Skip to content

Commit 564a663

Browse files
mongoKartmongoKart
committed
Squashed commit of the following:
commit ddf20eb Author: Mike Woofter <[email protected]> Date: Wed Apr 24 08:52:12 2024 -0500 remove aws eks commit 375ff2b Author: Mike Woofter <[email protected]> Date: Tue Apr 23 15:02:16 2024 -0500 add quotes to key commit 5f58b4c Author: Mike Woofter <[email protected]> Date: Tue Apr 23 15:00:33 2024 -0500 js feedback commit 6cd1518 Author: Mike Woofter <[email protected]> Date: Tue Apr 23 12:49:09 2024 -0500 links commit c9cabca Author: Mike Woofter <[email protected]> Date: Tue Apr 23 12:44:10 2024 -0500 add to usage examples commit 6dd50d1 Author: Mike Woofter <[email protected]> Date: Tue Apr 23 12:17:56 2024 -0500 refactor commit 61d2d7d Author: Mike Woofter <[email protected]> Date: Tue Apr 23 12:08:24 2024 -0500 fix commit 3d5c068 Author: Mike Woofter <[email protected]> Date: Tue Apr 23 12:05:16 2024 -0500 refactor commit ef9a110 Author: Mike Woofter <[email protected]> Date: Tue Apr 23 11:53:29 2024 -0500 refactor aws eks commit feeffda Author: Mike Woofter <[email protected]> Date: Tue Apr 23 11:41:04 2024 -0500 formatting commit 60c102e Author: Mike Woofter <[email protected]> Date: Tue Apr 23 11:32:30 2024 -0500 refactor code commit 8d1a1b7 Author: Mike Woofter <[email protected]> Date: Tue Apr 23 10:39:13 2024 -0500 fixes commit 2eeaaea Author: Mike Woofter <[email protected]> Date: Tue Apr 23 09:19:22 2024 -0500 autobuilder commit fbd5272 Author: Mike Woofter <[email protected]> Date: Tue Apr 23 09:03:32 2024 -0500 autobuilder commit 650922d Author: Mike Woofter <[email protected]> Date: Tue Apr 23 08:33:49 2024 -0500 first draft
1 parent 95ccae2 commit 564a663

10 files changed

+447
-5
lines changed

‎source/includes/authentication/azure-envs-connection-string.py

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
from pymongo import MongoClient
2+
from azure.identity import DefaultAzureCredential
3+
from pymongo.auth_oidc import OIDCCallback, OIDCCallbackContext, OIDCCallbackResult
4+
5+
# define callback, properties, URI, and MongoClient
6+
audience = "<percent-encoded application or service that the OIDC access token is intended for>"
7+
client_id = "<Azure identity client ID>"
8+
class MyCallback(OIDCCallback):
9+
def fetch(self, context: OIDCCallbackContext) -> OIDCCallbackResult:
10+
credential = DefaultAzureCredential(managed_identity_client_id=client_id)
11+
token = credential.get_token(f"{audience}/.default").token
12+
return OIDCCallbackResult(access_token=token)
13+
properties = {"OIDC_CALLBACK": MyCallback()}
14+
uri = ("mongodb://<hostname>:<port>/?"
15+
"&authMechanism=MONGODB-OIDC"
16+
"&authMechanismProperties=properties")
17+
client = MongoClient(uri)

‎source/includes/authentication/azure-envs-mongoclient.py

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
from pymongo import MongoClient
2+
from azure.identity import DefaultAzureCredential
3+
from pymongo.auth_oidc import OIDCCallback, OIDCCallbackContext, OIDCCallbackResult
4+
5+
# define callback, properties, and MongoClient
6+
audience = "<percent-encoded application or service that the OIDC access token is intended for>"
7+
client_id = "<Azure identity client ID>"
8+
class MyCallback(OIDCCallback):
9+
def fetch(self, context: OIDCCallbackContext) -> OIDCCallbackResult:
10+
credential = DefaultAzureCredential(managed_identity_client_id=client_id)
11+
token = credential.get_token(f"{audience}/.default").token
12+
return OIDCCallbackResult(access_token=token)
13+
properties = {"OIDC_CALLBACK": MyCallback()}
14+
client = MongoClient(
15+
"mongodb://<hostname>:<port>",
16+
authMechanism="MONGODB-OIDC",
17+
authMechanismProperties=properties,
18+
)

