SERVER-66360 Remove multi-user authentication support

6 files changed, 84 insertions, 85 deletions

diff --git a/src/mongo/s/query/cluster_aggregation_planner.cpp b/src/mongo/s/query/cluster_aggregation_planner.cpp
index dc044f72309..0c80b838544 100644
--- a/src/mongo/s/query/cluster_aggregation_planner.cpp
+++ b/src/mongo/s/query/cluster_aggregation_planner.cpp
@@ -344,14 +344,14 @@ BSONObj establishMergingMongosCursor(OperationContext* opCtx,
     CursorId clusterCursorId = 0;
 
     if (cursorState == ClusterCursorManager::CursorState::NotExhausted) {
-        auto authUsers = AuthorizationSession::get(opCtx->getClient())->getAuthenticatedUserNames();
+        auto authUser = AuthorizationSession::get(opCtx->getClient())->getAuthenticatedUserName();
         clusterCursorId = uassertStatusOK(Grid::get(opCtx)->getCursorManager()->registerCursor(
             opCtx,
             ccc.releaseCursor(),
             requestedNss,
             ClusterCursorManager::CursorType::MultiTarget,
             ClusterCursorManager::CursorLifetime::Mortal,
-            authUsers));
+            authUser));
     }
 
     // Fill out the aggregation metrics in CurOp.
diff --git a/src/mongo/s/query/cluster_cursor_manager.cpp b/src/mongo/s/query/cluster_cursor_manager.cpp
index 5eaa7e05306..3361c1dace5 100644
--- a/src/mongo/s/query/cluster_cursor_manager.cpp
+++ b/src/mongo/s/query/cluster_cursor_manager.cpp
@@ -162,7 +162,7 @@ StatusWith<CursorId> ClusterCursorManager::registerCursor(
     const NamespaceString& nss,
     CursorType cursorType,
     CursorLifetime cursorLifetime,
-    UserNameIterator authenticatedUsers) {
+    const boost::optional<UserName>& authenticatedUser) {
     // Read the clock out of the lock.
     const auto now = _clockSource->now();
 
@@ -188,7 +188,7 @@ StatusWith<CursorId> ClusterCursorManager::registerCursor(
                                                              cursorType,
                                                              cursorLifetime,
                                                              now,
-                                                             authenticatedUsers,
+                                                             authenticatedUser,
                                                              opCtx->getClient()->getUUID(),
                                                              opCtx->getOperationKey(),
                                                              nss));
@@ -216,7 +216,7 @@ StatusWith<ClusterCursorManager::PinnedCursor> ClusterCursorManager::checkOutCur
     }
 
     // Check if the user is coauthorized to access this cursor.
-    auto authCheckStatus = authChecker(entry->getAuthenticatedUsers());
+    auto authCheckStatus = authChecker(entry->getAuthenticatedUser());
     if (!authCheckStatus.isOK()) {
         return authCheckStatus.withContext(str::stream()
                                            << "cursor id " << cursorId
@@ -296,9 +296,9 @@ Status ClusterCursorManager::checkAuthForKillCursors(OperationContext* opCtx,
         return cursorNotFoundStatus(cursorId);
     }
 
-    // Note that getAuthenticatedUsers() is thread-safe, so it's okay to call even if there's
+    // Note that getAuthenticatedUser() is thread-safe, so it's okay to call even if there's
     // an operation using the cursor.
-    return authChecker(entry->getAuthenticatedUsers());
+    return authChecker(entry->getAuthenticatedUser());
 }
 
 void ClusterCursorManager::killOperationUsingCursor(WithLock, CursorEntry* entry) {
@@ -497,7 +497,7 @@ std::vector<GenericCursor> ClusterCursorManager::getIdleCursors(
         // permission to see this cursor.
         if (ctxAuth->getAuthorizationManager().isAuthEnabled() &&
             userMode == MongoProcessInterface::CurrentOpUserMode::kExcludeOthers &&
-            !ctxAuth->isCoauthorizedWith(entry.getAuthenticatedUsers())) {
+            !ctxAuth->isCoauthorizedWith(entry.getAuthenticatedUser())) {
             continue;
         }
         if (entry.isKillPending() || entry.getOperationUsingCursor()) {
diff --git a/src/mongo/s/query/cluster_cursor_manager.h b/src/mongo/s/query/cluster_cursor_manager.h
index be10b0d60bd..730ccc40624 100644
--- a/src/mongo/s/query/cluster_cursor_manager.h
+++ b/src/mongo/s/query/cluster_cursor_manager.h
@@ -117,7 +117,7 @@ public:
     // Represents a function that may be passed into a ClusterCursorManager method which checks
     // whether the current client is authorized to perform the operation in question. The function
     // will be passed the list of users authorized to use the cursor.
-    using AuthzCheckFn = std::function<Status(UserNameIterator)>;
+    using AuthzCheckFn = std::function<Status(const boost::optional<UserName>&)>;
 
