-
Notifications
You must be signed in to change notification settings - Fork 1.1k
PYTHON-3460 Implement OIDC SASL mechanism #1138
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from all commits
Commits
Show all changes
138 commits
Select commit
Hold shift + click to select a range
2381380
PYTHON-3460 Implement OIDC SASL mechanism
blink1073 5048aea
fix log cat
blink1073 17972eb
print tokens
blink1073 0380ded
try again
blink1073 950df79
undo comments
blink1073 ab10e68
test multiple principals
blink1073 e9a8992
fix handling of principal name
blink1073 883d427
try different token
blink1073 ccf5a3f
test with auth_oidc scripts
blink1073 be21e22
use bash shell
blink1073 1595f31
fix handling of python bin
blink1073 8bd23c6
do not cache aws device creds
blink1073 0e93762
remove skipping server step 1 and add todo
blink1073 eef2712
update handling of cache key
blink1073 8e5638e
fix clientId name
blink1073 905b89d
handle when there is no principal name
blink1073 43d49ad
handle device_name
blink1073 e93c4c0
add lock
blink1073 324437e
fix locking logic
blink1073 0ddeaf3
update for running both servers on the same replicaset
blink1073 b9c0d47
update oidc bootstrap
blink1073 50b72e1
Merge branch 'master' of github.com:mongodb/mongo-python-driver into …
blink1073 0313d6c
fix lint and typings
blink1073 b02a969
test 27017
blink1073 8d6d503
update for spec compliance
blink1073 1a12de9
add mechanism field
blink1073 f408386
clean up caching behavior
blink1073 b7f161a
typing fixes
blink1073 2826753
clean up caching behavior
blink1073 57046f8
cleanup
blink1073 9f4fb49
add handling of auth connection string tests
blink1073 62d78dc
add initial handling of reauth required
blink1073 8bff0ff
finish reauthentication
blink1073 35182f3
add timeout handling
blink1073 7ac2fed
fix connection string tests
blink1073 8ce95bc
add callback return validation
blink1073 0ecfba4
add more callback validation
blink1073 b42cc7d
fix function validation
blink1073 834c130
implement some prose tests
blink1073 818911d
add unified tests for reconnect
blink1073 3ccd850
update tests
blink1073 a59ba53
finish prose tests
blink1073 5f59c31
update docs and prose test on reauthentication
blink1073 2cc0a62
debug
blink1073 7479a24
debug
blink1073 caabfb6
try clearing auth_ctx
blink1073 b236f2a
try another way to re-auth
blink1073 eab4d83
try another way to re-auth
blink1073 933be5f
cleanup
blink1073 20aecb7
try again
blink1073 7ed72fe
try again
blink1073 c4c64bc
use username as principal name
blink1073 3acf277
add read and write reauth tests using failcommand
blink1073 0da3037
lint
blink1073 370ef94
add event listeners for reauth tests
blink1073 10e9f20
Merge branch 'master' of github.com:mongodb/mongo-python-driver into …
blink1073 0abc433
add changelog and example
blink1073 93a4884
clean up example
blink1073 b0d1e3b
clean up example
blink1073 256915a
clean up reauth handling
blink1073 51c6639
clean up server response
blink1073 b78e404
clean up config
blink1073 ce250de
typing
blink1073 3339837
clarify the supported auth types
blink1073 2c33731
use mongosh
blink1073 529cf63
add test for multiple principals and no username
blink1073 5f0fde0
add principal name to callbacks, and include callbacks in cache key
blink1073 765dde6
fix test
blink1073 6186ed9
update cache exp on access
blink1073 c2e91e2
switch to OIDC_TOKEN_DIR
blink1073 ca6dd7d
switch to activate-authoidcvenv.sh
blink1073 5f730ec
upgrade pip and setuptools
blink1073 f1998d6
remove reauth write prose test
blink1073 ba2253b
remove temp file
blink1073 b023041
use main drivers-evergreen-tools
blink1073 3b6288b
install xml and coverage
blink1073 a574237
better reauth support
blink1073 3607f72
Revert "install xml and coverage"
blink1073 75a707b
implement speculativeAuth for OIDC
blink1073 35fc668
fix errors
blink1073 3ceda8a
clarify reauth behavior
blink1073 6976ef8
fix speculativeAuth and add prose tests
blink1073 43a5269
update docstring
blink1073 40ed893
rename DEVICE_NAME to PRINCIPAL_NAME
blink1073 a46ba28
fix test runner
blink1073 c7df390
better reauth support
blink1073 02ce52d
add test numbering and new prose test
blink1073 28a804b
lint
blink1073 19dda74
wip clean up tests
blink1073 9c33a02
wip refractor with test headings
blink1073 c21771f
refactor prose tests
blink1073 bad4527
remove speculative auth error test
blink1073 7beac7a
Refactor to address review
blink1073 8c8088a
update for prose test clarifications
blink1073 6c45619
lint
blink1073 500c98f
allow for extra keys
blink1073 11261b9
validate callback results
blink1073 f4ebaf6
updates for security mitigations
blink1073 f584885
make allowed_hosts a mechanism property
blink1073 beb2b24
fix auth spec test
blink1073 6d3ebe2
