mongo 1.12.5 → 2.0.0.beta

data/lib/mongo/auth/cr.rb

@@ -0,0 +1,44 @@
+# Copyright (C) 2014-2015 MongoDB Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'mongo/auth/cr/conversation'
+
+module Mongo
+  module Auth
+
+    # Defines behaviour for MongoDB-CR authentication.
+    #
+    # @since 2.0.0
+    class CR
+      include Executable
+
+      # Log the user in on the given connection.
+      #
+      # @example Log the user in.
+      #   user.login(connection)
+      #
+      # @param [ Mongo::Connection ] connection The connection to log into.
+      #
+      # @return [ Protocol::Reply ] The authentication response.
+      #
+      # @since 2.0.0
+      def login(connection)
+        conversation = Conversation.new(user, auth_database(connection))
+        reply = connection.dispatch([ conversation.start ])
+        reply = connection.dispatch([ conversation.continue(reply) ])
+        conversation.finalize(reply)
+      end
+    end
+  end
+end

data/lib/mongo/auth/cr/conversation.rb

@@ -0,0 +1,119 @@
+# Copyright (C) 2014 MongoDB Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Mongo
+  module Auth
+    class CR
+
+      # Defines behaviour around a single MONGODB-CR conversation between the
+      # client and server.
+      #
+      # @since 2.0.0
+      class Conversation
+
+        # The login message base.
+        #
+        # @since 2.0.0
+        LOGIN = { authenticate: 1 }.freeze
+
+        # @return [ Protocol::Reply ] reply The current reply in the
+        #   conversation.
+        attr_reader :reply
+
+        # @return [ String ] database The database to authenticate against.
+        attr_reader :database
+
+        # @return [ String ] nonce The initial auth nonce.
+        attr_reader :nonce
+
+        # @return [ User ] user The user for the conversation.
+        attr_reader :user
+
+        # Continue the CR conversation. This sends the client final message
+        # to the server after setting the reply from the previous server
+        # communication.
+        #
+        # @example Continue the conversation.
+        #   conversation.continue(reply)
+        #
+        # @param [ Protocol::Reply ] reply The reply of the previous
+        #   message.
+        #
+        # @return [ Protocol::Query ] The next message to send.
+        #
+        # @since 2.0.0
+        def continue(reply)
+          validate!(reply)
+          Protocol::Query.new(
+            database,
+            Database::COMMAND,
+            LOGIN.merge(user: user.name, nonce: nonce, key: user.auth_key(nonce)),
+            limit: -1
+          )
+        end
+
+        # Finalize the CR conversation. This is meant to be iterated until
+        # the provided reply indicates the conversation is finished.
+        #
+        # @example Finalize the conversation.
+        #   conversation.finalize(reply)
+        #
+        # @param [ Protocol::Reply ] reply The reply of the previous
+        #   message.
+        #
+        # @return [ Protocol::Query ] The next message to send.
+        #
+        # @since 2.0.0
+        def finalize(reply)
+          validate!(reply)
+        end
+
+        # Start the CR conversation. This returns the first message that
+        # needs to be send to the server.
+        #
+        # @example Start the conversation.
+        #   conversation.start
+        #
+        # @return [ Protocol::Query ] The first CR conversation message.
+        #
+        # @since 2.0.0
+        def start
+          Protocol::Query.new(database, Database::COMMAND, Auth::GET_NONCE, limit: -1)
+        end
+
+        # Create the new conversation.
+        #
+        # @example Create the new coversation.
+        #   Conversation.new(user, "admin")
+        #
+        # @param [ Auth::User ] user The user to converse about.
+        # @param [ String ] database The database to authenticate against.
+        #
+        # @since 2.0.0
+        def initialize(user, database)
+          @user = user
+          @database = database
+        end
+
+        private
+
+        def validate!(reply)
+          raise Unauthorized.new(user) if reply.documents[0]['ok'] != 1
+          @nonce = reply.documents[0][Auth::NONCE]
+          @reply = reply
+        end
+      end
+    end
+  end
+end