     /**
      * PinnedCursor is a moveable, non-copyable class representing ownership of a cursor that has
@@ -226,7 +226,7 @@ public:
                     CursorType cursorType,
                     CursorLifetime cursorLifetime,
                     Date_t lastActive,
-                    UserNameIterator authenticatedUsersIter,
+                    boost::optional<UserName> authenticatedUser,
                     UUID clientUUID,
                     boost::optional<OperationKey> opKey,
                     NamespaceString nss)
@@ -238,8 +238,7 @@ public:
               _opKey(std::move(opKey)),
               _nss(std::move(nss)),
               _originatingClient(std::move(clientUUID)),
-              _authenticatedUsers(
-                  userNameIteratorToContainer<std::vector<UserName>>(authenticatedUsersIter)) {
+              _authenticatedUser(std::move(authenticatedUser)) {
             invariant(_cursor);
         }
 
@@ -330,8 +329,8 @@ public:
             _lastActive = lastActive;
         }
 
-        UserNameIterator getAuthenticatedUsers() const {
-            return makeUserNameIterator(_authenticatedUsers.begin(), _authenticatedUsers.end());
+        const boost::optional<UserName>& getAuthenticatedUser() const {
+            return _authenticatedUser;
         }
 
         const UUID& originatingClientUuid() const {
@@ -365,7 +364,7 @@ public:
         /**
          * The set of users authorized to use this cursor.
          */
-        std::vector<UserName> _authenticatedUsers;
+        boost::optional<UserName> _authenticatedUser;
     };
 
     /**
@@ -408,7 +407,7 @@ public:
                                         const NamespaceString& nss,
                                         CursorType cursorType,
                                         CursorLifetime cursorLifetime,
-                                        UserNameIterator authenticatedUsers);
+                                        const boost::optional<UserName>& authenticatedUser);
 
     /**
      * Moves the given cursor to the 'pinned' state, and transfers ownership of the cursor to the
diff --git a/src/mongo/s/query/cluster_cursor_manager_test.cpp b/src/mongo/s/query/cluster_cursor_manager_test.cpp
index 0176fe23947..58cd6bcdb02 100644
--- a/src/mongo/s/query/cluster_cursor_manager_test.cpp
+++ b/src/mongo/s/query/cluster_cursor_manager_test.cpp
@@ -60,11 +60,11 @@ protected:
         _manager.shutdown(_opCtx.get());
     }
 
-    static Status successAuthChecker(UserNameIterator userNames) {
+    static Status successAuthChecker(const boost::optional<UserName>&) {
         return Status::OK();
     };
 
-    static Status failAuthChecker(UserNameIterator userNames) {
+    static Status failAuthChecker(const boost::optional<UserName>&) {
         return {ErrorCodes::Unauthorized, "Unauthorized"};
     };
 
@@ -147,7 +147,7 @@ TEST_F(ClusterCursorManagerTest, RegisterCursor) {
                                                nss,
                                                ClusterCursorManager::CursorType::SingleTarget,
                                                ClusterCursorManager::CursorLifetime::Mortal,
-                                               UserNameIterator()));
+                                               boost::none));
     auto pinnedCursor =
         getManager()->checkOutCursor(cursorId, getOperationContext(), successAuthChecker);
     ASSERT_OK(pinnedCursor.getStatus());
@@ -168,7 +168,7 @@ TEST_F(ClusterCursorManagerTest, RegisterCursorReturnsNonZeroId) {
                                                nss,
                                                ClusterCursorManager::CursorType::SingleTarget,
                                                ClusterCursorManager::CursorLifetime::Mortal,
-                                               UserNameIterator()));
+                                               boost::none));
     ASSERT_NE(0, cursorId);
 }
 
@@ -182,7 +182,7 @@ TEST_F(ClusterCursorManagerTest, CheckOutCursorBasic) {
                                                nss,
                                                ClusterCursorManager::CursorType::SingleTarget,
                                                ClusterCursorManager::CursorLifetime::Mortal,
-                                               UserNameIterator()));
+                                               boost::none));
     auto checkedOutCursor =
         getManager()->checkOutCursor(cursorId, getOperationContext(), successAuthChecker);
     ASSERT_OK(checkedOutCursor.getStatus());
@@ -210,7 +210,7 @@ TEST_F(ClusterCursorManagerTest, CheckOutCursorMultipleCursors) {
                                                    nss,
                                                    ClusterCursorManager::CursorType::SingleTarget,
                                                    ClusterCursorManager::CursorLifetime::Mortal,
-                                                   UserNameIterator()));
+                                                   boost::none));
     }
     for (int i = 0; i < numCursors; ++i) {
         auto pinnedCursor =
@@ -234,7 +234,7 @@ TEST_F(ClusterCursorManagerTest, CheckOutCursorPinned) {
                                                nss,
                                                ClusterCursorManager::CursorType::SingleTarget,
                                                ClusterCursorManager::CursorLifetime::Mortal,
-                                               UserNameIterator()));
+                                               boost::none));
     auto pinnedCursor =
         getManager()->checkOutCursor(cursorId, getOperationContext(), successAuthChecker);
     ASSERT_OK(pinnedCursor.getStatus());
@@ -252,7 +252,7 @@ TEST_F(ClusterCursorManagerTest, CheckOutCursorKilled) {
                                                nss,
                                                ClusterCursorManager::CursorType::SingleTarget,
                                                ClusterCursorManager::CursorLifetime::Mortal,
-                                               UserNameIterator()));
+                                               boost::none));
     killCursorFromDifferentOpCtx(cursorId);
     ASSERT_EQ(ErrorCodes::CursorNotFound,
               getManager()
@@ -275,7 +275,7 @@ TEST_F(ClusterCursorManagerTest, CheckOutCursorWrongCursorId) {
                                                nss,
                                                ClusterCursorManager::CursorType::SingleTarget,
                                                ClusterCursorManager::CursorLifetime::Mortal,
-                                               UserNameIterator()));
+                                               boost::none));
     ASSERT_EQ(ErrorCodes::CursorNotFound,
               getManager()
                   ->checkOutCursor(cursorId + 1, getOperationContext(), successAuthChecker)
@@ -291,7 +291,7 @@ TEST_F(ClusterCursorManagerTest, CheckOutCursorUpdateActiveTime) {
                                                nss,
                                                ClusterCursorManager::CursorType::SingleTarget,
                                                ClusterCursorManager::CursorLifetime::Mortal,
-                                               UserNameIterator()));
+                                               boost::none));
     Date_t cursorRegistrationTime = getClockSource()->now();
     getClockSource()->advance(Milliseconds(1));
     auto checkedOutCursor =
@@ -309,7 +309,7 @@ TEST_F(ClusterCursorManagerTest, CheckOutCursorAuthFails) {
                                                nss,
                                                ClusterCursorManager::CursorType::SingleTarget,
                                                ClusterCursorManager::CursorLifetime::Mortal,
-                                               UserNameIterator()));
+                                               boost::none));
     auto checkedOutCursor =
         getManager()->checkOutCursor(cursorId, getOperationContext(), failAuthChecker);
     ASSERT_EQ(checkedOutCursor.getStatus(), ErrorCodes::Unauthorized);
@@ -325,7 +325,7 @@ TEST_F(ClusterCursorManagerTest, ReturnCursorUpdateActiveTime) {
                                                nss,
                                                ClusterCursorManager::CursorType::SingleTarget,
                                                ClusterCursorManager::CursorLifetime::Mortal,
-                                               UserNameIterator()));
+                                               boost::none));
     Date_t cursorCheckOutTime = getClockSource()->now();
     auto checkedOutCursor =
         getManager()->checkOutCursor(cursorId, getOperationContext(), successAuthChecker);
@@ -344,7 +344,7 @@ TEST_F(ClusterCursorManagerTest, KillUnpinnedCursorBasic) {
                                                nss,
                                                ClusterCursorManager::CursorType::SingleTarget,
                                                ClusterCursorManager::CursorLifetime::Mortal,
-                                               UserNameIterator()));
+                                               boost::none));
     killCursorFromDifferentOpCtx(cursorId);
     ASSERT(isMockCursorKilled(0));
 }
@@ -357,7 +357,7 @@ TEST_F(ClusterCursorManagerTest, KillPinnedCursorBasic) {
                                                nss,
                                                ClusterCursorManager::CursorType::SingleTarget,
                                                ClusterCursorManager::CursorLifetime::Mortal,
-                                               UserNameIterator()));
+                                               boost::none));
     auto pinnedCursor =
         getManager()->checkOutCursor(cursorId, getOperationContext(), successAuthChecker);
     ASSERT_OK(pinnedCursor.getStatus());
@@ -384,7 +384,7 @@ TEST_F(ClusterCursorManagerTest, KillCursorMultipleCursors) {
                                                    nss,
                                                    ClusterCursorManager::CursorType::SingleTarget,
                                                    ClusterCursorManager::CursorLifetime::Mortal,
-                                                   UserNameIterator()));
+                                                   boost::none));
     }
     // Kill each cursor and verify that it was successfully killed.
     for (size_t i = 0; i < numCursors; ++i) {
@@ -408,7 +408,7 @@ TEST_F(ClusterCursorManagerTest, KillCursorWrongCursorId) {
                                                nss,
                                                ClusterCursorManager::CursorType::SingleTarget,
                                                ClusterCursorManager::CursorLifetime::Mortal,
-                                               UserNameIterator()));
+                                               boost::none));
     Status killResult = getManager()->killCursor(getOperationContext(), cursorId + 1);
     ASSERT_EQ(ErrorCodes::CursorNotFound, killResult);
 }
@@ -420,7 +420,7 @@ TEST_F(ClusterCursorManagerTest, KillMortalCursorsInactiveSinceBasic) {
                                            nss,
                                            ClusterCursorManager::CursorType::SingleTarget,
                                            ClusterCursorManager::CursorLifetime::Mortal,
-                                           UserNameIterator()));
+                                           boost::none));
     getManager()->killMortalCursorsInactiveSince(getOperationContext(), getClockSource()->now());
     ASSERT(isMockCursorKilled(0));
 }
@@ -434,7 +434,7 @@ TEST_F(ClusterCursorManagerTest, KillMortalCursorsInactiveSinceSkipUnexpired) {
                                            nss,
                                            ClusterCursorManager::CursorType::SingleTarget,
                                            ClusterCursorManager::CursorLifetime::Mortal,
-                                           UserNameIterator()));
+                                           boost::none));
     getManager()->killMortalCursorsInactiveSince(getOperationContext(), timeBeforeCursorCreation);
     ASSERT(!isMockCursorKilled(0));
 }
@@ -446,7 +446,7 @@ TEST_F(ClusterCursorManagerTest, KillMortalCursorsInactiveSinceSkipImmortal) {
                                            nss,
                                            ClusterCursorManager::CursorType::SingleTarget,
                                            ClusterCursorManager::CursorLifetime::Immortal,
-                                           UserNameIterator()));
+                                           boost::none));
     getManager()->killMortalCursorsInactiveSince(getOperationContext(), getClockSource()->now());
     ASSERT(!isMockCursorKilled(0));
 }
@@ -460,7 +460,7 @@ TEST_F(ClusterCursorManagerTest, ShouldNotKillPinnedCursors) {
                                                nss,
                                                ClusterCursorManager::CursorType::SingleTarget,
                                                ClusterCursorManager::CursorLifetime::Mortal,
-                                               UserNameIterator()));
+                                               boost::none));
     auto pin = assertGet(
         getManager()->checkOutCursor(cursorId, getOperationContext(), successAuthChecker));
     getManager()->killMortalCursorsInactiveSince(getOperationContext(), getClockSource()->now());
@@ -485,7 +485,7 @@ TEST_F(ClusterCursorManagerTest, KillMortalCursorsInactiveSinceMultipleCursors)
                                                nss,
                                                ClusterCursorManager::CursorType::SingleTarget,
                                                ClusterCursorManager::CursorLifetime::Mortal,
-                                               UserNameIterator()));
+                                               boost::none));
         getClockSource()->advance(Milliseconds(1));
     }
     getManager()->killMortalCursorsInactiveSince(getOperationContext(), cutoff);
@@ -507,7 +507,7 @@ TEST_F(ClusterCursorManagerTest, KillAllCursors) {
                                                nss,
                                                ClusterCursorManager::CursorType::SingleTarget,
                                                ClusterCursorManager::CursorLifetime::Mortal,
-                                               UserNameIterator()));
+                                               boost::none));
     }
     getManager()->killAllCursors(getOperationContext());
     for (size_t i = 0; i < numCursors; ++i) {
@@ -523,7 +523,7 @@ TEST_F(ClusterCursorManagerTest, KillCursorsSatisfyingAlwaysTrueKillsAllCursors)
                                                nss,
                                                ClusterCursorManager::CursorType::SingleTarget,
                                                ClusterCursorManager::CursorLifetime::Mortal,
-                                               UserNameIterator()));
+                                               boost::none));
     }
     auto pred = [](CursorId, const ClusterCursorManager::CursorEntry&) { return true; };
     auto nKilled = getManager()->killCursorsSatisfying(getOperationContext(), std::move(pred));
@@ -541,7 +541,7 @@ TEST_F(ClusterCursorManagerTest, KillCursorsSatisfyingAlwaysFalseKillsNoCursors)
                                                nss,
                                                ClusterCursorManager::CursorType::SingleTarget,
                                                ClusterCursorManager::CursorLifetime::Mortal,
-                                               UserNameIterator()));
+                                               boost::none));
     }
     auto pred = [](CursorId, const ClusterCursorManager::CursorEntry&) { return false; };
     auto nKilled = getManager()->killCursorsSatisfying(getOperationContext(), std::move(pred));
@@ -562,7 +562,7 @@ TEST_F(ClusterCursorManagerTest, KillCursorsSatisfyingOnlyKillsMatchingSubset) {
                                          nss,
                                          ClusterCursorManager::CursorType::SingleTarget,
                                          ClusterCursorManager::CursorLifetime::Mortal,
-                                         UserNameIterator());
+                                         boost::none);
         ASSERT_OK(swCursorId);
         if (shouldKillCursor(i))
             idsToKill.insert(swCursorId.getValue());
@@ -589,7 +589,7 @@ TEST_F(ClusterCursorManagerTest, KillCursorsSatisfyingBasedOnOpKey) {
                                                nss,
                                                ClusterCursorManager::CursorType::SingleTarget,
                                                ClusterCursorManager::CursorLifetime::Mortal,
-                                               UserNameIterator()));
+                                               boost::none));
     }
     auto pred = [&](CursorId id, const ClusterCursorManager::CursorEntry& entry) {
         return entry.getOperationKey() == getOperationContext()->getOperationKey();
@@ -608,7 +608,7 @@ TEST_F(ClusterCursorManagerTest, CorrectlyRecordsOriginatingClient) {
                                            nss,
                                            ClusterCursorManager::CursorType::MultiTarget,
                                            ClusterCursorManager::CursorLifetime::Mortal,
-                                           UserNameIterator()));
+                                           boost::none));
     // Now insert some cursors under a different client.
     const size_t numAltClientCursors = 10;
     {
@@ -621,7 +621,7 @@ TEST_F(ClusterCursorManagerTest, CorrectlyRecordsOriginatingClient) {
                                                    nss,
                                                    ClusterCursorManager::CursorType::MultiTarget,
                                                    ClusterCursorManager::CursorLifetime::Mortal,
-                                                   UserNameIterator()));
+                                                   boost::none));
         }
     }
 
