mongo 2.11.2 → 2.13.0.beta1

data/lib/mongo/auth/cr/conversation.rb

@@ -1,4 +1,4 @@
-# Copyright (C) 2014-2019 MongoDB Inc.
+# Copyright (C) 2014-2020 MongoDB Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -23,46 +23,32 @@ module Mongo
       # @deprecated MONGODB-CR authentication mechanism is deprecated
       #   as of MongoDB 3.6. Support for it in the Ruby driver will be
       #   removed in driver version 3.0. Please use SCRAM instead.
-      class Conversation
+      # @api private
+      class Conversation < ConversationBase
 
         # The login message base.
         #
         # @since 2.0.0
         LOGIN = { authenticate: 1 }.freeze
 
-        # @return [ Protocol::Message ] reply The current reply in the
-        #   conversation.
-        attr_reader :reply
-
         # @return [ String ] database The database to authenticate against.
         attr_reader :database
 
         # @return [ String ] nonce The initial auth nonce.
         attr_reader :nonce
 
-        # @return [ User ] user The user for the conversation.
-        attr_reader :user
-
-        # Continue the CR conversation. This sends the client final message
-        # to the server after setting the reply from the previous server
-        # communication.
-        #
-        # @example Continue the conversation.
-        #   conversation.continue(reply)
+        # Start the CR conversation. This returns the first message that
+        # needs to be sent to the server.
         #
-        # @param [ Protocol::Message ] reply The reply of the previous
-        #   message.
-        # @param [ Mongo::Server::Connection ] connection The connection being
+        # @param [ Server::Connection ] connection The connection being
         #   authenticated.
         #
-        # @return [ Protocol::Query ] The next message to send.
+        # @return [ Protocol::Query ] The first CR conversation message.
         #
         # @since 2.0.0
-        def continue(reply, connection)
-          validate!(reply, connection.server)
+        def start(connection)
           if connection && connection.features.op_msg_enabled?
-            selector = LOGIN.merge(user: user.name, nonce: nonce, key: user.auth_key(nonce))
-            selector[Protocol::Msg::DATABASE_IDENTIFIER] = user.auth_source
+            selector = Auth::GET_NONCE.merge(Protocol::Msg::DATABASE_IDENTIFIER => user.auth_source)
             cluster_time = connection.mongos? && connection.cluster_time
             selector[Operation::CLUSTER_TIME] = cluster_time if cluster_time
             Protocol::Msg.new([], {}, selector)
@@ -70,39 +56,29 @@ module Mongo
             Protocol::Query.new(
               user.auth_source,
               Database::COMMAND,
-              LOGIN.merge(user: user.name, nonce: nonce, key: user.auth_key(nonce)),
-              limit: -1
-            )
+              Auth::GET_NONCE,
+              limit: -1)
           end
         end
 
-        # Finalize the CR conversation. This is meant to be iterated until
-        # the provided reply indicates the conversation is finished.
+        # Continue the CR conversation. This sends the client final message
+        # to the server after setting the reply from the previous server
+        # communication.
         #
-        # @param [ Protocol::Message ] reply The reply of the previous
-        #   message.
-        # @param [ Server::Connection ] connection The connection being
+        # @param [ BSON::Document ] reply_document The reply document of the
+        #   previous message.
+        # @param [ Mongo::Server::Connection ] connection The connection being
         #   authenticated.
         #
         # @return [ Protocol::Query ] The next message to send.
         #
         # @since 2.0.0
-        def finalize(reply, connection)
-          validate!(reply, connection.server)
-        end
+        def continue(reply_document, connection)
+          @nonce = reply_document[Auth::NONCE]
 
-        # Start the CR conversation. This returns the first message that
-        # needs to be sent to the server.
-        #
-        # @param [ Server::Connection ] connection The connection being
-        #   authenticated.
-        #
-        # @return [ Protocol::Query ] The first CR conversation message.
-        #
-        # @since 2.0.0
-        def start(connection)
           if connection && connection.features.op_msg_enabled?
-            selector = Auth::GET_NONCE.merge(Protocol::Msg::DATABASE_IDENTIFIER => user.auth_source)
+            selector = LOGIN.merge(user: user.name, nonce: nonce, key: user.auth_key(nonce))
+            selector[Protocol::Msg::DATABASE_IDENTIFIER] = user.auth_source
             cluster_time = connection.mongos? && connection.cluster_time
             selector[Operation::CLUSTER_TIME] = cluster_time if cluster_time
             Protocol::Msg.new([], {}, selector)
@@ -110,31 +86,10 @@ module Mongo
             Protocol::Query.new(
               user.auth_source,
               Database::COMMAND,
-              Auth::GET_NONCE,
-              limit: -1)
-          end
-        end
-
-        # Create the new conversation.
-        #
-        # @example Create the new conversation.
-        #   Conversation.new(user, "admin")
-        #
-        # @param [ Auth::User ] user The user to converse about.
-        #
-        # @since 2.0.0
-        def initialize(user)
-          @user = user
-        end
-
-        private
-
-        def validate!(reply, server)
-          if reply.documents[0][Operation::Result::OK] != 1
-            raise Unauthorized.new(user, used_mechanism: MECHANISM, server: server)
+              LOGIN.merge(user: user.name, nonce: nonce, key: user.auth_key(nonce)),
+              limit: -1
+            )
           end
-          @nonce = reply.documents[0][Auth::NONCE]
-          @reply = reply
         end
       end
     end

