Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-78466

SessionsCollectionRS::_makePrimaryConnection() can reauthenticate as __system

    • Type: Icon: Task Task
    • Resolution: Unresolved
    • Priority: Icon: Major - P3 Major - P3
    • None
    • Affects Version/s: None
    • Component/s: None
    • Cluster Scalability
    • Security 2023-07-24, Security 2023-08-07
    • 2

      The SessionsCollectionRS class is responsible for accessing the config.sessions collection on replica sets. The _makePrimaryConnection() method is used to retrieve a connection to the primary node before performing some kind of operation on the sessions collection. 

      Today, the implementation of this method retrieves a ScopedDbCollection, which comes from the internal connection pool, and then authenticates as the __system user on the connection before performing the requisite operation. After the operation is completed, the connection is returned to the pool.

      As a result, it is possible that the connection from the pool has already been authenticated as _system. Ever since SERVER-56267, the auth subsystem now logs a warning whenever a client reauthenticates as the same user already authenticated on the connection. This can result in unnecessary log spam, so this method should strive to only authenticate as _system once.

            Assignee:
            backlog-server-cluster-scalability [DO NOT USE] Backlog - Cluster Scalability
            Reporter:
            varun.ravichandran@mongodb.com Varun Ravichandran
            Votes:
            3 Vote for this issue
            Watchers:
            9 Start watching this issue

              Created:
              Updated: