[DRIVERS-103] Manipulate user objects exclusively via commands Created: 30/Jul/13  Updated: 27/May/22  Resolved: 11/Nov/15

Status: Closed
Project: Drivers
Component/s: None
Fix Version/s: None

Type: New Feature Priority: Major - P3
Reporter: Barrie Segal Assignee: Barrie Segal
Resolution: Done Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Issue Links:
Depends
depends on SERVER-10794 For compatibility with old versions o... Closed
depends on CSHARP-793 Manipulate user objects exclusively v... Closed
depends on JAVA-909 Update user manipulation helpers to u... Closed
depends on CDRIVER-232 Manipulate user objects exclusively v... Closed
depends on NODE-61 Manipulate user objects exclusively v... Closed
depends on PYTHON-552 Manipulate user objects exclusively v... Closed
depends on RUBY-667 Manipulate user objects exclusively v... Closed
depends on SERVER-6246 Manipulate user objects exclusively v... Closed
depends on SERVER-10721 Add an error code for "no such cmd: <... Closed
depends on SERVER-10855 Add a way to specify in createUser an... Closed
depends on SERVER-7727 Provide at least two extra free forma... Closed
Gantt Dependency
has to be done before DOCS-2445 Provide sample LDAP, MongoDB user/rol... Closed
Related
related to CDRIVER-326 add update_user helper to mongoc_data... Closed
is related to DRIVERS-149 Some MongoDB 2.6 driver releases may ... Closed
is related to PHPLIB-4 Create PHP library to provide helpers... Closed
Server Compat: 2.5
Driver Compliance:
Key Status/Resolution FixVersion
JAVA-909 Done 2.12.0, 3.0.0
PERL-254 Won't Fix 0.704.0.0
RUBY-667 Done 1.10.0
NODE-61 Done
CSHARP-793 Done 1.9
CDRIVER-232 Done
PYTHON-552 Done 2.7

 Description   

All CRUD on system.users is being replaced and enhanced with commands.

Note that these commands will all take a write concern as an extra field.

The point of this ticket is to ensure that a given driver's addUser / removeUser helpers work in a backward and forward compatible way. To do this your driver has to determine wether it has to use the new user manipulation commands or fall back to its existing code. Pseudo code looks something like this:

try
    userInfo = db.runCommand({'usersInfo': username})
catch error
    if error code == 59 or error code == Null
        <fallback to existing code for backward compatibility>
    else
        re-raise error
 
if userInfo["users"]
    <use new updateUser command>
else
    <use new createUser command>

Notes:

  1. By default the server will salt and hash the password sent in createUser and updateUser, assuming the password was passed to it in plaintext. This can be controlled using the "digestPassword" option. By default drivers should salt and hash the password client side, passing the password digest to the server instead of the plaintext password. You must pass {digestPassword: false}

    to the server when hashing the password client side.

  2. All drivers with an addUser helper must continue to support the 2 and 3 parameter versions of that method. See NOTE below for more details.
  3. Delegated authentication is gone in 2.5.x so any tests you have that make use of userSource should be skipped in >= 2.5.3.
  4. All users must have roles in 2.5.x. To get the equivalent of a legacy super user for testing you want at least ['readWriteAnyDatabase', 'userAdminAnyDatabase', 'dbAdminAnyDatabase', 'clusterAdmin']
  5. To remove all users from a database in 2.5.x use the command {"dropAllUsersFromDatabase": 1}

NOTE - Although createUser requires a "roles" field the addUser helper must continue to support the legacy 2 and 3 parameter forms, i.e.:

db.addUser('username', 'password')
# Read Only User
db.addUser('username', 'password', true)

Drivers will follow the shell implementation specified in SERVER-10794. This requires some new built-in roles, specified in that ticket. Drivers should also warn when these forms are used, as specified in the server ticket.



 Comments   
Comment by Andrew Morrow (Inactive) [ 03/Mar/15 ]

Validating for C+11 because validated for C; C+11 does not currently offer user helpers, but if we ever did, we would call into C driver, so we would be in compliance.

Generated at Thu Feb 08 08:20:46 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.