backend fallback

FerretDB · chilagrow · Feb 28, 2024 · Feb 14, 2024 · Feb 14, 2024 · Feb 15, 2024
commit a9be0e245fe3159d3b6b631717104cb63598e2e9
@@ -221,8 +221,8 @@ func TestAuthentication(t *testing.T) {
 }
 
 // TestAuthenticationEnableNewAuthNoUser tests that the authentication succeeds
-// with any PLAIN mechanism user until the first user is created. This is temporary
-// until local exception is implemented.
+// with PLAIN mechanism user when there are no users in the database.
+// It uses backend to authenticate the user such case.
 // For SCRAM-SHA-256 mechanism users, authentication fails if the user does not exist.
 func TestAuthenticationEnableNewAuthNoUserExists(t *testing.T) {
 	t.Parallel()
@@ -237,23 +237,25 @@ func TestAuthenticationEnableNewAuthNoUserExists(t *testing.T) {
 		password  string
 		mechanism string
 
-		err string
+		pingErr   string
+		insertErr string
 	}{
-		"PLAIN": {
+		"PLAINNonExistingUser": {
 			username:  "plain-user",
 			password:  "whatever",
 			mechanism: "PLAIN",
+			insertErr: `role "plain-user" does not exist`,
 		},
-		"PLAINEmpty": {
-			username:  "",
-			password:  "",
+		"PLAINBackendUser": {
+			username:  "username",
+			password:  "password",
 			mechanism: "PLAIN",
 		},
 		"SHA256": {
 			username:  "sha256-user",
 			password:  "whatever",
 			mechanism: "SCRAM-SHA-256",
-			err:       "Authentication failed",
+			pingErr:   "Authentication failed",
 		},
 	}
 
@@ -280,15 +282,21 @@ func TestAuthenticationEnableNewAuthNoUserExists(t *testing.T) {
 
 			err = client.Ping(ctx, nil)
 
-			if tc.err != "" {
-				require.ErrorContains(t, err, tc.err)
+			if tc.pingErr != "" {
+				require.ErrorContains(t, err, tc.pingErr)
 				return
 			}
 
 			require.NoError(t, err, "cannot ping MongoDB")
 
 			connCollection := client.Database(db.Name()).Collection(collection.Name())
 			_, err = connCollection.InsertOne(ctx, bson.D{{"ping", "pong"}})
+
+			if tc.insertErr != "" {
+				require.ErrorContains(t, err, tc.insertErr)
+				return
+			}
+
 			require.NoError(t, err, "cannot insert document")
 		})
 	}

diff --git a/integration/users/create_user_test.go b/integration/users/create_user_test.go
@@ -318,7 +318,7 @@ func createUserTestRunnerUser(tb *testing.T, s *setup.SetupResult) (*mongo.Datab
 
 	username, pwd, mechanism := "user-test-runner", "password", "PLAIN"
 
-	err := s.Collection.Database().RunCommand(s.Ctx, bson.D{
+	err := s.Collection.Database().Client().Database("admin").RunCommand(s.Ctx, bson.D{
 		{"createUser", username},
 		{"roles", bson.A{}},
 		{"pwd", pwd},
@@ -341,7 +341,7 @@ func createUserTestRunnerUser(tb *testing.T, s *setup.SetupResult) (*mongo.Datab
 	collection := db.Collection(s.Collection.Name())
 
 	tb.Cleanup(func() {
-		require.NoError(tb, db.RunCommand(s.Ctx, bson.D{{"dropAllUsersFromDatabase", 1}}).Err())
+		_ = db.RunCommand(s.Ctx, bson.D{{"dropAllUsersFromDatabase", 1}})
 	})
 
 	return db, collection

diff --git a/integration/users/drop_all_users_from_database_test.go b/integration/users/drop_all_users_from_database_test.go
@@ -53,16 +53,11 @@ func TestDropAllUsersFromDatabase(t *testing.T) {
 	// So this call should remove zero users as the database doesn't exist. The next one, "quantity" users.
 	assertDropAllUsersFromDatabase(t, ctx, client.Database(t.Name()+"_another_database"), 0)
 
