Skip to content

Commit f4bc1cb

Browse files
katcharovstIncMale
katcharov
and
stIncMale
authored
Implement OIDC SASL mechanism (#1134)
* Implement OIDC SASL mechanism in sync (#1107) JAVA-4980 * Implement OIDC auth for async (#1131) JAVA-4981 * Remove non-machine workflow (#1259) JAVA-5077 * Add Human OIDC Workflow (#1316) JAVA-5328 * OIDC Add remaining environments (azure, gcp), evergreen testing, API naming updates (#1371) JAVA-5353 JAVA-5395 JAVA-4834 JAVA-4932 Co-authored-by: Valentin Kovalenko <valentin.kovalenko@mongodb.com>
1 parent f9edd86 commit f4bc1cb

37 files changed

+3825
-235
lines changed

‎.evergreen/.evg.yml‎

Lines changed: 149 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,8 @@ stepback: true
1212
# Actual testing tasks are marked with `type: test`
1313
command_type: system
1414

15-
# Protect ourself against rogue test case, or curl gone wild, that runs forever
16-
# 12 minutes is the longest we'll ever run
17-
exec_timeout_secs: 3600 # 12 minutes is the longest we'll ever run
15+
# Protect ourselves against rogue test case, or curl gone wild, that runs forever
16+
exec_timeout_secs: 3600
1817

1918
# What to do when evergreen hits the timeout (`post:` tasks are run automatically)
2019
timeout:
@@ -968,6 +967,60 @@ tasks:
968967
- func: "run load-balancer"
969968
- func: "run load-balancer tests"
970969

970+
- name: "oidc-auth-test"
971+
commands:
972+
- command: subprocess.exec
973+
type: test
974+
params:
975+
working_dir: "src"
976+
binary: bash
977+
include_expansions_in_env: ["DRIVERS_TOOLS", "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN"]
978+
env:
979+
OIDC_ENV: "test"
980+
args:
981+
- .evergreen/run-mongodb-oidc-test.sh
982+
983+
- name: "oidc-auth-test-azure"
984+
commands:
985+
- command: shell.exec
986+
params:
987+
shell: bash
988+
env:
989+
JAVA_HOME: ${JAVA_HOME}
990+
script: |-
991+
set -o errexit
992+
${PREPARE_SHELL}
993+
cd src
994+
git add .
995+
git commit -m "add files"
996+
# uncompressed tar used to allow appending .git folder
997+
export AZUREOIDC_DRIVERS_TAR_FILE=/tmp/mongo-java-driver.tar
998+
git archive -o $AZUREOIDC_DRIVERS_TAR_FILE HEAD
999+
tar -rf $AZUREOIDC_DRIVERS_TAR_FILE .git
1000+
export AZUREOIDC_TEST_CMD="OIDC_ENV=azure ./.evergreen/run-mongodb-oidc-test.sh"
1001+
bash $DRIVERS_TOOLS/.evergreen/auth_oidc/azure/run-driver-test.sh
1002+
1003+
- name: "oidc-auth-test-gcp"
1004+
commands:
1005+
- command: shell.exec
1006+
params:
1007+
shell: bash
1008+
script: |-
1009+
set -o errexit
1010+
${PREPARE_SHELL}
1011+
cd src
1012+
git add .
1013+
git commit -m "add files"
1014+
# uncompressed tar used to allow appending .git folder
1015+
export GCPOIDC_DRIVERS_TAR_FILE=/tmp/mongo-java-driver.tar
1016+
git archive -o $GCPOIDC_DRIVERS_TAR_FILE HEAD
1017+
tar -rf $GCPOIDC_DRIVERS_TAR_FILE .git
1018+
# Define the command to run on the VM.
1019+
# Ensure that we source the environment file created for us, set up any other variables we need,
1020+
# and then run our test suite on the vm.
1021+
export GCPOIDC_TEST_CMD="OIDC_ENV=gcp ./.evergreen/run-mongodb-oidc-test.sh"
1022+
bash $DRIVERS_TOOLS/.evergreen/auth_oidc/gcp/run-driver-test.sh
1023+
9711024
- name: serverless-test
9721025
commands:
9731026
- func: "run serverless"
@@ -2065,6 +2118,78 @@ task_groups:
20652118
tasks:
20662119
- test-aws-lambda-deployed
20672120

