feat(NODE-5035): enable OIDC authentication #3577

durran · 2023-02-20T21:39:24Z

Description

Implements OIDC auth.

Spec PR: mongodb/specifications#1365

Latest tools fix: mongodb-labs/drivers-evergreen-tools#272

What is changing?

Adds a new MongoDBOIDC auth provider.
Introduces the concept of workflows for additional cloud providers in the future.
Adds the spec prose tests for OIDC except reauthentication. (NODE-5036)

Is there new documentation needed for these changes?

None

What is the motivation for this change?

NODE-5035/DRIVERS-2415

Double check the following

Ran npm run check:lint script
Self-review completed using the steps outlined here
PR title follows the correct format: type(NODE-xxxx)[!]: description
- Example: feat(NODE-1234)!: rewriting everything in coffeescript
Changes are covered by tests
New TODOs have a related JIRA ticket

src/cmap/auth/mongodb_oidc.ts

src/cmap/auth/mongo_credentials.ts

src/cmap/auth/mongodb_oidc/aws_device_workflow.ts

src/cmap/auth/mongodb_oidc.ts

addaleax

Didn’t quite get around to the test/ changes right now, will try to do that later, but what’s in src/ looks good to me 👍

.evergreen/config.in.yml

.evergreen/config.yml

src/cmap/auth/mongodb_oidc/callback_workflow.ts

src/cmap/auth/mongodb_oidc/aws_device_workflow.ts

src/cmap/auth/mongodb_oidc/token_entry_cache.ts

test/manual/mongodb_oidc.test.ts

test/unit/cmap/auth/mongodb_oidc/aws_device_workflow.test.ts

test/manual/mongodb_oidc.test.ts

baileympearson

I didn't look at tests here, but have some suggestions on the implementation. I like the workflow abstraction, and I love to see more usage of async-await in the driver. Nice work 🙂

src/cmap/auth/mongodb_oidc.ts

src/cmap/auth/mongodb_oidc/callback_workflow.ts

src/cmap/auth/mongodb_oidc/token_entry_cache.ts

src/cmap/auth/mongodb_oidc/callback_workflow.ts

test/manual/mongodb_oidc.test.ts

src/cmap/auth/mongodb_oidc/device_workflow.ts

test/unit/cmap/auth/mongodb_oidc/aws_device_workflow.test.ts

W-A-James

Note: Serverless failures are caused by issue documented in https://jira.mongodb.org/browse/DRIVERS-2564

Filing flaky test ticket for time series unified spec tests

Co-authored-by: Daria Pardue <daria.pardue@mongodb.com>

durran changed the title ~~test(NODE-5035): enable OIDC authentication~~ feat(NODE-5035): enable OIDC authentication Feb 20, 2023

durran force-pushed the NODE-5035 branch 2 times, most recently from c161b8f to 1043567 Compare February 20, 2023 22:05

addaleax reviewed Feb 20, 2023

View reviewed changes

src/cmap/auth/mongodb_oidc.ts Outdated Show resolved Hide resolved

src/cmap/auth/mongo_credentials.ts Show resolved Hide resolved

durran added the wip label Feb 20, 2023

addaleax reviewed Feb 23, 2023

View reviewed changes

src/cmap/auth/mongodb_oidc/aws_device_workflow.ts Outdated Show resolved Hide resolved

durran force-pushed the NODE-5035 branch 3 times, most recently from 93376a0 to 464a587 Compare February 24, 2023 16:28

addaleax reviewed Feb 27, 2023

View reviewed changes

src/cmap/auth/mongodb_oidc.ts Outdated Show resolved Hide resolved

src/cmap/auth/mongodb_oidc.ts Outdated Show resolved Hide resolved

addaleax reviewed Feb 27, 2023

View reviewed changes

src/cmap/auth/mongodb_oidc.ts Show resolved Hide resolved

durran removed the wip label Feb 27, 2023

durran marked this pull request as ready for review February 27, 2023 13:17

addaleax reviewed Feb 27, 2023

View reviewed changes

.evergreen/config.in.yml Outdated Show resolved Hide resolved

.evergreen/config.yml Outdated Show resolved Hide resolved

src/cmap/auth/mongodb_oidc/callback_workflow.ts Outdated Show resolved Hide resolved

src/cmap/auth/mongodb_oidc/aws_device_workflow.ts Outdated Show resolved Hide resolved

durran force-pushed the NODE-5035 branch from bcf2784 to 652486c Compare February 27, 2023 14:47

