1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
|
/**
* Copyright (C) 2012 10gen Inc.
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License, version 3,
* as published by the Free Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "mongo/db/auth/authz_manager_external_state_s.h"
#include <string>
#include "mongo/client/dbclientinterface.h"
#include "mongo/db/auth/user_name.h"
#include "mongo/db/jsobj.h"
#include "mongo/s/type_database.h"
#include "mongo/s/grid.h"
#include "mongo/util/assert_util.h"
#include "mongo/util/mongoutils/str.h"
namespace mongo {
AuthzManagerExternalStateMongos::AuthzManagerExternalStateMongos() {}
AuthzManagerExternalStateMongos::~AuthzManagerExternalStateMongos() {}
namespace {
ScopedDbConnection* getConnectionForUsersCollection(const std::string& ns) {
//
// Note: The connection mechanism here is *not* ideal, and should not be used elsewhere.
// If the primary for the collection moves, this approach may throw rather than handle
// version exceptions.
//
DBConfigPtr config = grid.getDBConfig(ns);
Shard s = config->getShard(ns);
return new ScopedDbConnection(s.getConnString(), 30.0);
}
}
bool AuthzManagerExternalStateMongos::_findUser(const string& usersNamespace,
const BSONObj& query,
BSONObj* result) const {
scoped_ptr<ScopedDbConnection> conn(getConnectionForUsersCollection(usersNamespace));
*result = conn->get()->findOne(usersNamespace, query).getOwned();
conn->done();
return !result->isEmpty();
}
Status AuthzManagerExternalStateMongos::insertPrivilegeDocument(const string& dbname,
const BSONObj& userObj) const {
string userNS = dbname + ".system.users";
scoped_ptr<ScopedDbConnection> conn(getConnectionForUsersCollection(userNS));
conn->get()->insert(userNS, userObj);
// 30 second timeout for w:majority
BSONObj res = conn->get()->getLastErrorDetailed(false, false, -1, 30*1000);
string errstr = conn->get()->getLastErrorString(res);
conn->done();
if (errstr.empty()) {
return Status::OK();
}
if (res.hasField("code") && res["code"].Int() == ASSERT_ID_DUPKEY) {
return Status(ErrorCodes::DuplicateKey,
mongoutils::str::stream() << "User \"" << userObj["user"].String() <<
"\" already exists on database \"" << dbname << "\"");
}
return Status(ErrorCodes::UserModificationFailed, errstr);
}
Status AuthzManagerExternalStateMongos::updatePrivilegeDocument(
const UserName& user, const BSONObj& updateObj) const {
string userNS = mongoutils::str::stream() << user.getDB() << ".system.users";
scoped_ptr<ScopedDbConnection> conn(getConnectionForUsersCollection(userNS));
conn->get()->update(userNS,
QUERY("user" << user.getUser() << "userSource" << BSONNULL),
updateObj);
// 30 second timeout for w:majority
BSONObj res = conn->get()->getLastErrorDetailed(false, false, -1, 30*1000);
string err = conn->get()->getLastErrorString(res);
conn->done();
if (!err.empty()) {
return Status(ErrorCodes::UserModificationFailed, err);
}
int numUpdated = res["n"].numberInt();
dassert(numUpdated <= 1 && numUpdated >= 0);
if (numUpdated == 0) {
return Status(ErrorCodes::UserNotFound,
mongoutils::str::stream() << "User " << user.getFullName() <<
" not found");
}
return Status::OK();
}
Status AuthzManagerExternalStateMongos::getAllDatabaseNames(
std::vector<std::string>* dbnames) const {
std::vector<BSONObj> dbDocs;
scoped_ptr<ScopedDbConnection> conn(getConnectionForUsersCollection("config.databases"));
conn->get()->findN(dbDocs, DatabaseType::ConfigNS, Query(), 0);
conn->done();
for (std::vector<BSONObj>::const_iterator it = dbDocs.begin();
it != dbDocs.end(); ++it) {
DatabaseType dbInfo;
std::string errmsg;
if (!dbInfo.parseBSON( *it, &errmsg) || !dbInfo.isValid( &errmsg )) {
return Status(ErrorCodes::FailedToParse, errmsg);
}
dbnames->push_back(dbInfo.getName());
}
dbnames->push_back("config"); // config db isn't listed in config.databases
return Status::OK();
}
std::vector<BSONObj> AuthzManagerExternalStateMongos::getAllV1PrivilegeDocsForDB(
const std::string& dbname) const {
std::vector<BSONObj> userDocs;
std::string usersNamespace = dbname + ".system.users";
scoped_ptr<ScopedDbConnection> conn(getConnectionForUsersCollection(usersNamespace));
conn->get()->findN(userDocs, usersNamespace, Query(), 0);
conn->done();
return userDocs;
}
} // namespace mongo
|
