SERVER-55792 Verify credentials when clusterAuthMode is set via setParameter

(cherry picked from commit c73b1c09eb5ce2053577abac0a4ba360e3845de8)

2 files changed, 34 insertions, 7 deletions

diff --git a/jstests/ssl/set_parameter_ssl.js b/jstests/ssl/set_parameter_ssl.js
index 1a39cbd22a2..ce4143d0996 100644
--- a/jstests/ssl/set_parameter_ssl.js
+++ b/jstests/ssl/set_parameter_ssl.js
@@ -51,19 +51,46 @@ function testTransportTransition(scheme, oldMode, newMode, shouldSucceed) {
 }
 
 function testAuthModeTransition(oldMode, newMode, sslMode, shouldSucceed) {
-    var conn = MongoRunner.runMongod({
+    const keyFile = 'jstests/libs/key1';
+
+    let config = {
         sslMode: sslMode,
         sslPEMKeyFile: SERVER_CERT,
         sslCAFile: CA_CERT,
         clusterAuthMode: oldMode
-    });
+    };
 
-    var adminDB = conn.getDB("admin");
-    adminDB.createUser({user: "root", pwd: "pwd", roles: ['root']});
-    adminDB.auth("root", "pwd");
-    var res = adminDB.runCommand({"setParameter": 1, "clusterAuthMode": newMode});
+    if (oldMode != 'x509') {
+        config.keyFile = keyFile;
+    }
+
+    const conn = MongoRunner.runMongod(config);
+    const adminDB = conn.getDB("admin");
+    let authAsKeyFileCluster = function() {
+        const authParams = {
+            user: '__system',
+            mechanism: 'SCRAM-SHA-1',
+            pwd: cat(keyFile).replace(/[\011-\015\040]/g, '')
+        };
 
+        return adminDB.auth(authParams);
+    };
+
+    if (oldMode != 'x509') {
+        assert(authAsKeyFileCluster());
+    }
+
+    var res = adminDB.runCommand({"setParameter": 1, "clusterAuthMode": newMode});
     assert(res["ok"] == shouldSucceed, tojson(res));
+
+    if (shouldSucceed && oldMode != 'x509') {
+        if (newMode == 'x509') {
+            assert(!authAsKeyFileCluster(), "Key file cluster auth should no longer work");
+        } else {
+            assert(authAsKeyFileCluster(), "Key file cluster auth should still work");
+        }
+    }
+
     MongoRunner.stopMongod(conn);
 }
 
diff --git a/jstests/sslSpecial/set_parameter_nossl.js b/jstests/sslSpecial/set_parameter_nossl.js
index 95b66bc274f..94f4337fb80 100644
--- a/jstests/sslSpecial/set_parameter_nossl.js
+++ b/jstests/sslSpecial/set_parameter_nossl.js
@@ -5,7 +5,7 @@
 // cannot be used to transition from disabled/keyFile modes
 function testTransition(newSSLMode, newClusterAuthMode) {
     // If no parameters are given sslMode defaults to disabled
-    var conn = MongoRunner.runMongod({clusterAuthMode: "keyFile"});
+    var conn = MongoRunner.runMongod({clusterAuthMode: "keyFile", keyFile: 'jstests/libs/key1'});
     var adminDB = conn.getDB("admin");
     adminDB.createUser({user: "root", pwd: "pwd", roles: ["root"]});
     adminDB.auth("root", "pwd");