Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-77907

Create tests for OIDC managed identity machine flows in Azure

    • Type: Icon: Task Task
    • Resolution: Fixed
    • Priority: Icon: Major - P3 Major - P3
    • 7.2.0-rc0
    • Affects Version/s: None
    • Component/s: None
    • None
    • Server Security
    • Fully Compatible
    • Security 2023-06-26, Security 2023-07-10, Security 2023-07-24, Security 2023-08-07, Security 2023-08-21, Security 2023-09-04, Security 2023-09-18, Security 2023-10-02, Security 2023-10-16, Security 2023-10-30
    • 167

      This ticket will create simple integration test for an Azure Managed Identity VM, where the OIDC access and refresh token are obtained via a local machine metadata URI (see https://wiki.corp.mongodb.com/display/~adam.rayner/Azure+POC+Notes#AzurePOCNotes-ServiceAccounts/ManagedIdentities/MachineFlows)

      To achieve this, we will need to do some orchestration of Azure VMs from our evergreen instances running in AWS. A starting point for what this kind of thing looks like is the AWS IAM external auth jstests (https://github.com/10gen/mongo-enterprise-modules/tree/master/jstests/external_auth_aws): these use the AWS python API to construct a temporary container instance in AWS Fargate, deploy test code to this, run the tests on the remote container instance while getting access to a local machine-specific token, and then clean up this newly-created infrastructure.

      We will want to essentially port this approach to Azure (and then GCP).

            Assignee:
            adam.rayner@mongodb.com Adam Rayner
            Reporter:
            adam.rayner@mongodb.com Adam Rayner
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated:
              Resolved: