1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
|
/**
* Copyright (C) 2018 10gen Inc.
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License, version 3,
* as published by the Free Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*
* As a special exception, the copyright holders give permission to link the
* code of portions of this program with the OpenSSL library under certain
* conditions as described in each individual source file and distribute
* linked combinations including the program with the OpenSSL library. You
* must comply with the GNU Affero General Public License in all respects for
* all of the code used other than as permitted herein. If you modify file(s)
* with this exception, you may extend this exception to your version of the
* file(s), but you are not obligated to do so. If you do not wish to do so,
* delete this exception statement from your version. If you delete this
* exception statement from all source files in the program, then also delete
* it in the license file.
*/
#define MONGO_LOG_DEFAULT_COMPONENT ::mongo::logger::LogComponent::kAccessControl
#include "mongo/platform/basic.h"
#include "mongo/db/auth/authorization_session_impl.h"
#include <string>
#include <vector>
#include "mongo/base/status.h"
#include "mongo/db/auth/action_set.h"
#include "mongo/db/auth/action_type.h"
#include "mongo/db/auth/authorization_manager.h"
#include "mongo/db/auth/authz_session_external_state.h"
#include "mongo/db/auth/privilege.h"
#include "mongo/db/auth/restriction_environment.h"
#include "mongo/db/auth/security_key.h"
#include "mongo/db/auth/user_management_commands_parser.h"
#include "mongo/db/bson/dotted_path_support.h"
#include "mongo/db/catalog/document_validation.h"
#include "mongo/db/client.h"
#include "mongo/db/jsobj.h"
#include "mongo/db/namespace_string.h"
#include "mongo/db/pipeline/aggregation_request.h"
#include "mongo/db/pipeline/lite_parsed_pipeline.h"
#include "mongo/util/assert_util.h"
#include "mongo/util/log.h"
#include "mongo/util/mongoutils/str.h"
namespace mongo {
namespace dps = ::mongo::dotted_path_support;
using std::vector;
MONGO_REGISTER_SHIM(AuthorizationSession::create)
(AuthorizationManager* authzManager)->std::unique_ptr<AuthorizationSession> {
return std::make_unique<AuthorizationSessionImpl>(
AuthzSessionExternalState::create(authzManager),
AuthorizationSessionImpl::InstallMockForTestingOrAuthImpl{});
}
namespace {
constexpr StringData ADMIN_DBNAME = "admin"_sd;
// Checks if this connection has the privileges necessary to create or modify the view 'viewNs'
// to be a view on 'viewOnNs' with pipeline 'viewPipeline'. Call this function after verifying
// that the user has the 'createCollection' or 'collMod' action, respectively.
Status checkAuthForCreateOrModifyView(AuthorizationSession* authzSession,
const NamespaceString& viewNs,
const NamespaceString& viewOnNs,
const BSONArray& viewPipeline,
bool isMongos) {
// It's safe to allow a user to create or modify a view if they can't read it anyway.
if (!authzSession->isAuthorizedForActionsOnNamespace(viewNs, ActionType::find)) {
return Status::OK();
}
// This check performs some validation but it is not exhaustive and may allow for an invalid
// pipeline specification. In this case the authorization check will succeed but the pipeline
// will fail to parse later in Command::run().
return authzSession->checkAuthForAggregate(
viewOnNs,
BSON("aggregate" << viewOnNs.coll() << "pipeline" << viewPipeline << "cursor" << BSONObj()),
isMongos);
}
} // namespace
AuthorizationSessionImpl::AuthorizationSessionImpl(
std::unique_ptr<AuthzSessionExternalState> externalState, InstallMockForTestingOrAuthImpl)
: _externalState(std::move(externalState)), _impersonationFlag(false) {}
AuthorizationSessionImpl::~AuthorizationSessionImpl() {}
AuthorizationManager& AuthorizationSessionImpl::getAuthorizationManager() {
return _externalState->getAuthorizationManager();
}
void AuthorizationSessionImpl::startRequest(OperationContext* opCtx) {
_externalState->startRequest(opCtx);
_refreshUserInfoAsNeeded(opCtx);
}
Status AuthorizationSessionImpl::addAndAuthorizeUser(OperationContext* opCtx,
const UserName& userName) {
AuthorizationManager* authzManager = AuthorizationManager::get(opCtx->getServiceContext());
auto swUser = authzManager->acquireUser(opCtx, userName);
if (!swUser.isOK()) {
return swUser.getStatus();
}
auto user = std::move(swUser.getValue());
const auto& restrictionSet = user->getRestrictions();
if (opCtx->getClient() == nullptr) {
return Status(ErrorCodes::AuthenticationFailed,
"Unable to evaluate restrictions, OperationContext has no Client");
}
Status restrictionStatus =
restrictionSet.validate(RestrictionEnvironment::get(*opCtx->getClient()));
if (!restrictionStatus.isOK()) {
log() << "Failed to acquire user '" << userName
<< "' because of unmet authentication restrictions: " << restrictionStatus.reason();
return AuthorizationManager::authenticationFailedStatus;
}
_authenticatedUsers.add(std::move(user));
// If there are any users and roles in the impersonation data, clear it out.
