Skip to content

Commit 0b930fd

Browse files
craiggwilsoncraiggwilson
committed
corrected issue with SSPI utilizing cached credentials. It is now required to specify the username for GSSAPI credentials.
1 parent 6d49cc2 commit 0b930fd

10 files changed

+38
-58
lines changed

‎MongoDB.Driver/Communication/Security/Mechanisms/GssapiMechanism.cs

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -26,9 +26,9 @@ namespace MongoDB.Driver.Communication.Security.Mechanisms
2626
/// </summary>
2727
internal class GssapiMechanism : ISaslMechanism
2828
{
29-
// private static methods
29+
// private static fields
3030
private static bool __useGsasl = !Environment.OSVersion.Platform.ToString().Contains("Win");
31-
31+
3232
// public properties
3333
/// <summary>
3434
/// Gets the name of the mechanism.
@@ -49,11 +49,11 @@ public string Name
4949
/// <exception cref="System.NotImplementedException"></exception>
5050
public bool CanUse(MongoCredential credential)
5151
{
52-
if(credential.Mechanism != MongoAuthenticationMechanism.GSSAPI || !(credential.Identity is MongoExternalIdentity))
52+
if (credential.Mechanism != MongoAuthenticationMechanism.Gssapi || !(credential.Identity is MongoExternalIdentity))
5353
{
54-
return false;
54+
return false;
5555
}
56-
if(__useGsasl)
56+
if (__useGsasl)
5757
{
5858
// GSASL relies on kinit to work properly and hence, the evidence is external.
5959
return credential.Evidence is ExternalEvidence;

‎MongoDB.Driver/Communication/Security/MongoCRAuthenticationProtocol.cs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@ public void Authenticate(MongoConnection connection, MongoCredential credential)
7777
/// </returns>
7878
public bool CanUse(MongoCredential credential)
7979
{
80-
return credential.Mechanism == MongoAuthenticationMechanism.MONGO_CR &&
80+
return credential.Mechanism == MongoAuthenticationMechanism.MongoCR &&
8181
credential.Evidence is PasswordEvidence;
8282
}
8383
}

‎MongoDB.Driver/ExternalEvidence.cs

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,8 @@
2121
namespace MongoDB.Driver
2222
{
2323
/// <summary>
24-
/// Evidence of a MongoIdentity via the currently executing process.
24+
/// Evidence of a MongoIdentity via an external mechanism. For example, on windows this may
25+
/// be the current process' user or, on linux, via kinit.
2526
/// </summary>
2627
public sealed class ExternalEvidence : MongoIdentityEvidence
2728
{

‎MongoDB.Driver/MongoAuthenticationMechanism.cs

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,10 +23,10 @@ public enum MongoAuthenticationMechanism
2323
/// <summary>
2424
/// Authenticate to the server using the Mongo Challenge Response (MONGO-CR) protocol.
2525
/// </summary>
26-
MONGO_CR,
26+
MongoCR,
2727
/// <summary>
2828
/// Authenticate to the server using GSSAPI.
2929
/// </summary>
30-
GSSAPI
30+
Gssapi
3131
}
3232
}

‎MongoDB.Driver/MongoConnectionStringBuilder.cs

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -675,7 +675,7 @@ public override object this[string keyword]
675675
case "authmechanism":
676676
if (value is string)
677677
{
678-
string mechanism = value.ToString().Replace("-", "_");
678+
string mechanism = ((string)value).Replace("-", "_");
679679
AuthenticationMechanism = (MongoAuthenticationMechanism)Enum.Parse(typeof(MongoAuthenticationMechanism), mechanism, true);
680680
}
681681
else
@@ -965,7 +965,7 @@ private IEnumerable<MongoServerAddress> ParseServersString(string value)
965965
private void ResetValues()
966966
{
967967
// set fields and not properties so base class items aren't set
968-
_authenticationMechanism = MongoAuthenticationMechanism.MONGO_CR;
968+
_authenticationMechanism = MongoAuthenticationMechanism.MongoCR;
969969
_authenticationSource = null;
970970
_connectionMode = ConnectionMode.Automatic;
971971
_connectTimeout = MongoDefaults.ConnectTimeout;

‎MongoDB.Driver/MongoCredential.cs

Lines changed: 13 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -137,18 +137,6 @@ public string Username
137137
}
138138

139139
// public static methods
140-
/// <summary>
141-
/// Creates a GSSAPI credential.
142-
/// </summary>
143-
/// <returns>A credential for GSSAPI.</returns>
144-
public static MongoCredential CreateGssapiCredential()
145-
{
146-
return FromComponents(MongoAuthenticationMechanism.GSSAPI,
147-
"$external",
148-
null,
149-
(PasswordEvidence)null);
150-
}
151-
152140
/// <summary>
153141
/// Creates a GSSAPI credential.
154142
/// </summary>
@@ -157,7 +145,7 @@ public static MongoCredential CreateGssapiCredential()
157145
/// <remarks>This overload is used primarily on linux.</remarks>
158146
public static MongoCredential CreateGssapiCredential(string username)
159147
{
160-
return FromComponents(MongoAuthenticationMechanism.GSSAPI,
148+
return FromComponents(MongoAuthenticationMechanism.Gssapi,
161149
"$external",
162150
username,
163151
(PasswordEvidence)null);
@@ -171,7 +159,7 @@ public static MongoCredential CreateGssapiCredential(string username)
171159
/// <returns>A credential for GSSAPI.</returns>
172160
public static MongoCredential CreateGssapiCredential(string username, string password)
173161
{
174-
return FromComponents(MongoAuthenticationMechanism.GSSAPI,
162+
return FromComponents(MongoAuthenticationMechanism.Gssapi,
175163
"$external",
176164
username,
177165
new PasswordEvidence(password));
@@ -185,7 +173,7 @@ public static MongoCredential CreateGssapiCredential(string username, string pas
185173
/// <returns>A credential for GSSAPI.</returns>
186174
public static MongoCredential CreateGssapiCredential(string username, SecureString password)
187175
{
188-
return FromComponents(MongoAuthenticationMechanism.GSSAPI,
176+
return FromComponents(MongoAuthenticationMechanism.Gssapi,
189177
"$external",
190178
username,
191179
new PasswordEvidence(password));
@@ -200,7 +188,7 @@ public static MongoCredential CreateGssapiCredential(string username, SecureStri
200188
/// <returns></returns>
201189
public static MongoCredential CreateMongoCRCredential(string databaseName, string username, string password)
202190
{
203-
return FromComponents(MongoAuthenticationMechanism.MONGO_CR,
191+
return FromComponents(MongoAuthenticationMechanism.MongoCR,
204192
databaseName,
205193
username,
206194
new PasswordEvidence(password));
@@ -215,7 +203,7 @@ public static MongoCredential CreateMongoCRCredential(string databaseName, strin
215203
/// <returns></returns>
216204
public static MongoCredential CreateMongoCRCredential(string databaseName, string username, SecureString password)
217205
{
218-
return FromComponents(MongoAuthenticationMechanism.MONGO_CR,
206+
return FromComponents(MongoAuthenticationMechanism.MongoCR,
219207
databaseName,
220208
username,
221209
new PasswordEvidence(password));
@@ -289,15 +277,16 @@ private void ValidatePassword(string password)
289277
// private static methods
290278
private static MongoCredential FromComponents(MongoAuthenticationMechanism mechanism, string source, string username, MongoIdentityEvidence evidence)
291279
{
280+
if (string.IsNullOrEmpty(username))
281+
{
282+
return null;
283+
}
284+
292285
switch (mechanism)
293286
{
294-
case MongoAuthenticationMechanism.MONGO_CR:
287+
case MongoAuthenticationMechanism.MongoCR:
295288
// it is allowed for a password to be an empty string, but not a username
296289
source = source ?? "admin";
297-
if (string.IsNullOrEmpty(username))
298-
{
299-
return null;
300-
}
301290
if (evidence == null || !(evidence is PasswordEvidence))
302291
{
303292
throw new ArgumentException(string.Format("A {0} credential must have a password.", mechanism));
@@ -307,25 +296,15 @@ private static MongoCredential FromComponents(MongoAuthenticationMechanism mecha
307296
mechanism,
308297
new MongoInternalIdentity(source, username),
309298
evidence);
310-
case MongoAuthenticationMechanism.GSSAPI:
299+
case MongoAuthenticationMechanism.Gssapi:
311300
source = source ?? "$external";
312301
if (source != "$external")
313302
{
314303
throw new ArgumentException("The source for GSSAPI must be $external.");
315304
}
316305