‎source/includes/authentication/azure-imds-connection-string.py

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
from pymongo import MongoClient
2+
3+
# define properties, URI, and MongoClient
4+
properties = {"ENVIRONMENT": "azure", "TOKEN_RESOURCE": "<audience>"}
5+
uri = ("mongodb://<hostname>:<port>/?"
6+
"username=<Azure identity client ID>"
7+
"&authMechanism=MONGODB-OIDC"
8+
"&authMechanismProperties=properties")
9+
client = MongoClient(uri)

‎source/includes/authentication/azure-imds-mongoclient.py

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
from pymongo import MongoClient
2+
3+
# define properties and MongoClient
4+
properties = {"ENVIRONMENT": "azure", "TOKEN_RESOURCE": "<audience>"}
5+
client = MongoClient(
6+
"mongodb://<hostname>:<port>",
7+
username="<Azure identity client ID>",
8+
authMechanism="MONGODB-OIDC",
9+
authMechanismProperties=properties,
10+
)

‎source/includes/authentication/gcp-gke-connection-string.py

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
from pymongo import MongoClient
2+
from pymongo.auth_oidc import OIDCCallback, OIDCCallbackContext, OIDCCallbackResult
3+
4+
# define callback, properties, URI, and MongoClient
5+
class MyCallback(OIDCCallback):
6+
def fetch(self, context: OIDCCallbackContext) -> OIDCCallbackResult:
7+
with open("/var/run/secrets/kubernetes.io/serviceaccount/token") as fid:
8+
token = fid.read()
9+
return OIDCCallbackResult(access_token=token)
10+
properties = {"OIDC_CALLBACK": MyCallback()}
11+
uri = ("mongodb://<hostname>:<port>/?"
12+
"&authMechanism=MONGODB-OIDC"
13+
"&authMechanismProperties=properties")
14+
client = MongoClient(uri)

‎source/includes/authentication/gcp-gke-mongoclient.py

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
from pymongo import MongoClient
2+
from pymongo.auth_oidc import OIDCCallback, OIDCCallbackContext, OIDCCallbackResult
3+
4+
# define callback, properties, and MongoClient
5+
class MyCallback(OIDCCallback):
6+
def fetch(self, context: OIDCCallbackContext) -> OIDCCallbackResult:
7+
with open("/var/run/secrets/kubernetes.io/serviceaccount/token") as fid:
8+
token = fid.read()
9+
return OIDCCallbackResult(access_token=token)
10+
properties = {"OIDC_CALLBACK": MyCallback()}
11+
client = MongoClient(
12+
"mongodb://<hostname>:<port>",
13+
authMechanism="MONGODB-OIDC",
14+
authMechanismProperties=properties,
15+
)

‎source/includes/authentication/gcp-imds-connection-string.py

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
from pymongo import MongoClient
2+
3+
# define properties, URI, and MongoClient
4+
properties = {"ENVIRONMENT": "gcp", "TOKEN_RESOURCE": "<audience>"}
5+
uri = ("mongodb://<hostname>:<port>/?"
6+
"username=<GCP identity client ID>"
7+
"&authMechanism=MONGODB-OIDC"
8+
"&authMechanismProperties=properties")
9+
client = MongoClient(uri)

‎source/includes/authentication/gcp-imds-mongoclient.py

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
from pymongo import MongoClient
2+
3+
# define properties and MongoClient
4+
properties = {"ENVIRONMENT": "gcp", "TOKEN_RESOURCE": "<audience>"}
5+
client = MongoClient(
6+
"mongodb://<hostname>:<port>",
7+
username="<GCP identity client ID>",
8+
authMechanism="MONGODB-OIDC",
9+
authMechanismProperties=properties,
10+
)