data/lib/mongo/auth/credential_cache.rb

@@ -0,0 +1,51 @@
+# Copyright (C) 2019-2020 MongoDB Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Mongo
+  module Auth
+
+    # Cache store for computed SCRAM credentials.
+    #
+    # @api private
+    module CredentialCache
+
+      class << self
+        attr_reader :store
+      end
+
+      module_function def get(key)
+        @store ||= {}
+        @store[key]
+      end
+
+      module_function def set(key, value)
+        @store ||= {}
+        @store[key] = value
+      end
+
+      module_function def cache(key)
+        value = get(key)
+        if value.nil?
+          value = yield
+          set(key, value)
+        end
+        value
+      end
+
+      module_function def clear
+        @store = {}
+      end
+    end
+  end
+end

data/lib/mongo/auth/gssapi.rb

@@ -0,0 +1,38 @@
+# Copyright (C) 2014-2020 MongoDB, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Mongo
+  module Auth
+
+    # Defines behavior for Kerberos authentication.
+    #
+    # @api private
+    class Gssapi < Base
+
+      # The authentication mechanism string.
+      #
+      # @since 2.0.0
+      MECHANISM = 'GSSAPI'.freeze
+
+      # Log the user in on the current connection.
+      #
+      # @return [ BSON::Document ] The document of the authentication response.
+      def login
+        converse_multi_step(connection, conversation)
+      end
+    end
+  end
+end
+
+require 'mongo/auth/gssapi/conversation'

data/lib/mongo/auth/gssapi/conversation.rb

@@ -0,0 +1,108 @@
+# Copyright (C) 2015-2020 MongoDB Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Mongo
+  module Auth
+    class Gssapi
+
+      # Defines behaviour around a single Kerberos conversation between the
+      # client and the server.
+      #
+      # @api private
+      class Conversation < SaslConversationBase
+
+        # The base client first message.
+        START_MESSAGE = { saslStart: 1, autoAuthorize: 1 }.freeze
+
+        # The base client continue message.
+        CONTINUE_MESSAGE = { saslContinue: 1 }.freeze
+
+        # Create the new conversation.
+        #
+        # @example Create the new conversation.
+        #   Conversation.new(user, 'test.example.com')
+        #
+        # @param [ Auth::User ] user The user to converse about.
+        # @param [ Mongo::Connection ] connection The connection to
+        #   authenticate over.
+        #
+        # @since 2.0.0
+        def initialize(user, connection, **opts)
+          super
+          host = connection.address.host
+          unless defined?(Mongo::GssapiNative)
+            require 'mongo_kerberos'
+          end
+          @authenticator = Mongo::GssapiNative::Authenticator.new(
+            user.name,
+            host,
+            user.auth_mech_properties[:service_name] || 'mongodb',
+            user.auth_mech_properties[:canonicalize_host_name] || false,
+          )
+        end
+
+        # @return [ Authenticator ] authenticator The native SASL authenticator.
+        attr_reader :authenticator
+
+        # Get the id of the conversation.
+        #
+        # @return [ Integer ] The conversation id.
+        attr_reader :id
+
+        def client_first_document
+          start_token = authenticator.initialize_challenge
+          START_MESSAGE.merge(mechanism: Gssapi::MECHANISM, payload: start_token)
+        end
+
+        # Continue the conversation.
+        #
+        # @param [ BSON::Document ] reply_document The reply document of the
+        #   previous message.
+        #
+        # @return [ Protocol::Query ] The next query to execute.
+        def continue(reply_document, connection)
+          @id = reply_document['conversationId']
+          payload = reply_document['payload']
+
+          continue_token = authenticator.evaluate_challenge(payload)
+          selector = CONTINUE_MESSAGE.merge(payload: continue_token, conversationId: id)
+
+          Protocol::Query.new(
+            Auth::EXTERNAL,
+            Database::COMMAND,
+            selector,
+            limit: 1,
+          )
+        end
+
+        def process_continue_response(reply_document)
+          payload = reply_document['payload']
+
+          @continue_token = authenticator.evaluate_challenge(payload)
+        end
+
+        def finalize(connection)
+          selector = CONTINUE_MESSAGE.merge(payload: @continue_token, conversationId: id)
+
+          Protocol::Query.new(
+            Auth::EXTERNAL,
+            Database::COMMAND,
+            selector,
+            limit: 1,
+          )
+        end
+      end
+    end
+  end
+end