clearImpersonatedUserData();
_buildAuthenticatedRolesVector();
return Status::OK();
}
User* AuthorizationSessionImpl::lookupUser(const UserName& name) {
return _authenticatedUsers.lookup(name).get();
}
User* AuthorizationSessionImpl::getSingleUser() {
UserName userName;
auto userNameItr = getAuthenticatedUserNames();
if (userNameItr.more()) {
userName = userNameItr.next();
if (userNameItr.more()) {
uasserted(ErrorCodes::Unauthorized, "too many users are authenticated");
}
} else {
uasserted(ErrorCodes::Unauthorized, "there are no users authenticated");
}
return lookupUser(userName);
}
void AuthorizationSessionImpl::logoutDatabase(StringData dbname) {
_authenticatedUsers.removeByDBName(dbname);
clearImpersonatedUserData();
_buildAuthenticatedRolesVector();
}
UserNameIterator AuthorizationSessionImpl::getAuthenticatedUserNames() {
return _authenticatedUsers.getNames();
}
RoleNameIterator AuthorizationSessionImpl::getAuthenticatedRoleNames() {
return makeRoleNameIterator(_authenticatedRoleNames.begin(), _authenticatedRoleNames.end());
}
std::string AuthorizationSessionImpl::getAuthenticatedUserNamesToken() {
std::string ret;
for (UserNameIterator nameIter = getAuthenticatedUserNames(); nameIter.more();
nameIter.next()) {
ret += '\0'; // Using a NUL byte which isn't valid in usernames to separate them.
ret += nameIter->getFullName();
}
return ret;
}
void AuthorizationSessionImpl::grantInternalAuthorization() {
_authenticatedUsers.add(internalSecurity.user);
_buildAuthenticatedRolesVector();
}
PrivilegeVector AuthorizationSessionImpl::getDefaultPrivileges() {
PrivilegeVector defaultPrivileges;
// If localhost exception is active (and no users exist),
// return a vector of the minimum privileges required to bootstrap
// a system and add the first user.
if (_externalState->shouldAllowLocalhost()) {
ResourcePattern adminDBResource = ResourcePattern::forDatabaseName(ADMIN_DBNAME);
ActionSet setupAdminUserActionSet;
setupAdminUserActionSet.addAction(ActionType::createUser);
setupAdminUserActionSet.addAction(ActionType::grantRole);
Privilege setupAdminUserPrivilege = Privilege(adminDBResource, setupAdminUserActionSet);
ResourcePattern externalDBResource = ResourcePattern::forDatabaseName("$external");
Privilege setupExternalUserPrivilege =
Privilege(externalDBResource, ActionType::createUser);
ActionSet setupServerConfigActionSet;
// If this server is an arbiter, add specific privileges meant to circumvent
// the behavior of an arbiter in an authenticated replset. See SERVER-5479.
if (_externalState->serverIsArbiter()) {
setupServerConfigActionSet.addAction(ActionType::getCmdLineOpts);
setupServerConfigActionSet.addAction(ActionType::getParameter);
setupServerConfigActionSet.addAction(ActionType::serverStatus);
setupServerConfigActionSet.addAction(ActionType::shutdown);
}
setupServerConfigActionSet.addAction(ActionType::addShard);
setupServerConfigActionSet.addAction(ActionType::replSetConfigure);
setupServerConfigActionSet.addAction(ActionType::replSetGetStatus);
Privilege setupServerConfigPrivilege =
Privilege(ResourcePattern::forClusterResource(), setupServerConfigActionSet);
Privilege::addPrivilegeToPrivilegeVector(&defaultPrivileges, setupAdminUserPrivilege);
Privilege::addPrivilegeToPrivilegeVector(&defaultPrivileges, setupExternalUserPrivilege);
Privilege::addPrivilegeToPrivilegeVector(&defaultPrivileges, setupServerConfigPrivilege);
return defaultPrivileges;
}
return defaultPrivileges;
}
Status AuthorizationSessionImpl::checkAuthForAggregate(const NamespaceString& nss,
const BSONObj& cmdObj,
bool isMongos) {
if (!nss.isValid()) {
return Status(ErrorCodes::InvalidNamespace,
mongoutils::str::stream() << "Invalid input namespace, " << nss.ns());
}
// If this connection does not need to be authenticated (for instance, if auth is disabled),
// return Status::OK() immediately.
if (_externalState->shouldIgnoreAuthChecks()) {
return Status::OK();
}
// We require at least one authenticated user when running aggregate with auth enabled.
if (!isAuthenticated()) {
return Status(ErrorCodes::Unauthorized, "unauthorized");
}
auto statusWithAggRequest = AggregationRequest::parseFromBSON(nss, cmdObj);
if (!statusWithAggRequest.isOK()) {
return statusWithAggRequest.getStatus();
}
AggregationRequest aggRequest = std::move(statusWithAggRequest.getValue());
const auto& pipeline = aggRequest.getPipeline();
// If the aggregation pipeline is empty, confirm the user is authorized for find on 'nss'.
