diff options
33 files changed, 89 insertions, 90 deletions
diff --git a/buildscripts/resmokeconfig/suites/aggregation_auth.yml b/buildscripts/resmokeconfig/suites/aggregation_auth.yml index c047bce1f30..c133cd3091c 100644 --- a/buildscripts/resmokeconfig/suites/aggregation_auth.yml +++ b/buildscripts/resmokeconfig/suites/aggregation_auth.yml @@ -20,13 +20,13 @@ executor: global_vars: TestData: auth: true - authMechanism: SCRAM-SHA-1 + authMechanism: SCRAM-SHA-256 keyFile: *keyFile keyFileData: *keyFileData roleGraphInvalidationIsFatal: true eval: jsTest.authenticate(db.getMongo()) authenticationDatabase: local - authenticationMechanism: SCRAM-SHA-1 + authenticationMechanism: SCRAM-SHA-256 password: *keyFileData username: __system hooks: diff --git a/buildscripts/resmokeconfig/suites/causally_consistent_jscore_passthrough_auth.yml b/buildscripts/resmokeconfig/suites/causally_consistent_jscore_passthrough_auth.yml index da4871c5033..0ddb9baba3d 100644 --- a/buildscripts/resmokeconfig/suites/causally_consistent_jscore_passthrough_auth.yml +++ b/buildscripts/resmokeconfig/suites/causally_consistent_jscore_passthrough_auth.yml @@ -3,7 +3,7 @@ config_variables: - &keyFileData Thiskeyisonlyforrunningthesuitewithauthenticationdontuseitinanytestsdirectly - &authOptions authenticationDatabase: admin - authenticationMechanism: SCRAM-SHA-1 + authenticationMechanism: SCRAM-SHA-256 password: *keyFileData username: __system @@ -137,7 +137,7 @@ executor: global_vars: TestData: &TestData auth: true - authMechanism: SCRAM-SHA-1 + authMechanism: SCRAM-SHA-256 keyFile: *keyFile keyFileData: *keyFileData roleGraphInvalidationIsFatal: true diff --git a/buildscripts/resmokeconfig/suites/core_auth.yml b/buildscripts/resmokeconfig/suites/core_auth.yml index ea811788017..a85a88f589c 100644 --- a/buildscripts/resmokeconfig/suites/core_auth.yml +++ b/buildscripts/resmokeconfig/suites/core_auth.yml @@ -4,7 +4,7 @@ config_variables: - &keyFileData Thiskeyisonlyforrunningthesuitewithauthenticationdontuseitinanytestsdirectly - &authOptions authenticationDatabase: local - authenticationMechanism: SCRAM-SHA-1 + authenticationMechanism: SCRAM-SHA-256 password: *keyFileData username: __system @@ -33,7 +33,7 @@ executor: global_vars: TestData: &TestData auth: true - authMechanism: SCRAM-SHA-1 + authMechanism: SCRAM-SHA-256 keyFile: *keyFile keyFileData: *keyFileData roleGraphInvalidationIsFatal: true diff --git a/buildscripts/resmokeconfig/suites/failpoints_auth.yml b/buildscripts/resmokeconfig/suites/failpoints_auth.yml index e1172f7399d..15070560a2c 100644 --- a/buildscripts/resmokeconfig/suites/failpoints_auth.yml +++ b/buildscripts/resmokeconfig/suites/failpoints_auth.yml @@ -19,7 +19,7 @@ executor: global_vars: TestData: auth: true - authMechanism: SCRAM-SHA-1 + authMechanism: SCRAM-SHA-256 keyFile: *keyFile keyFileData: *keyFileData roleGraphInvalidationIsFatal: true diff --git a/buildscripts/resmokeconfig/suites/integration_tests_replset_ssl_auth.yml b/buildscripts/resmokeconfig/suites/integration_tests_replset_ssl_auth.yml index bc34cec9b7b..b6bae6b1ab4 100644 --- a/buildscripts/resmokeconfig/suites/integration_tests_replset_ssl_auth.yml +++ b/buildscripts/resmokeconfig/suites/integration_tests_replset_ssl_auth.yml @@ -12,12 +12,12 @@ config_variables: - &keyFileData Thiskeyisonlyforrunningthesuitewithauthenticationdontuseitinanytestsdirectly - &authOptions authenticationDatabase: admin - authenticationMechanism: SCRAM-SHA-1 + authenticationMechanism: SCRAM-SHA-256 password: *keyFileData username: __system - TestData: &TestData auth: true - authMechanism: SCRAM-SHA-1 + authMechanism: SCRAM-SHA-256 keyFile: *keyFile keyFileData: *keyFileData diff --git a/buildscripts/resmokeconfig/suites/multiversion_auth.yml b/buildscripts/resmokeconfig/suites/multiversion_auth.yml index 0f4152ccf60..550da7bbe28 100644 --- a/buildscripts/resmokeconfig/suites/multiversion_auth.yml +++ b/buildscripts/resmokeconfig/suites/multiversion_auth.yml @@ -38,12 +38,12 @@ executor: global_vars: TestData: auth: true - authMechanism: SCRAM-SHA-1 +# authMechanism: SCRAM-SHA-256 keyFile: *keyFile keyFileData: *keyFileData authenticationDatabase: local - authenticationMechanism: SCRAM-SHA-1 +# authenticationMechanism: SCRAM-SHA-256 password: *keyFileData username: __system nodb: '' diff --git a/buildscripts/resmokeconfig/suites/replica_sets_auth.yml b/buildscripts/resmokeconfig/suites/replica_sets_auth.yml index b643419455b..4f6556e1083 100644 --- a/buildscripts/resmokeconfig/suites/replica_sets_auth.yml +++ b/buildscripts/resmokeconfig/suites/replica_sets_auth.yml @@ -38,7 +38,7 @@ executor: global_vars: TestData: auth: true - authMechanism: SCRAM-SHA-1 + authMechanism: SCRAM-SHA-256 keyFile: *keyFile keyFileData: *keyFileData roleGraphInvalidationIsFatal: true diff --git a/buildscripts/resmokeconfig/suites/search_auth.yml b/buildscripts/resmokeconfig/suites/search_auth.yml index 61e6d26f56a..edf79042a40 100644 --- a/buildscripts/resmokeconfig/suites/search_auth.yml +++ b/buildscripts/resmokeconfig/suites/search_auth.yml @@ -14,7 +14,7 @@ executor: global_vars: TestData: auth: true - authMechanism: SCRAM-SHA-1 + authMechanism: SCRAM-SHA-256 keyFile: *keyFile keyFileData: *keyFileData roleGraphInvalidationIsFatal: true diff --git a/buildscripts/resmokeconfig/suites/search_ssl.yml b/buildscripts/resmokeconfig/suites/search_ssl.yml index ba443347dc5..0b82b75388d 100644 --- a/buildscripts/resmokeconfig/suites/search_ssl.yml +++ b/buildscripts/resmokeconfig/suites/search_ssl.yml @@ -14,7 +14,7 @@ executor: global_vars: TestData: auth: true - authMechanism: SCRAM-SHA-1 + authMechanism: SCRAM-SHA-256 keyFile: *keyFile keyFileData: *keyFileData roleGraphInvalidationIsFatal: true diff --git a/buildscripts/resmokeconfig/suites/sharding_auth.yml b/buildscripts/resmokeconfig/suites/sharding_auth.yml index a67fa56174b..963f115fe48 100644 --- a/buildscripts/resmokeconfig/suites/sharding_auth.yml +++ b/buildscripts/resmokeconfig/suites/sharding_auth.yml @@ -43,7 +43,7 @@ executor: global_vars: TestData: auth: true - authMechanism: SCRAM-SHA-1 + authMechanism: SCRAM-SHA-256 keyFile: *keyFile keyFileData: *keyFileData roleGraphInvalidationIsFatal: true diff --git a/buildscripts/resmokeconfig/suites/sharding_auth_audit.yml b/buildscripts/resmokeconfig/suites/sharding_auth_audit.yml index 2dec2287103..81f603f2953 100644 --- a/buildscripts/resmokeconfig/suites/sharding_auth_audit.yml +++ b/buildscripts/resmokeconfig/suites/sharding_auth_audit.yml @@ -44,7 +44,7 @@ executor: TestData: auditDestination: 'console' auth: true - authMechanism: SCRAM-SHA-1 + authMechanism: SCRAM-SHA-256 keyFile: *keyFile keyFileData: *keyFileData roleGraphInvalidationIsFatal: true diff --git a/buildscripts/resmokeconfig/suites/tenant_migration_causally_consistent_jscore_passthrough.yml b/buildscripts/resmokeconfig/suites/tenant_migration_causally_consistent_jscore_passthrough.yml index c639bbfaff2..d0c6eb768a5 100644 --- a/buildscripts/resmokeconfig/suites/tenant_migration_causally_consistent_jscore_passthrough.yml +++ b/buildscripts/resmokeconfig/suites/tenant_migration_causally_consistent_jscore_passthrough.yml @@ -3,7 +3,7 @@ config_variables: - &keyFileData Thiskeyisonlyforrunningthesuitewithauthenticationdontuseitinanytestsdirectly - &authOptions authenticationDatabase: admin - authenticationMechanism: SCRAM-SHA-1 + authenticationMechanism: SCRAM-SHA-256 password: *keyFileData username: __system @@ -203,7 +203,7 @@ executor: TestData: &TestData tenantId: "tenantMigrationTenantId" auth: true - authMechanism: SCRAM-SHA-1 + authMechanism: SCRAM-SHA-256 keyFile: *keyFile keyFileData: *keyFileData roleGraphInvalidationIsFatal: true diff --git a/buildscripts/resmokeconfig/suites/tenant_migration_jscore_passthrough.yml b/buildscripts/resmokeconfig/suites/tenant_migration_jscore_passthrough.yml index 42e71829bd0..ed869d0f400 100644 --- a/buildscripts/resmokeconfig/suites/tenant_migration_jscore_passthrough.yml +++ b/buildscripts/resmokeconfig/suites/tenant_migration_jscore_passthrough.yml @@ -3,7 +3,7 @@ config_variables: - &keyFileData Thiskeyisonlyforrunningthesuitewithauthenticationdontuseitinanytestsdirectly - &authOptions authenticationDatabase: admin - authenticationMechanism: SCRAM-SHA-1 + authenticationMechanism: SCRAM-SHA-256 password: *keyFileData username: __system @@ -135,7 +135,7 @@ executor: TestData: &TestData tenantId: "tenantMigrationTenantId" auth: true - authMechanism: SCRAM-SHA-1 + authMechanism: SCRAM-SHA-256 keyFile: *keyFile keyFileData: *keyFileData roleGraphInvalidationIsFatal: true diff --git a/buildscripts/resmokeconfig/suites/tenant_migration_kill_primary_jscore_passthrough.yml b/buildscripts/resmokeconfig/suites/tenant_migration_kill_primary_jscore_passthrough.yml index 7a0e7010c1d..2ff07cdc7b2 100644 --- a/buildscripts/resmokeconfig/suites/tenant_migration_kill_primary_jscore_passthrough.yml +++ b/buildscripts/resmokeconfig/suites/tenant_migration_kill_primary_jscore_passthrough.yml @@ -3,7 +3,7 @@ config_variables: - &keyFileData Thiskeyisonlyforrunningthesuitewithauthenticationdontuseitinanytestsdirectly - &authOptions authenticationDatabase: admin - authenticationMechanism: SCRAM-SHA-1 + authenticationMechanism: SCRAM-SHA-256 password: *keyFileData username: __system @@ -244,7 +244,7 @@ executor: TestData: &TestData tenantId: "tenantMigrationTenantId" auth: true - authMechanism: SCRAM-SHA-1 + authMechanism: SCRAM-SHA-256 keyFile: *keyFile keyFileData: *keyFileData roleGraphInvalidationIsFatal: true diff --git a/buildscripts/resmokeconfig/suites/tenant_migration_multi_stmt_txn_jscore_passthrough.yml b/buildscripts/resmokeconfig/suites/tenant_migration_multi_stmt_txn_jscore_passthrough.yml index 21b6fb2815b..96645aea009 100644 --- a/buildscripts/resmokeconfig/suites/tenant_migration_multi_stmt_txn_jscore_passthrough.yml +++ b/buildscripts/resmokeconfig/suites/tenant_migration_multi_stmt_txn_jscore_passthrough.yml @@ -3,7 +3,7 @@ config_variables: - &keyFileData Thiskeyisonlyforrunningthesuitewithauthenticationdontuseitinanytestsdirectly - &authOptions authenticationDatabase: admin - authenticationMechanism: SCRAM-SHA-1 + authenticationMechanism: SCRAM-SHA-256 password: *keyFileData username: __system @@ -371,7 +371,7 @@ executor: TestData: &TestData tenantId: "tenantMigrationTenantId" auth: true - authMechanism: SCRAM-SHA-1 + authMechanism: SCRAM-SHA-256 keyFile: *keyFile keyFileData: *keyFileData roleGraphInvalidationIsFatal: true diff --git a/buildscripts/resmokeconfig/suites/tenant_migration_stepdown_jscore_passthrough.yml b/buildscripts/resmokeconfig/suites/tenant_migration_stepdown_jscore_passthrough.yml index c6b1a94d9d3..0e1ccf3e1c5 100644 --- a/buildscripts/resmokeconfig/suites/tenant_migration_stepdown_jscore_passthrough.yml +++ b/buildscripts/resmokeconfig/suites/tenant_migration_stepdown_jscore_passthrough.yml @@ -3,7 +3,7 @@ config_variables: - &keyFileData Thiskeyisonlyforrunningthesuitewithauthenticationdontuseitinanytestsdirectly - &authOptions authenticationDatabase: admin - authenticationMechanism: SCRAM-SHA-1 + authenticationMechanism: SCRAM-SHA-256 password: *keyFileData username: __system @@ -234,7 +234,7 @@ executor: TestData: &TestData tenantId: "tenantMigrationTenantId" auth: true - authMechanism: SCRAM-SHA-1 + authMechanism: SCRAM-SHA-256 keyFile: *keyFile keyFileData: *keyFileData roleGraphInvalidationIsFatal: true diff --git a/buildscripts/resmokeconfig/suites/tenant_migration_terminate_primary_jscore_passthrough.yml b/buildscripts/resmokeconfig/suites/tenant_migration_terminate_primary_jscore_passthrough.yml index 778fa24479f..d7024bae704 100644 --- a/buildscripts/resmokeconfig/suites/tenant_migration_terminate_primary_jscore_passthrough.yml +++ b/buildscripts/resmokeconfig/suites/tenant_migration_terminate_primary_jscore_passthrough.yml @@ -3,7 +3,7 @@ config_variables: - &keyFileData Thiskeyisonlyforrunningthesuitewithauthenticationdontuseitinanytestsdirectly - &authOptions authenticationDatabase: admin - authenticationMechanism: SCRAM-SHA-1 + authenticationMechanism: SCRAM-SHA-256 password: *keyFileData username: __system @@ -234,7 +234,7 @@ executor: TestData: &TestData tenantId: "tenantMigrationTenantId" auth: true - authMechanism: SCRAM-SHA-1 + authMechanism: SCRAM-SHA-256 keyFile: *keyFile keyFileData: *keyFileData roleGraphInvalidationIsFatal: true diff --git a/jstests/auth/auth-counters.js b/jstests/auth/auth-counters.js index aa42042e0ef..b74fa531725 100644 --- a/jstests/auth/auth-counters.js +++ b/jstests/auth/auth-counters.js @@ -64,7 +64,7 @@ function assertFailure(creds, mech, db = test) { } function assertSuccessInternal() { - const mech = "SCRAM-SHA-1"; + const mech = "SCRAM-SHA-256"; // asCluster exiting cleanly indicates successful auth assert.eq(authutil.asCluster(replTest.nodes, keyfile, () => true), true); ++expected[mech].authenticate.received; @@ -75,8 +75,11 @@ function assertSuccessInternal() { assertSuccess({user: 'admin', pwd: 'pwd'}, 'SCRAM-SHA-256', admin); } +// Because authutil.asCluster utilizes SCRAM-SHA-256 as a default keyfile mechanism, we will attempt +// to record this authentication with an invalid keyfile, and then verify that the # of +// successful attempts made using the fallback (SCRAM-SHA-256) has NOT been incremented function assertFailureInternal() { - const mech = "SCRAM-SHA-1"; + const mech = "SCRAM-SHA-256"; // If asCluster fails, it explodes. assert.throws(authutil.asCluster, [replTest.nodes, badKeyfile, () => true]); ++expected[mech].authenticate.received; diff --git a/jstests/auth/sasl_mechanism_discovery.js b/jstests/auth/sasl_mechanism_discovery.js index c8ca845d08b..a29af39c608 100644 --- a/jstests/auth/sasl_mechanism_discovery.js +++ b/jstests/auth/sasl_mechanism_discovery.js @@ -66,8 +66,8 @@ function runTest(conn) { checkMechs("admin.\u2168", ["SCRAM-SHA-1", "SCRAM-SHA-256"]); // __system's mechanisms can be queried on local and admin if the server is in test mode - checkMechs("local.__system", ["SCRAM-SHA-1", "SCRAM-SHA-256"]); - checkMechs("admin.__system", ["SCRAM-SHA-1", "SCRAM-SHA-256"]); + checkMechs("local.__system", ["SCRAM-SHA-256"]); + checkMechs("admin.__system", ["SCRAM-SHA-256"]); } // Test standalone. diff --git a/jstests/auth/speculative-auth-replset.js b/jstests/auth/speculative-auth-replset.js index 576f567cc62..c0b8ef6c19a 100644 --- a/jstests/auth/speculative-auth-replset.js +++ b/jstests/auth/speculative-auth-replset.js @@ -47,6 +47,7 @@ rst.awaitReplication(); const admin = rst.getPrimary().getDB('admin'); admin.createUser({user: 'admin', pwd: 'pwd', roles: ['root']}); admin.auth('admin', 'pwd'); + assert.commandWorked(admin.setLogLevel(3, 'accessControl')); function getMechStats(db) { @@ -55,8 +56,13 @@ function getMechStats(db) { } // Capture statistics after a fresh instantiation of a 1-node replica set. +// initialMechStats contains stats state for the test setup (e.g. shell authentication) actions +// that will have incremented the internal counters but are not relevant to the functionality under +// test const initialMechStats = getMechStats(admin); + printjson(initialMechStats); + assert(initialMechStats['SCRAM-SHA-256'] !== undefined); // We've made no client connections for which speculation was possible, @@ -66,12 +72,6 @@ Object.keys(initialMechStats).forEach(function(mech) { const specStats = initialMechStats[mech].speculativeAuthenticate; const clusterStats = initialMechStats[mech].clusterAuthenticate; - if (mech === 'SCRAM-SHA-256') { - // It appears that replication helpers use SCRAM-SHA-1, preventing SCRAM-SHA-256 cluster - // stats from being incremented during test setup. - assert.eq(clusterStats.received, 0); - } - // No speculation has occured assert.eq(specStats.received, 0); @@ -110,10 +110,19 @@ Object.keys(initialMechStats).forEach(function(mech) { assert.gt(newMechStats["SCRAM-SHA-256"].clusterAuthenticate.successful, initialMechStats["SCRAM-SHA-256"].clusterAuthenticate.successful); + // Speculative and cluster auth counts should align with the authentication events in the server + // log const logCounts = countAuthInLog(admin); + assert.eq(logCounts.speculative, newMechStats["SCRAM-SHA-256"].speculativeAuthenticate.successful); - assert.eq(logCounts.cluster, newMechStats["SCRAM-SHA-256"].clusterAuthenticate.successful); + + // Subtract the initial mech stats for cluster authentication that were incremented + // during test setup, so we can assert on only the "real" cluster authetnication count + assert.eq(logCounts.cluster, + newMechStats["SCRAM-SHA-256"].clusterAuthenticate.successful - + initialMechStats["SCRAM-SHA-256"].clusterAuthenticate.successful); + assert.gt(logCounts.speculativeCluster, 0, "Expected to observe at least one speculative cluster authentication attempt"); diff --git a/jstests/auth/system_auth_scram_mechs.js b/jstests/auth/system_auth_scram_mechs.js index 08934385d05..e411a6dda6b 100644 --- a/jstests/auth/system_auth_scram_mechs.js +++ b/jstests/auth/system_auth_scram_mechs.js @@ -1,6 +1,5 @@ /** - * Tests that the __system user can auth using both SCRAM-SHA-1 and SCRAM-SHA-256 - * + * Tests that the __system user can auth using SCRAM-SHA-256 * @tags: [requires_replication] */ (function() { @@ -17,8 +16,9 @@ jsTestLog("Testing scram-sha-256"); assert.eq(db.auth({mechanism: 'SCRAM-SHA-256', user: '__system', pwd: keyfileContents}), 1); db.logout(); +// Test that SCRAM-SHA-1 fails explicitly jsTestLog("Testing scram-sha-1"); -assert.eq(db.auth({mechanism: 'SCRAM-SHA-1', user: '__system', pwd: keyfileContents}), 1); +assert.eq(db.auth({mechanism: 'SCRAM-SHA-1', user: '__system', pwd: keyfileContents}), 0); rs.stopSet(); })(); diff --git a/jstests/auth/system_user_exception.js b/jstests/auth/system_user_exception.js index 67814119541..78dff98a8a9 100644 --- a/jstests/auth/system_user_exception.js +++ b/jstests/auth/system_user_exception.js @@ -7,13 +7,13 @@ var m = MongoRunner.runMongod( {keyFile: "jstests/libs/key1", setParameter: "authenticationMechanisms=PLAIN"}); -// Verify that it's possible to use SCRAM-SHA-1 to authenticate as the __system@local user +// Verify that it's possible to use SCRAM-SHA-256 to authenticate as the __system@local user assert.eq(1, - m.getDB("local").auth({user: "__system", pwd: "foopdedoop", mechanism: "SCRAM-SHA-1"})); + m.getDB("local").auth({user: "__system", pwd: "foopdedoop", mechanism: "SCRAM-SHA-256"})); // Verify that it is not possible to authenticate other users m.getDB("test").runCommand({createUser: "guest", pwd: "guest", roles: jsTest.readOnlyUserRoles}); -assert.eq(0, m.getDB("test").auth({user: "guest", pwd: "guest", mechanism: "SCRAM-SHA-1"})); +assert.eq(0, m.getDB("test").auth({user: "guest", pwd: "guest", mechanism: "SCRAM-SHA-256"})); MongoRunner.stopMongod(m); })(); diff --git a/jstests/ssl/set_parameter_ssl.js b/jstests/ssl/set_parameter_ssl.js index ce4143d0996..dd8990fdf64 100644 --- a/jstests/ssl/set_parameter_ssl.js +++ b/jstests/ssl/set_parameter_ssl.js @@ -69,7 +69,7 @@ function testAuthModeTransition(oldMode, newMode, sslMode, shouldSucceed) { let authAsKeyFileCluster = function() { const authParams = { user: '__system', - mechanism: 'SCRAM-SHA-1', + mechanism: 'SCRAM-SHA-256', pwd: cat(keyFile).replace(/[\011-\015\040]/g, '') }; diff --git a/src/mongo/client/authenticate.cpp b/src/mongo/client/authenticate.cpp index a1b3fd5a649..2c26e03953e 100644 --- a/src/mongo/client/authenticate.cpp +++ b/src/mongo/client/authenticate.cpp @@ -277,14 +277,11 @@ Future<void> authenticateInternalClient( }); } -BSONObj buildAuthParams(StringData dbname, - StringData username, - StringData passwordText, - bool digestPassword) { - return BSON(saslCommandMechanismFieldName - << "SCRAM-SHA-1" << saslCommandUserDBFieldName << dbname << saslCommandUserFieldName - << username << saslCommandPasswordFieldName << passwordText - << saslCommandDigestPasswordFieldName << digestPassword); +BSONObj buildAuthParams(StringData dbname, StringData username, StringData passwordText) { + + return BSON(saslCommandMechanismFieldName << "SCRAM-SHA-256" << saslCommandUserDBFieldName + << dbname << saslCommandUserFieldName << username + << saslCommandPasswordFieldName << passwordText); } StringData getSaslCommandUserDBFieldName() { diff --git a/src/mongo/client/authenticate.h b/src/mongo/client/authenticate.h index b5b4876c573..613fcef768e 100644 --- a/src/mongo/client/authenticate.h +++ b/src/mongo/client/authenticate.h @@ -160,12 +160,8 @@ Future<void> authenticateInternalClient( * @dbname: The database target of the auth command. * @username: The std::string name of the user to authenticate. * @passwordText: The std::string representing the user's password. - * @digestPassword: Set to true if the password is undigested. */ -BSONObj buildAuthParams(StringData dbname, - StringData username, - StringData passwordText, - bool digestPassword); +BSONObj buildAuthParams(StringData dbname, StringData username, StringData passwordText); /** * Run an isMaster exchange to negotiate a SASL mechanism for authentication. diff --git a/src/mongo/client/dbclient_base.cpp b/src/mongo/client/dbclient_base.cpp index 69bb443908b..c4b38ddb3e3 100644 --- a/src/mongo/client/dbclient_base.cpp +++ b/src/mongo/client/dbclient_base.cpp @@ -416,11 +416,9 @@ void DBClientBase::auth(const BSONObj& params) { bool DBClientBase::auth(const string& dbname, const string& username, const string& password_text, - string& errmsg, - bool digestPassword) { + string& errmsg) { try { - const auto authParams = - auth::buildAuthParams(dbname, username, password_text, digestPassword); + const auto authParams = auth::buildAuthParams(dbname, username, password_text); auth(authParams); return true; } catch (const AssertionException& ex) { diff --git a/src/mongo/client/dbclient_base.h b/src/mongo/client/dbclient_base.h index d34bffd34ed..28dda9ada30 100644 --- a/src/mongo/client/dbclient_base.h +++ b/src/mongo/client/dbclient_base.h @@ -277,12 +277,10 @@ public: * of the credential information for the user. May be "$external" if * credential information is stored outside of the mongo cluster. Mandatory. * 'pwd': The password data. - * 'digestPassword': Boolean, set to true if the "pwd" is undigested (default). * 'serviceName': The GSSAPI service name to use. Defaults to "mongodb". * 'serviceHostname': The GSSAPI hostname to use. Defaults to the name of the remote host. * * Other fields in 'params' are silently ignored. - * * Returns normally on success, and throws on error. Throws a DBException with getCode() == * ErrorCodes::AuthenticationFailed if authentication is rejected. All other exceptions are * tantamount to authentication failure, but may also indicate more serious problems. @@ -296,16 +294,12 @@ public: * number of databases on a single connection. The "admin" database is special and once * authenticated provides access to all databases on the server. * - * 'digestPassword': If password is plain text, set this to true. otherwise assumed to be - * pre-digested. - * * Returns true if successful. */ bool auth(const std::string& dbname, const std::string& username, const std::string& pwd, - std::string& errmsg, - bool digestPassword = true); + std::string& errmsg); /** * Logs out the connection for the given database. diff --git a/src/mongo/db/auth/sasl_mechanism_policies.h b/src/mongo/db/auth/sasl_mechanism_policies.h index 4e5e6d23382..abd3d4d4036 100644 --- a/src/mongo/db/auth/sasl_mechanism_policies.h +++ b/src/mongo/db/auth/sasl_mechanism_policies.h @@ -78,7 +78,7 @@ struct SCRAMSHA1Policy { return 2; } static constexpr bool isInternalAuthMech() { - return true; + return false; } }; diff --git a/src/mongo/db/auth/security_key.cpp b/src/mongo/db/auth/security_key.cpp index 2554dd7565e..838e8c6ce02 100644 --- a/src/mongo/db/auth/security_key.cpp +++ b/src/mongo/db/auth/security_key.cpp @@ -39,7 +39,6 @@ #include "mongo/base/status_with.h" #include "mongo/client/internal_auth.h" #include "mongo/crypto/mechanism_scram.h" -#include "mongo/crypto/sha1_block.h" #include "mongo/crypto/sha256_block.h" #include "mongo/db/auth/authorization_manager.h" #include "mongo/db/auth/sasl_options.h" @@ -58,8 +57,7 @@ constexpr size_t kMaxKeyLength = 1024; class CredentialsGenerator { public: explicit CredentialsGenerator(StringData filename) - : _salt1(scram::Presecrets<SHA1Block>::generateSecureRandomSalt()), - _salt256(scram::Presecrets<SHA256Block>::generateSecureRandomSalt()), + : _salt256(scram::Presecrets<SHA256Block>::generateSecureRandomSalt()), _filename(filename) {} boost::optional<User::CredentialData> generate(const std::string& password) { @@ -87,11 +85,6 @@ public: (*internalSecurity.getUser())->getName().getUser(), password); User::CredentialData credentials; - if (!_copyCredentials( - credentials.scram_sha1, - scram::Secrets<SHA1Block>::generateCredentials( - _salt1, passwordDigest, saslGlobalParams.scramSHA1IterationCount.load()))) - return boost::none; if (!_copyCredentials(credentials.scram_sha256, scram::Secrets<SHA256Block>::generateCredentials( @@ -120,7 +113,6 @@ private: return true; } - const std::vector<uint8_t> _salt1; const std::vector<uint8_t> _salt256; const StringData _filename; }; diff --git a/src/mongo/db/stats/counters.cpp b/src/mongo/db/stats/counters.cpp index d1a0640315a..9bc37932381 100644 --- a/src/mongo/db/stats/counters.cpp +++ b/src/mongo/db/stats/counters.cpp @@ -226,11 +226,9 @@ void AuthCounter::initializeMechanismMap(const std::vector<std::string>& mechani // Ensure it's always included in counts. addMechanism(auth::kMechanismMongoX509.toString()); - // SERVER-46399 Use only