DOCSP-40811 Authentication Mechanisms

source/includes/authentication.cpp

@@ -30,7 +30,7 @@ mongocxx::client client(uri);
 #include <mongocxx/uri.hpp>
 
 auto uri = mongocxx::uri("mongodb://<AWS IAM access key ID>:<AWS IAM secret access key>@<hostname>:<port>/?"
-                         "&authMechanism=MONGODB-AWS");
+                         "authMechanism=MONGODB-AWS");
 mongocxx::client client(uri);
 // end-aws-connection-uri
 
@@ -39,7 +39,7 @@ mongocxx::client client(uri);
 #include <mongocxx/uri.hpp>
 
 auto uri = mongocxx::uri("mongodb://<AWS IAM access key ID>:<AWS IAM secret access key>@<hostname>:<port>/?"
-                         "&authMechanism=MONGODB-AWSS&authMechanismProperties=AWS_SESSION_TOKEN:<token>");
+                         "authMechanism=MONGODB-AWSS&authMechanismProperties=AWS_SESSION_TOKEN:<token>");
 mongocxx::client client(uri);
 // end-aws-connection-uri-session
 
@@ -57,7 +57,7 @@ mongocxx::client client(uri);
 #include <mongocxx/uri.hpp>
 
 auto uri = mongocxx::uri("mongodb://mongodbuser%40EXAMPLE.COM@<hostname>:<port>/?"
-                         "&authMechanism=GSSAPI"
+                         "authMechanism=GSSAPI"
                          "&authMechanismProperties=SERVICE_NAME:<authentication service name>");
 mongocxx::client client(uri);
 // end-kerberos
@@ -67,6 +67,6 @@ mongocxx::client client(uri);
 #include <mongocxx/uri.hpp>
 
 auto uri = mongocxx::uri("mongodb://<username>:<password>@<hostname>:<port>/?"
-                         "&authMechanism=PLAIN&tls=true");
+                         "authMechanism=PLAIN&tls=true");
 mongocxx::client client(uri);
 // end-plain

source/security/authentication.txt

@@ -122,6 +122,7 @@ retrieve your AWS credentials from the following sources, in the order listed:
 
 1. Named parameters passed to the Connection URI
 #. Environment variables
+#. AWS EKS AssumeRoleWithWebIdentity request
 #. ECS container metadata
 #. EC2 instance metadata
 
@@ -189,6 +190,36 @@ following example:
    :start-after: // start-aws-environment
    :end-before: // end-aws-environment
 
+AssumeRoleWithWebIdentity Request
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+If your application authenticates users for your EKS cluster from an OpenID Connect (OIDC)
+identity provider, {+driver-short+} can make an ``AssumeRoleWithWebIdentity`` request
+to exchange the OIDC token for temporary AWS credentials for your application. 
+
+To authenticate with temporary AWS IAM credentials returned by an
+``AssumeRoleWithWebIdentity`` request, ensure that the AWS config file exists in your
+environment and is configured with the ``AWS_WEB_IDENTITY_TOKEN_FILE``
+and ``AWS_ROLE_ARN`` environment variables. To learn how to create and configure
+an AWS config file, see `Configuration <https://docs.aws.amazon.com/sdkref/latest/guide/creds-config-files.html>`__
+in the AWS documentation.
+
+After you configure your environment for an ``AssumeRoleWithWebIdentity`` request,
+set the ``authMechanism`` parameter in your connection URI to ``"MONGODB-AWS"``,
+as shown in the following example:
+
+.. literalinclude:: /includes/authentication.cpp
+   :language: cpp
+   :copyable: true
+   :start-after: // start-aws-environment
+   :end-before: // end-aws-environment
+
+For more information about using an ``AssumeRoleWithWebIdentity`` request to
+authenticate your application, see the following AWS documentation:
+
+- `AssumeRoleWithWebIdentity <https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html>`__
+- `Authenticating users for your cluster from an OpenID Connect identity provider <https://docs.aws.amazon.com/eks/latest/userguide/authenticate-oidc-identity-provider.html>`__
+
 ECS Metadata
 ~~~~~~~~~~~~
 

source/security/enterprise-authentication.txt

@@ -35,7 +35,7 @@ authentication.
 
 .. note::
 
-   To authenticate with GSSAPI, you must build the driver with SASL support.
+   To authenticate with GSSAPI, you must build the MongoDB C driver with SASL support.
    If you are building the driver from source, you can enable SASL support with
    the ``ENABLE_SASL`` ``cmake`` option.