if (pipeline.empty()) {
if (!isAuthorizedForPrivilege(
Privilege(ResourcePattern::forExactNamespace(nss), ActionType::find))) {
return Status(ErrorCodes::Unauthorized, "unauthorized");
}
return Status::OK();
}
// Confirm the user is authorized for the pipeline's initial document source. We confirm a user
// is authorized incrementally rather than once for the entire pipeline. This will prevent a
// malicious user, who doesn't have access to the initial document source, from consuming the
// resources needed to parse a potentially large pipeline.
auto liteParsedFirstDocumentSource = LiteParsedDocumentSource::parse(aggRequest, pipeline[0]);
if (!liteParsedFirstDocumentSource->isInitialSource() &&
!isAuthorizedForPrivilege(
Privilege(ResourcePattern::forExactNamespace(nss), ActionType::find))) {
return Status(ErrorCodes::Unauthorized, "unauthorized");
}
// We have done the work to lite parse the first stage. Given that, we check required privileges
// for it using 'liteParsedFirstDocumentSource' regardless of whether is an initial source or
// not.
if (!isAuthorizedForPrivileges(liteParsedFirstDocumentSource->requiredPrivileges(isMongos))) {
return Status(ErrorCodes::Unauthorized, "unauthorized");
}
// Confirm privileges for the remainder of the pipepline. Start with the second stage as we have
// already authorized the first.
auto pipelineIter = pipeline.begin() + 1;
for (; pipelineIter != pipeline.end(); ++pipelineIter) {
auto liteParsedDocSource = LiteParsedDocumentSource::parse(aggRequest, *pipelineIter);
if (!isAuthorizedForPrivileges(liteParsedDocSource->requiredPrivileges(isMongos))) {
return Status(ErrorCodes::Unauthorized, "unauthorized");
}
}
return Status::OK();
}
Status AuthorizationSessionImpl::checkAuthForFind(const NamespaceString& ns, bool hasTerm) {
if (MONGO_unlikely(ns.isCommand())) {
return Status(ErrorCodes::InternalError,
str::stream() << "Checking query auth on command namespace " << ns.ns());
}
if (!isAuthorizedForActionsOnNamespace(ns, ActionType::find)) {
return Status(ErrorCodes::Unauthorized,
str::stream() << "not authorized for query on " << ns.ns());
}
// Only internal clients (such as other nodes in a replica set) are allowed to use
// the 'term' field in a find operation. Use of this field could trigger changes
// in the receiving server's replication state and should be protected.
if (hasTerm &&
!isAuthorizedForActionsOnResource(ResourcePattern::forClusterResource(),
ActionType::internal)) {
return Status(ErrorCodes::Unauthorized,
str::stream() << "not authorized for query with term on " << ns.ns());
}
return Status::OK();
}
Status AuthorizationSessionImpl::checkAuthForGetMore(const NamespaceString& ns,
long long cursorID,
bool hasTerm) {
// Since users can only getMore their own cursors, we verify that a user either is authenticated
// or does not need to be.
if (!_externalState->shouldIgnoreAuthChecks() && !isAuthenticated()) {
return Status(ErrorCodes::Unauthorized,
str::stream() << "not authorized for getMore on " << ns.db());
}
// Only internal clients (such as other nodes in a replica set) are allowed to use
// the 'term' field in a getMore operation. Use of this field could trigger changes
// in the receiving server's replication state and should be protected.
if (hasTerm &&
!isAuthorizedForActionsOnResource(ResourcePattern::forClusterResource(),
ActionType::internal)) {
return Status(ErrorCodes::Unauthorized,
str::stream() << "not authorized for getMore with term on " << ns.ns());
}
return Status::OK();
}
Status AuthorizationSessionImpl::checkAuthForInsert(OperationContext* opCtx,
const NamespaceString& ns,
const BSONObj& document) {
if (ns.coll() == "system.indexes"_sd) {
BSONElement nsElement = document["ns"];
if (nsElement.type() != String) {
return Status(nsElement.type() == BSONType::EOO ? ErrorCodes::NoSuchKey
: ErrorCodes::TypeMismatch,
"Cannot authorize inserting into "
"system.indexes documents without a string-typed \"ns\" field.");
}
NamespaceString indexNS(nsElement.valueStringData());
if (!isAuthorizedForActionsOnNamespace(indexNS, ActionType::createIndex)) {
return Status(ErrorCodes::Unauthorized,
str::stream() << "not authorized to create index on " << indexNS.ns());
}
} else {
ActionSet required{ActionType::insert};
if (documentValidationDisabled(opCtx)) {
required.addAction(ActionType::bypassDocumentValidation);
}
if (!isAuthorizedForActionsOnNamespace(ns, required)) {
return Status(ErrorCodes::Unauthorized,
str::stream() << "not authorized for insert on " << ns.ns());
}
}
return Status::OK();
}
Status AuthorizationSessionImpl::checkAuthForUpdate(OperationContext* opCtx,
const NamespaceString& ns,
const BSONObj& query,
const BSONObj& update,
bool upsert) {
ActionSet required{ActionType::update};
StringData operationType = "update"_sd;
if (upsert) {
required.addAction(ActionType::insert);
operationType = "upsert"_sd;
}
if (documentValidationDisabled(opCtx)) {
required.addAction(ActionType::bypassDocumentValidation);
}
if (!isAuthorizedForActionsOnNamespace(ns, required)) {
return Status(ErrorCodes::Unauthorized,
str::stream() << "not authorized for " << operationType << " on " << ns.ns());
}
return Status::OK();
}
Status AuthorizationSessionImpl::checkAuthForDelete(OperationContext* opCtx,
const NamespaceString& ns,
const BSONObj& query) {
if (!isAuthorizedForActionsOnNamespace(ns, ActionType::remove)) {
return Status(ErrorCodes::Unauthorized,
str::stream() << "not authorized to remove from " << ns.ns());
}
return Status::OK();
}
Status AuthorizationSessionImpl::checkAuthForKillCursors(const NamespaceString& ns,
UserNameIterator cursorOwner) {
if (isAuthorizedForActionsOnResource(ResourcePattern::forClusterResource(),
ActionType::killAnyCursor)) {
return Status::OK();
}
if (ns.isListCollectionsCursorNS()) {
// listCollections: Target the database being enumerated.
if (isAuthorizedForActionsOnResource(ResourcePattern::forDatabaseName(ns.db()),
ActionType::killAnyCursor)) {
return Status::OK();
}
const bool canKill =
isAuthorizedForActionsOnResource(ResourcePattern::forDatabaseName(ns.db()),
ActionType::killCursors) ||
isAuthorizedToListCollections(ns.db(), BSONObj());
if (canKill && isCoauthorizedWith(cursorOwner)) {
return Status::OK();
}
return Status(ErrorCodes::Unauthorized,
str::stream() << "not authorized to kill listCollections cursor on "
<< ns.ns());
} else if (ns.isListIndexesCursorNS()) {
// listIndexes: Target the underlying collection.
NamespaceString targetNS = ns.getTargetNSForListIndexes();
if (isAuthorizedForActionsOnNamespace(targetNS, ActionType::killAnyCursor)) {
return Status::OK();
}
const bool canKill = isAuthorizedForActionsOnNamespace(targetNS, ActionType::killCursors) ||
isAuthorizedForActionsOnNamespace(targetNS, ActionType::listIndexes);
if (canKill && isCoauthorizedWith(cursorOwner)) {
return Status::OK();
}
return Status(ErrorCodes::Unauthorized,
str::stream() << "not authorized to kill listIndexes cursor on " << ns.ns());
} else {
// Otherwise: Target the collection as named.
if (isAuthorizedForActionsOnNamespace(ns, ActionType::killAnyCursor)) {
return Status::OK();
}
const bool canKill = isAuthorizedForActionsOnNamespace(ns, ActionType::killCursors) ||
isAuthorizedForActionsOnNamespace(ns, ActionType::find);
if (canKill && isCoauthorizedWith(cursorOwner)) {
return Status::OK();
}
return Status(ErrorCodes::Unauthorized,
str::stream() << "not authorized to kill cursor on " << ns.ns());
}
}
Status AuthorizationSessionImpl::checkAuthForCreate(const NamespaceString& ns,
const BSONObj& cmdObj,
bool isMongos) {
if (cmdObj["capped"].trueValue() &&
!isAuthorizedForActionsOnNamespace(ns, ActionType::convertToCapped)) {
return Status(ErrorCodes::Unauthorized, "unauthorized");
}
const bool hasCreateCollectionAction =
isAuthorizedForActionsOnNamespace(ns, ActionType::createCollection);
// If attempting to create a view, check for additional required privileges.
if (cmdObj["viewOn"]) {
// You need the createCollection action on this namespace; the insert action is not
// sufficient.
if (!hasCreateCollectionAction) {
return Status(ErrorCodes::Unauthorized, "unauthorized");
}
// Parse the viewOn namespace and the pipeline. If no pipeline was specified, use the empty
// pipeline.
NamespaceString viewOnNs(ns.db(), cmdObj["viewOn"].checkAndGetStringData());
auto pipeline =
cmdObj.hasField("pipeline") ? BSONArray(cmdObj["pipeline"].Obj()) : BSONArray();
return checkAuthForCreateOrModifyView(this, ns, viewOnNs, pipeline, isMongos);
}
// To create a regular collection, ActionType::createCollection or ActionType::insert are
// both acceptable.
if (hasCreateCollectionAction || isAuthorizedForActionsOnNamespace(ns, ActionType::insert)) {
return Status::OK();
}
return Status(ErrorCodes::Unauthorized, "unauthorized");
}
Status AuthorizationSessionImpl::checkAuthForCollMod(const NamespaceString& ns,
const BSONObj& cmdObj,
bool isMongos) {
if (!isAuthorizedForActionsOnNamespace(ns, ActionType::collMod)) {
return Status(ErrorCodes::Unauthorized, "unauthorized");
}
// Check for additional required privileges if attempting to modify a view. When auth is
// enabled, users must specify both "viewOn" and "pipeline" together. This prevents a user from
// exposing more information in the original underlying namespace by only changing "pipeline",
// or looking up more information via the original pipeline by only changing "viewOn".