@@ -652,7 +652,7 @@ TEST_F(ClusterCursorManagerTest, StatsRegisterShardedCursor) {
                                            nss,
                                            ClusterCursorManager::CursorType::MultiTarget,
                                            ClusterCursorManager::CursorLifetime::Mortal,
-                                           UserNameIterator()));
+                                           boost::none));
     ASSERT_EQ(1U, getManager()->stats().cursorsMultiTarget);
 }
 
@@ -663,7 +663,7 @@ TEST_F(ClusterCursorManagerTest, StatsRegisterNotShardedCursor) {
                                            nss,
                                            ClusterCursorManager::CursorType::SingleTarget,
                                            ClusterCursorManager::CursorLifetime::Mortal,
-                                           UserNameIterator()));
+                                           boost::none));
     ASSERT_EQ(1U, getManager()->stats().cursorsSingleTarget);
 }
 
@@ -675,7 +675,7 @@ TEST_F(ClusterCursorManagerTest, StatsPinCursor) {
                                                nss,
                                                ClusterCursorManager::CursorType::MultiTarget,
                                                ClusterCursorManager::CursorLifetime::Mortal,
-                                               UserNameIterator()));
+                                               boost::none));
     auto pinnedCursor =
         getManager()->checkOutCursor(cursorId, getOperationContext(), successAuthChecker);
     ASSERT_EQ(1U, getManager()->stats().cursorsPinned);
@@ -691,7 +691,7 @@ TEST_F(ClusterCursorManagerTest, StatsRegisterMultipleCursors) {
                                                nss,
                                                ClusterCursorManager::CursorType::MultiTarget,
                                                ClusterCursorManager::CursorLifetime::Mortal,
-                                               UserNameIterator()));
+                                               boost::none));
         ASSERT_EQ(i + 1, getManager()->stats().cursorsMultiTarget);
         ASSERT_EQ(0U, getManager()->stats().cursorsSingleTarget);
     }
@@ -702,7 +702,7 @@ TEST_F(ClusterCursorManagerTest, StatsRegisterMultipleCursors) {
                                                nss,
                                                ClusterCursorManager::CursorType::SingleTarget,
                                                ClusterCursorManager::CursorLifetime::Mortal,
-                                               UserNameIterator()));
+                                               boost::none));
         ASSERT_EQ(numShardedCursors, getManager()->stats().cursorsMultiTarget);
         ASSERT_EQ(i + 1, getManager()->stats().cursorsSingleTarget);
     }
@@ -716,7 +716,7 @@ TEST_F(ClusterCursorManagerTest, StatsKillShardedCursor) {
                                                nss,
                                                ClusterCursorManager::CursorType::MultiTarget,
                                                ClusterCursorManager::CursorLifetime::Mortal,
-                                               UserNameIterator()));
+                                               boost::none));
     ASSERT_EQ(1U, getManager()->stats().cursorsMultiTarget);
     ASSERT_OK(getManager()->killCursor(getOperationContext(), cursorId));
     ASSERT_EQ(0U, getManager()->stats().cursorsMultiTarget);
@@ -730,7 +730,7 @@ TEST_F(ClusterCursorManagerTest, StatsKillNotShardedCursor) {
                                                nss,
                                                ClusterCursorManager::CursorType::SingleTarget,
                                                ClusterCursorManager::CursorLifetime::Mortal,
-                                               UserNameIterator()));
+                                               boost::none));
     ASSERT_EQ(1U, getManager()->stats().cursorsSingleTarget);
     ASSERT_OK(getManager()->killCursor(getOperationContext(), cursorId));
     ASSERT_EQ(0U, getManager()->stats().cursorsSingleTarget);
@@ -744,7 +744,7 @@ TEST_F(ClusterCursorManagerTest, StatsKillPinnedCursor) {
                                                nss,
                                                ClusterCursorManager::CursorType::MultiTarget,
                                                ClusterCursorManager::CursorLifetime::Mortal,
-                                               UserNameIterator()));
+                                               boost::none));
     auto pinnedCursor =
         getManager()->checkOutCursor(cursorId, getOperationContext(), successAuthChecker);
     ASSERT_EQ(1U, getManager()->stats().cursorsPinned);
@@ -763,7 +763,7 @@ TEST_F(ClusterCursorManagerTest, StatsExhaustShardedCursor) {
                                                nss,
                                                ClusterCursorManager::CursorType::MultiTarget,
                                                ClusterCursorManager::CursorLifetime::Mortal,
-                                               UserNameIterator()));
+                                               boost::none));
     auto pinnedCursor =
         getManager()->checkOutCursor(cursorId, getOperationContext(), successAuthChecker);
     ASSERT_OK(pinnedCursor.getStatus());
@@ -781,7 +781,7 @@ TEST_F(ClusterCursorManagerTest, StatsExhaustNotShardedCursor) {
                                                nss,
                                                ClusterCursorManager::CursorType::SingleTarget,
                                                ClusterCursorManager::CursorLifetime::Mortal,
-                                               UserNameIterator()));
+                                               boost::none));
     auto pinnedCursor =
         getManager()->checkOutCursor(cursorId, getOperationContext(), successAuthChecker);
     ASSERT_OK(pinnedCursor.getStatus());
@@ -800,7 +800,7 @@ TEST_F(ClusterCursorManagerTest, StatsExhaustPinnedCursor) {
