Skip to content

Commit cb453cb

Browse files
rustagirrustagir
committed
DOCSP-40133: custom auth provider (#163)
* DOCSP-40133: custom auth provider * wip * vale * fixes * updates * add to wn * wip RW tech comments * RW comments * fix * fix * RW comments (cherry picked from commit e21986b)
1 parent 1a3573a commit cb453cb

File tree

5 files changed

+147
-6
lines changed

5 files changed

+147
-6
lines changed

‎source/includes/security/AwsAssumeRoleCredentialProvider.java

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
package com.mongodb;
2+
3+
import java.util.Map;
4+
import java.util.function.Supplier;
5+
6+
import com.mongodb.kafka.connect.util.custom.credentials.CustomCredentialProvider;
7+
8+
import com.amazonaws.auth.AWSCredentialsProvider;
9+
import com.amazonaws.auth.DefaultAWSCredentialsProviderChain;
10+
import com.amazonaws.services.securitytoken.AWSSecurityTokenService;
11+
import com.amazonaws.services.securitytoken.AWSSecurityTokenServiceAsyncClientBuilder;
12+
import com.amazonaws.services.securitytoken.model.AssumeRoleRequest;
13+
import com.amazonaws.services.securitytoken.model.AssumeRoleResult;
14+
import com.amazonaws.services.securitytoken.model.Credentials;
15+
import com.amazonaws.util.StringUtils;
16+
17+
public class SampleAssumeRoleCredential implements CustomCredentialProvider {
18+
19+
public SampleAssumeRoleCredential() {}
20+
@Override
21+
public MongoCredential getCustomCredential(Map<?, ?> map) {
22+
AWSCredentialsProvider provider = new DefaultAWSCredentialsProviderChain();
23+
Supplier<AwsCredential> awsFreshCredentialSupplier = () -> {
24+
AWSSecurityTokenService stsClient = AWSSecurityTokenServiceAsyncClientBuilder.standard()
25+
.withCredentials(provider)
26+
.withRegion("us-east-1")
27+
.build();
28+
AssumeRoleRequest assumeRoleRequest = new AssumeRoleRequest().withDurationSeconds(3600)
29+
.withRoleArn((String)map.get("mongodbaws.auth.mechanism.roleArn"))
30+
.withRoleSessionName("Test_Session");
31+
AssumeRoleResult assumeRoleResult = stsClient.assumeRole(assumeRoleRequest);
32+
Credentials creds = assumeRoleResult.getCredentials();
33+
// Add your code to fetch new credentials
34+
return new AwsCredential(creds.getAccessKeyId(), creds.getSecretAccessKey(), creds.getSessionToken());
35+
};
36+
return MongoCredential.createAwsCredential(null, null)
37+
.withMechanismProperty(MongoCredential.AWS_CREDENTIAL_PROVIDER_KEY, awsFreshCredentialSupplier);
38+
}
39+
40+
// Validates presence of an ARN
41+
@Override
42+
public void validate(Map<?, ?> map) {
43+
String roleArn = (String) map.get("mongodbaws.auth.mechanism.roleArn");
44+
if (StringUtils.isNullOrEmpty(roleArn)) {
45+
throw new RuntimeException("Invalid value set for customProperty");
46+
}
47+
}
48+
49+
// Initializes the custom provider
50+
@Override
51+
public void init(Map<?, ?> map) {
52+
53+
}
54+
}

‎source/security-and-authentication.txt

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,10 +10,11 @@ Security and Authentication
1010

1111
SSL/TLS and X.509 Certificates </security-and-authentication/tls-and-x509>
1212
MongoDB AWS-based Authentication </security-and-authentication/mongodb-aws-auth>
13+
Custom Authentication Provider </security-and-authentication/custom-auth>
1314

1415
Read the following sections to learn how to secure communications between MongoDB
1516
and the {+connector+}:
1617

17-
- :doc:`Encrypt the Messages Your Connector Sends with SSL/TLS </security-and-authentication/tls-and-x509>`
18-
- :doc:`Authenticate Your Connector with MongoDB using Amazon Web Services </security-and-authentication/mongodb-aws-auth>`
19-
18+
- :ref:`Encrypt the Messages Your Connector Sends with SSL/TLS <kafka-configure-ssl>`
19+
- :ref:`Authenticate Your Connector with MongoDB using Amazon Web Services <kafka-mongodb-aws>`
20+
- :ref:`Implement a Custom Authentication Provider <kafka-custom-auth>`

‎source/security-and-authentication/custom-auth.txt

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
.. _kafka-custom-auth:
2+
3+
==============================
4+
Custom Authentication Provider
5+
==============================
6+
7+
.. facet::
8+
:name: genre
9+
:values: reference
10+
11+
.. meta::
12+
:keywords: credentials, implementation class, custom class
13+
14+
.. contents:: On this page
15+
:local:
16+
:backlinks: none
17+
:depth: 2
18+
:class: singlecol
19+
20+
Overview
21+
--------
22+
23+
You can add a custom authentication provider by implementing the
24+
``com.mongodb.kafka.connect.util.custom.credentials.CustomCredentialProvider``
25+
interface. You must place your custom class JAR file in the ``lib`` folder
26+
in your {+kafka-connect+} deployment.
27+
28+
Set following authentication properties to configure the authentication
29+
provider:
30+
31+
- ``mongo.custom.auth.mechanism.enable``: set to ``true``
32+
- ``mongo.custom.auth.mechanism.providerClass``: set to the qualified
33+
class name of the implementation class
34+
- *(Optional)* ``mongodbaws.auth.mechanism.roleArn``: set to an Amazon Resource Name (ARN)
35+
36+
AWS IAM Authentication Example
37+
------------------------------
38+
39+
This example provides a custom authentication provider that supports AWS
40+
IAM. The following code shows the custom authentication
41+
provider JAR file:
42+
43+
.. literalinclude:: /includes/security/AwsAssumeRoleCredentialProvider.java
44+
:language: java
45+
46+
Compile the JAR file and place it in the ``lib`` folder in your
47+
deployment.
48+
49+
.. note::
50+
51+
To view an example of a ``pom.xml`` file that can build the complete JAR containing
52+
the implementation class, see the `Kafka Connector GitHub repository
53+
README file
54+
<https://github.com/mongodb/mongo-kafka/blob/master/README.md#pom-file-to-build-the-sample-customroleprovider-into-a-jar>`__.
55+
56+
Next, configure your source or sink connector to include the custom
57+
authentication method. The following configuration properties define a
58+
sink connector that connects the {+connector-short+} to MongoDB Atlas
59+
by using AWS IAM authentication:
60+
61+
.. code-block:: json
62+
:emphasize-lines: 12-14
63+
64+
{
65+
"name": "mongo-tutorial-sink",
66+
"config": {
67+
"connector.class": "com.mongodb.kafka.connect.MongoSinkConnector",
68+
"topics": "<topic>",
69+
"connection.uri": "<connection string>?authSource=%24external&authMechanism=MONGODB-AWS&retryWrites=true&w=majority",
70+
"key.converter": "org.apache.kafka.connect.storage.StringConverter",
71+
"value.converter": "org.apache.kafka.connect.json.JsonConverter",
72+
"value.converter.schemas.enable": false,
73+
"database": "<db>",
74+
"collection": "<collection>",
75+
"mongo.custom.auth.mechanism.enable": "true",
76+
"mongo.custom.auth.mechanism.providerClass": "com.mongodb.SampleAssumeRoleCredential",
77+
"mongodbaws.auth.mechanism.roleArn": "<AWS IAM ARN>"
78+
}
79+
}
80+
81+
In this example, the ``roleArn`` value is the IAM Role of the user group that has
82+
access to MongoDB Atlas. In the AWS IAM console, the IAM account that is
83+
running {+kafka-connect+} has ``AssumeRole`` permissions to the Atlas User Group.

‎source/security-and-authentication/mongodb-aws-auth.txt

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,3 +79,8 @@ replace:
7979
and placeholder value.
8080
| *Optional*
8181

82+
.. tip:: Custom Authentication Provider
83+
84+
You can create and use a custom authentication provider to support
85+
AWS IAM authentication. To learn more, see the
86+
:ref:`kafka-custom-auth` guide.

‎source/whats-new.txt

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -47,9 +47,7 @@ What's New in 1.13
4747

4848
- Added a custom authentication provider interface for Source and Sink
4949
Connectors. This feature enables you to write and use a custom implementation
50-
class in your connector.
51-
52-
.. TODO add link To learn more, see the :ref:`` guide.
50+
class in your connector. To learn more, see the :ref:`kafka-custom-auth` guide.
5351

5452
- Fixed an issue that occurred when validating configuration for Source
5553
and Sink Connectors if the configuration contained secrets and used

0 commit comments

Comments
 (0)