@@ -26,14 +26,23 @@ import (
26
26
// MongoDBOIDC is the string constant for the MONGODB-OIDC authentication mechanism.
27
27
const MongoDBOIDC = "MONGODB-OIDC"
28
28
29
- // const tokenResourceProp = "TOKEN_RESOURCE"
30
- const environmentProp = "ENVIRONMENT"
31
- const resourceProp = "TOKEN_RESOURCE"
32
- const allowedHostsProp = "ALLOWED_HOSTS"
29
+ // EnvironmentProp is the property key name that specifies the environment for the OIDC authenticator.
30
+ const EnvironmentProp = "ENVIRONMENT"
33
31
34
- const azureEnvironmentValue = "azure"
35
- const gcpEnvironmentValue = "gcp"
36
- const testEnvironmentValue = "test"
32
+ // ResourceProp is the property key name that specifies the token resource for GCP and AZURE OIDC auth.
33
+ const ResourceProp = "TOKEN_RESOURCE"
34
+
35
+ // AllowedHostsProp is the property key name that specifies the allowed hosts for the OIDC authenticator.
36
+ const AllowedHostsProp = "ALLOWED_HOSTS"
37
+
38
+ // AzureEnvironmentValue is the value for the Azure environment.
39
+ const AzureEnvironmentValue = "azure"
40
+
41
+ // GCPEnvironmentValue is the value for the GCP environment.
42
+ const GCPEnvironmentValue = "gcp"
43
+
44
+ // TestEnvironmentValue is the value for the test environment.
45
+ const TestEnvironmentValue = "test"
37
46
38
47
const apiVersion = 1
39
48
const invalidateSleepTimeout = 100 * time .Millisecond
@@ -104,18 +113,18 @@ func newOIDCAuthenticator(cred *Cred, httpClient *http.Client) (Authenticator, e
104
113
return nil , fmt .Errorf ("password cannot be specified for %q" , MongoDBOIDC )
105
114
}
106
115
if cred .Props != nil {
107
- if env , ok := cred .Props [environmentProp ]; ok {
116
+ if env , ok := cred .Props [EnvironmentProp ]; ok {
108
117
switch strings .ToLower (env ) {
109
- case azureEnvironmentValue :
118
+ case AzureEnvironmentValue :
110
119
fallthrough
111
- case gcpEnvironmentValue :
112
- if _ , ok := cred .Props [resourceProp ]; ! ok {
113
- return nil , fmt .Errorf ("%q must be specified for %q %q" , resourceProp , env , environmentProp )
120
+ case GCPEnvironmentValue :
121
+ if _ , ok := cred .Props [ResourceProp ]; ! ok {
122
+ return nil , fmt .Errorf ("%q must be specified for %q %q" , ResourceProp , env , EnvironmentProp )
114
123
}
115
124
fallthrough
116
- case testEnvironmentValue :
125
+ case TestEnvironmentValue :
117
126
if cred .OIDCMachineCallback != nil || cred .OIDCHumanCallback != nil {
118
- return nil , fmt .Errorf ("OIDC callbacks are not allowed for %q %q" , env , environmentProp )
127
+ return nil , fmt .Errorf ("OIDC callbacks are not allowed for %q %q" , env , EnvironmentProp )
119
128
}
120
129
}
121
130
}
@@ -151,7 +160,8 @@ func (oa *OIDCAuthenticator) setAllowedHosts() error {
151
160
oa .allowedHosts = & defaultAllowedHosts
152
161
return nil
153
162
}
154
- allowedHosts , ok := oa .AuthMechanismProperties [allowedHostsProp ]
163
+
164
+ allowedHosts , ok := oa .AuthMechanismProperties [AllowedHostsProp ]
155
165
if ! ok {
156
166
oa .allowedHosts = & defaultAllowedHosts
157
167
return nil
@@ -168,18 +178,18 @@ func (oa *OIDCAuthenticator) setAllowedHosts() error {
168
178
func (oa * OIDCAuthenticator ) validateConnectionAddressWithAllowedHosts (conn driver.Connection ) error {
169
179
if oa .allowedHosts == nil {
170
180
// should be unreachable, but this is a safety check.
171
- return newAuthError (fmt .Sprintf ("%q missing" , allowedHostsProp ), nil )
181
+ return newAuthError (fmt .Sprintf ("%q missing" , AllowedHostsProp ), nil )
172
182
}
173
183
allowedHosts := * oa .allowedHosts
174
184
if len (allowedHosts ) == 0 {
175
- return newAuthError (fmt .Sprintf ("empty %q specified" , allowedHostsProp ), nil )
185
+ return newAuthError (fmt .Sprintf ("empty %q specified" , AllowedHostsProp ), nil )
176
186
}
177
187
for _ , pattern := range allowedHosts {
178
188
if pattern .MatchString (string (conn .Address ())) {
179
189
return nil
180
190
}
181
191
}
182
- return newAuthError (fmt .Sprintf ("address %q not allowed by %q: %v" , conn .Address (), allowedHostsProp , allowedHosts ), nil )
192
+ return newAuthError (fmt .Sprintf ("address %q not allowed by %q: %v" , conn .Address (), AllowedHostsProp , allowedHosts ), nil )
183
193
}
184
194
185
195
type oidcOneStep struct {
@@ -249,27 +259,27 @@ func (*oidcTwoStep) Completed() bool {
249
259
}
250
260
251
261
func (oa * OIDCAuthenticator ) providerCallback () (OIDCCallback , error ) {
252
- env , ok := oa .AuthMechanismProperties [environmentProp ]
262
+ env , ok := oa .AuthMechanismProperties [EnvironmentProp ]
253
263
if ! ok {
254
264
return nil , nil
255
265
}
256
266
257
267
switch env {
258
- case azureEnvironmentValue :
259
- resource , ok := oa .AuthMechanismProperties [resourceProp ]
268
+ case AzureEnvironmentValue :
269
+ resource , ok := oa .AuthMechanismProperties [ResourceProp ]
260
270
if ! ok {
261
- return nil , newAuthError (fmt .Sprintf ("%q must be specified for Azure OIDC" , resourceProp ), nil )
271
+ return nil , newAuthError (fmt .Sprintf ("%q must be specified for Azure OIDC" , ResourceProp ), nil )
262
272
}
263
273
return getAzureOIDCCallback (oa .userName , resource , oa .httpClient ), nil
264
- case gcpEnvironmentValue :
265
- resource , ok := oa .AuthMechanismProperties [resourceProp ]
274
+ case GCPEnvironmentValue :
275
+ resource , ok := oa .AuthMechanismProperties [ResourceProp ]
266
276
if ! ok {
267
- return nil , newAuthError (fmt .Sprintf ("%q must be specified for GCP OIDC" , resourceProp ), nil )
277
+ return nil , newAuthError (fmt .Sprintf ("%q must be specified for GCP OIDC" , ResourceProp ), nil )
268
278
}
269
279
return getGCPOIDCCallback (resource , oa .httpClient ), nil
270
280
}
271
281
272
- return nil , fmt .Errorf ("%q %q not supported for MONGODB-OIDC" , environmentProp , env )
282
+ return nil , fmt .Errorf ("%q %q not supported for MONGODB-OIDC" , EnvironmentProp , env )
273
283
}
274
284
275
285
// getAzureOIDCCallback returns the callback for the Azure Identity Provider.
0 commit comments