                                                nss,
                                                ClusterCursorManager::CursorType::SingleTarget,
                                                ClusterCursorManager::CursorLifetime::Mortal,
-                                               UserNameIterator()));
+                                               boost::none));
     auto pinnedCursor =
         getManager()->checkOutCursor(cursorId, getOperationContext(), successAuthChecker);
     ASSERT_OK(pinnedCursor.getStatus());
@@ -819,7 +819,7 @@ TEST_F(ClusterCursorManagerTest, StatsCheckInWithoutExhaustingPinnedCursor) {
                                                nss,
                                                ClusterCursorManager::CursorType::SingleTarget,
                                                ClusterCursorManager::CursorLifetime::Mortal,
-                                               UserNameIterator()));
+                                               boost::none));
     auto pinnedCursor =
         getManager()->checkOutCursor(cursorId, getOperationContext(), successAuthChecker);
     ASSERT_OK(pinnedCursor.getStatus());
@@ -844,7 +844,7 @@ TEST_F(ClusterCursorManagerTest, PinnedCursorReturnCursorNotExhausted) {
                                                nss,
                                                ClusterCursorManager::CursorType::SingleTarget,
                                                ClusterCursorManager::CursorLifetime::Mortal,
-                                               UserNameIterator()));
+                                               boost::none));
     auto registeredCursor =
         getManager()->checkOutCursor(cursorId, getOperationContext(), successAuthChecker);
     ASSERT_OK(registeredCursor.getStatus());
@@ -866,7 +866,7 @@ TEST_F(ClusterCursorManagerTest, PinnedCursorReturnCursorExhausted) {
                                                nss,
                                                ClusterCursorManager::CursorType::SingleTarget,
                                                ClusterCursorManager::CursorLifetime::Mortal,
-                                               UserNameIterator()));
+                                               boost::none));
     auto registeredCursor =
         getManager()->checkOutCursor(cursorId, getOperationContext(), successAuthChecker);
     ASSERT_OK(registeredCursor.getStatus());
@@ -894,7 +894,7 @@ TEST_F(ClusterCursorManagerTest, PinnedCursorReturnCursorExhaustedWithNonExhaust
                                                nss,
                                                ClusterCursorManager::CursorType::SingleTarget,
                                                ClusterCursorManager::CursorLifetime::Mortal,
-                                               UserNameIterator()));
+                                               boost::none));
     auto registeredCursor =
         getManager()->checkOutCursor(cursorId, getOperationContext(), successAuthChecker);
     ASSERT_OK(registeredCursor.getStatus());
@@ -920,7 +920,7 @@ TEST_F(ClusterCursorManagerTest, PinnedCursorMoveAssignmentKill) {
                                                nss,
                                                ClusterCursorManager::CursorType::SingleTarget,
                                                ClusterCursorManager::CursorLifetime::Mortal,
-                                               UserNameIterator()));
+                                               boost::none));
     auto pinnedCursor =
         getManager()->checkOutCursor(cursorId, getOperationContext(), successAuthChecker);
     pinnedCursor = ClusterCursorManager::PinnedCursor();
@@ -936,7 +936,7 @@ TEST_F(ClusterCursorManagerTest, PinnedCursorDestructorKill) {
                                                    nss,
                                                    ClusterCursorManager::CursorType::SingleTarget,
                                                    ClusterCursorManager::CursorLifetime::Mortal,
-                                                   UserNameIterator()));
+                                                   boost::none));
         auto pinnedCursor =
             getManager()->checkOutCursor(cursorId, getOperationContext(), successAuthChecker);
     }
@@ -954,7 +954,7 @@ TEST_F(ClusterCursorManagerTest, RemotesExhausted) {
                                                nss,
                                                ClusterCursorManager::CursorType::SingleTarget,
                                                ClusterCursorManager::CursorLifetime::Mortal,
-                                               UserNameIterator()));
+                                               boost::none));
     auto pinnedCursor =
         getManager()->checkOutCursor(cursorId, getOperationContext(), successAuthChecker);
     ASSERT_OK(pinnedCursor.getStatus());
@@ -970,7 +970,7 @@ TEST_F(ClusterCursorManagerTest, DoNotDestroyKilledPinnedCursors) {
                                                nss,
                                                ClusterCursorManager::CursorType::SingleTarget,
                                                ClusterCursorManager::CursorLifetime::Mortal,
-                                               UserNameIterator()));
+                                               boost::none));
     auto pinnedCursor =
         getManager()->checkOutCursor(cursorId, getOperationContext(), successAuthChecker);
     ASSERT_OK(pinnedCursor.getStatus());
@@ -1008,7 +1008,7 @@ TEST_F(ClusterCursorManagerTest, CursorStoresAPIParameters) {
                                                nss,
                                                ClusterCursorManager::CursorType::SingleTarget,
                                                ClusterCursorManager::CursorLifetime::Mortal,
-                                               UserNameIterator()));
+                                               boost::none));
     auto pinnedCursor = assertGet(
         getManager()->checkOutCursor(cursorId, getOperationContext(), successAuthChecker));
 
