Skip to content

Commit d838ef2

Browse files
kevinAlbskevinAlbs
authored
CDRIVER-4081 Add support for AssumeRoleWithWebIdentity in AWS Auth (#1211)
* ignore NULL for `bson_string_free` Follows pattern of other destroy / free functions in libbson and libmongoc * add use_tls option to _send_http_request * add `_obtain_creds_from_assumerolewithwebidentity` rename expiration_to_timer to expiration_iso8601_to_timer * fix length in `_mongoc_http_send` `datalen` is capacity of the buffer. * fix size arg in `bin_to_hex` utility The size argument includes the NULL byte * test in Evergreen * format util.h * move `hex_to_bin` and `bin_to_hex` to mongoc-util-private.h * test `bin_to_hex` and `hex_to_bin` * lowercase variable names * revise comment for null terminator * break long line at ampersand * add spaces between test cases * multiply before cast
1 parent 07352c5 commit d838ef2

File tree

15 files changed

+509
-87
lines changed

15 files changed

+509
-87
lines changed

‎.evergreen/generated_configs/legacy-config.yml

Lines changed: 60 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -267,7 +267,12 @@ functions:
267267
"iam_auth_assume_role_name" : "${iam_auth_assume_role_name}",
268268
"iam_auth_ec2_instance_account" : "${iam_auth_ec2_instance_account}",
269269
"iam_auth_ec2_instance_secret_access_key" : "${iam_auth_ec2_instance_secret_access_key}",
270-
"iam_auth_ec2_instance_profile" : "${iam_auth_ec2_instance_profile}"
270+
"iam_auth_ec2_instance_profile" : "${iam_auth_ec2_instance_profile}",
271+
"iam_auth_assume_web_role_name": "${iam_auth_assume_web_role_name}",
272+
"iam_web_identity_issuer": "${iam_web_identity_issuer}",
273+
"iam_web_identity_rsa_key": "${iam_web_identity_rsa_key}",
274+
"iam_web_identity_jwks_uri": "${iam_web_identity_jwks_uri}",
275+
"iam_web_identity_token_file": "${iam_web_identity_token_file}"
271276
}
272277
EOF
273278
- command: shell.exec
@@ -2050,6 +2055,57 @@ tasks:
20502055
- func: run aws tests
20512056
vars:
20522057
TESTCASE: ASSUME_ROLE
2058+
- name: test-aws-openssl-assume_role_with_web_identity-latest
2059+
depends_on:
2060+
name: debug-compile-aws
2061+
commands:
2062+
- func: fetch-build
2063+
vars:
2064+
BUILD_NAME: debug-compile-aws
2065+
- func: fetch-det
2066+
- func: bootstrap-mongo-orchestration
2067+
vars:
2068+
AUTH: auth
2069+
MONGODB_VERSION: latest
2070+
ORCHESTRATION_FILE: auth-aws
2071+
TOPOLOGY: server
2072+
- func: run aws tests
2073+
vars:
2074+
TESTCASE: ASSUME_ROLE_WITH_WEB_IDENTITY
2075+
- name: test-aws-openssl-assume_role_with_web_identity-5.0
2076+
depends_on:
2077+
name: debug-compile-aws
2078+
commands:
2079+
- func: fetch-build
2080+
vars:
2081+
BUILD_NAME: debug-compile-aws
2082+
- func: fetch-det
2083+
- func: bootstrap-mongo-orchestration
2084+
vars:
2085+
AUTH: auth
2086+
MONGODB_VERSION: '5.0'
2087+
ORCHESTRATION_FILE: auth-aws
2088+
TOPOLOGY: server
2089+
- func: run aws tests
2090+
vars:
2091+
TESTCASE: ASSUME_ROLE_WITH_WEB_IDENTITY
2092+
- name: test-aws-openssl-assume_role_with_web_identity-4.4
2093+
depends_on:
2094+
name: debug-compile-aws
2095+
commands:
2096+
- func: fetch-build
2097+
vars:
2098+
BUILD_NAME: debug-compile-aws
2099+
- func: fetch-det
2100+
- func: bootstrap-mongo-orchestration
2101+
vars:
2102+
AUTH: auth
2103+
MONGODB_VERSION: '4.4'
2104+
ORCHESTRATION_FILE: auth-aws
2105+
TOPOLOGY: server
2106+
- func: run aws tests
2107+
vars:
2108+
TESTCASE: ASSUME_ROLE_WITH_WEB_IDENTITY
20532109
- name: ocsp-openssl-test_1-rsa-delegate-latest
20542110
tags:
20552111
- ocsp-openssl
@@ -9639,6 +9695,9 @@ buildvariants:
96399695
- test-aws-openssl-ecs-4.4
96409696
- test-aws-openssl-assume_role-4.4
96419697
- test-aws-openssl-lambda-4.4
9698+
- test-aws-openssl-assume_role_with_web_identity-latest
9699+
- test-aws-openssl-assume_role_with_web_identity-5.0
9700+
- test-aws-openssl-assume_role_with_web_identity-4.4
96429701
- name: mongohouse
96439702
display_name: Mongohouse Test
96449703
run_on: ubuntu1804-test