configured SASL mechanisms for intra-cluster auth. - // It's possible for intracluster auth to use a default fallback mechanism of SCRAM-SHA-1/256 + // It's possible for intracluster auth to use a default fallback mechanism of SCRAM-SHA-256 // even if it's not configured to do so. - // Explicitly add these to the map for now so that they can be incremented if this happens. - addMechanism(auth::kMechanismScramSha1.toString()); + // Explicitly add this to the map for now so that they can be incremented if this happens. addMechanism(auth::kMechanismScramSha256.toString()); } diff --git a/src/mongo/shell/db.js b/src/mongo/shell/db.js index b0318cfef7f..f0ceba8e5d2 100644 --- a/src/mongo/shell/db.js +++ b/src/mongo/shell/db.js @@ -5,6 +5,7 @@ var DB; (function() { var _defaultWriteConcern = {w: 'majority', wtimeout: 10 * 60 * 1000}; +const kWireVersionSupportingScramSha256Fallback = 15; if (DB === undefined) { DB = function(mongo, name) { @@ -1403,10 +1404,17 @@ DB.prototype.__pwHash = function(nonce, username, pass) { DB.prototype._defaultAuthenticationMechanism = null; +function _fallbackToScramSha256(helloResult) { + return helloResult && isNumber(helloResult.maxWireVersion) && + helloResult.maxWireVersion >= kWireVersionSupportingScramSha256Fallback; +} + DB.prototype._getDefaultAuthenticationMechanism = function(username, database) { + let result = null; if (username !== undefined) { const userid = database + "." + username; - const result = this._helloOrLegacyHello({saslSupportedMechs: userid}); + result = this._helloOrLegacyHello({saslSupportedMechs: userid}); + if (result.ok && (result.saslSupportedMechs !== undefined)) { const mechs = result.saslSupportedMechs; if (!Array.isArray(mechs)) { @@ -1428,14 +1436,18 @@ DB.prototype._getDefaultAuthenticationMechanism = function(username, database) { } // If isMaster doesn't support saslSupportedMechs, // or if we couldn't agree on a mechanism, - // then fallthrough to configured default or SCRAM-SHA-1. + // then fall through to a default mech, either + // configured or implicit based on the wire version } // Use the default auth mechanism if set on the command line. - if (this._defaultAuthenticationMechanism != null) + if (this._defaultAuthenticationMechanism != null) { return this._defaultAuthenticationMechanism; + } - return "SCRAM-SHA-1"; + // for later wire versions, we prefer (or require) SCRAM-SHA-256 + // if a fallback is required + return _fallbackToScramSha256(result) ? "SCRAM-SHA-256" : "SCRAM-SHA-1"; }; DB.prototype._defaultGssapiServiceName = null; diff --git a/src/mongo/shell/servers.js b/src/mongo/shell/servers.js index 7712e9dd30f..b40131a6425 100644 --- a/src/mongo/shell/servers.js +++ b/src/mongo/shell/servers.js @@ -1290,7 +1290,7 @@ function appendSetParameterArgs(argArray) { } } - if (jsTest.options().authMechanism && jsTest.options().authMechanism != "SCRAM-SHA-1") { + if (jsTest.options().authMechanism && jsTest.options().authMechanism != "SCRAM-SHA-256") { if (!argArrayContainsSetParameterValue('authenticationMechanisms=')) { argArray.push(...['--setParameter', "authenticationMechanisms=" + jsTest.options().authMechanism]); diff --git a/src/mongo/shell/utils_auth.js b/src/mongo/shell/utils_auth.js index 9ad340e950b..e913e0453ed 100644 --- a/src/mongo/shell/utils_auth.js +++ b/src/mongo/shell/utils_auth.js @@ -114,7 +114,7 @@ authutil.asCluster = function(conn, keyfile, action) { authutil.assertAuthenticate(conn, 'admin', { user: '__system', - mechanism: 'SCRAM-SHA-1', + mechanism: 'SCRAM-SHA-256', pwd: cat(keyfile).replace(/[\011-\015\040]/g, '') }); } else if (authMode === 'x509' || authMode === 'sendX509') { |