@@ -1024,7 +1024,7 @@ TEST_F(ClusterCursorManagerTest, CannotRegisterCursorDuringShutdown) {
                                            nss,
                                            ClusterCursorManager::CursorType::SingleTarget,
                                            ClusterCursorManager::CursorLifetime::Mortal,
-                                           UserNameIterator()));
+                                           boost::none));
     ASSERT(!isMockCursorKilled(0));
 
     getManager()->shutdown(getOperationContext());
@@ -1037,7 +1037,7 @@ TEST_F(ClusterCursorManagerTest, CannotRegisterCursorDuringShutdown) {
                                                nss,
                                                ClusterCursorManager::CursorType::SingleTarget,
                                                ClusterCursorManager::CursorLifetime::Mortal,
-                                               UserNameIterator()));
+                                               boost::none));
 }
 
 TEST_F(ClusterCursorManagerTest, PinnedCursorNotKilledOnShutdown) {
@@ -1047,7 +1047,7 @@ TEST_F(ClusterCursorManagerTest, PinnedCursorNotKilledOnShutdown) {
                                                nss,
                                                ClusterCursorManager::CursorType::SingleTarget,
                                                ClusterCursorManager::CursorLifetime::Mortal,
-                                               UserNameIterator()));
+                                               boost::none));
 
     auto pinnedCursor =
         getManager()->checkOutCursor(cursorId, getOperationContext(), successAuthChecker);
@@ -1069,7 +1069,7 @@ TEST_F(ClusterCursorManagerTest, CannotCheckoutCursorDuringShutdown) {
                                                nss,
                                                ClusterCursorManager::CursorType::SingleTarget,
                                                ClusterCursorManager::CursorLifetime::Mortal,
-                                               UserNameIterator()));
+                                               boost::none));
     ASSERT(!isMockCursorKilled(0));
 
     getManager()->shutdown(getOperationContext());
@@ -1092,7 +1092,7 @@ TEST_F(ClusterCursorManagerTest, CursorsWithoutSessions) {
                                            nss,
                                            ClusterCursorManager::CursorType::SingleTarget,
                                            ClusterCursorManager::CursorLifetime::Mortal,
-                                           UserNameIterator()));
+                                           boost::none));
 
     // Manager should have no active sessions.
     LogicalSessionIdSet lsids;
@@ -1112,7 +1112,7 @@ TEST_F(ClusterCursorManagerTest, OneCursorWithASession) {
                                                nss,
                                                ClusterCursorManager::CursorType::SingleTarget,
                                                ClusterCursorManager::CursorLifetime::Mortal,
-                                               UserNameIterator()));
+                                               boost::none));
 
     // Retrieve all sessions active in manager - set should contain just lsid.
     LogicalSessionIdSet lsids;
@@ -1147,7 +1147,7 @@ TEST_F(ClusterCursorManagerTest, GetSessionIdsWhileCheckedOut) {
                                                nss,
                                                ClusterCursorManager::CursorType::SingleTarget,
                                                ClusterCursorManager::CursorLifetime::Mortal,
-                                               UserNameIterator()));
+                                               boost::none));
 
     // Check the cursor out, then try to append cursors, see that we get one.
     auto res = getManager()->checkOutCursor(cursorId, getOperationContext(), successAuthChecker);
@@ -1169,14 +1169,14 @@ TEST_F(ClusterCursorManagerTest, MultipleCursorsWithSameSession) {
                                                nss,
                                                ClusterCursorManager::CursorType::SingleTarget,
                                                ClusterCursorManager::CursorLifetime::Mortal,
-                                               UserNameIterator()));
+                                               boost::none));
     auto cursorId2 =
         assertGet(getManager()->registerCursor(getOperationContext(),
                                                allocateMockCursor(lsid),
                                                nss,
                                                ClusterCursorManager::CursorType::SingleTarget,
                                                ClusterCursorManager::CursorLifetime::Mortal,
-                                               UserNameIterator()));
+                                               boost::none));
 
     // Retrieve all sessions - set should contain just lsid.
     stdx::unordered_set<LogicalSessionId, LogicalSessionIdHash> lsids;
@@ -1219,7 +1219,7 @@ TEST_F(ClusterCursorManagerTest, MultipleCursorsMultipleSessions) {
                                                nss,
                                                ClusterCursorManager::CursorType::SingleTarget,
                                                ClusterCursorManager::CursorLifetime::Mortal,
-                                               UserNameIterator()));
+                                               boost::none));
 
     CursorId cursor2 =
         assertGet(getManager()->registerCursor(getOperationContext(),
@@ -1227,14 +1227,14 @@ TEST_F(ClusterCursorManagerTest, MultipleCursorsMultipleSessions) {
                                                nss,
                                                ClusterCursorManager::CursorType::SingleTarget,
                                                ClusterCursorManager::CursorLifetime::Mortal,
-                                               UserNameIterator()));
+                                               boost::none));
 
