DOCSP-40811 Authentication Mechanisms #22

jordan-smith721 · 2024-06-26T19:25:00Z

Pull Request Info

JIRA - https://jira.mongodb.org/browse/DOCSP-40811
Staging -
https://preview-mongodbjordansmith721.gatsbyjs.io/cpp-driver/DOCSP-40811-authentication/security/authentication/
https://preview-mongodbjordansmith721.gatsbyjs.io/cpp-driver/DOCSP-40811-authentication/security/enterprise-authentication/

Self-Review Checklist

Is this free of any warnings or errors in the RST?
Did you run a spell-check?
Did you run a grammar-check?
Are all the links working?
Are the facets and meta keywords accurate?

mcmorisi

Good stuff! A smattering of nitpicks, but LGTM otherwise!

source/security/authentication.txt

mcmorisi · 2024-06-26T19:51:58Z

source/security/authentication.txt

+- ``username``: The AWS IAM access key ID to authenticate.
+- ``password``: The AWS IAM secret access key.
+- ``authMechanism``: Set to ``"MONGODB-AWS"``.


Clarification for my sake: Because the third list item here is in imperative form and therefore warrants a period, the style guide dictates that a period follows all items in this list – am I correct?

Yep, exactly

source/security/authentication.txt

source/security/enterprise-authentication.txt

mcmorisi · 2024-06-26T19:59:51Z

source/security/enterprise-authentication.txt

+         You must replace the ``@`` symbol in the URI string with ``%40``, as shown
+         in the preceding example.


Looks like there are two @ symbols, only one of which gets encoded to %40. This might make it more clear.

Suggested change

You must replace the ``@`` symbol in the URI string with ``%40``, as shown

in the preceding example.

You must replace the first ``@`` symbol in the URI string with ``%40``, as shown

in the preceding example.

I reworded to refer to the principal instead of the URI, which I think is more accurate

kevinAlbs · 2024-06-28T15:08:50Z

source/security/authentication.txt

+
+1. Named parameters passed to the Connection URI
+#. Environment variables
+#. ECS container metadata


Suggest noting EKS. As of DRIVERS-1746, drivers also check for environment variables set in EKS environments. See: the auth spec section AssumeRoleWithWebIdentity for a description.

Added a section on AssumeRoleWithWebIdentity

kevinAlbs · 2024-07-01T14:46:35Z

source/includes/authentication.cpp

+auto uri = mongocxx::uri("mongodb://<AWS IAM access key ID>:<AWS IAM secret access key>@<hostname>:<port>/?"
+                         "&authMechanism=MONGODB-AWS");


Suggested change

auto uri = mongocxx::uri("mongodb://<AWS IAM access key ID>:<AWS IAM secret access key>@<hostname>:<port>/?"

"&authMechanism=MONGODB-AWS");

auto uri = mongocxx::uri("mongodb://<AWS IAM access key ID>:<AWS IAM secret access key>@<hostname>:<port>/?"

"authMechanism=MONGODB-AWS");

Remove extra & to prevent error: URI option "" contains no "=" sign: an invalid MongoDB URI was provided

Good catch, thanks!

kevinAlbs · 2024-07-01T14:47:11Z

source/includes/authentication.cpp

+#include <mongocxx/uri.hpp>
+
+auto uri = mongocxx::uri("mongodb://<AWS IAM access key ID>:<AWS IAM secret access key>@<hostname>:<port>/?"
+                         "&authMechanism=MONGODB-AWSS&authMechanismProperties=AWS_SESSION_TOKEN:<token>");


Suggested change

"&authMechanism=MONGODB-AWSS&authMechanismProperties=AWS_SESSION_TOKEN:<token>");

"authMechanism=MONGODB-AWSS&authMechanismProperties=AWS_SESSION_TOKEN:<token>");

kevinAlbs · 2024-07-01T14:47:29Z

source/includes/authentication.cpp

+#include <mongocxx/uri.hpp>
+
+auto uri = mongocxx::uri("mongodb://mongodbuser%40EXAMPLE.COM@<hostname>:<port>/?"
+                         "&authMechanism=GSSAPI"


Suggested change

"&authMechanism=GSSAPI"

"authMechanism=GSSAPI"

kevinAlbs · 2024-07-01T14:47:36Z

source/includes/authentication.cpp

+#include <mongocxx/uri.hpp>
+
+auto uri = mongocxx::uri("mongodb://<username>:<password>@<hostname>:<port>/?"
+                         "&authMechanism=PLAIN&tls=true");


Suggested change

"&authMechanism=PLAIN&tls=true");

"authMechanism=PLAIN&tls=true");

kevinAlbs · 2024-07-01T14:51:29Z

source/security/enterprise-authentication.txt

+
+.. note::
+
+   To authenticate with GSSAPI, you must build the driver with SASL support.