Merge principal name and timeout into client info object
blink1073 e46047d
fix validation
blink1073 3454bab
fix auth spec test
blink1073 8e8912d
strip sasl commands
blink1073 2133125
clean up handling of allowed hosts
blink1073 e9024ec
add another allowed_host and update docs
blink1073 f522d0d
refactor and adjust allowed_hosts handling
blink1073 b0c0919
update callback parameters
blink1073 5828220
clear all info on reauth if no refresh callback
blink1073 a78ad30
add reauth guard
blink1073 ef991f9
wip better handling of reauth and locks
blink1073 4cf5110
add prose tests for reauth and lock guards
blink1073 a354ce6
use gen_id instead of datetimes
blink1073 66f2276
update callback parameters
blink1073 710add4
remove principal name from context
blink1073 b98aa5c
update for spec changes
blink1073 5fe805f
Merge branch 'master' of github.com:mongodb/mongo-python-driver into …
blink1073 eb3ced0
use unittest asserts
blink1073 c7d33b2
address review
blink1073 d23ef6b
address review
blink1073 b431cdc
address review
blink1073 504d2b1
Merge branch 'master' of github.com:mongodb/mongo-python-driver into …
blink1073 a089dc0
address review
blink1073 7c56888
try more bytes
blink1073 7bb678f
Revert "try more bytes"
blink1073 bd53fdc
wip better handling of reauth
blink1073 b13427e
Revert "wip better handling of reauth"
blink1073 8d24dd9
clean up reauth handling
blink1073 c73be94
lint
blink1073 1924f3e
lint
blink1073 770e4f6
always use for source
blink1073 828e22a
undo change to uri
blink1073 c719618
Revert "undo change to uri"
blink1073 1739968
address review
blink1073 f4d6f24
Merge branch 'master' of github.com:mongodb/mongo-python-driver into …
blink1073 cbadc70
fix uri
blink1073 109a204
fix handling of no_mongos
blink1073 7baf5a7
update schema version
blink1073 File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,85 @@ | ||
#!/bin/bash | ||
|
||
set -o xtrace | ||
set -o errexit # Exit the script with error if any of the commands fail | ||
|
||
############################################ | ||
# Main Program # | ||
############################################ | ||
|
||
# Supported/used environment variables: | ||
# MONGODB_URI Set the URI, including an optional username/password to use | ||
# to connect to the server via MONGODB-OIDC authentication | ||
# mechanism. | ||
# PYTHON_BINARY The Python version to use. | ||
|
||
echo "Running MONGODB-OIDC authentication tests" | ||
# ensure no secrets are printed in log files | ||
set +x | ||
|
||
# load the script | ||
shopt -s expand_aliases # needed for `urlencode` alias | ||
[ -s "${PROJECT_DIRECTORY}/prepare_mongodb_oidc.sh" ] && source "${PROJECT_DIRECTORY}/prepare_mongodb_oidc.sh" | ||
|
||
MONGODB_URI=${MONGODB_URI:-"mongodb://localhost"} | ||
MONGODB_URI_SINGLE="${MONGODB_URI}/?authMechanism=MONGODB-OIDC" | ||
MONGODB_URI_MULTIPLE="${MONGODB_URI}:27018/?authMechanism=MONGODB-OIDC&directConnection=true" | ||
|
||
if [ -z "${OIDC_TOKEN_DIR}" ]; then | ||
echo "Must specify OIDC_TOKEN_DIR" | ||
exit 1 | ||
fi | ||
|
||
export MONGODB_URI_SINGLE="$MONGODB_URI_SINGLE" | ||
export MONGODB_URI_MULTIPLE="$MONGODB_URI_MULTIPLE" | ||
export MONGODB_URI="$MONGODB_URI" | ||
|
||
echo $MONGODB_URI_SINGLE | ||
echo $MONGODB_URI_MULTIPLE | ||
echo $MONGODB_URI | ||
|
||
if [ "$ASSERT_NO_URI_CREDS" = "true" ]; then | ||
if echo "$MONGODB_URI" | grep -q "@"; then | ||
echo "MONGODB_URI unexpectedly contains user credentials!"; | ||
exit 1 | ||
fi | ||
fi | ||
|
||
# show test output | ||
set -x | ||
|
||
# Workaround macOS python 3.9 incompatibility with system virtualenv. | ||
if [ "$(uname -s)" = "Darwin" ]; then | ||
VIRTUALENV="/Library/Frameworks/Python.framework/Versions/3.9/bin/python3 -m virtualenv" | ||
else | ||
VIRTUALENV=$(command -v virtualenv) | ||
fi | ||
|
||
authtest () { | ||
if [ "Windows_NT" = "$OS" ]; then | ||
PYTHON=$(cygpath -m $PYTHON) | ||
fi | ||
|
||
echo "Running MONGODB-OIDC authentication tests with $PYTHON" | ||
$PYTHON --version | ||
|
||
$VIRTUALENV -p $PYTHON --never-download venvoidc | ||
if [ "Windows_NT" = "$OS" ]; then | ||
. venvoidc/Scripts/activate | ||
else | ||
. venvoidc/bin/activate | ||
fi | ||
python -m pip install -U pip setuptools | ||
python -m pip install '.[aws]' | ||
python test/auth_aws/test_auth_oidc.py -v | ||
deactivate | ||
rm -rf venvoidc | ||
} | ||
|
||
PYTHON=${PYTHON_BINARY:-} | ||
if [ -z "$PYTHON" ]; then | ||
echo "Cannot test without specifying PYTHON_BINARY" | ||
exit 1 | ||
fi | ||
|
||
authtest |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This makes it seem like non-ODIC mechs also support reauthentication. Is that intended?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yes, we are using SCRAM in the unified spec tests.