‎source/security.txt

Lines changed: 94 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -358,7 +358,7 @@ Unix
358358
client = pymongo.MongoClient(uri)
359359

360360
To learn more about authenticating with Kerberos, see
361-
:ref:`pymongo-kerberos` in the Authentication guide.
361+
:ref:`pymongo-kerberos` in the Enterprise Authentication guide.
362362

363363
Windows
364364
~~~~~~~
@@ -393,7 +393,7 @@ Windows
393393
client = pymongo.MongoClient(uri)
394394

395395
To learn more about authenticating with Kerberos, see
396-
:ref:`pymongo-kerberos` in the Authentication guide.
396+
:ref:`pymongo-kerberos` in the Enterprise Authentication guide.
397397

398398
PLAIN SASL
399399
----------
@@ -426,4 +426,95 @@ PLAIN SASL
426426
client = pymongo.MongoClient(uri)
427427

428428
To learn more about authenticating with PLAIN SASL, see
429-
:ref:`pymongo-sasl` in the Authentication guide.
429+
:ref:`pymongo-sasl` in the Enterprise Authentication guide.
430+
431+
MONGODB-OIDC
432+
------------
433+
434+
Azure IMDS
435+
~~~~~~~~~~
436+
437+
.. tabs::
438+
439+
.. tab:: MongoClient
440+
:tabid: mongoclient
441+
442+
.. literalinclude:: /includes/authentication/azure-imds-mongoclient.py
443+
:language: python
444+
:copyable: true
445+
446+
.. tab:: Connection String
447+
:tabid: connectionstring
448+
449+
.. literalinclude:: /includes/authentication/azure-imds-connection-string.py
450+
:language: python
451+
:copyable: true
452+
453+
To learn more about authenticating with OIDC, see
454+
:ref:`pymongo-mongodb-oidc-azure-imds` in the Authentication guide.
455+
456+
GCP IMDS
457+
~~~~~~~~
458+
459+
.. tabs::
460+
461+
.. tab:: MongoClient
462+
:tabid: mongoclient
463+
464+
.. literalinclude:: /includes/authentication/gcp-imds-mongoclient.py
465+
:language: python
466+
:copyable: true
467+
468+
.. tab:: Connection String
469+
:tabid: connectionstring
470+
471+
.. literalinclude:: /includes/authentication/gcp-imds-connection-string.py
472+
:language: python
473+
:copyable: true
474+
475+
To learn more about authenticating with OIDC, see
476+
:ref:`pymongo-mongodb-oidc-gcp-imds` in the Authentication guide.
477+
478+
Other Azure Environments
479+
~~~~~~~~~~~~~~~~~~~~~~~~
480+
481+
.. tabs::
482+
483+
.. tab:: MongoClient
484+
:tabid: mongoclient
485+
486+
.. literalinclude:: /includes/authentication/azure-envs-mongoclient.py
487+
:language: python
488+
:copyable: true
489+
490+
.. tab:: Connection String
491+
:tabid: connectionstring
492+
493+
.. literalinclude:: /includes/authentication/azure-envs-connection-string.py
494+
:language: python
495+
:copyable: true
496+
497+
To learn more about authenticating with OIDC, see
498+
:ref:`pymongo-mongodb-oidc-azure-envs` in the Authentication guide.
499+
500+
GCP GKE
501+
~~~~~~~
502+
503+
.. tabs::
504+
505+
.. tab:: MongoClient
506+
:tabid: mongoclient
507+
508+
.. literalinclude:: /includes/authentication/gcp-gke-mongoclient.py
509+
:language: python
510+
:copyable: true
511+
512+
.. tab:: Connection String
513+
:tabid: connectionstring
514+
515+
.. literalinclude:: /includes/authentication/gcp-gke-connection-string.py
516+
:language: python
517+
:copyable: true
518+
519+
To learn more about authenticating with OIDC, see
520+
:ref:`pymongo-mongodb-oidc-gcp-gke` in the Authentication guide.

0 commit comments

Comments
 (0)