Skip to content

Commit c788f29

Browse files
committed
Add human workflow
1 parent d460444 commit c788f29

File tree

6 files changed

+809
-76
lines changed

6 files changed

+809
-76
lines changed

driver-core/src/main/com/mongodb/MongoCredential.java

Lines changed: 112 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
import java.util.Arrays;
2626
import java.util.Collections;
2727
import java.util.HashMap;
28+
import java.util.List;
2829
import java.util.Map;
2930
import java.util.Objects;
3031

@@ -187,7 +188,8 @@ public final class MongoCredential {
187188
* The provider name. The value must be a string.
188189
* <p>
189190
* If this is provided,
190-
* {@link MongoCredential#OIDC_CALLBACK_KEY}
191+
* {@link MongoCredential#OIDC_CALLBACK_KEY} and
192+
* {@link MongoCredential#OIDC_HUMAN_CALLBACK_KEY}
191193
* must not be provided.
192194
*
193195
* @see #createOidcCredential(String)
@@ -197,17 +199,59 @@ public final class MongoCredential {
197199

198200
/**
199201
* This callback is invoked when the OIDC-based authenticator requests
200-
* tokens from the identity provider. The type of the value must be
201-
* {@link OidcRequestCallback}.
202+
* a token. The type of the value must be {@link OidcCallback}.
203+
* {@link IdpInfo} will not be supplied to the callback, and a refresh
204+
* token must not be returned by the callback.
202205
* <p>
203206
* If this is provided, {@link MongoCredential#PROVIDER_NAME_KEY}
207+
* and {@link MongoCredential#OIDC_HUMAN_CALLBACK_KEY}
204208
* must not be provided.
205209
*
206210
* @see #createOidcCredential(String)
207211
* @since 4.10
208212
*/
209213
public static final String OIDC_CALLBACK_KEY = "OIDC_CALLBACK";
210214

215+
/**
216+
* This callback is invoked when the OIDC-based authenticator requests
217+
* a token from the identity provider (IDP) using the IDP information
218+
* from the MongoDB server. The type of the value must be
219+
* {@link OidcCallback}.
220+
* <p>
221+
* If this is provided, {@link MongoCredential#PROVIDER_NAME_KEY}
222+
* and {@link MongoCredential#OIDC_CALLBACK_KEY}
223+
* must not be provided.
224+
*
225+
* @see #createOidcCredential(String)
226+
* @since 4.10
227+
*/
228+
public static final String OIDC_HUMAN_CALLBACK_KEY = "OIDC_HUMAN_CALLBACK";
229+
230+
231+
/**
232+
* Mechanism key for a list of allowed hostnames or ip-addresses for MongoDB connections. Ports must be excluded.
233+
* The hostnames may include a leading "*." wildcard, which allows for matching (potentially nested) subdomains.
234+
* When MONGODB-OIDC authentication is attempted against a hostname that does not match any of list of allowed hosts
235+
* the driver will raise an error. The type of the value must be {@code List<String>}.
236+
*
237+
* @see MongoCredential#DEFAULT_ALLOWED_HOSTS
238+
* @see #createOidcCredential(String)
239+
* @since 4.10
240+
*/
241+
public static final String ALLOWED_HOSTS_KEY = "ALLOWED_HOSTS";
242+
243+
/**
244+
* The list of allowed hosts that will be used if no
245+
* {@link MongoCredential#ALLOWED_HOSTS_KEY} value is supplied.
246+
* The default allowed hosts are:
247+
* {@code "*.mongodb.net", "*.mongodb-dev.net", "*.mongodbgov.net", "localhost", "127.0.0.1", "::1"}
248+
*
249+
* @see #createOidcCredential(String)
250+
* @since 4.10
251+
*/
252+
public static final List<String> DEFAULT_ALLOWED_HOSTS = Collections.unmodifiableList(Arrays.asList(
253+
"*.mongodb.net", "*.mongodb-dev.net", "*.mongodbgov.net", "localhost", "127.0.0.1", "::1"));
254+
211255
/**
212256
* Creates a MongoCredential instance with an unspecified mechanism. The client will negotiate the best mechanism based on the
213257
* version of the server that the client is authenticating to.
@@ -365,6 +409,8 @@ public static MongoCredential createAwsCredential(@Nullable final String userNam
365409
* @see #withMechanismProperty(String, Object)
366410
* @see #PROVIDER_NAME_KEY
367411
* @see #OIDC_CALLBACK_KEY
412+
* @see #OIDC_HUMAN_CALLBACK_KEY
413+
* @see #ALLOWED_HOSTS_KEY
368414
* @mongodb.server.release 7.0
369415
*/
370416
public static MongoCredential createOidcCredential(@Nullable final String userName) {
@@ -593,10 +639,15 @@ public String toString() {
593639
}
594640

595641
/**
596-
* The context for the {@link OidcRequestCallback#onRequest(OidcRequestContext) OIDC request callback}.
642+
* The context for the {@link OidcCallback#onRequest(OidcCallbackContext) OIDC request callback}.
597643
*/
598644
@Evolving
599-
public interface OidcRequestContext {
645+
public interface OidcCallbackContext {
646+
/**
647+
* @return The OIDC Identity Provider's configuration that can be used to acquire an Access Token.
648+
*/
649+
@Nullable
650+
IdpInfo getIdpInfo();
600651

601652
/**
602653
* @return The timeout that this callback must complete within.
@@ -607,6 +658,12 @@ public interface OidcRequestContext {
607658
* @return The OIDC callback API version. Currently, version 1.
608659
*/
609660
int getVersion();
661+
662+
/**
663+
* @return The OIDC Refresh token supplied by a prior callback invocation.
664+
*/
665+
@Nullable
666+
String getRefreshToken();
610667
}
611668

612669
/**
@@ -616,27 +673,65 @@ public interface OidcRequestContext {
616673
* It does not have to be thread-safe, unless it is provided to multiple
617674
* MongoClients.
618675
*/
619-
public interface OidcRequestCallback {
676+
public interface OidcCallback {
620677
/**
621678
* @param context The context.
622679
* @return The response produced by an OIDC Identity Provider
623680
*/
624-
RequestCallbackResult onRequest(OidcRequestContext context);
681+
OidcCallbackResult onRequest(OidcCallbackContext context);
682+
}
683+
684+
/**
685+
* The OIDC Identity Provider's configuration that can be used to acquire an Access Token.
686+
*/
687+
@Evolving
688+
public interface IdpInfo {
689+
/**
690+
* @return URL which describes the Authorization Server. This identifier is the
691+
* iss of provided access tokens, and is viable for RFC8414 metadata
692+
* discovery and RFC9207 identification.
693+
*/
694+
String getIssuer();
695+
696+
/**
697+
* @return Unique client ID for this OIDC client.
698+
*/
699+
String getClientId();
700+
701+
/**
702+
* @return Additional scopes to request from Identity Provider. Immutable.
703+
*/
704+
List<String> getRequestScopes();
625705
}
626706

627707
/**
628708
* The response produced by an OIDC Identity Provider.
629709
*/
630-
public static final class RequestCallbackResult {
710+
@Evolving
711+
public static final class OidcCallbackResult {
631712

632713
private final String accessToken;
633714

715+
@Nullable
716+
private final String refreshToken;
717+
634718
/**
635719
* @param accessToken The OIDC access token
636720
*/
637-
public RequestCallbackResult(final String accessToken) {
721+
public OidcCallbackResult(final String accessToken) {
638722
notNull("accessToken", accessToken);
639723
this.accessToken = accessToken;
724+
this.refreshToken = null;
725+
}
726+
727+
/**
728+
* @param accessToken The OIDC access token
729+
* @param refreshToken The refresh token. If null, refresh will not be attempted.
730+
*/
731+
public OidcCallbackResult(final String accessToken, @Nullable final String refreshToken) {
732+
notNull("accessToken", accessToken);
733+
this.accessToken = accessToken;
734+
this.refreshToken = refreshToken;
640735
}
641736

642737
/**
@@ -645,5 +740,13 @@ public RequestCallbackResult(final String accessToken) {
645740
public String getAccessToken() {
646741
return accessToken;
647742
}
743+
744+
/**
745+
* @return The OIDC refresh token. If null, refresh will not be attempted.
746+
*/
747+
@Nullable
748+
public String getRefreshToken() {
749+
return refreshToken;
750+
}
648751
}
649752
}

0 commit comments

Comments
 (0)