-	if !setup.IsMongoDB(t) {
-		// For non MongoDB, a user created to run the tests is also dropped.
-		quantity++
-	}
-
 	assertDropAllUsersFromDatabase(t, ctx, db, quantity)
 
 	// Run for the second time to check if it still succeeds when there aren't any users remaining,
 	// instead of returning an error.
-	assertDropAllUsersFromDatabase(t, ctx, db, 0)
+	assertDropAllUsersFromDatabase(t, ctx, s.Collection.Database(), 0)
 }
 
 func assertDropAllUsersFromDatabase(t *testing.T, ctx context.Context, db *mongo.Database, quantity int) {

@@ -120,6 +120,14 @@ func (connInfo *ConnInfo) SetBypassBackendAuth() {
 	connInfo.bypassBackendAuth = true
 }
 
+// UnsetBypassBackendAuth marks the connection as requiring backend authentication.
+func (connInfo *ConnInfo) UnsetBypassBackendAuth() {
+	connInfo.rw.Lock()
+	defer connInfo.rw.Unlock()
+
+	connInfo.bypassBackendAuth = false
+}
+
 // BypassBackendAuth returns whether the connection requires backend authentication.
 func (connInfo *ConnInfo) BypassBackendAuth() bool {
 	connInfo.rw.RLock()

@@ -37,7 +37,7 @@
 // the first user is created.
 func (h *Handler) authenticate(ctx context.Context, msg *wire.OpMsg) error {
 	if !h.EnableNewAuth {
 		return nil
 	}

 	if !conninfo.Get(ctx).BypassBackendAuth() {
@@ -46,12 +46,12 @@

 	adminDB, err := h.b.Database("admin")
 	if err != nil {
 		return lazyerrors.Error(err)
 	}

 	usersCol, err := adminDB.Collection("system.users")
 	if err != nil {
 		return lazyerrors.Error(err)
 	}

 	username, pwd := conninfo.Get(ctx).Auth()
@@ -60,7 +60,7 @@

 	qr, err := usersCol.Query(ctx, nil)
 	if err != nil {
 		return lazyerrors.Error(err)
 	}

 	defer qr.Iter.Close()
@@ -78,7 +78,7 @@
 		}

 		if err != nil {
 			return lazyerrors.Error(err)
 		}

 		hasUser = true
@@ -86,7 +86,7 @@
 		var matches bool

 		if matches, err = common.FilterDocument(v, filter); err != nil {
 			return lazyerrors.Error(err)
 		}

 		if matches {
@@ -96,17 +96,20 @@
 	}
 
 	if !hasUser {
-		// If a user connects with any credentials or no credentials at all,
-		// the authentication succeeds until the first user is created.
+		// There is no user in the database, let backend check the authentication.
+		// Do not want unauthenticated users accessing the database, while there need
+		// to be a way to access the database until local exception is implemented.
+		conninfo.Get(ctx).UnsetBypassBackendAuth()
+
 		return nil
 	}
 
 	if storedUser == nil {
 		return handlererrors.NewCommandErrorMsgWithArgument(
 			handlererrors.ErrAuthenticationFailed,
 			"Authentication failed",
 			"authenticate",
 		)
 	}

 	credentials := must.NotFail(storedUser.Get("credentials")).(*types.Document)
@@ -118,24 +121,24 @@
 		return nil
 	case credentials.Has("PLAIN"):
 		break
 	default:
 		panic("credentials does not contain a known mechanism")
 	}

 	v := must.NotFail(credentials.Get("PLAIN"))

 	doc, ok := v.(*types.Document)
 	if !ok {
 		return lazyerrors.Errorf("field 'PLAIN' has type %T, expected Document", v)
 	}

 	err = password.PlainVerify(pwd, doc)
 	if err != nil {
 		return handlererrors.NewCommandErrorMsgWithArgument(
 			handlererrors.ErrAuthenticationFailed,
 			"Authentication failed",
 			"authenticate",
 		)
 	}

 	return nil