Suggested change

To authenticate with GSSAPI, you must build the driver with SASL support.

To authenticate with GSSAPI, you must build the C driver with SASL support.

Suggest clarifying the ENABLE_SASL option is intended for the C driver (not C++ driver). The C++ driver wraps the C driver. Auth is performed within the C driver.

mcmorisi

LGTM!

mcmorisi · 2024-07-10T13:58:38Z

source/security/authentication.txt

+AssumeRoleWithWebIdentity Request
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+If your application authenticates users for your EKS cluster from an OpenID Connect (OIDC)


"from" an OIDC identity provider or "with" an OIDC identity provider?

Sticking with "from" since this wording is taken from the AWS docs link at the bottom of the section

mcmorisi · 2024-07-10T13:59:20Z

source/security/authentication.txt

+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+If your application authenticates users for your EKS cluster from an OpenID Connect (OIDC)
+identity provider, {+driver-short+} can make an ``AssumeRoleWithWebIdentity`` request


Suggested change

identity provider, {+driver-short+} can make an ``AssumeRoleWithWebIdentity`` request

identity provider, the {+driver-short+} can make an ``AssumeRoleWithWebIdentity`` request

mongoKart and others added 5 commits June 24, 2024 12:17

workflows

13b4d17

first draft authentication pages

88911c1

build errors

faf6ffb

typos and rst errors:

4be63aa

another typo

f7c8a10

mcmorisi approved these changes Jun 26, 2024

View reviewed changes

feedback

a1128b8

jordan-smith721 requested a review from kevinAlbs June 26, 2024 21:29

jordan-smith721 changed the base branch from master to cpp-standardization June 26, 2024 22:15

remove files from master

0c4c508

kevinAlbs requested a review from kkloberdanz June 27, 2024 17:30

add refs

eebeea8

kevinAlbs reviewed Jul 1, 2024

View reviewed changes

eng feedback

55427d9

jordan-smith721 requested a review from kevinAlbs July 9, 2024 15:02

kevinAlbs approved these changes Jul 9, 2024

View reviewed changes

kevinAlbs removed the request for review from kkloberdanz July 9, 2024 20:33

mcmorisi approved these changes Jul 10, 2024

View reviewed changes

jordan-smith721 and others added 2 commits July 10, 2024 07:08

feedback

be2a41a

Merge branch 'cpp-standardization' into DOCSP-40811-authentication

71f5a99

jordan-smith721 merged commit 71b2761 into mongodb:cpp-standardization Jul 10, 2024

jordan-smith721 deleted the DOCSP-40811-authentication branch July 10, 2024 14:12

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

DOCSP-40811 Authentication Mechanisms #22

DOCSP-40811 Authentication Mechanisms #22

jordan-smith721 commented Jun 26, 2024

mcmorisi left a comment

mcmorisi Jun 26, 2024

jordan-smith721 Jun 26, 2024

mcmorisi Jun 26, 2024

jordan-smith721 Jun 26, 2024

kevinAlbs Jun 28, 2024

jordan-smith721 Jul 9, 2024

kevinAlbs Jul 1, 2024

jordan-smith721 Jul 9, 2024

kevinAlbs Jul 1, 2024

kevinAlbs Jul 1, 2024

kevinAlbs Jul 1, 2024

kevinAlbs Jul 1, 2024

mcmorisi left a comment

mcmorisi Jul 10, 2024

jordan-smith721 Jul 10, 2024

mcmorisi Jul 10, 2024

		You must replace the ``@`` symbol in the URI string with ``%40``, as shown
		in the preceding example.

		auto uri = mongocxx::uri("mongodb://<AWS IAM access key ID>:<AWS IAM secret access key>@<hostname>:<port>/?"
		"&authMechanism=MONGODB-AWS");

	"&authMechanism=MONGODB-AWSS&authMechanismProperties=AWS_SESSION_TOKEN:<token>");
	"authMechanism=MONGODB-AWSS&authMechanismProperties=AWS_SESSION_TOKEN:<token>");

	"&authMechanism=PLAIN&tls=true");
	"authMechanism=PLAIN&tls=true");


		.. note::

		To authenticate with GSSAPI, you must build the driver with SASL support.

	identity provider, {+driver-short+} can make an ``AssumeRoleWithWebIdentity`` request
	identity provider, the {+driver-short+} can make an ``AssumeRoleWithWebIdentity`` request

DOCSP-40811 Authentication Mechanisms #22

DOCSP-40811 Authentication Mechanisms #22

Conversation

jordan-smith721 commented Jun 26, 2024

Pull Request Info

Self-Review Checklist

mcmorisi left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mcmorisi left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment