SERVER-18478 Get rid of UpdateGuard and simplify locking for user management commands on mongod

14 files changed, 89 insertions, 274 deletions

diff --git a/src/mongo/db/auth/SConscript b/src/mongo/db/auth/SConscript
index b8aa0e38063..94fa4f24f74 100644
--- a/src/mongo/db/auth/SConscript
+++ b/src/mongo/db/auth/SConscript
@@ -12,7 +12,6 @@ env.Library('authcore', ['action_set.cpp',
                          'action_type.cpp',
                          'authorization_manager.cpp',
                          'authorization_session.cpp',
-                         'authz_documents_update_guard.cpp',
                          'authz_manager_external_state.cpp',
                          'authz_manager_external_state_local.cpp',
                          'authz_session_external_state.cpp',
diff --git a/src/mongo/db/auth/authorization_manager.cpp b/src/mongo/db/auth/authorization_manager.cpp
index 8e68dbbcbb4..42fb2216780 100644
--- a/src/mongo/db/auth/authorization_manager.cpp
+++ b/src/mongo/db/auth/authorization_manager.cpp
@@ -46,7 +46,6 @@
 #include "mongo/crypto/mechanism_scram.h"
 #include "mongo/db/auth/action_set.h"
 #include "mongo/db/auth/authorization_session.h"
-#include "mongo/db/auth/authz_documents_update_guard.h"
 #include "mongo/db/auth/authz_manager_external_state.h"
 #include "mongo/db/auth/privilege.h"
 #include "mongo/db/auth/role_graph.h"
@@ -750,14 +749,6 @@ namespace mongo {
         return Status::OK();
     }
 
-    bool AuthorizationManager::tryAcquireAuthzUpdateLock(StringData why) {
-        return _externalState->tryAcquireAuthzUpdateLock(why);
-    }
-
-    void AuthorizationManager::releaseAuthzUpdateLock() {
-        return _externalState->releaseAuthzUpdateLock();
-    }
-
 namespace {
 
     /**
diff --git a/src/mongo/db/auth/authorization_manager.h b/src/mongo/db/auth/authorization_manager.h
index a87e5c0e4cf..2825269be58 100644
--- a/src/mongo/db/auth/authorization_manager.h
+++ b/src/mongo/db/auth/authorization_manager.h
@@ -395,20 +395,6 @@ namespace mongo {
         Status _initializeUserFromPrivilegeDocument(User* user, const BSONObj& privDoc);
 
         /**
-         * Tries to acquire the global lock guarding modifications to all persistent data related
-         * to authorization, namely the admin.system.users, admin.system.roles, and
-         * admin.system.version collections.  This serializes all writers to the authorization
-         * documents, but does not impact readers.
-         */
-        bool tryAcquireAuthzUpdateLock(StringData why);
-
-        /**
-         * Releases the lock guarding modifications to persistent authorization data, which must
-         * already be held.
-         */
-        void releaseAuthzUpdateLock();
-
-        /**
          * Performs one step in the process of upgrading the stored authorization data to the
          * newest schema.
          *
diff --git a/src/mongo/db/auth/authz_documents_update_guard.cpp b/src/mongo/db/auth/authz_documents_update_guard.cpp
deleted file mode 100644
index 25bfef87a94..00000000000
--- a/src/mongo/db/auth/authz_documents_update_guard.cpp
+++ /dev/null
@@ -1,57 +0,0 @@
-/**
-*    Copyright (C) 2013 10gen Inc.
-*
-*    This program is free software: you can redistribute it and/or  modify
-*    it under the terms of the GNU Affero General Public License, version 3,
-*    as published by the Free Software Foundation.
-*
-*    This program is distributed in the hope that it will be useful,
-*    but WITHOUT ANY WARRANTY; without even the implied warranty of
-*    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-*    GNU Affero General Public License for more details.
-*
-*    You should have received a copy of the GNU Affero General Public License
-*    along with this program.  If not, see <http://www.gnu.org/licenses/>.
-*
-*    As a special exception, the copyright holders give permission to link the
-*    code of portions of this program with the OpenSSL library under certain
-*    conditions as described in each individual source file and distribute
-*    linked combinations including the program with the OpenSSL library. You
-*    must comply with the GNU Affero General Public License in all respects for
-*    all of the code used other than as permitted herein. If you modify file(s)
-*    with this exception, you may extend this exception to your version of the
-*    file(s), but you are not obligated to do so. If you do not wish to do so,
-*    delete this exception statement from your version. If you delete this
-*    exception statement from all source files in the program, then also delete
-*    it in the license file.
-*/
-
-#include "mongo/db/auth/authz_documents_update_guard.h"
-
-#include "mongo/db/auth/authorization_manager.h"
-
-
-namespace mongo {
-
-    AuthzDocumentsUpdateGuard::AuthzDocumentsUpdateGuard(AuthorizationManager* authzManager)
-        : _authzManager(authzManager), _lockedForUpdate(false) {}
-
-    AuthzDocumentsUpdateGuard::~AuthzDocumentsUpdateGuard() {
-        if (_lockedForUpdate) {
-            unlock();
-        }
-    }
-
-    bool AuthzDocumentsUpdateGuard::tryLock(StringData why) {
-        fassert(17126, !_lockedForUpdate);
-        _lockedForUpdate = _authzManager->tryAcquireAuthzUpdateLock(why);
-        return _lockedForUpdate;
-    }
-
-    void AuthzDocumentsUpdateGuard::unlock() {
-        fassert(17127, _lockedForUpdate);
-        _authzManager->releaseAuthzUpdateLock();
-        _lockedForUpdate = false;
-    }
-
-} // namespace mongo
diff --git a/src/mongo/db/auth/authz_documents_update_guard.h b/src/mongo/db/auth/authz_documents_update_guard.h
deleted file mode 100644
index 9a81409a8cb..00000000000
--- a/src/mongo/db/auth/authz_documents_update_guard.h
+++ /dev/null
@@ -1,69 +0,0 @@
-/**
-*    Copyright (C) 2013 10gen Inc.
-*
-*    This program is free software: you can redistribute it and/or  modify
-*    it under the terms of the GNU Affero General Public License, version 3,
-*    as published by the Free Software Foundation.
-*
-*    This program is distributed in the hope that it will be useful,
-*    but WITHOUT ANY WARRANTY; without even the implied warranty of
-*    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-*    GNU Affero General Public License for more details.
-*
-*    You should have received a copy of the GNU Affero General Public License
-*    along with this program.  If not, see <http://www.gnu.org/licenses/>.
-*
-*    As a special exception, the copyright holders give permission to link the
-*    code of portions of this program with the OpenSSL library under certain
-*    conditions as described in each individual source file and distribute
-*    linked combinations including the program with the OpenSSL library. You
-*    must comply with the GNU Affero General Public License in all respects for
-*    all of the code used other than as permitted herein. If you modify file(s)
-*    with this exception, you may extend this exception to your version of the
-*    file(s), but you are not obligated to do so. If you do not wish to do so,
-*    delete this exception statement from your version. If you delete this
-*    exception statement from all source files in the program, then also delete
-*    it in the license file.
-*/
-
-#pragma once
-
-#include "mongo/base/disallow_copying.h"
-#include "mongo/base/string_data.h"
-
-namespace mongo {
-
-    class AuthorizationManager;
-
-    /*
-     * Guard object for locking the lock that serializes all writes to the persistent authorization
-     * documents.
-     */
-    class AuthzDocumentsUpdateGuard {
-        MONGO_DISALLOW_COPYING(AuthzDocumentsUpdateGuard);
-    public:
-        explicit AuthzDocumentsUpdateGuard(AuthorizationManager* authzManager);
-        ~AuthzDocumentsUpdateGuard();
-
-        /**
-         * Tries to acquire the global lock guarding modifications to all persistent data related
-         * to authorization, namely the admin.system.users, admin.system.roles, and
-         * admin.system.version collections.  This serializes all writers to the authorization
-         * documents, but does not impact readers.
-         * Returns whether or not it was successful at acquiring the lock.
-         */
-        bool tryLock(StringData why);
-
-        /**
-         * Releases the lock guarding modifications to persistent authorization data, which must
-         * already be held.
-         */
-        void unlock();
-
-    private:
-        AuthorizationManager* _authzManager;
-        // True if the Guard has locked the lock that guards modifications to authz documents.
-        bool _lockedForUpdate;
-    };
-
-} // namespace mongo
diff --git a/src/mongo/db/auth/authz_manager_external_state.cpp b/src/mongo/db/auth/authz_manager_external_state.cpp
index 2ed2ee6376e..9d9d1763439 100644
--- a/src/mongo/db/auth/authz_manager_external_state.cpp
+++ b/src/mongo/db/auth/authz_manager_external_state.cpp
@@ -41,10 +41,6 @@ namespace mongo {
 
     stdx::function<std::unique_ptr<AuthzManagerExternalState>()> AuthzManagerExternalState::create;
 
-#ifndef _MSC_EXTENSIONS
-    const long long AuthzManagerExternalState::_authzUpdateLockAcquisitionTimeoutMillis;
-#endif
-
     AuthzManagerExternalState::AuthzManagerExternalState() {}
     AuthzManagerExternalState::~AuthzManagerExternalState() {}
 
diff --git a/src/mongo/db/auth/authz_manager_external_state.h b/src/mongo/db/auth/authz_manager_external_state.h
index 9614b2d6989..05b1ba18aeb 100644
--- a/src/mongo/db/auth/authz_manager_external_state.h
+++ b/src/mongo/db/auth/authz_manager_external_state.h
@@ -226,20 +226,6 @@ namespace mongo {
                               const BSONObj& writeConcern,
                               int* numRemoved) = 0;
 
-        /**
-         * Tries to acquire the global lock guarding modifications to all persistent data related
-         * to authorization, namely the admin.system.users, admin.system.roles, and
-         * admin.system.version collections.  This serializes all writers to the authorization
-         * documents, but does not impact readers.
-         */
-        virtual bool tryAcquireAuthzUpdateLock(StringData why) = 0;
-
-        /**
-         * Releases the lock guarding modifications to persistent authorization data, which must
-         * already be held.
-         */
-        virtual void releaseAuthzUpdateLock() = 0;
-
         virtual void logOp(
                 OperationContext* txn,
                 const char* op,
@@ -250,8 +236,6 @@ namespace mongo {
 
     protected:
         AuthzManagerExternalState(); // This class should never be instantiated directly.
-
-        static const long long _authzUpdateLockAcquisitionTimeoutMillis = 5000;
     };
 
 } // namespace mongo
diff --git a/src/mongo/db/auth/authz_manager_external_state_d.cpp b/src/mongo/db/auth/authz_manager_external_state_d.cpp
index 7871f8d5a78..79e81727242 100644
--- a/src/mongo/db/auth/authz_manager_external_state_d.cpp
+++ b/src/mongo/db/auth/authz_manager_external_state_d.cpp
@@ -32,8 +32,6 @@
 
 #include "mongo/db/auth/authz_manager_external_state_d.h"
 
-#include <boost/thread/mutex.hpp>
-#include <boost/date_time/time_duration.hpp>
 #include <string>
 
 #include "mongo/base/status.h"
@@ -189,14 +187,4 @@ namespace mongo {
         }
     }
 
-    bool AuthzManagerExternalStateMongod::tryAcquireAuthzUpdateLock(StringData why) {
-        LOG(2) << "Attempting to lock user data for: " << why << endl;
-        return _authzDataUpdateLock.timed_lock(
-                boost::posix_time::milliseconds(_authzUpdateLockAcquisitionTimeoutMillis));
-    }
-
-    void AuthzManagerExternalStateMongod::releaseAuthzUpdateLock() {
-        return _authzDataUpdateLock.unlock();
-    }
-
 } // namespace mongo
diff --git a/src/mongo/db/auth/authz_manager_external_state_d.h b/src/mongo/db/auth/authz_manager_external_state_d.h
index 7a3e1f98de4..3c8fa8aa1c6 100644
--- a/src/mongo/db/auth/authz_manager_external_state_d.h
+++ b/src/mongo/db/auth/authz_manager_external_state_d.h
@@ -79,11 +79,6 @@ namespace mongo {
                               const BSONObj& query,
                               const BSONObj& writeConcern,
                               int* numRemoved);
-        virtual bool tryAcquireAuthzUpdateLock(StringData why);
-        virtual void releaseAuthzUpdateLock();
-
-    private:
-        boost::timed_mutex _authzDataUpdateLock;
     };
 
 } // namespace mongo
diff --git a/src/mongo/db/auth/authz_manager_external_state_mock.cpp b/src/mongo/db/auth/authz_manager_external_state_mock.cpp
index a8939fceb70..047ca78d52c 100644
--- a/src/mongo/db/auth/authz_manager_external_state_mock.cpp
+++ b/src/mongo/db/auth/authz_manager_external_state_mock.cpp
@@ -271,12 +271,6 @@ namespace {
         return Status::OK();
     }
 
-    bool AuthzManagerExternalStateMock::tryAcquireAuthzUpdateLock(StringData) {
-        return true;
-    }
-
-    void AuthzManagerExternalStateMock::releaseAuthzUpdateLock() {}
-
     std::vector<BSONObj> AuthzManagerExternalStateMock::getCollectionContents(
             const NamespaceString& collectionName) {
         return mapFindWithDefault(_documents, collectionName, std::vector<BSONObj>());
diff --git a/src/mongo/db/auth/authz_manager_external_state_mock.h b/src/mongo/db/auth/authz_manager_external_state_mock.h
index 92698263295..585d954e7ba 100644
--- a/src/mongo/db/auth/authz_manager_external_state_mock.h
+++ b/src/mongo/db/auth/authz_manager_external_state_mock.h
@@ -99,8 +99,6 @@ namespace mongo {
                               const BSONObj& query,
                               const BSONObj& writeConcern,
                               int* numRemoved);
-        virtual bool tryAcquireAuthzUpdateLock(StringData why);
-        virtual void releaseAuthzUpdateLock();
 
         std::vector<BSONObj> getCollectionContents(const NamespaceString& collectionName);
 
diff --git a/src/mongo/db/auth/authz_manager_external_state_s.cpp b/src/mongo/db/auth/authz_manager_external_state_s.cpp
index 40c844f9a7a..19e32f62003 100644
--- a/src/mongo/db/auth/authz_manager_external_state_s.cpp
+++ b/src/mongo/db/auth/authz_manager_external_state_s.cpp
@@ -332,31 +332,4 @@ namespace {
         return res;
     }
 
-    bool AuthzManagerExternalStateMongos::tryAcquireAuthzUpdateLock(StringData why) {
-        boost::lock_guard<boost::mutex> lkLocal(_distLockGuard);
-        if (_authzDataUpdateLock.get()) {
-            return false;
-        }
-
-        auto timeout = stdx::chrono::milliseconds(_authzUpdateLockAcquisitionTimeoutMillis);
-        auto scopedDistLock = grid.catalogManager()->getDistLockManager()->lock(
-                "authorizationData", why, timeout);
-
-        if (!scopedDistLock.isOK()) {
-            warning() << "Error while attempting to acquire distributed lock for "
-                      << "user modification: " << scopedDistLock.getStatus().toString();
-            return false;
-        }
-
-        _authzDataUpdateLock = stdx::make_unique<DistLockManager::ScopedDistLock>(
-                std::move(scopedDistLock.getValue()));
-
-        return true;
-    }
-
-    void AuthzManagerExternalStateMongos::releaseAuthzUpdateLock() {
-        boost::lock_guard<boost::mutex> lkLocal(_distLockGuard);
-        _authzDataUpdateLock.reset();
-    }
-
 } // namespace mongo
diff --git a/src/mongo/db/auth/authz_manager_external_state_s.h b/src/mongo/db/auth/authz_manager_external_state_s.h
index 194d2f08f8f..31295aa3ec3 100644
--- a/src/mongo/db/auth/authz_manager_external_state_s.h
+++ b/src/mongo/db/auth/authz_manager_external_state_s.h
@@ -105,12 +105,6 @@ namespace mongo {
                               const BSONObj& query,
                               const BSONObj& writeConcern,
                               int* numRemoved);
-        virtual bool tryAcquireAuthzUpdateLock(StringData why);
-        virtual void releaseAuthzUpdateLock();
-
-    private:
-        boost::mutex _distLockGuard; // Guards access to _authzDataUpdateLock
-        std::unique_ptr<DistLockManager::ScopedDistLock> _authzDataUpdateLock;
     };
 
 } // namespace mongo
diff --git a/src/mongo/db/commands/user_management_commands.cpp b/src/mongo/db/commands/user_management_commands.cpp
index fbac3ef177b..7e2e1c100b3 100644
--- a/src/mongo/db/commands/user_management_commands.cpp
+++ b/src/mongo/db/commands/user_management_commands.cpp
@@ -32,6 +32,7 @@
 
 #include "mongo/db/commands/user_management_commands.h"
 
+#include <boost/thread/mutex.hpp>
 #include <string>
 #include <vector>
 
@@ -46,7 +47,6 @@
 #include "mongo/db/audit.h"
 #include "mongo/db/auth/action_set.h"
 #include "mongo/db/auth/action_type.h"
-#include "mongo/db/auth/authz_documents_update_guard.h"
 #include "mongo/db/auth/authorization_manager.h"
 #include "mongo/db/auth/authorization_manager_global.h"
 #include "mongo/db/auth/authorization_session.h"
@@ -56,14 +56,18 @@
 #include "mongo/db/auth/user.h"
 #include "mongo/db/auth/user_document_parser.h"
 #include "mongo/db/auth/user_management_commands_parser.h"
+#include "mongo/db/client.h"
 #include "mongo/db/commands.h"
 #include "mongo/db/jsobj.h"
+#include "mongo/db/operation_context.h"
+#include "mongo/db/service_context.h"
 #include "mongo/platform/unordered_set.h"
 #include "mongo/stdx/functional.h"
 #include "mongo/util/log.h"
 #include "mongo/util/mongoutils/str.h"
 #include "mongo/util/net/ssl_manager.h"
 #include "mongo/util/sequence_util.h"
+#include "mongo/util/time_support.h"
 
 namespace mongo {
 
@@ -74,6 +78,15 @@ namespace mongo {
     using std::stringstream;
     using std::vector;
 
+namespace {
+
+    // Used to obtain mutex that guards modifications to persistent authorization data
+    const auto getAuthzDataMutex = ServiceContext::declareDecoration<boost::timed_mutex>();
+
+    const Seconds authzDataMutexAcquisitionTimeout{5};
+
+} // namespace
+
     class CmdCreateUser : public Command {
     public:
 
@@ -162,7 +175,8 @@ namespace mongo {
             userObjBuilder.append(AuthorizationManager::USER_DB_FIELD_NAME,
                                   args.userName.getDB());
 
-            AuthorizationManager* authzManager = getGlobalAuthorizationManager();
+            ServiceContext* serviceContext = txn->getClient()->getServiceContext();
+            AuthorizationManager* authzManager = AuthorizationManager::get(serviceContext);
             int authzVersion;
             status = authzManager->getAuthorizationVersion(txn, &authzVersion);
             if (!status.isOK()) {
@@ -200,8 +214,9 @@ namespace mongo {
                 return appendCommandStatus(result, status);
             }
 
-            AuthzDocumentsUpdateGuard updateGuard(authzManager);
-            if (!updateGuard.tryLock("Create user")) {
+            boost::unique_lock<boost::timed_mutex> lk(getAuthzDataMutex(serviceContext),
+                                                      authzDataMutexAcquisitionTimeout);
+            if (!lk) {
                 return appendCommandStatus(
                         result,
                         Status(ErrorCodes::LockBusy, "Could not lock auth data update lock."));
@@ -319,14 +334,16 @@ namespace mongo {
                 updateSetBuilder.append("roles", auth::rolesVectorToBSONArray(args.roles));
             }
 
-            AuthorizationManager* authzManager = getGlobalAuthorizationManager();
-            AuthzDocumentsUpdateGuard updateGuard(authzManager);
-            if (!updateGuard.tryLock("Update user")) {
+            ServiceContext* serviceContext = txn->getClient()->getServiceContext();
+            boost::unique_lock<boost::timed_mutex> lk(getAuthzDataMutex(serviceContext),
+                                                      authzDataMutexAcquisitionTimeout);
+            if (!lk) {
                 return appendCommandStatus(
                         result,
                         Status(ErrorCodes::LockBusy, "Could not lock auth data update lock."));
             }
 
+            AuthorizationManager* authzManager = AuthorizationManager::get(serviceContext);
             status = auth::requireAuthSchemaVersion26Final(txn, authzManager);
             if (!status.isOK()) {
                 return appendCommandStatus(result, status);
@@ -391,14 +408,16 @@ namespace mongo {
                  int options,
                  string& errmsg,
                  BSONObjBuilder& result) {
-            AuthorizationManager* authzManager = getGlobalAuthorizationManager();
-            AuthzDocumentsUpdateGuard updateGuard(authzManager);
-            if (!updateGuard.tryLock("Drop user")) {
+            ServiceContext* serviceContext = txn->getClient()->getServiceContext();
+            boost::unique_lock<boost::timed_mutex> lk(getAuthzDataMutex(serviceContext),
+                                                      authzDataMutexAcquisitionTimeout);
+            if (!lk) {
                 return appendCommandStatus(
                         result,
                         Status(ErrorCodes::LockBusy, "Could not lock auth data update lock."));
             }
 
+            AuthorizationManager* authzManager = AuthorizationManager::get(serviceContext);
             Status status = auth::requireAuthSchemaVersion26Final(txn, authzManager);
             if (!status.isOK()) {
                 return appendCommandStatus(result, status);
@@ -470,14 +489,16 @@ namespace mongo {
                  int options,
                  string& errmsg,
                  BSONObjBuilder& result) {
-            AuthorizationManager* authzManager = getGlobalAuthorizationManager();
-            AuthzDocumentsUpdateGuard updateGuard(authzManager);
-            if (!updateGuard.tryLock("Drop all users from database")) {
+            ServiceContext* serviceContext = txn->getClient()->getServiceContext();
+            boost::unique_lock<boost::timed_mutex> lk(getAuthzDataMutex(serviceContext),
+                                                      authzDataMutexAcquisitionTimeout);
+            if (!lk) {
                 return appendCommandStatus(
                         result,
                         Status(ErrorCodes::LockBusy, "Could not lock auth data update lock."));
             }
 
+            AuthorizationManager* authzManager = AuthorizationManager::get(serviceContext);
             Status status = auth::requireAuthSchemaVersion26Final(txn, authzManager);
             if (!status.isOK()) {
                 return appendCommandStatus(result, status);
@@ -538,14 +559,16 @@ namespace mongo {
                  int options,
                  string& errmsg,
                  BSONObjBuilder& result) {
-            AuthorizationManager* authzManager = getGlobalAuthorizationManager();
-            AuthzDocumentsUpdateGuard updateGuard(authzManager);
-            if (!updateGuard.tryLock("Grant roles to user")) {
+            ServiceContext* serviceContext = txn->getClient()->getServiceContext();
+            boost::unique_lock<boost::timed_mutex> lk(getAuthzDataMutex(serviceContext),
+                                                      authzDataMutexAcquisitionTimeout);
+            if (!lk) {
                 return appendCommandStatus(
                         result,
                         Status(ErrorCodes::LockBusy, "Could not lock auth data update lock."));
             }
 
+            AuthorizationManager* authzManager = AuthorizationManager::get(serviceContext);
             Status status = auth::requireAuthSchemaVersion26Final(txn, authzManager);
             if (!status.isOK()) {
                 return appendCommandStatus(result, status);
@@ -621,14 +644,16 @@ namespace mongo {
                  int options,
                  string& errmsg,
                  BSONObjBuilder& result) {
-            AuthorizationManager* authzManager = getGlobalAuthorizationManager();
-            AuthzDocumentsUpdateGuard updateGuard(authzManager);
-            if (!updateGuard.tryLock("Revoke roles from user")) {
+            ServiceContext* serviceContext = txn->getClient()->getServiceContext();
+            boost::unique_lock<boost::timed_mutex> lk(getAuthzDataMutex(serviceContext),
+                                                      authzDataMutexAcquisitionTimeout);
+            if (!lk) {
                 return appendCommandStatus(
                         result,
                         Status(ErrorCodes::LockBusy, "Could not lock auth data update lock."));
             }
 
+            AuthorizationManager* authzManager = AuthorizationManager::get(serviceContext);
             Status status = auth::requireAuthSchemaVersion26Final(txn, authzManager);
             if (!status.isOK()) {
                 return appendCommandStatus(result, status);
@@ -880,14 +905,16 @@ namespace mongo {
 
             roleObjBuilder.append("roles", auth::rolesVectorToBSONArray(args.roles));
 
-            AuthorizationManager* authzManager = getGlobalAuthorizationManager();
-            AuthzDocumentsUpdateGuard updateGuard(authzManager);
-            if (!updateGuard.tryLock("Create role")) {
+            ServiceContext* serviceContext = txn->getClient()->getServiceContext();
+            boost::unique_lock<boost::timed_mutex> lk(getAuthzDataMutex(serviceContext),
+                                                      authzDataMutexAcquisitionTimeout);
+            if (!lk) {
                 return appendCommandStatus(
                         result,
                         Status(ErrorCodes::LockBusy, "Could not lock auth data update lock."));
             }
 
+            AuthorizationManager* authzManager = AuthorizationManager::get(serviceContext);
             status = auth::requireAuthSchemaVersion26Final(txn, authzManager);
             if (!status.isOK()) {
                 return appendCommandStatus(result, status);
@@ -972,14 +999,16 @@ namespace mongo {
                 updateSetBuilder.append("roles", auth::rolesVectorToBSONArray(args.roles));
             }
 
-            AuthorizationManager* authzManager = getGlobalAuthorizationManager();
-            AuthzDocumentsUpdateGuard updateGuard(authzManager);
-            if (!updateGuard.tryLock("Update role")) {
+            ServiceContext* serviceContext = txn->getClient()->getServiceContext();
+            boost::unique_lock<boost::timed_mutex> lk(getAuthzDataMutex(serviceContext),
+                                                      authzDataMutexAcquisitionTimeout);
+            if (!lk) {
                 return appendCommandStatus(
                         result,
                         Status(ErrorCodes::LockBusy, "Could not lock auth data update lock."));
             }
 
+            AuthorizationManager* authzManager = AuthorizationManager::get(serviceContext);
             status = auth::requireAuthSchemaVersion26Final(txn, authzManager);
             if (!status.isOK()) {
                 return appendCommandStatus(result, status);
@@ -1047,14 +1076,16 @@ namespace mongo {
                  int options,
                  string& errmsg,
                  BSONObjBuilder& result) {
-            AuthorizationManager* authzManager = getGlobalAuthorizationManager();
-            AuthzDocumentsUpdateGuard updateGuard(authzManager);
-            if (!updateGuard.tryLock("Grant privileges to role")) {
+            ServiceContext* serviceContext = txn->getClient()->getServiceContext();
+            boost::unique_lock<boost::timed_mutex> lk(getAuthzDataMutex(serviceContext),
+                                                      authzDataMutexAcquisitionTimeout);
+            if (!lk) {
                 return appendCommandStatus(
                         result,
                         Status(ErrorCodes::LockBusy, "Could not lock auth data update lock."));
             }
 
+            AuthorizationManager* authzManager = AuthorizationManager::get(serviceContext);
             Status status = auth::requireAuthSchemaVersion26Final(txn, authzManager);
             if (!status.isOK()) {
                 return appendCommandStatus(result, status);
@@ -1168,14 +1199,16 @@ namespace mongo {
                  int options,
                  string& errmsg,
                  BSONObjBuilder& result) {
-            AuthorizationManager* authzManager = getGlobalAuthorizationManager();
-            AuthzDocumentsUpdateGuard updateGuard(authzManager);
-            if (!updateGuard.tryLock("Revoke privileges from role")) {
+            ServiceContext* serviceContext = txn->getClient()->getServiceContext();
+            boost::unique_lock<boost::timed_mutex> lk(getAuthzDataMutex(serviceContext),
+                                                      authzDataMutexAcquisitionTimeout);
+            if (!lk) {
                 return appendCommandStatus(
                         result,
                         Status(ErrorCodes::LockBusy, "Could not lock auth data update lock."));
             }
 
+            AuthorizationManager* authzManager = AuthorizationManager::get(serviceContext);
             Status status = auth::requireAuthSchemaVersion26Final(txn, authzManager);
             if (!status.isOK()) {
                 return appendCommandStatus(result, status);
@@ -1314,14 +1347,16 @@ namespace mongo {
                                " is a built-in role and cannot be modified."));
             }
 
-            AuthorizationManager* authzManager = getGlobalAuthorizationManager();
-            AuthzDocumentsUpdateGuard updateGuard(authzManager);
-            if (!updateGuard.tryLock("Grant roles to role")) {
+            ServiceContext* serviceContext = txn->getClient()->getServiceContext();
+            boost::unique_lock<boost::timed_mutex> lk(getAuthzDataMutex(serviceContext),
+                                                      authzDataMutexAcquisitionTimeout);
+            if (!lk) {
                 return appendCommandStatus(
                         result,
                         Status(ErrorCodes::LockBusy, "Could not lock auth data update lock."));
             }
 
