SERVER-25254 Only advance config server optime in response to messages from cluster members

(cherry picked from commit f22f6e220e5471c0876938bd0812ffa62901e3a7)

Conflicts:
   src/mongo/db/s/sharding_state.cpp

1 files changed, 51 insertions, 0 deletions

diff --git a/jstests/sharding/replset_config/auth_sharding_cmd_metadata.js b/jstests/sharding/replset_config/auth_sharding_cmd_metadata.js
new file mode 100644
index 00000000000..63caf39ab1f
--- /dev/null
+++ b/jstests/sharding/replset_config/auth_sharding_cmd_metadata.js
@@ -0,0 +1,51 @@
+/**
+ * Tests that only the internal user will be able to advance the config server opTime.
+ */
+(function() {
+
+    "use strict";
+
+    var st = new ShardingTest({shards: 1, other: {keyFile: 'jstests/libs/key1'}});
+
+    var adminUser = {
+        db: "admin",
+        username: "foo",
+        password: "bar"
+    };
+
+    st.s.getDB(adminUser.db).createUser({user: 'foo', pwd: 'bar', roles: jsTest.adminUserRoles});
+
+    st.s.getDB('admin').auth('foo', 'bar');
+
+    st.adminCommand({enableSharding: 'test'});
+    st.adminCommand({shardCollection: 'test.user', key: {x: 1}});
+
+    st.d0.getDB('admin').createUser({user: 'user', pwd: 'pwd', roles: jsTest.adminUserRoles});
+    st.d0.getDB('admin').auth('user', 'pwd');
+
+    var maxSecs = Math.pow(2, 32) - 1;
+    var metadata = {
+        configsvr: {opTime: {ts: Timestamp(maxSecs, 0), t: maxSecs}}
+    };
+    var res = st.d0.getDB('test').runCommandWithMetadata("ping", {ping: 1}, metadata);
+
+    assert.commandFailedWithCode(res.commandReply, ErrorCodes.Unauthorized);
+
+    // Make sure that the config server optime did not advance.
+    var status = st.d0.getDB('test').runCommand({serverStatus: 1});
+    assert.neq(null, status.sharding);
+    assert.lt(status.sharding.lastSeenConfigServerOpTime.t, maxSecs);
+
+    st.d0.getDB('admin').createUser({user: 'internal', pwd: 'pwd', roles: ['__system']});
+    st.d0.getDB('admin').auth('internal', 'pwd');
+
+    res = st.d0.getDB('test').runCommandWithMetadata("ping", {ping: 1}, metadata);
+    assert.commandWorked(res.commandReply);
+
+    status = st.d0.getDB('test').runCommand({serverStatus: 1});
+    assert.neq(null, status.sharding);
+    assert.eq(status.sharding.lastSeenConfigServerOpTime.t, maxSecs);
+
+    st.stop();
+
+})();