Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enforce new authentication #4075

Merged
merged 52 commits into from
Feb 28, 2024
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
52 commits
Select commit Hold shift + click to select a range
fbaf68a
get authentication mechanism from db
chilagrow Feb 14, 2024
f5c6049
add test for conneting without plain username password
chilagrow Feb 14, 2024
88b6316
add authentication to sasl start
chilagrow Feb 15, 2024
bcfd350
add authentication to all handlers except command query
chilagrow Feb 15, 2024
3699034
move files
chilagrow Feb 15, 2024
8e65773
Merge branch 'main' into enforce-new-auth
chilagrow Feb 15, 2024
70f0183
until first user is created new authentication always succeeds
chilagrow Feb 15, 2024
470ca14
is master does not need authentication
chilagrow Feb 15, 2024
40be66d
handle database without any pool yet
chilagrow Feb 16, 2024
2e98e84
merge conflict
chilagrow Feb 16, 2024
fd048c6
do not authenticate on some handlers
chilagrow Feb 16, 2024
4a6b841
authentication for sha256 is done by conversation step, so handler ch…
chilagrow Feb 16, 2024
90de3fa
Plain credential hashes password
chilagrow Feb 16, 2024
b4b4c57
add test for scram sha256 user for empty database
chilagrow Feb 16, 2024
5dc7ae5
fix create update and drop user tests
chilagrow Feb 16, 2024
c3583d1
update error and panic
chilagrow Feb 16, 2024
8d72103
create pool upon registry creation
chilagrow Feb 19, 2024
f694f4e
do not authenticate on handler if bypass backend auth is not set
chilagrow Feb 19, 2024
b08beea
user tests use credentials for test runner
chilagrow Feb 19, 2024
4286628
lint
chilagrow Feb 19, 2024
287b728
Revert "user tests use credentials for test runner"
chilagrow Feb 19, 2024
950e567
authentication checks user instead of db.user
chilagrow Feb 19, 2024
a9be0e2
backend fallback
chilagrow Feb 19, 2024
a4b5699
cleanup
chilagrow Feb 19, 2024
daba28a
missing import
chilagrow Feb 19, 2024
5a8014e
revert
chilagrow Feb 19, 2024
eda4ed1
tidy up
chilagrow Feb 19, 2024
add453e
add test for plain mechanism backend user
chilagrow Feb 19, 2024
0d786cb
simplify test user
chilagrow Feb 19, 2024
5bdcfc4
update comments
chilagrow Feb 19, 2024
f74532c
remove unused var
chilagrow Feb 19, 2024
5c4b117
Merge branch 'main' into enforce-new-auth
chilagrow Feb 19, 2024
d407f5f
sqlite does not have backend auth
chilagrow Feb 19, 2024
0ab1f56
use opt out way
chilagrow Feb 20, 2024
306c10b
add todo links
chilagrow Feb 20, 2024
55a52b9
merge
chilagrow Feb 20, 2024
0128186
rename reorder
chilagrow Feb 20, 2024
a0df39f
add todo
chilagrow Feb 20, 2024
24c393c
address feedback
chilagrow Feb 21, 2024
e3edaae
Merge branch 'main' into enforce-new-auth
chilagrow Feb 21, 2024
73ec82a
create user during the setup
chilagrow Feb 21, 2024
ae2d02b
Merge branch 'main' into enforce-new-auth
chilagrow Feb 22, 2024
07c749a
fix test
chilagrow Feb 22, 2024
3f95100
update comment add explaination add more mechanisms
chilagrow Feb 22, 2024
c4c1224
PLAIN and SHA handles authenticated users the same way
chilagrow Feb 22, 2024
53d76ae
Merge branch 'main' into enforce-new-auth
chilagrow Feb 26, 2024
d5d2499
do not use pwd as abbrev
chilagrow Feb 26, 2024
7bcc892
update comment
chilagrow Feb 26, 2024
dbd27a8
do not allow SCRAM if new authentication is not enabled
chilagrow Feb 27, 2024
e45cc60
Merge branch 'main' into enforce-new-auth
AlekSi Feb 27, 2024
339b52d
Merge branch 'main' into enforce-new-auth
AlekSi Feb 28, 2024
fb4dd9e
Merge branch 'main' into enforce-new-auth
AlekSi Feb 28, 2024
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
fix create update and drop user tests
  • Loading branch information
chilagrow committed Feb 16, 2024
commit 5dc7ae5d319703f7a1c0a59565f18decf221e100
48 changes: 46 additions & 2 deletions integration/users/create_user_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@ import (
"github.com/stretchr/testify/require"
"go.mongodb.org/mongo-driver/bson"
"go.mongodb.org/mongo-driver/mongo"
"go.mongodb.org/mongo-driver/mongo/options"