data/lib/mongo/auth/ldap.rb

@@ -1,4 +1,4 @@
-# Copyright (C) 2014-2019 MongoDB Inc.
+# Copyright (C) 2014-2020 MongoDB Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -12,8 +12,6 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-require 'mongo/auth/ldap/conversation'
-
 module Mongo
   module Auth
 
@@ -21,44 +19,21 @@ module Mongo
     #
     # @since 2.0.0
     # @api private
-    class LDAP
+    class LDAP < Base
 
-      # The authentication mechinism string.
+      # The authentication mechanism string.
       #
       # @since 2.0.0
       MECHANISM = 'PLAIN'.freeze
 
-      # @return [ Mongo::Auth::User ] The user to authenticate.
-      attr_reader :user
-
-      # Instantiate a new authenticator.
-      #
-      # @example Create the authenticator.
-      #   Mongo::Auth::LDAP.new(user)
-      #
-      # @param [ Mongo::Auth::User ] user The user to authenticate.
-      #
-      # @since 2.0.0
-      def initialize(user)
-        @user = user
-      end
-      # Log the user in on the given connection.
-      #
-      # @example Log the user in.
-      #   user.login(connection)
-      #
-      # @param [ Mongo::Connection ] connection The connection to log into.
-      #   on.
-      #
-      # @return [ Protocol::Message ] The authentication response.
+      # Log the user in on the current connection.
       #
-      # @since 2.0.0
-      def login(connection)
-        conversation = Conversation.new(user)
-        reply = connection.dispatch([ conversation.start(connection) ])
-        connection.update_cluster_time(Operation::Result.new(reply))
-        conversation.finalize(reply, connection)
+      # @return [ BSON::Document ] The document of the authentication response.
+      def login
+        converse_1_step(connection, conversation)
       end
     end
   end
 end
+
+require 'mongo/auth/ldap/conversation'

data/lib/mongo/auth/ldap/conversation.rb

@@ -1,4 +1,4 @@
-# Copyright (C) 2014-2019 MongoDB Inc.
+# Copyright (C) 2014-2020 MongoDB Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -20,35 +20,14 @@ module Mongo
       # client and server.
       #
       # @since 2.0.0
-      class Conversation
+      # @api private
+      class Conversation < ConversationBase
 
         # The login message.
         #
         # @since 2.0.0
         LOGIN = { saslStart: 1, autoAuthorize: 1 }.freeze
 
-        # @return [ Protocol::Message ] reply The current reply in the
-        #   conversation.
-        attr_reader :reply
-
-        # @return [ User ] user The user for the conversation.
-        attr_reader :user
-
-        # Finalize the PLAIN conversation. This is meant to be iterated until
-        # the provided reply indicates the conversation is finished.
-        #
-        # @param [ Protocol::Message ] reply The reply of the previous
-        #   message.
-        # @param [ Server::Connection ] connection The connection being
-        #   authenticated.
-        #
-        # @return [ Protocol::Query ] The next message to send.
-        #
-        # @since 2.0.0
-        def finalize(reply, connection)
-          validate!(reply, connection.server)
-        end
-
         # Start the PLAIN conversation. This returns the first message that
         # needs to be sent to the server.
         #
@@ -75,30 +54,11 @@ module Mongo
           end
         end
 
-        # Create the new conversation.
-        #
-        # @example Create the new conversation.
-        #   Conversation.new(user, "admin")
-        #
-        # @param [ Auth::User ] user The user to converse about.
-        #
-        # @since 2.0.0
-        def initialize(user)
-          @user = user
-        end
-
         private
 
         def payload
           BSON::Binary.new("\x00#{user.name}\x00#{user.password}")
         end
-
-        def validate!(reply, server)
-          if reply.documents[0][Operation::Result::OK] != 1
-            raise Unauthorized.new(user, used_mechanism: MECHANISM, server: server)
-          end
-          @reply = reply
-        end
       end
     end
   end