‎.evergreen/legacy_config_generator/evergreen_config_lib/functions.py

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -193,7 +193,12 @@
193193
"iam_auth_assume_role_name" : "${iam_auth_assume_role_name}",
194194
"iam_auth_ec2_instance_account" : "${iam_auth_ec2_instance_account}",
195195
"iam_auth_ec2_instance_secret_access_key" : "${iam_auth_ec2_instance_secret_access_key}",
196-
"iam_auth_ec2_instance_profile" : "${iam_auth_ec2_instance_profile}"
196+
"iam_auth_ec2_instance_profile" : "${iam_auth_ec2_instance_profile}",
197+
"iam_auth_assume_web_role_name": "${iam_auth_assume_web_role_name}",
198+
"iam_web_identity_issuer": "${iam_web_identity_issuer}",
199+
"iam_web_identity_rsa_key": "${iam_web_identity_rsa_key}",
200+
"iam_web_identity_jwks_uri": "${iam_web_identity_jwks_uri}",
201+
"iam_web_identity_token_file": "${iam_web_identity_token_file}"
197202
}
198203
EOF
199204
''', silent=True),

‎.evergreen/legacy_config_generator/evergreen_config_lib/tasks.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -826,7 +826,7 @@ def _check_allowed(self):
826826

827827

828828
class AWSTestTask(MatrixTask):
829-
axes = OD([('testcase', ['regular', 'ec2', 'ecs', 'lambda', 'assume_role']),
829+
axes = OD([('testcase', ['regular', 'ec2', 'ecs', 'lambda', 'assume_role', 'assume_role_with_web_identity']),
830830
('version', ['latest', '5.0', '4.4'])])
831831

832832
name_prefix = 'test-aws-openssl'

‎.evergreen/legacy_config_generator/evergreen_config_lib/variants.py

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -397,7 +397,10 @@ def days(n):
397397
'test-aws-openssl-ec2-4.4',
398398
'test-aws-openssl-ecs-4.4',
399399
'test-aws-openssl-assume_role-4.4',
400-
'test-aws-openssl-lambda-4.4'
400+
'test-aws-openssl-lambda-4.4',
401+
'test-aws-openssl-assume_role_with_web_identity-latest',
402+
'test-aws-openssl-assume_role_with_web_identity-5.0',
403+
'test-aws-openssl-assume_role_with_web_identity-4.4',
401404
], {'CC': 'clang'}),
402405
Variant('mongohouse',
403406
'Mongohouse Test',

‎.evergreen/scripts/run-aws-tests.sh

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -158,5 +158,46 @@ EOF
158158
exit
159159
fi
160160

161+
if [[ "${TESTCASE}" == "ASSUME_ROLE_WITH_WEB_IDENTITY" ]]; then
162+
echo "===== Testing auth via Web Identity ====="
163+
# Do necessary setup.
164+
# Create user on $external db.
165+
pushd "${drivers_tools_dir}/.evergreen/auth_aws"
166+
mongo --verbose aws_e2e_web_identity.js
167+
popd # "${drivers_tools_dir}/.evergreen/auth_aws"
168+
169+
declare iam_auth_assume_web_role_name iam_web_identity_token_file
170+
iam_auth_assume_web_role_name="$(jq -r '.iam_auth_assume_web_role_name' "${drivers_tools_dir}/.evergreen/auth_aws/aws_e2e_setup.json")"
171+
iam_web_identity_token_file="$(jq -r '.iam_web_identity_token_file' "${drivers_tools_dir}/.evergreen/auth_aws/aws_e2e_setup.json")"
172+
173+
echo "Valid credentials via Web Identity - should succeed"
174+
AWS_ROLE_ARN="${iam_auth_assume_web_role_name}" \
175+
AWS_WEB_IDENTITY_TOKEN_FILE="${iam_web_identity_token_file}" \
176+
expect_success "mongodb://localhost/?authMechanism=MONGODB-AWS"
177+
178+
echo "Valid credentials via Web Identity with session name - should succeed"
179+
AWS_ROLE_ARN="${iam_auth_assume_web_role_name}" \
180+
AWS_WEB_IDENTITY_TOKEN_FILE="${iam_web_identity_token_file}" \
181+
AWS_ROLE_SESSION_NAME=test \
182+
expect_success "mongodb://localhost/?authMechanism=MONGODB-AWS"
183+
184+
echo "Invalid AWS_ROLE_ARN via Web Identity with session name - should fail"
185+
AWS_ROLE_ARN="invalid_role_arn" \
186+
AWS_WEB_IDENTITY_TOKEN_FILE="${iam_web_identity_token_file}" \
187+
expect_failure "mongodb://localhost/?authMechanism=MONGODB-AWS"
188+
189+
echo "Invalid AWS_WEB_IDENTITY_TOKEN_FILE via Web Identity with session name - should fail"
190+
AWS_ROLE_ARN="${iam_auth_assume_web_role_name}" \
191+
AWS_WEB_IDENTITY_TOKEN_FILE="/invalid/path" \
192+
expect_failure "mongodb://localhost/?authMechanism=MONGODB-AWS"
193+
194+
echo "Invalid AWS_ROLE_SESSION_NAME via Web Identity with session name - should fail"
195+
AWS_ROLE_ARN="${iam_auth_assume_web_role_name}" \
196+
AWS_WEB_IDENTITY_TOKEN_FILE="${iam_web_identity_token_file}" \
197+
AWS_ROLE_SESSION_NAME="contains_invalid_character_^" \
198+
expect_failure "mongodb://localhost/?authMechanism=MONGODB-AWS"
199+
exit
200+
fi
201+
161202
echo "Unexpected testcase '${TESTCASE}'" 1>&2
162203
exit 1

‎src/libbson/src/bson/bson-string.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -90,7 +90,9 @@ bson_string_free (bson_string_t *string, /* IN */
9090
{
9191
char *ret = NULL;
9292

93-
BSON_ASSERT (string);
93+
if (!string) {
94+
return NULL;
95+
}
9496

9597
if (!free_segment) {
9698
ret = string->str;

0 commit comments

Comments
 (0)