diff options
author | Andy Schwerin <schwerin@10gen.com> | 2013-05-01 13:54:20 -0400 |
---|---|---|
committer | Andy Schwerin <schwerin@10gen.com> | 2013-05-01 15:39:43 -0400 |
commit | 340ccbb1cced25e5e9e9b33ede652b728134d50b (patch) | |
tree | 478526b544ecf14f37cefd5a189d1e36104eb297 /src/mongo/client/sasl_client_authenticate_impl.cpp | |
parent | 5d675c8855d6d7c7ed0faea97b143ea4243a5cc5 (diff) | |
download | mongo-340ccbb1cced25e5e9e9b33ede652b728134d50b.tar.gz |
SERVER-6407 When using PLAIN mechanism and $external database, do not digest password by default.
The only use of SASL PLAIN authentication against the $external database is for
LDAP proxy authentication, so this is the intelligent default choice in this scenario.
Diffstat (limited to 'src/mongo/client/sasl_client_authenticate_impl.cpp')
-rw-r--r-- | src/mongo/client/sasl_client_authenticate_impl.cpp | 50 |
1 files changed, 27 insertions, 23 deletions
diff --git a/src/mongo/client/sasl_client_authenticate_impl.cpp b/src/mongo/client/sasl_client_authenticate_impl.cpp index 30ee4bc9b40..be54e0b3303 100644 --- a/src/mongo/client/sasl_client_authenticate_impl.cpp +++ b/src/mongo/client/sasl_client_authenticate_impl.cpp @@ -56,7 +56,7 @@ namespace { /** * Gets the password data from "saslParameters" and stores it to "outPassword". * - * If "saslParameters" indicates that the password needs to be "digested" via + * If "digestPassword" indicates that the password needs to be "digested" via * DBClientWithCommands::createPasswordDigest(), this method takes care of that. * On success, the value of "*outPassword" is always the correct value to set * as the password on the SaslClientSession. @@ -66,6 +66,7 @@ namespace { */ Status extractPassword(DBClientWithCommands* client, const BSONObj& saslParameters, + bool digestPassword, std::string* outPassword) { std::string rawPassword; @@ -75,15 +76,7 @@ namespace { if (!status.isOK()) return status; - bool digest; - status = bsonExtractBooleanFieldWithDefault(saslParameters, - saslCommandDigestPasswordFieldName, - true, - &digest); - if (!status.isOK()) - return status; - - if (digest) { + if (digestPassword) { std::string user; status = bsonExtractStringField(saslParameters, saslCommandPrincipalFieldName, @@ -109,16 +102,18 @@ namespace { */ Status configureSession(SaslClientSession* session, DBClientWithCommands* client, + const std::string& targetDatabase, const BSONObj& saslParameters) { - std::string value; + std::string mechanism; Status status = bsonExtractStringField(saslParameters, saslCommandMechanismFieldName, - &value); + &mechanism); if (!status.isOK()) return status; - session->setParameter(SaslClientSession::parameterMechanism, value); + session->setParameter(SaslClientSession::parameterMechanism, mechanism); + std::string value; status = bsonExtractStringFieldWithDefault(saslParameters, saslCommandServiceNameFieldName, saslDefaultServiceName, @@ -142,7 +137,16 @@ namespace { return status; session->setParameter(SaslClientSession::parameterUser, value); - status = extractPassword(client, saslParameters, &value); + bool digestPasswordDefault = !(targetDatabase == "$external" && mechanism == "PLAIN"); + bool digestPassword; + status = bsonExtractBooleanFieldWithDefault(saslParameters, + saslCommandDigestPasswordFieldName, + digestPasswordDefault, + &digestPassword); + if (!status.isOK()) + return status; + + status = extractPassword(client, saslParameters, digestPassword, &value); if (status.isOK()) { session->setParameter(SaslClientSession::parameterPassword, value); } @@ -161,20 +165,20 @@ namespace { int saslLogLevel = getSaslClientLogLevel(saslParameters); - SaslClientSession session; - Status status = configureSession(&session, client, saslParameters); - if (!status.isOK()) - return status; - std::string targetDatabase; try { - status = bsonExtractStringFieldWithDefault(saslParameters, - saslCommandPrincipalSourceFieldName, - saslDefaultDBName, - &targetDatabase); + Status status = bsonExtractStringFieldWithDefault(saslParameters, + saslCommandPrincipalSourceFieldName, + saslDefaultDBName, + &targetDatabase); + if (!status.isOK()) + return status; } catch (const DBException& ex) { return ex.toStatus(); } + + SaslClientSession session; + Status status = configureSession(&session, client, targetDatabase, saslParameters); if (!status.isOK()) return status; |