2121+
- name: testoidc_task_group
2122+
setup_group:
2123+
- func: fetch source
2124+
- func: prepare resources
2125+
- func: fix absolute paths
2126+
- command: ec2.assume_role
2127+
params:
2128+
role_arn: ${aws_test_secrets_role}
2129+
- command: subprocess.exec
2130+
params:
2131+
binary: bash
2132+
include_expansions_in_env: ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN"]
2133+
args:
2134+
- ${DRIVERS_TOOLS}/.evergreen/auth_oidc/setup.sh
2135+
teardown_task:
2136+
- command: subprocess.exec
2137+
params:
2138+
binary: bash
2139+
args:
2140+
- ${DRIVERS_TOOLS}/.evergreen/auth_oidc/teardown.sh
2141+
setup_group_can_fail_task: true
2142+
setup_group_timeout_secs: 1800
2143+
tasks:
2144+
- oidc-auth-test
2145+
2146+
- name: testazureoidc_task_group
2147+
setup_group:
2148+
- func: fetch source
2149+
- func: prepare resources
2150+
- func: fix absolute paths
2151+
- command: subprocess.exec
2152+
params:
2153+
binary: bash
2154+
env:
2155+
AZUREOIDC_VMNAME_PREFIX: "JAVA_DRIVER"
2156+
args:
2157+
- ${DRIVERS_TOOLS}/.evergreen/auth_oidc/azure/create-and-setup-vm.sh
2158+
teardown_task:
2159+
- command: subprocess.exec
2160+
params:
2161+
binary: bash
2162+
args:
2163+
- ${DRIVERS_TOOLS}/.evergreen/auth_oidc/azure/delete-vm.sh
2164+
setup_group_can_fail_task: true
2165+
setup_group_timeout_secs: 1800
2166+
tasks:
2167+
- oidc-auth-test-azure
2168+
2169+
- name: testgcpoidc_task_group
2170+
setup_group:
2171+
- func: fetch source
2172+
- func: prepare resources
2173+
- func: fix absolute paths
2174+
- command: subprocess.exec
2175+
params:
2176+
binary: bash
2177+
env:
2178+
GCPOIDC_VMNAME_PREFIX: "JAVA_DRIVER"
2179+
GCPKMS_MACHINETYPE: "e2-medium" # comparable elapsed time to Azure; default was starved, caused timeouts
2180+
args:
2181+
- ${DRIVERS_TOOLS}/.evergreen/auth_oidc/gcp/setup.sh
2182+
teardown_task:
2183+
- command: subprocess.exec
2184+
params:
2185+
binary: bash
2186+
args:
2187+
- ${DRIVERS_TOOLS}/.evergreen/auth_oidc/gcp/teardown.sh
2188+
setup_group_can_fail_task: true
2189+
setup_group_timeout_secs: 1800
2190+
tasks:
2191+
- oidc-auth-test-gcp
2192+
20682193
buildvariants:
20692194

20702195
# Test packaging and other release related routines
@@ -2216,6 +2341,27 @@ buildvariants:
22162341
tasks:
22172342
- name: "test_atlas_task_group_search_indexes"
22182343

2344+
- name: "oidc-auth-test"
2345+
display_name: "OIDC Auth"
2346+
run_on: ubuntu2204-small
2347+
tasks:
2348+
- name: testoidc_task_group
2349+
batchtime: 20160 # 14 days
2350+
2351+
- name: testazureoidc-variant
2352+
display_name: "OIDC Auth Azure"
2353+
run_on: ubuntu2204-small
2354+
tasks:
2355+
- name: testazureoidc_task_group
2356+
batchtime: 20160 # 14 days
2357+
2358+
- name: testgcpoidc-variant
2359+
display_name: "OIDC Auth GCP"
2360+
run_on: ubuntu2204-small
2361+
tasks:
2362+
- name: testgcpoidc_task_group
2363+
batchtime: 20160 # 14 days
2364+
22192365
- matrix_name: "aws-auth-test"
22202366
matrix_spec: { ssl: "nossl", jdk: ["jdk8", "jdk17", "jdk21"], version: ["4.4", "5.0", "6.0", "7.0", "latest"], os: "ubuntu",
22212367
aws-credential-provider: "*" }

‎.evergreen/prepare-oidc-get-tokens-docker.sh‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
#!/bin/bash
2+
3+
set -o xtrace
4+
set -o errexit # Exit the script with error if any of the commands fail
5+
6+
############################################
7+
# Main Program #
8+
############################################
9+
10+
# Supported/used environment variables:
11+
# DRIVERS_TOOLS The path to evergreeen tools
12+
# OIDC_AWS_* Required OIDC_AWS_* env variables must be configured
13+
#
14+
# Environment variables used as output:
15+
# OIDC_TESTS_ENABLED Allows running OIDC tests
16+
# OIDC_TOKEN_DIR The path to generated OIDC AWS tokens
17+
# AWS_WEB_IDENTITY_TOKEN_FILE The path to AWS token for device workflow
18+
19+
if [ -z ${DRIVERS_TOOLS+x} ]; then
20+
echo "DRIVERS_TOOLS. is not set";
21+
exit 1
22+
fi
23+
24+
if [ -z ${OIDC_AWS_ROLE_ARN+x} ]; then
25+
echo "OIDC_AWS_ROLE_ARN. is not set";
26+
exit 1
27+
fi
28+
29+
if [ -z ${OIDC_AWS_SECRET_ACCESS_KEY+x} ]; then
30+
echo "OIDC_AWS_SECRET_ACCESS_KEY. is not set";
31+
exit 1
32+
fi
33+
34+
if [ -z ${OIDC_AWS_ACCESS_KEY_ID+x} ]; then
35+
echo "OIDC_AWS_ACCESS_KEY_ID. is not set";
36+
exit 1
37+
fi
38+
39+
export AWS_ROLE_ARN=${OIDC_AWS_ROLE_ARN}
40+
export AWS_SECRET_ACCESS_KEY=${OIDC_AWS_SECRET_ACCESS_KEY}
41+
export AWS_ACCESS_KEY_ID=${OIDC_AWS_ACCESS_KEY_ID}
42+
export OIDC_FOLDER=${DRIVERS_TOOLS}/.evergreen/auth_oidc
43+
export OIDC_TOKEN_DIR=${OIDC_FOLDER}/test_tokens
44+
export AWS_WEB_IDENTITY_TOKEN_FILE=${OIDC_TOKEN_DIR}/test1
45+
export OIDC_TESTS_ENABLED=true
46+
47+
echo "Configuring OIDC server for local authentication tests"
48+
49+
cd ${OIDC_FOLDER}
50+
DRIVERS_TOOLS=${DRIVERS_TOOLS} ./oidc_get_tokens.sh

‎.evergreen/prepare-oidc-server-docker.sh‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
#!/bin/bash
2+
3+
set -o xtrace
4+
set -o errexit # Exit the script with error if any of the commands fail
5+
6+
############################################
7+
# Main Program #
8+
############################################
9+
10+
# Supported/used environment variables:
11+
# DRIVERS_TOOLS The path to evergreeen tools
12+
# OIDC_AWS_* OIDC_AWS_* env variables must be configured
13+
#
14+
# Environment variables used as output:
15+
# OIDC_TESTS_ENABLED Allows running OIDC tests
16+
# OIDC_TOKEN_DIR The path to generated tokens
17+
# AWS_WEB_IDENTITY_TOKEN_FILE The path to AWS token for device workflow
18+
19+
if [ -z ${DRIVERS_TOOLS+x} ]; then
20+
echo "DRIVERS_TOOLS. is not set";
21+
exit 1
22+
fi
23+
24+
if [ -z ${OIDC_AWS_ROLE_ARN+x} ]; then
25+
echo "OIDC_AWS_ROLE_ARN. is not set";
26+
exit 1
27+
fi
28+
29+
if [ -z ${OIDC_AWS_SECRET_ACCESS_KEY+x} ]; then
30+
echo "OIDC_AWS_SECRET_ACCESS_KEY. is not set";
31+
exit 1
32+
fi
33+
34+
if [ -z ${OIDC_AWS_ACCESS_KEY_ID+x} ]; then
35+
echo "OIDC_AWS_ACCESS_KEY_ID. is not set";
36+
exit 1
37+
fi
38+
39+
export AWS_ROLE_ARN=${OIDC_AWS_ROLE_ARN}
40+
export AWS_SECRET_ACCESS_KEY=${OIDC_AWS_SECRET_ACCESS_KEY}
41+
export AWS_ACCESS_KEY_ID=${OIDC_AWS_ACCESS_KEY_ID}
42+
export OIDC_FOLDER=${DRIVERS_TOOLS}/.evergreen/auth_oidc
43+
export OIDC_TOKEN_DIR=${OIDC_FOLDER}/test_tokens
44+
export AWS_WEB_IDENTITY_TOKEN_FILE=${OIDC_TOKEN_DIR}/test1
45+
export OIDC_TESTS_ENABLED=true
46+
47+
echo "Configuring OIDC server for local authentication tests"
48+
49+
cd ${OIDC_FOLDER}
50+
DRIVERS_TOOLS=${DRIVERS_TOOLS} ./start_local_server.sh

‎.evergreen/run-mongodb-oidc-test.sh‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
#!/bin/bash
2+
3+
set +x # Disable debug trace
4+
set -eu
5+
6+
echo "Running MONGODB-OIDC authentication tests"
7+
echo "OIDC_ENV $OIDC_ENV"
8+
9+
if [ $OIDC_ENV == "test" ]; then
10+
if [ -z "$DRIVERS_TOOLS" ]; then
11+
echo "Must specify DRIVERS_TOOLS"
12+
exit 1
13+
fi
14+
source ${DRIVERS_TOOLS}/.evergreen/auth_oidc/secrets-export.sh
15+
# java will not need to be installed, but we need to config
16+
RELATIVE_DIR_PATH="$(dirname "${BASH_SOURCE:-$0}")"
17+
source "${RELATIVE_DIR_PATH}/javaConfig.bash"
18+
elif [ $OIDC_ENV == "azure" ]; then
19+
source ./env.sh
20+
elif [ $OIDC_ENV == "gcp" ]; then
21+
source ./secrets-export.sh
22+
else
23+
echo "Unrecognized OIDC_ENV $OIDC_ENV"
24+
exit 1
25+
fi
26+
27+
28+
if ! which java ; then
29+
echo "Installing java..."
30+
sudo apt install openjdk-17-jdk -y
31+
echo "Installed java."
32+
fi
33+
34+
which java
35+
export OIDC_TESTS_ENABLED=true
36+
37+
./gradlew -Dorg.mongodb.test.uri="$MONGODB_URI" \
38+
--stacktrace --debug --info --no-build-cache driver-core:cleanTest \
39+
driver-sync:test --tests OidcAuthenticationProseTests --tests UnifiedAuthTest \
40+
driver-reactive-streams:test --tests OidcAuthenticationAsyncProseTests \

‎bson/src/test/unit/util/ThreadTestHelpers.java‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -31,15 +31,19 @@ private ThreadTestHelpers() {
3131
}
3232

3333
public static void executeAll(final int nThreads, final Runnable c) {
34+
executeAll(Collections.nCopies(nThreads, c).toArray(new Runnable[0]));
35+
}
36+
37+
public static void executeAll(final Runnable... runnables) {
3438
ExecutorService service = null;
3539
try {
36-
service = Executors.newFixedThreadPool(nThreads);
37-
CountDownLatch latch = new CountDownLatch(nThreads);
40+
service = Executors.newFixedThreadPool(runnables.length);
41+
CountDownLatch latch = new CountDownLatch(runnables.length);
3842
List<Throwable> failures = Collections.synchronizedList(new ArrayList<>());
39-
for (int i = 0; i < nThreads; i++) {
43+
for (final Runnable runnable : runnables) {
4044
service.submit(() -> {
4145
try {
42-
c.run();
46+
runnable.run();
4347
} catch (Throwable e) {
4448
failures.add(e);
4549
} finally {

‎driver-core/src/main/com/mongodb/AuthenticationMechanism.java‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,13 @@ public enum AuthenticationMechanism {
3737
*/
3838
MONGODB_AWS("MONGODB-AWS"),
3939

40+
/**
41+
* The MONGODB-OIDC mechanism.
42+
* @since 4.10
43+
* @mongodb.server.release 7.0
44+
*/
45+
MONGODB_OIDC("MONGODB-OIDC"),
46+
4047
/**
4148
* The MongoDB X.509 mechanism. This mechanism is available only with client certificates over SSL.
4249
*/

0 commit comments

Comments
 (0)