const bool hasViewOn = cmdObj.hasField("viewOn");
const bool hasPipeline = cmdObj.hasField("pipeline");
if (hasViewOn != hasPipeline) {
return Status(
ErrorCodes::InvalidOptions,
"Must specify both 'viewOn' and 'pipeline' when modifying a view and auth is enabled");
}
if (hasViewOn) {
NamespaceString viewOnNs(ns.db(), cmdObj["viewOn"].checkAndGetStringData());
auto viewPipeline = BSONArray(cmdObj["pipeline"].Obj());
return checkAuthForCreateOrModifyView(this, ns, viewOnNs, viewPipeline, isMongos);
}
return Status::OK();
}
Status AuthorizationSessionImpl::checkAuthorizedToGrantPrivilege(const Privilege& privilege) {
const ResourcePattern& resource = privilege.getResourcePattern();
if (resource.isDatabasePattern() || resource.isExactNamespacePattern()) {
if (!isAuthorizedForActionsOnResource(
ResourcePattern::forDatabaseName(resource.databaseToMatch()),
ActionType::grantRole)) {
return Status(ErrorCodes::Unauthorized,
str::stream() << "Not authorized to grant privileges on the "
<< resource.databaseToMatch()
<< "database");
}
} else if (!isAuthorizedForActionsOnResource(ResourcePattern::forDatabaseName("admin"),
ActionType::grantRole)) {
return Status(ErrorCodes::Unauthorized,
"To grant privileges affecting multiple databases or the cluster,"
" must be authorized to grant roles from the admin database");
}
return Status::OK();
}
Status AuthorizationSessionImpl::checkAuthorizedToRevokePrivilege(const Privilege& privilege) {
const ResourcePattern& resource = privilege.getResourcePattern();
if (resource.isDatabasePattern() || resource.isExactNamespacePattern()) {
if (!isAuthorizedForActionsOnResource(
ResourcePattern::forDatabaseName(resource.databaseToMatch()),
ActionType::revokeRole)) {
return Status(ErrorCodes::Unauthorized,
str::stream() << "Not authorized to revoke privileges on the "
<< resource.databaseToMatch()
<< "database");
}
} else if (!isAuthorizedForActionsOnResource(ResourcePattern::forDatabaseName("admin"),
ActionType::revokeRole)) {
return Status(ErrorCodes::Unauthorized,
"To revoke privileges affecting multiple databases or the cluster,"
" must be authorized to revoke roles from the admin database");
}
return Status::OK();
}
bool AuthorizationSessionImpl::isAuthorizedToParseNamespaceElement(const BSONElement& element) {
const bool isUUID = element.type() == BinData && element.binDataType() == BinDataType::newUUID;
uassert(ErrorCodes::InvalidNamespace,
"Failed to parse namespace element",
element.type() == String || isUUID);
if (isUUID) {
return isAuthorizedForActionsOnResource(ResourcePattern::forClusterResource(),
ActionType::useUUID);
}
return true;
}
bool AuthorizationSessionImpl::isAuthorizedToCreateRole(
const struct auth::CreateOrUpdateRoleArgs& args) {
// A user is allowed to create a role under either of two conditions.
// The user may create a role if the authorization system says they are allowed to.
if (isAuthorizedForActionsOnResource(ResourcePattern::forDatabaseName(args.roleName.getDB()),
ActionType::createRole)) {
return true;
}
// The user may create a role if the localhost exception is enabled, and they already own the
// role. This implies they have obtained the role through an external authorization mechanism.
if (_externalState->shouldAllowLocalhost()) {
for (const auto& user : _authenticatedUsers) {
if (user->hasRole(args.roleName)) {
return true;
}
}
log() << "Not authorized to create the first role in the system '" << args.roleName
<< "' using the localhost exception. The user needs to acquire the role through "
"external authentication first.";
}
return false;
}
bool AuthorizationSessionImpl::isAuthorizedToGrantRole(const RoleName& role) {
return isAuthorizedForActionsOnResource(ResourcePattern::forDatabaseName(role.getDB()),
ActionType::grantRole);
}
bool AuthorizationSessionImpl::isAuthorizedToRevokeRole(const RoleName& role) {
return isAuthorizedForActionsOnResource(ResourcePattern::forDatabaseName(role.getDB()),
ActionType::revokeRole);
}
bool AuthorizationSessionImpl::isAuthorizedForPrivilege(const Privilege& privilege) {
if (_externalState->shouldIgnoreAuthChecks())
return true;
return _isAuthorizedForPrivilege(privilege);
}
bool AuthorizationSessionImpl::isAuthorizedForPrivileges(const vector<Privilege>& privileges) {
if (_externalState->shouldIgnoreAuthChecks())
return true;
for (size_t i = 0; i < privileges.size(); ++i) {
if (!_isAuthorizedForPrivilege(privileges[i]))
return false;
}
return true;
}
bool AuthorizationSessionImpl::isAuthorizedForActionsOnResource(const ResourcePattern& resource,
ActionType action) {
return isAuthorizedForPrivilege(Privilege(resource, action));
}
bool AuthorizationSessionImpl::isAuthorizedForActionsOnResource(const ResourcePattern& resource,
const ActionSet& actions) {
return isAuthorizedForPrivilege(Privilege(resource, actions));
}
bool AuthorizationSessionImpl::isAuthorizedForActionsOnNamespace(const NamespaceString& ns,
ActionType action) {
return isAuthorizedForPrivilege(Privilege(ResourcePattern::forExactNamespace(ns), action));
}
bool AuthorizationSessionImpl::isAuthorizedForActionsOnNamespace(const NamespaceString& ns,
const ActionSet& actions) {
return isAuthorizedForPrivilege(Privilege(ResourcePattern::forExactNamespace(ns), actions));
}
static const int resourceSearchListCapacity = 5;
/**
* Builds from "target" an exhaustive list of all ResourcePatterns that match "target".
*
* Stores the resulting list into resourceSearchList, and returns the length.
*
* The seach lists are as follows, depending on the type of "target":
*
* target is ResourcePattern::forAnyResource():
* searchList = { ResourcePattern::forAnyResource(), ResourcePattern::forAnyResource() }
* target is the ResourcePattern::forClusterResource():
* searchList = { ResourcePattern::forAnyResource(), ResourcePattern::forClusterResource() }
* target is a database, db:
* searchList = { ResourcePattern::forAnyResource(),
* ResourcePattern::forAnyNormalResource(),
* db }
* target is a non-system collection, db.coll:
* searchList = { ResourcePattern::forAnyResource(),
* ResourcePattern::forAnyNormalResource(),
* db,
* coll,
* db.coll }
* target is a system collection, db.system.coll:
* searchList = { ResourcePattern::forAnyResource(),
* system.coll,
* db.system.coll }
*/
static int buildResourceSearchList(const ResourcePattern& target,
ResourcePattern resourceSearchList[resourceSearchListCapacity]) {
int size = 0;
resourceSearchList[size++] = ResourcePattern::forAnyResource();
if (target.isExactNamespacePattern()) {
if (!target.ns().isSystem()) {
// Some databases should not be matchable with ResourcePattern::forAnyNormalResource.
// 'local' and 'config' are used to store special system collections, which user level
// administrators should not be able to manipulate.
if (target.ns().db() != "local" && target.ns().db() != "config") {
resourceSearchList[size++] = ResourcePattern::forAnyNormalResource();
}
resourceSearchList[size++] = ResourcePattern::forDatabaseName(target.ns().db());
}
resourceSearchList[size++] = ResourcePattern::forCollectionName(target.ns().coll());
} else if (target.isDatabasePattern()) {
resourceSearchList[size++] = ResourcePattern::forAnyNormalResource();
}
resourceSearchList[size++] = target;
dassert(size <= resourceSearchListCapacity);
return size;
}
bool AuthorizationSessionImpl::isAuthorizedToChangeAsUser(const UserName& userName,
ActionType actionType) {
User* user = lookupUser(userName);
if (!user) {
return false;
}
ResourcePattern resourceSearchList[resourceSearchListCapacity];
const int resourceSearchListLength = buildResourceSearchList(
ResourcePattern::forDatabaseName(userName.getDB()), resourceSearchList);
ActionSet actions;
for (int i = 0; i < resourceSearchListLength; ++i) {
actions.addAllActionsFromSet(user->getActionsForResource(resourceSearchList[i]));
}
return actions.contains(actionType);
}
bool AuthorizationSessionImpl::isAuthorizedToChangeOwnPasswordAsUser(const UserName& userName) {
return AuthorizationSessionImpl::isAuthorizedToChangeAsUser(userName,
ActionType::changeOwnPassword);
}
bool AuthorizationSessionImpl::isAuthorizedToChangeOwnCustomDataAsUser(const UserName& userName) {
return AuthorizationSessionImpl::isAuthorizedToChangeAsUser(userName,
ActionType::changeOwnCustomData);
}
bool AuthorizationSessionImpl::isAuthorizedToListCollections(StringData dbname,
const BSONObj& cmdObj) {
if (cmdObj["authorizedCollections"].trueValue() && cmdObj["nameOnly"].trueValue() &&
AuthorizationSessionImpl::isAuthorizedForAnyActionOnAnyResourceInDB(dbname)) {
return true;
}
// Check for the listCollections ActionType on the database or find on system.namespaces for
// pre 3.0 systems.
return AuthorizationSessionImpl::isAuthorizedForActionsOnResource(
ResourcePattern::forDatabaseName(dbname), ActionType::listCollections) ||
AuthorizationSessionImpl::isAuthorizedForActionsOnResource(
ResourcePattern::forExactNamespace(NamespaceString(dbname, "system.namespaces")),
ActionType::find);
}
bool AuthorizationSessionImpl::isAuthenticatedAsUserWithRole(const RoleName& roleName) {
for (UserSet::iterator it = _authenticatedUsers.begin(); it != _authenticatedUsers.end();
++it) {
if ((*it)->hasRole(roleName)) {
return true;
}
}
return false;
}
bool AuthorizationSessionImpl::isAuthenticated() {
return _authenticatedUsers.begin() != _authenticatedUsers.end();
}
void AuthorizationSessionImpl::_refreshUserInfoAsNeeded(OperationContext* opCtx) {
AuthorizationManager& authMan = getAuthorizationManager();
UserSet::iterator it = _authenticatedUsers.begin();
while (it != _authenticatedUsers.end()) {
auto& user = *it;
if (!user->isValid()) {
// The user is invalid, so make sure that we erase it from _authenticateUsers at the
// end of this block.
auto removeGuard = MakeGuard([&] { _authenticatedUsers.removeAt(it++); });
// Make a good faith effort to acquire an up-to-date user object, since the one
// we've cached is marked "out-of-date."