+            AuthorizationManager* authzManager = AuthorizationManager::get(serviceContext);
             status = auth::requireAuthSchemaVersion26Final(txn, authzManager);
             if (!status.isOK()) {
                 return appendCommandStatus(result, status);
@@ -1396,14 +1431,16 @@ namespace mongo {
                  int options,
                  string& errmsg,
                  BSONObjBuilder& result) {
-            AuthorizationManager* authzManager = getGlobalAuthorizationManager();
-            AuthzDocumentsUpdateGuard updateGuard(authzManager);
-            if (!updateGuard.tryLock("Revoke roles from role")) {
+            ServiceContext* serviceContext = txn->getClient()->getServiceContext();
+            boost::unique_lock<boost::timed_mutex> lk(getAuthzDataMutex(serviceContext),
+                                                      authzDataMutexAcquisitionTimeout);
+            if (!lk) {
                 return appendCommandStatus(
                         result,
                         Status(ErrorCodes::LockBusy, "Could not lock auth data update lock."));
             }
 
+            AuthorizationManager* authzManager = AuthorizationManager::get(serviceContext);
             Status status = auth::requireAuthSchemaVersion26Final(txn, authzManager);
             if (!status.isOK()) {
                 return appendCommandStatus(result, status);
@@ -1498,14 +1535,16 @@ namespace mongo {
                  int options,
                  string& errmsg,
                  BSONObjBuilder& result) {
-            AuthorizationManager* authzManager = getGlobalAuthorizationManager();
-            AuthzDocumentsUpdateGuard updateGuard(authzManager);
-            if (!updateGuard.tryLock("Drop role")) {
+            ServiceContext* serviceContext = txn->getClient()->getServiceContext();
+            boost::unique_lock<boost::timed_mutex> lk(getAuthzDataMutex(serviceContext),
+                                                      authzDataMutexAcquisitionTimeout);
+            if (!lk) {
                 return appendCommandStatus(
                         result,
                         Status(ErrorCodes::LockBusy, "Could not lock auth data update lock."));
             }
 
+            AuthorizationManager* authzManager = AuthorizationManager::get(serviceContext);
             Status status = auth::requireAuthSchemaVersion26Final(txn, authzManager);
             if (!status.isOK()) {
                 return appendCommandStatus(result, status);
@@ -1669,14 +1708,16 @@ namespace mongo {
                 return appendCommandStatus(result, status);
             }
 
-            AuthorizationManager* authzManager = getGlobalAuthorizationManager();
-            AuthzDocumentsUpdateGuard updateGuard(authzManager);
-            if (!updateGuard.tryLock("Drop roles from database")) {
+            ServiceContext* serviceContext = txn->getClient()->getServiceContext();
+            boost::unique_lock<boost::timed_mutex> lk(getAuthzDataMutex(serviceContext),
+                                                      authzDataMutexAcquisitionTimeout);
+            if (!lk) {
                 return appendCommandStatus(
                         result,
                         Status(ErrorCodes::LockBusy, "Could not lock auth data update lock."));
             }
 
+            AuthorizationManager* authzManager = AuthorizationManager::get(serviceContext);
             status = auth::requireAuthSchemaVersion26Final(txn, authzManager);
             if (!status.isOK()) {
                 return appendCommandStatus(result, status);
@@ -2320,14 +2361,16 @@ namespace mongo {
                                        "\"tempRolescollection\""));
             }
 
-            AuthorizationManager* authzManager = getGlobalAuthorizationManager();
-            AuthzDocumentsUpdateGuard updateGuard(authzManager);
-            if (!updateGuard.tryLock("_mergeAuthzCollections")) {
+            ServiceContext* serviceContext = txn->getClient()->getServiceContext();
+            boost::unique_lock<boost::timed_mutex> lk(getAuthzDataMutex(serviceContext),
+                                                      authzDataMutexAcquisitionTimeout);
+            if (!lk) {
                 return appendCommandStatus(
                         result,
                         Status(ErrorCodes::LockBusy, "Could not lock auth data update lock."));
             }
 
+            AuthorizationManager* authzManager = AuthorizationManager::get(serviceContext);
             status = auth::requireAuthSchemaVersion26Final(txn, authzManager);
             if (!status.isOK()) {
                 return appendCommandStatus(result, status);