOWED_HOSTS_KEY
368
414
* @mongodb.server.release 7.0
369
415
*/
370
416
public static MongoCredential createOidcCredential (@ Nullable final String userName ) {
@@ -593,10 +639,15 @@ public String toString() {
593
639
}
594
640
595
641
/**
596
- * The context for the {@link OidcRequestCallback #onRequest(OidcRequestContext ) OIDC request callback}.
642
+ * The context for the {@link OidcCallback #onRequest(OidcCallbackContext ) OIDC request callback}.
597
643
*/
598
644
@ Evolving
599
- public interface OidcRequestContext {
645
+ public interface OidcCallbackContext {
646
+ /**
647
+ * @return The OIDC Identity Provider's configuration that can be used to acquire an Access Token.
648
+ */
649
+ @ Nullable
650
+ IdpInfo getIdpInfo ();
600
651
601
652
/**
602
653
* @return The timeout that this callback must complete within.
@@ -607,6 +658,12 @@ public interface OidcRequestContext {
607
658
* @return The OIDC callback API version. Currently, version 1.
608
659
*/
609
660
int getVersion ();
661
+
662
+ /**
663
+ * @return The OIDC Refresh token supplied by a prior callback invocation.
664
+ */
665
+ @ Nullable
666
+ String getRefreshToken ();
610
667
}
611
668
612
669
/**
@@ -616,27 +673,65 @@ public interface OidcRequestContext {
616
673
* It does not have to be thread-safe, unless it is provided to multiple
617
674
* MongoClients.
618
675
*/
619
- public interface OidcRequestCallback {
676
+ public interface OidcCallback {
620
677
/**
621
678
* @param context The context.
622
679
* @return The response produced by an OIDC Identity Provider
623
680
*/
624
- RequestCallbackResult onRequest (OidcRequestContext context );
681
+ OidcCallbackResult onRequest (OidcCallbackContext context );
682
+ }
683
+
684
+ /**
685
+ * The OIDC Identity Provider's configuration that can be used to acquire an Access Token.
686
+ */
687
+ @ Evolving
688
+ public interface IdpInfo {
689
+ /**
690
+ * @return URL which describes the Authorization Server. This identifier is the
691
+ * iss of provided access tokens, and is viable for RFC8414 metadata
692
+ * discovery and RFC9207 identification.
693
+ */
694
+ String getIssuer ();
695
+
696
+ /**
697
+ * @return Unique client ID for this OIDC client.
698
+ */
699
+ String getClientId ();
700
+
701
+ /**
702
+ * @return Additional scopes to request from Identity Provider. Immutable.
703
+ */
704
+ List <String > getRequestScopes ();
625
705
}
626
706
627
707
/**
628
708
* The response produced by an OIDC Identity Provider.
629
709
*/
630
- public static final class RequestCallbackResult {
710
+ @ Evolving
711
+ public static final class OidcCallbackResult {
631
712
632
713
private final String accessToken ;
633
714
715
+ @ Nullable
716
+ private final String refreshToken ;
717
+
634
718
/**
635
719
* @param accessToken The OIDC access token
636
720
*/
637
- public RequestCallbackResult (final String accessToken ) {
721
+ public OidcCallbackResult (final String accessToken ) {
638
722
notNull ("accessToken" , accessToken );
639
723
this .accessToken = accessToken ;
724
+ this .refreshToken = null ;
725
+ }
726
+
727
+ /**
728
+ * @param accessToken The OIDC access token
729
+ * @param refreshToken The refresh token. If null, refresh will not be attempted.
730
+ */
731
+ public OidcCallbackResult (final String accessToken , @ Nullable final String refreshToken ) {
732
+ notNull ("accessToken" , accessToken );
733
+ this .accessToken = accessToken ;
734
+ this .refreshToken = refreshToken ;
640
735
}
641
736
642
737
/**
@@ -645,5 +740,13 @@ public RequestCallbackResult(final String accessToken) {
645
740
public String getAccessToken () {
646
741
return accessToken ;
647
742
}
743
+
744
+ /**
745
+ * @return The OIDC refresh token. If null, refresh will not be attempted.
746
+ */
747
+ @ Nullable
748
+ public String getRefreshToken () {
749
+ return refreshToken ;
750
+ }
648
751
}
649
752
}
0 commit comments