UserName name = user->getName();
UserHandle updatedUser;
auto swUser = authMan.acquireUser(opCtx, name);
auto& status = swUser.getStatus();
switch (status.code()) {
case ErrorCodes::OK: {
updatedUser = std::move(swUser.getValue());
try {
const auto& restrictionSet =
updatedUser->getRestrictions(); // Owned by updatedUser
invariant(opCtx->getClient());
Status restrictionStatus = restrictionSet.validate(
RestrictionEnvironment::get(*opCtx->getClient()));
if (!restrictionStatus.isOK()) {
log() << "Removed user " << name
<< " with unmet authentication restrictions from session cache of"
<< " user information. Restriction failed because: "
<< restrictionStatus.reason();
// If we remove from the UserSet, we cannot increment the iterator.
continue;
}
} catch (...) {
log() << "Evaluating authentication restrictions for " << name
<< " resulted in an unknown exception. Removing user from the"
<< " session cache.";
continue;
}
// Success! Replace the old User object with the updated one.
removeGuard.Dismiss();
_authenticatedUsers.replaceAt(it, std::move(updatedUser));
LOG(1) << "Updated session cache of user information for " << name;
break;
}
case ErrorCodes::UserNotFound: {
// User does not exist anymore; remove it from _authenticatedUsers.
log() << "Removed deleted user " << name
<< " from session cache of user information.";
continue; // No need to advance "it" in this case.
}
case ErrorCodes::UnsupportedFormat: {
// An auth subsystem has explicitly indicated a failure.
log() << "Removed user " << name
<< " from session cache of user information because of refresh failure:"
<< " '" << status << "'.";
continue; // No need to advance "it" in this case.
}
default:
// Unrecognized error; assume that it's transient, and continue working with the
// out-of-date privilege data.
warning() << "Could not fetch updated user privilege information for " << name
<< "; continuing to use old information. Reason is "
<< redact(status);
removeGuard.Dismiss();
break;
}
}
++it;
}
_buildAuthenticatedRolesVector();
}
void AuthorizationSessionImpl::_buildAuthenticatedRolesVector() {
_authenticatedRoleNames.clear();
for (UserSet::iterator it = _authenticatedUsers.begin(); it != _authenticatedUsers.end();
++it) {
RoleNameIterator roles = (*it)->getIndirectRoles();
while (roles.more()) {
RoleName roleName = roles.next();
_authenticatedRoleNames.push_back(RoleName(roleName.getRole(), roleName.getDB()));
}
}
}
bool AuthorizationSessionImpl::isAuthorizedForAnyActionOnAnyResourceInDB(StringData db) {
if (_externalState->shouldIgnoreAuthChecks()) {
return true;
}
for (const auto& user : _authenticatedUsers) {
// First lookup any Privileges on this database specifying Database resources
if (user->hasActionsForResource(ResourcePattern::forDatabaseName(db))) {
return true;
}
// Any resource will match any collection in the database
if (user->hasActionsForResource(ResourcePattern::forAnyResource())) {
return true;
}
// If the user is authorized for anyNormalResource, then they implicitly have access
// to most databases.
if (db != "local" && db != "config" &&
user->hasActionsForResource(ResourcePattern::forAnyNormalResource())) {
return true;
}
// We've checked all the resource types that can be directly expressed. Now we must
// iterate all privileges, until we see something that could reside in the target database.
User::ResourcePrivilegeMap map = user->getPrivileges();
for (const auto& privilege : map) {
// If the user has a Collection privilege, then they're authorized for this resource
// on all databases.
if (privilege.first.isCollectionPattern()) {
return true;
}
// If the user has an exact namespace privilege on a collection in this database, they
// have access to a resource in this database.