317-
if (string.IsNullOrEmpty(username))
318-
{
319-
username = Environment.UserName;
320-
if (!string.IsNullOrEmpty(Environment.UserDomainName))
321-
{
322-
// DOMAIN\username
323-
username = Environment.UserDomainName + "\\" + username;
324-
}
325-
}
326-
327306
return new MongoCredential(
328-
MongoAuthenticationMechanism.GSSAPI,
307+
MongoAuthenticationMechanism.Gssapi,
329308
new MongoExternalIdentity(source, username),
330309
evidence);
331310
default:

‎MongoDB.Driver/MongoUrlBuilder.cs

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ public class MongoUrlBuilder
6666
/// </summary>
6767
public MongoUrlBuilder()
6868
{
69-
_authenticationMechanism = MongoAuthenticationMechanism.MONGO_CR;
69+
_authenticationMechanism = MongoAuthenticationMechanism.MongoCR;
7070
_authenticationSource = null;
7171
_connectionMode = ConnectionMode.Automatic;
7272
_connectTimeout = MongoDefaults.ConnectTimeout;
@@ -1014,7 +1014,7 @@ public override string ToString()
10141014
url.Append(_databaseName);
10151015
}
10161016
var query = new StringBuilder();
1017-
if (_authenticationMechanism != MongoAuthenticationMechanism.MONGO_CR)
1017+
if (_authenticationMechanism != MongoAuthenticationMechanism.MongoCR)
10181018
{
10191019
string mechanismName = _authenticationMechanism
10201020
.ToString()

‎MongoDB.DriverUnitTests/MongoConnectionStringBuilderTests.cs

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ public void TestAll()
3737
};
3838
var built = new MongoConnectionStringBuilder()
3939
{
40-
AuthenticationMechanism = MongoAuthenticationMechanism.GSSAPI,
40+
AuthenticationMechanism = MongoAuthenticationMechanism.Gssapi,
4141
AuthenticationSource = "db",
4242
ConnectionMode = ConnectionMode.ReplicaSet,
4343
ConnectTimeout = TimeSpan.FromSeconds(1),
@@ -96,7 +96,7 @@ public void TestAll()
9696

9797
foreach (var builder in EnumerateBuiltAndParsedBuilders(built, connectionString))
9898
{
99-
Assert.AreEqual(MongoAuthenticationMechanism.GSSAPI, builder.AuthenticationMechanism);
99+
Assert.AreEqual(MongoAuthenticationMechanism.Gssapi, builder.AuthenticationMechanism);
100100
Assert.AreEqual("db", builder.AuthenticationSource);
101101
Assert.AreEqual(123, builder.ComputedWaitQueueSize);
102102
Assert.AreEqual(ConnectionMode.ReplicaSet, builder.ConnectionMode);
@@ -135,8 +135,8 @@ public void TestAll()
135135
}
136136

137137
[Test]
138-
[TestCase(MongoAuthenticationMechanism.MONGO_CR, "server=localhost;authMechanism=MONGO-CR")]
139-
[TestCase(MongoAuthenticationMechanism.GSSAPI, "server=localhost;authMechanism=GSSAPI")]
138+
[TestCase(MongoAuthenticationMechanism.MongoCR, "server=localhost;authMechanism=MONGO-CR")]
139+
[TestCase(MongoAuthenticationMechanism.Gssapi, "server=localhost;authMechanism=GSSAPI")]
140140
public void TestAuthMechanism(MongoAuthenticationMechanism mechanism, string connectionString)
141141
{
142142
var built = new MongoConnectionStringBuilder { Server = _localhost, AuthenticationMechanism = mechanism };