"github.com/FerretDB/FerretDB/integration"
"github.com/FerretDB/FerretDB/integration/setup"
Expand All @@ -34,8 +35,10 @@ import (
func TestCreateUser(t *testing.T) {
t.Parallel()

ctx, collection := setup.Setup(t)
db := collection.Database()
s := setup.SetupWithOpts(t, nil)
ctx := s.Ctx

db, _ := createUserTestRunnerUser(t, s)

testCases := map[string]struct { //nolint:vet // for readability
payload bson.D
Expand Down Expand Up @@ -302,3 +305,44 @@ func assertSCRAMSHA256Credentials(t testtb.TB, key string, cred *types.Document)
assert.NotEmpty(t, must.NotFail(c.Get("serverKey")).(string))
assert.NotEmpty(t, must.NotFail(c.Get("storedKey")).(string))
}

// createUserTestRunnerUser creates a user with PLAIN mechanism and returns
// the database and collection connection created by that user.
// This gives a user to run user creation tests until local exception is implemented for FerretDB.
// Without this, once the first user is created, the connection to FerretDB fails authentication
// and cannot do any further operations.
func createUserTestRunnerUser(tb *testing.T, s *setup.SetupResult) (*mongo.Database, *mongo.Collection) {
if setup.IsMongoDB(tb) {
return s.Collection.Database(), s.Collection
}

username, pwd, mechanism := "user-test-runner", "password", "PLAIN"

err := s.Collection.Database().RunCommand(s.Ctx, bson.D{
{"createUser", username},
{"roles", bson.A{}},
{"pwd", pwd},
{"mechanisms", bson.A{mechanism}},
}).Err()
require.NoErrorf(tb, err, "cannot create user")

// once the first user has been created use that user for any other action
// until local exception is implemented
opts := options.Client().ApplyURI(s.MongoDBURI).SetAuth(options.Credential{
AuthMechanism: mechanism,
AuthSource: s.Collection.Name(),
Username: username,
Password: pwd,
})
client, err := mongo.Connect(s.Ctx, opts)
require.NoError(tb, err, "cannot connect to MongoDB")

db := client.Database(s.Collection.Database().Name())
collection := db.Collection(s.Collection.Name())

tb.Cleanup(func() {
require.NoError(tb, db.RunCommand(s.Ctx, bson.D{{"dropAllUsersFromDatabase", 1}}).Err())
})

return db, collection
}
6 changes: 4 additions & 2 deletions integration/users/drop_user_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -31,8 +31,10 @@ import (
func TestDropUser(t *testing.T) {
t.Parallel()

ctx, collection := setup.Setup(t)
db := collection.Database()
s := setup.SetupWithOpts(t, nil)
ctx := s.Ctx

db, _ := createUserTestRunnerUser(t, s)

err := db.RunCommand(ctx, bson.D{
{"createUser", "a_user"},
Expand Down
6 changes: 4 additions & 2 deletions integration/users/update_user_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -32,8 +32,10 @@ import (
func TestUpdateUser(t *testing.T) {
t.Parallel()

ctx, collection := setup.Setup(t)
db := collection.Database()
s := setup.SetupWithOpts(t, nil)
ctx := s.Ctx

db, _ := createUserTestRunnerUser(t, s)

testCases := map[string]struct { //nolint:vet // for readability
createPayload bson.D
Expand Down
Loading