if (privilege.first.isExactNamespacePattern() &&
privilege.first.databaseToMatch() == db) {
return true;
}
}
}
return false;
}
bool AuthorizationSessionImpl::isAuthorizedForAnyActionOnResource(const ResourcePattern& resource) {
if (_externalState->shouldIgnoreAuthChecks()) {
return true;
}
std::array<ResourcePattern, resourceSearchListCapacity> resourceSearchList;
const int resourceSearchListLength =
buildResourceSearchList(resource, resourceSearchList.data());
for (int i = 0; i < resourceSearchListLength; ++i) {
for (const auto& user : _authenticatedUsers) {
if (user->hasActionsForResource(resourceSearchList[i])) {
return true;
}
}
}
return false;
}
bool AuthorizationSessionImpl::_isAuthorizedForPrivilege(const Privilege& privilege) {
const ResourcePattern& target(privilege.getResourcePattern());
ResourcePattern resourceSearchList[resourceSearchListCapacity];
const int resourceSearchListLength = buildResourceSearchList(target, resourceSearchList);
ActionSet unmetRequirements = privilege.getActions();
PrivilegeVector defaultPrivileges = getDefaultPrivileges();
for (PrivilegeVector::iterator it = defaultPrivileges.begin(); it != defaultPrivileges.end();
++it) {
for (int i = 0; i < resourceSearchListLength; ++i) {
if (!(it->getResourcePattern() == resourceSearchList[i]))
continue;
ActionSet userActions = it->getActions();
unmetRequirements.removeAllActionsFromSet(userActions);
if (unmetRequirements.empty())
return true;
}
}
for (const auto& user : _authenticatedUsers) {
for (int i = 0; i < resourceSearchListLength; ++i) {
ActionSet userActions = user->getActionsForResource(resourceSearchList[i]);
unmetRequirements.removeAllActionsFromSet(userActions);
if (unmetRequirements.empty()) {
return true;
}
}
}
return false;
}
void AuthorizationSessionImpl::setImpersonatedUserData(std::vector<UserName> usernames,
std::vector<RoleName> roles) {
_impersonatedUserNames = usernames;
_impersonatedRoleNames = roles;
_impersonationFlag = true;
}
bool AuthorizationSessionImpl::isCoauthorizedWithClient(Client* opClient) {
auto getUserNames = [](AuthorizationSession* authSession) {
if (authSession->isImpersonating()) {
return authSession->getImpersonatedUserNames();
} else {
return authSession->getAuthenticatedUserNames();
}
};
UserNameIterator it = getUserNames(this);
while (it.more()) {
UserNameIterator opIt = getUserNames(AuthorizationSession::get(opClient));
while (opIt.more()) {
if (it.get() == opIt.get()) {
return true;
}
opIt.next();
}
it.next();
}
return false;
}
bool AuthorizationSessionImpl::isCoauthorizedWith(UserNameIterator userNameIter) {
if (!getAuthorizationManager().isAuthEnabled()) {
return true;
}
if (!userNameIter.more() && !isAuthenticated()) {
return true;
}
for (; userNameIter.more(); userNameIter.next()) {
for (UserNameIterator thisUserNameIter = getAuthenticatedUserNames();
thisUserNameIter.more();
thisUserNameIter.next()) {
if (*userNameIter == *thisUserNameIter) {
return true;
}
}
}
return false;
}
UserNameIterator AuthorizationSessionImpl::getImpersonatedUserNames() {
return makeUserNameIterator(_impersonatedUserNames.begin(), _impersonatedUserNames.end());
}
RoleNameIterator AuthorizationSessionImpl::getImpersonatedRoleNames() {
return makeRoleNameIterator(_impersonatedRoleNames.begin(), _impersonatedRoleNames.end());
}
bool AuthorizationSessionImpl::isUsingLocalhostBypass() {
return getAuthorizationManager().isAuthEnabled() && _externalState->shouldAllowLocalhost();
}
// Clear the vectors of impersonated usernames and roles.
void AuthorizationSessionImpl::clearImpersonatedUserData() {
_impersonatedUserNames.clear();
_impersonatedRoleNames.clear();
_impersonationFlag = false;
}
bool AuthorizationSessionImpl::isImpersonating() const {
return _impersonationFlag;
}
auto AuthorizationSessionImpl::checkCursorSessionPrivilege(
OperationContext* const opCtx, const boost::optional<LogicalSessionId> cursorSessionId)
-> Status {
auto nobodyIsLoggedIn = [authSession = this] {
return !authSession->isAuthenticated();
};
auto authHasImpersonatePrivilege = [authSession = this] {
return authSession->isAuthorizedForPrivilege(
Privilege(ResourcePattern::forClusterResource(), ActionType::impersonate));
};
auto authIsOn = [authSession = this] {
return authSession->getAuthorizationManager().isAuthEnabled();
};
auto sessionIdToStringOrNone =
[](const boost::optional<LogicalSessionId>& sessionId) -> std::string {
if (sessionId) {
return str::stream() << *sessionId;
}
return "none";
};
// If the cursor has a session then one of the following must be true:
// 1: context session id must match cursor session id.
// 2: user must be magic special (__system, or background task, etc).
// We do not check the user's ID against the cursor's notion of a user ID, since higher level
// auth checks will check that for us anyhow.
if (authIsOn() && // If the authorization is not on, then we permit anybody to do anything.
cursorSessionId != opCtx->getLogicalSessionId() && // If the cursor's session doesn't match
// the Operation Context's session, then
// we should forbid the operation even
// when the cursor has no session.
!nobodyIsLoggedIn() && // Unless, for some reason a user isn't actually using this
// Operation Context (which implies a background job
!authHasImpersonatePrivilege() // Or if the user has an impersonation privilege, in which
// case, the user gets to sidestep certain checks.
) {
return Status{ErrorCodes::Unauthorized,
str::stream() << "Cursor session id ("
<< sessionIdToStringOrNone(cursorSessionId)
<< ") is not the same as the operation context's session id ("
<< sessionIdToStringOrNone(opCtx->getLogicalSessionId())
<< ")"};
}
return Status::OK();
}
} // namespace mongo
|