     ASSERT_OK(getManager()->registerCursor(getOperationContext(),
                                            allocateMockCursor(),
                                            nss,
                                            ClusterCursorManager::CursorType::SingleTarget,
                                            ClusterCursorManager::CursorLifetime::Mortal,
-                                           UserNameIterator()));
+                                           boost::none));
 
     // Retrieve all sessions - should be both lsids.
     LogicalSessionIdSet lsids;
@@ -1265,7 +1265,7 @@ TEST_F(ClusterCursorManagerTest, ManyCursorsManySessions) {
                                                nss,
                                                ClusterCursorManager::CursorType::SingleTarget,
                                                ClusterCursorManager::CursorLifetime::Mortal,
-                                               UserNameIterator()));
+                                               boost::none));
     }
 
     // Retrieve all sessions.
@@ -1281,7 +1281,7 @@ TEST_F(ClusterCursorManagerTest, CheckAuthForKillCursors) {
                                                nss,
                                                ClusterCursorManager::CursorType::SingleTarget,
                                                ClusterCursorManager::CursorLifetime::Mortal,
-                                               UserNameIterator()));
+                                               boost::none));
 
     ASSERT_EQ(ErrorCodes::CursorNotFound,
               getManager()->checkAuthForKillCursors(
@@ -1301,7 +1301,7 @@ TEST_F(ClusterCursorManagerTest, PinnedCursorReturnsUnderlyingCursorTxnNumber) {
                                      nss,
                                      ClusterCursorManager::CursorType::SingleTarget,
                                      ClusterCursorManager::CursorLifetime::Mortal,
-                                     UserNameIterator()));
+                                     boost::none));
 
     auto pinnedCursor =
         getManager()->checkOutCursor(cursorId, getOperationContext(), successAuthChecker);
diff --git a/src/mongo/s/query/cluster_find.cpp b/src/mongo/s/query/cluster_find.cpp
index 42b0b8154e5..7d6f93623f9 100644
--- a/src/mongo/s/query/cluster_find.cpp
+++ b/src/mongo/s/query/cluster_find.cpp
@@ -409,11 +409,11 @@ CursorId runQueryWithoutRetrying(OperationContext* opCtx,
     const auto cursorLifetime = findCommand.getNoCursorTimeout()
         ? ClusterCursorManager::CursorLifetime::Immortal
         : ClusterCursorManager::CursorLifetime::Mortal;
-    auto authUsers = AuthorizationSession::get(opCtx->getClient())->getAuthenticatedUserNames();
+    auto authUser = AuthorizationSession::get(opCtx->getClient())->getAuthenticatedUserName();
     ccc->incNBatches();
 
     auto cursorId = uassertStatusOK(cursorManager->registerCursor(
-        opCtx, ccc.releaseCursor(), query.nss(), cursorType, cursorLifetime, authUsers));
+        opCtx, ccc.releaseCursor(), query.nss(), cursorType, cursorLifetime, authUser));
 
     // Record the cursorID in CurOp.
     CurOp::get(opCtx)->debug().cursorid = cursorId;
@@ -699,8 +699,8 @@ StatusWith<CursorResponse> ClusterFind::runGetMore(OperationContext* opCtx,
     auto cursorManager = Grid::get(opCtx)->getCursorManager();
 
     auto authzSession = AuthorizationSession::get(opCtx->getClient());
-    auto authChecker = [&authzSession](UserNameIterator userNames) -> Status {
-        return authzSession->isCoauthorizedWith(userNames)
+    auto authChecker = [&authzSession](const boost::optional<UserName>& userName) -> Status {
+        return authzSession->isCoauthorizedWith(userName)
             ? Status::OK()
             : Status(ErrorCodes::Unauthorized, "User not authorized to access cursor");
     };
diff --git a/src/mongo/s/query/store_possible_cursor.cpp b/src/mongo/s/query/store_possible_cursor.cpp
index c778daa9d84..329d47e34db 100644
--- a/src/mongo/s/query/store_possible_cursor.cpp
+++ b/src/mongo/s/query/store_possible_cursor.cpp
@@ -132,14 +132,14 @@ StatusWith<BSONObj> storePossibleCursor(OperationContext* opCtx,
     // We don't expect to use this cursor until a subsequent getMore, so detach from the current
     // OperationContext until then.
     ccc->detachFromOperationContext();
-    auto authUsers = AuthorizationSession::get(opCtx->getClient())->getAuthenticatedUserNames();
+    auto authUser = AuthorizationSession::get(opCtx->getClient())->getAuthenticatedUserName();
     auto clusterCursorId =
         cursorManager->registerCursor(opCtx,
                                       ccc.releaseCursor(),
                                       requestedNss,
                                       ClusterCursorManager::CursorType::SingleTarget,
                                       ClusterCursorManager::CursorLifetime::Mortal,
-                                      authUsers);
+                                      authUser);
     if (!clusterCursorId.isOK()) {
         return clusterCursorId.getStatus();
     }