Skip to content

CDRIVER-4081 Add support for AssumeRoleWithWebIdentity in AWS Auth #1211

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 15 commits into from
Mar 14, 2023
Merged

CDRIVER-4081 Add support for AssumeRoleWithWebIdentity in AWS Auth #1211

Show file tree
Hide file tree
Changes from 14 commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
36487ae
ignore NULL for `bson_string_free`
kevinAlbs Feb 27, 2023
f9b68da
add use_tls option to _send_http_request
kevinAlbs Feb 27, 2023
1fbad0f
add `_obtain_creds_from_assumerolewithwebidentity`
kevinAlbs Feb 27, 2023
f298af2
fix length in `_mongoc_http_send`
kevinAlbs Mar 1, 2023
6890595
fix size arg in `bin_to_hex` utility
kevinAlbs Mar 1, 2023
0b9f23b
test in Evergreen
kevinAlbs Feb 16, 2023
2f99410
Merge branch 'master' into C4081
kevinAlbs Mar 2, 2023
4b7d326
format util.h
kevinAlbs Mar 2, 2023
a96e677
move `hex_to_bin` and `bin_to_hex` to mongoc-util-private.h
kevinAlbs Mar 2, 2023
abb6396
test `bin_to_hex` and `hex_to_bin`
kevinAlbs Mar 2, 2023
2f58b29
lowercase variable names
kevinAlbs Mar 2, 2023
19ff875
revise comment for null terminator
kevinAlbs Mar 2, 2023
9c33e21
break long line at ampersand
kevinAlbs Mar 2, 2023
c18aabf
add spaces between test cases
kevinAlbs Mar 2, 2023
4b64397
multiply before cast
kevinAlbs Mar 3, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
61 changes: 60 additions & 1 deletion .evergreen/generated_configs/legacy-config.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -267,7 +267,12 @@ functions:
"iam_auth_assume_role_name" : "${iam_auth_assume_role_name}",
"iam_auth_ec2_instance_account" : "${iam_auth_ec2_instance_account}",
"iam_auth_ec2_instance_secret_access_key" : "${iam_auth_ec2_instance_secret_access_key}",
"iam_auth_ec2_instance_profile" : "${iam_auth_ec2_instance_profile}"
"iam_auth_ec2_instance_profile" : "${iam_auth_ec2_instance_profile}",
"iam_auth_assume_web_role_name": "${iam_auth_assume_web_role_name}",
"iam_web_identity_issuer": "${iam_web_identity_issuer}",
"iam_web_identity_rsa_key": "${iam_web_identity_rsa_key}",
"iam_web_identity_jwks_uri": "${iam_web_identity_jwks_uri}",
"iam_web_identity_token_file": "${iam_web_identity_token_file}"
}
EOF
- command: shell.exec
Expand Down Expand Up @@ -2050,6 +2055,57 @@ tasks:
- func: run aws tests
vars:
TESTCASE: ASSUME_ROLE
- name: test-aws-openssl-assume_role_with_web_identity-latest
depends_on:
name: debug-compile-aws
commands:
- func: fetch-build
vars:
BUILD_NAME: debug-compile-aws
- func: fetch-det
- func: bootstrap-mongo-orchestration
vars:
AUTH: auth
MONGODB_VERSION: latest
ORCHESTRATION_FILE: auth-aws
TOPOLOGY: server
- func: run aws tests
vars:
TESTCASE: ASSUME_ROLE_WITH_WEB_IDENTITY
- name: test-aws-openssl-assume_role_with_web_identity-5.0
depends_on:
name: debug-compile-aws
commands:
- func: fetch-build
vars:
BUILD_NAME: debug-compile-aws
- func: fetch-det
- func: bootstrap-mongo-orchestration
vars:
AUTH: auth
MONGODB_VERSION: '5.0'
ORCHESTRATION_FILE: auth-aws
TOPOLOGY: server
- func: run aws tests
vars:
TESTCASE: ASSUME_ROLE_WITH_WEB_IDENTITY
- name: test-aws-openssl-assume_role_with_web_identity-4.4
depends_on:
name: debug-compile-aws
commands:
- func: fetch-build
vars:
BUILD_NAME: debug-compile-aws
- func: fetch-det
- func: bootstrap-mongo-orchestration
vars:
AUTH: auth
MONGODB_VERSION: '4.4'
ORCHESTRATION_FILE: auth-aws
TOPOLOGY: server
- func: run aws tests
vars:
TESTCASE: ASSUME_ROLE_WITH_WEB_IDENTITY
- name: ocsp-openssl-test_1-rsa-delegate-latest
tags:
- ocsp-openssl
Expand Down Expand Up @@ -9639,6 +9695,9 @@ buildvariants:
- test-aws-openssl-ecs-4.4
- test-aws-openssl-assume_role-4.4
- test-aws-openssl-lambda-4.4
- test-aws-openssl-assume_role_with_web_identity-latest
- test-aws-openssl-assume_role_with_web_identity-5.0
- test-aws-openssl-assume_role_with_web_identity-4.4
- name: mongohouse
display_name: Mongohouse Test
run_on: ubuntu1804-test
Expand Down
7 changes: 6 additions & 1 deletion .evergreen/legacy_config_generator/evergreen_config_lib/functions.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -193,7 +193,12 @@
"iam_auth_assume_role_name" : "${iam_auth_assume_role_name}",
"iam_auth_ec2_instance_account" : "${iam_auth_ec2_instance_account}",
"iam_auth_ec2_instance_secret_access_key" : "${iam_auth_ec2_instance_secret_access_key}",
"iam_auth_ec2_instance_profile" : "${iam_auth_ec2_instance_profile}"
"iam_auth_ec2_instance_profile" : "${iam_auth_ec2_instance_profile}",
"iam_auth_assume_web_role_name": "${iam_auth_assume_web_role_name}",
"iam_web_identity_issuer": "${iam_web_identity_issuer}",
"iam_web_identity_rsa_key": "${iam_web_identity_rsa_key}",
"iam_web_identity_jwks_uri": "${iam_web_identity_jwks_uri}",
"iam_web_identity_token_file": "${iam_web_identity_token_file}"
}
EOF
''', silent=True),
Expand Down
2 changes: 1 addition & 1 deletion .evergreen/legacy_config_generator/evergreen_config_lib/tasks.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -826,7 +826,7 @@ def _check_allowed(self):