‎MongoDB.DriverUnitTests/MongoUrlBuilderTests.cs

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ public void TestAll()
3737
};
3838
var built = new MongoUrlBuilder()
3939
{
40-
AuthenticationMechanism = MongoAuthenticationMechanism.GSSAPI,
40+
AuthenticationMechanism = MongoAuthenticationMechanism.Gssapi,
4141
AuthenticationSource = "db",
4242
ConnectionMode = ConnectionMode.ReplicaSet,
4343
ConnectTimeout = TimeSpan.FromSeconds(1),
@@ -92,7 +92,7 @@ public void TestAll()
9292

9393
foreach (var builder in EnumerateBuiltAndParsedBuilders(built, connectionString))
9494
{
95-
Assert.AreEqual(MongoAuthenticationMechanism.GSSAPI, builder.AuthenticationMechanism);
95+
Assert.AreEqual(MongoAuthenticationMechanism.Gssapi, builder.AuthenticationMechanism);
9696
Assert.AreEqual("db", builder.AuthenticationSource);
9797
Assert.AreEqual(123, builder.ComputedWaitQueueSize);
9898
Assert.AreEqual(ConnectionMode.ReplicaSet, builder.ConnectionMode);
@@ -131,8 +131,8 @@ public void TestAll()
131131
}
132132

133133
[Test]
134-
[TestCase(MongoAuthenticationMechanism.MONGO_CR, "mongodb://localhost")]
135-
[TestCase(MongoAuthenticationMechanism.GSSAPI, "mongodb://localhost/?authMechanism=GSSAPI")]
134+
[TestCase(MongoAuthenticationMechanism.MongoCR, "mongodb://localhost")]
135+
[TestCase(MongoAuthenticationMechanism.Gssapi, "mongodb://localhost/?authMechanism=GSSAPI")]
136136
public void TestAuthMechanism(MongoAuthenticationMechanism mechanism, string connectionString)
137137
{
138138
var built = new MongoUrlBuilder { Server = _localhost, AuthenticationMechanism = mechanism };
@@ -279,7 +279,7 @@ public void TestDefaults()
279279

280280
foreach (var builder in EnumerateBuiltAndParsedBuilders(built, connectionString))
281281
{
282-
Assert.AreEqual(MongoAuthenticationMechanism.MONGO_CR, builder.AuthenticationMechanism);
282+
Assert.AreEqual(MongoAuthenticationMechanism.MongoCR, builder.AuthenticationMechanism);
283283
Assert.AreEqual(null, builder.AuthenticationSource);
284284
Assert.AreEqual(MongoDefaults.ComputedWaitQueueSize, builder.ComputedWaitQueueSize);
285285
Assert.AreEqual(ConnectionMode.Automatic, builder.ConnectionMode);

‎MongoDB.DriverUnitTests/MongoUrlTests.cs

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ public void TestAll()
3737
};
3838
var built = new MongoUrlBuilder()
3939
{
40-
AuthenticationMechanism = MongoAuthenticationMechanism.GSSAPI,
40+
AuthenticationMechanism = MongoAuthenticationMechanism.Gssapi,
4141
AuthenticationSource = "db",
4242
ConnectionMode = ConnectionMode.ReplicaSet,
4343
ConnectTimeout = TimeSpan.FromSeconds(1),
@@ -92,7 +92,7 @@ public void TestAll()
9292

9393
foreach (var url in EnumerateBuiltAndParsedUrls(built, connectionString))
9494
{
95-
Assert.AreEqual(MongoAuthenticationMechanism.GSSAPI, url.AuthenticationMechanism);
95+
Assert.AreEqual(MongoAuthenticationMechanism.Gssapi, url.AuthenticationMechanism);
9696
Assert.AreEqual("db", url.AuthenticationSource);
9797
Assert.AreEqual(123, url.ComputedWaitQueueSize);
9898
Assert.AreEqual(ConnectionMode.ReplicaSet, url.ConnectionMode);

0 commit comments

Comments
 (0)