W-A-James added the Primary Review In Review with primary reviewer, not yet ready for team's eyes label Feb 27, 2023

W-A-James requested changes Feb 27, 2023

View reviewed changes

baileympearson requested changes Feb 27, 2023

View reviewed changes

durran requested review from baileympearson and W-A-James February 27, 2023 19:44

durran force-pushed the NODE-5035 branch from 3eae0b3 to 6cfd1d5 Compare February 27, 2023 21:47

addaleax reviewed Feb 28, 2023

View reviewed changes

src/cmap/auth/mongodb_oidc/token_entry_cache.ts Outdated Show resolved Hide resolved

src/cmap/auth/mongodb_oidc/token_entry_cache.ts Show resolved Hide resolved

durran force-pushed the NODE-5035 branch from 95fa8ff to 33c47dc Compare February 28, 2023 12:19

W-A-James reviewed Feb 28, 2023

View reviewed changes

src/cmap/auth/mongodb_oidc/callback_workflow.ts Outdated Show resolved Hide resolved

test/manual/mongodb_oidc.test.ts Outdated Show resolved Hide resolved

baileympearson requested changes Feb 28, 2023

View reviewed changes

src/cmap/auth/mongodb_oidc/device_workflow.ts Outdated Show resolved Hide resolved

test/unit/cmap/auth/mongodb_oidc/aws_device_workflow.test.ts Outdated Show resolved Hide resolved

W-A-James self-requested a review February 28, 2023 15:16

W-A-James reviewed Feb 28, 2023

View reviewed changes

W-A-James added Primary Review In Review with primary reviewer, not yet ready for team's eyes Team Review Needs review from team and removed Primary Review In Review with primary reviewer, not yet ready for team's eyes labels Feb 28, 2023

durran and others added 26 commits March 3, 2023 15:29

refactor(NODE-5035): only implement getToken for devices

3125359

chore(NODE-5035): remove comment

9b28104

chore(NODE-5035): remove comment

cb1bd77

test(NODE-5035): use tools master again

2c87f3c

feat(NODE-5035): cleanup cache ono each request

88f9bf4

feat(NODE-5035): remove from cache when auth fails

025b546

chore(NODE-5035): add comment

1d700d6

fix(NODE-5035): change per suggestions

46bad06

fix(NODE-5035): change per suggestions

528c102

test(NODE-5035): fix unit tests

7c674d8

test(NODE-5035): fix callback tests

defde0e

fix(NODE-5035): no expiresInSeconds is immediate expiration

221c45d

chore(NODE-5035): update per comments

b2bd284

fix(NODE-5035): change default setting

5d3015f

test(NODE-5035): check for error type

28b52cd

fix: comment

427b499

chore: add suggestions

a21a271

chore: add suggestions

33253a3

chore: addressing comments

e76c781

chore: update per suggestions

5db996d

refactor(NODE-5035): device becomes service

36caf3f

feat(NODE-5035): add function identity

10bc3c3

Update test/unit/cmap/auth/mongodb_oidc/token_entry_cache.test.ts

f38b215

Co-authored-by: Daria Pardue <daria.pardue@mongodb.com>

test: fix test

e9c43e7

fix: change service name to provider name

5028985

test: fix unit test

182ef41

durran force-pushed the NODE-5035 branch from ba1b845 to 182ef41 Compare March 3, 2023 14:30

dariakp approved these changes Mar 3, 2023

View reviewed changes

dariakp merged commit 35879f6 into main Mar 3, 2023

dariakp deleted the NODE-5035 branch March 3, 2023 16:19

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(NODE-5035): enable OIDC authentication #3577

feat(NODE-5035): enable OIDC authentication #3577

durran commented Feb 20, 2023 •

edited

Loading

addaleax left a comment

baileympearson left a comment

W-A-James left a comment

feat(NODE-5035): enable OIDC authentication #3577

feat(NODE-5035): enable OIDC authentication #3577

Conversation

durran commented Feb 20, 2023 • edited Loading

Description

What is changing?

Is there new documentation needed for these changes?

What is the motivation for this change?

Double check the following

addaleax left a comment

Choose a reason for hiding this comment

baileympearson left a comment

Choose a reason for hiding this comment

W-A-James left a comment

Choose a reason for hiding this comment

durran commented Feb 20, 2023 •

edited

Loading