data/lib/mongo/auth/executable.rb

@@ -0,0 +1,52 @@
+# Copyright (C) 2014-2015 MongoDB Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Mongo
+  module Auth
+
+    # Defines common behaviour for executable authorization commands.
+    #
+    # @since 2.0.0
+    module Executable
+
+      # @return [ Mongo::Auth::User ] The user to authenticate.
+      attr_reader :user
+
+      # Instantiate a new authenticator.
+      #
+      # @example Create the authenticator.
+      #   Mongo::Auth::X509.new(user)
+      #
+      # @param [ Mongo::Auth::User ] user The user to authenticate.
+      #
+      # @since 2.0.0
+      def initialize(user)
+        @user = user
+      end
+
+      private
+
+      # If we are on MongoDB 2.6 and higher, we *always* authorize against the
+      # admin database. Otherwise for 2.4 and lower we authorize against the
+      # auth source provided. The logic for that is encapsulated in the User class.
+      def auth_database(connection)
+        if connection.features.write_command_enabled?
+          Database::ADMIN
+        else
+          user.auth_source
+        end
+      end
+    end
+  end
+end

data/lib/mongo/auth/ldap.rb

@@ -0,0 +1,48 @@
+# Copyright (C) 2014-2015 MongoDB Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'mongo/auth/ldap/conversation'
+
+module Mongo
+  module Auth
+
+    # Defines behaviour for LDAP Proxy authentication.
+    #
+    # @since 2.0.0
+    class LDAP
+      include Executable
+
+      # The authentication mechinism string.
+      #
+      # @since 2.0.0
+      MECHANISM = 'PLAIN'.freeze
+
+      # Log the user in on the given connection.
+      #
+      # @example Log the user in.
+      #   user.login(connection)
+      #
+      # @param [ Mongo::Connection ] connection The connection to log into.
+      #   on.
+      #
+      # @return [ Protocol::Reply ] The authentication response.
+      #
+      # @since 2.0.0
+      def login(connection)
+        conversation = Conversation.new(user)
+        conversation.finalize(connection.dispatch([ conversation.start ]))
+      end
+    end
+  end
+end

data/lib/mongo/auth/ldap/conversation.rb

@@ -0,0 +1,92 @@
+# Copyright (C) 2014 MongoDB Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Mongo
+  module Auth
+    class LDAP
+
+      # Defines behaviour around a single PLAIN conversation between the
+      # client and server.
+      #
+      # @since 2.0.0
+      class Conversation
+
+        # The login message.
+        #
+        # @since 2.0.0
+        LOGIN = { authenticate: 1, digestPassword: false }.freeze
+
+        # @return [ Protocol::Reply ] reply The current reply in the
+        #   conversation.
+        attr_reader :reply
+
+        # @return [ User ] user The user for the conversation.
+        attr_reader :user
+
+        # Finalize the PLAIN conversation. This is meant to be iterated until
+        # the provided reply indicates the conversation is finished.
+        #
+        # @example Finalize the conversation.
+        #   conversation.finalize(reply)
+        #
+        # @param [ Protocol::Reply ] reply The reply of the previous
+        #   message.
+        #
+        # @return [ Protocol::Query ] The next message to send.
+        #
+        # @since 2.0.0
+        def finalize(reply)
+          validate!(reply)
+        end
+
+        # Start the PLAIN conversation. This returns the first message that
+        # needs to be send to the server.
+        #
+        # @example Start the conversation.
+        #   conversation.start
+        #
+        # @return [ Protocol::Query ] The first PLAIN conversation message.
+        #
+        # @since 2.0.0
+        def start
+          Protocol::Query.new(
+            Auth::EXTERNAL,
+            Database::COMMAND,
+            LOGIN.merge(user: user.name, password: user.password, mechanism: LDAP::MECHANISM),
+            limit: -1
+          )
+        end
+
+        # Create the new conversation.
+        #
+        # @example Create the new coversation.
+        #   Conversation.new(user, "admin")
+        #
+        # @param [ Auth::User ] user The user to converse about.
+        #
+        # @since 2.0.0
+        def initialize(user)
+          @user = user
+        end
+
+        private
+
+        def validate!(reply)
+          raise Unauthorized.new(user) if reply.documents[0]['ok'] != 1
+          @reply = reply
+        end
+      end
+    end
+  end
+end

data/lib/mongo/auth/roles.rb

@@ -0,0 +1,104 @@
+# Copyright (C) 2014-2015 MongoDB, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Mongo
+  module Auth
+
+    # Provides constants for the built in roles provided by MongoDB.
+    #
+    # @since 2.0.0
+    module Roles
+
+      # @see http://docs.mongodb.org/manual/reference/built-in-roles/#backup
+      #
+      # @since 2.0.0
+      BACKUP = 'backup'.freeze
+
+      # @see http://docs.mongodb.org/manual/reference/built-in-roles/#clusterAdmin
+      #
+      # @since 2.0.0
+      CLUSTER_ADMIN = 'clusterAdmin'.freeze
+
+      # @see http://docs.mongodb.org/manual/reference/built-in-roles/#clusterManager
+      #
+      # @since 2.0.0
+      CLUSTER_MANAGER = 'clusterManager'.freeze
+
+      # @see http://docs.mongodb.org/manual/reference/built-in-roles/#clusterMonitor
+      #
+      # @since 2.0.0
+      CLUSTER_MONITOR = 'clusterMonitor'.freeze
+
+      # @see http://docs.mongodb.org/manual/reference/built-in-roles/#dbAdmin
+      #
+      # @since 2.0.0
+      DATABASE_ADMIN = 'dbAdmin'.freeze
+
+      # @see http://docs.mongodb.org/manual/reference/built-in-roles/#dbAdminAnyDatabase
+      #
+      # @since 2.0.0
+      DATABASE_ADMIN_ANY_DATABASE = 'dbAdminAnyDatabase'.freeze
+
+      # @see http://docs.mongodb.org/manual/reference/built-in-roles/#dbOwner
+      #
+      # @since 2.0.0
+      DATABASE_OWNER = 'dbOwner'.freeze
+
+      # @see http://docs.mongodb.org/manual/reference/built-in-roles/#hostManager
+      #
+      # @since 2.0.0
+      HOST_MANAGER = 'hostManager'.freeze
+
+      # @see http://docs.mongodb.org/manual/reference/built-in-roles/#read
+      #
+      # @since 2.0.0
+      READ = 'read'.freeze
+
+      # @see http://docs.mongodb.org/manual/reference/built-in-roles/#readAnyDatabase
+      #
+      # @since 2.0.0
+      READ_ANY_DATABASE = 'readAnyDatabase'.freeze
+
+      # @see http://docs.mongodb.org/manual/reference/built-in-roles/#readWriteAnyDatabase
+      #
+      # @since 2.0.0
+      READ_WRITE_ANY_DATABASE = 'readWriteAnyDatabase'.freeze
+
+      # @see http://docs.mongodb.org/manual/reference/built-in-roles/#readWrite
+      #
+      # @since 2.0.0
+      READ_WRITE = 'readWrite'.freeze
+
+      # @see http://docs.mongodb.org/manual/reference/built-in-roles/#restore
+      #
+      # @since 2.0.0
+      RESTORE = 'restore'.freeze
+
+      # @see http://docs.mongodb.org/manual/reference/built-in-roles/#root
+      #
+      # @since 2.0.0
+      ROOT = 'root'.freeze
+
+      # @see http://docs.mongodb.org/manual/reference/built-in-roles/#userAdmin
+      #
+      # @since 2.0.0
+      USER_ADMIN = 'userAdmin'.freeze
+
+      # @see http://docs.mongodb.org/manual/reference/built-in-roles/#userAdminAnyDatabase
+      #
+      # @since 2.0.0
+      USER_ADMIN_ANY_DATABASE = 'userAdminAnyDatabase'.freeze
+    end
+  end
+end