class AWSTestTask(MatrixTask):
axes = OD([('testcase', ['regular', 'ec2', 'ecs', 'lambda', 'assume_role']),
axes = OD([('testcase', ['regular', 'ec2', 'ecs', 'lambda', 'assume_role', 'assume_role_with_web_identity']),
('version', ['latest', '5.0', '4.4'])])

name_prefix = 'test-aws-openssl'
Expand Down
5 changes: 4 additions & 1 deletion .evergreen/legacy_config_generator/evergreen_config_lib/variants.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -397,7 +397,10 @@ def days(n):
'test-aws-openssl-ec2-4.4',
'test-aws-openssl-ecs-4.4',
'test-aws-openssl-assume_role-4.4',
'test-aws-openssl-lambda-4.4'
'test-aws-openssl-lambda-4.4',
'test-aws-openssl-assume_role_with_web_identity-latest',
'test-aws-openssl-assume_role_with_web_identity-5.0',
'test-aws-openssl-assume_role_with_web_identity-4.4',
], {'CC': 'clang'}),
Variant('mongohouse',
'Mongohouse Test',
Expand Down
41 changes: 41 additions & 0 deletions .evergreen/scripts/run-aws-tests.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,5 +158,46 @@ EOF
exit
fi

if [[ "${TESTCASE}" == "ASSUME_ROLE_WITH_WEB_IDENTITY" ]]; then
echo "===== Testing auth via Web Identity ====="
# Do necessary setup.
# Create user on $external db.
pushd "${drivers_tools_dir}/.evergreen/auth_aws"
mongo --verbose aws_e2e_web_identity.js
popd # "${drivers_tools_dir}/.evergreen/auth_aws"

declare iam_auth_assume_web_role_name iam_web_identity_token_file
iam_auth_assume_web_role_name="$(jq -r '.iam_auth_assume_web_role_name' "${drivers_tools_dir}/.evergreen/auth_aws/aws_e2e_setup.json")"
iam_web_identity_token_file="$(jq -r '.iam_web_identity_token_file' "${drivers_tools_dir}/.evergreen/auth_aws/aws_e2e_setup.json")"

echo "Valid credentials via Web Identity - should succeed"
AWS_ROLE_ARN="${iam_auth_assume_web_role_name}" \
AWS_WEB_IDENTITY_TOKEN_FILE="${iam_web_identity_token_file}" \
expect_success "mongodb://localhost/?authMechanism=MONGODB-AWS"

echo "Valid credentials via Web Identity with session name - should succeed"
AWS_ROLE_ARN="${iam_auth_assume_web_role_name}" \
AWS_WEB_IDENTITY_TOKEN_FILE="${iam_web_identity_token_file}" \
AWS_ROLE_SESSION_NAME=test \
expect_success "mongodb://localhost/?authMechanism=MONGODB-AWS"

echo "Invalid AWS_ROLE_ARN via Web Identity with session name - should fail"
AWS_ROLE_ARN="invalid_role_arn" \
AWS_WEB_IDENTITY_TOKEN_FILE="${iam_web_identity_token_file}" \
expect_failure "mongodb://localhost/?authMechanism=MONGODB-AWS"

echo "Invalid AWS_WEB_IDENTITY_TOKEN_FILE via Web Identity with session name - should fail"
AWS_ROLE_ARN="${iam_auth_assume_web_role_name}" \
AWS_WEB_IDENTITY_TOKEN_FILE="/invalid/path" \
expect_failure "mongodb://localhost/?authMechanism=MONGODB-AWS"

echo "Invalid AWS_ROLE_SESSION_NAME via Web Identity with session name - should fail"
AWS_ROLE_ARN="${iam_auth_assume_web_role_name}" \
AWS_WEB_IDENTITY_TOKEN_FILE="${iam_web_identity_token_file}" \
AWS_ROLE_SESSION_NAME="contains_invalid_character_^" \
expect_failure "mongodb://localhost/?authMechanism=MONGODB-AWS"
exit
fi

echo "Unexpected testcase '${TESTCASE}'" 1>&2
exit 1
4 changes: 3 additions & 1 deletion src/libbson/src/bson/bson-string.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,7 +90,9 @@ bson_string_free (bson_string_t *string, /* IN */
{
char *ret = NULL;

BSON_ASSERT (string);
if (!string) {
return NULL;
}

if (!free_segment) {
ret = string->str;
Expand Down
Loading