mongodb/jstests/auth/authentication_restrictions.js

/**
 * This test checks that authentication restrictions can be set and respected.
 * @tags: [requires_sharding, requires_replication]
 */

(function() {
'use strict';

// TODO SERVER-35447: Multiple users cannot be authenticated on one connection within a session.
TestData.disableImplicitSessions = true;

function testConnection(
    conn, eventuallyConsistentConn, sleepUntilUserDataPropagated, sleepUntilUserDataRefreshed) {
    load("jstests/libs/host_ipaddr.js");

    // Create a session which observes an eventually consistent view of user data
    var eventualDb = eventuallyConsistentConn.getDB("admin");

    // Create a session for modifying user data during the life of the test
    var adminSession = new Mongo("localhost:" + conn.port);
    var admin = adminSession.getDB("admin");
    assert.commandWorked(admin.runCommand(
        {createUser: "admin", pwd: "admin", roles: [{role: "root", db: "admin"}]}));
    assert(admin.auth("admin", "admin"));

    // Create a strongly consistent session for consuming user data
    var db = conn.getDB("admin");

    // Create a strongly consistent session for consuming user data, with a non-localhost
    // source IP.
    var externalMongo = new Mongo(get_ipaddr() + ":" + conn.port);
    var externalDb = externalMongo.getDB("admin");

    assert.commandWorked(admin.runCommand({
        createUser: "user2",
        pwd: "user",
        roles: [],
        authenticationRestrictions: [{clientSource: ["127.0.0.1"]}]
    }));
    assert.commandWorked(admin.runCommand({createUser: "user3", pwd: "user", roles: []}));
    assert.commandWorked(admin.runCommand(
        {updateUser: "user3", authenticationRestrictions: [{serverAddress: ["127.0.0.1"]}]}));

    print("=== User creation tests");
    print(
        "When a client creates users with empty authenticationRestrictions, the operation succeeds, though it has no effect");
    assert.commandWorked(admin.runCommand(
        {createUser: "user4", pwd: "user", roles: [], authenticationRestrictions: []}));
    assert(!Object.keys(admin.system.users.findOne({user: "user4"}))
                .includes("authenticationRestrictions"));

    print(
        "When a client updates a user's authenticationRestrictions to be empty, the operation succeeds, and removes the authenticationRestrictions field");
    assert.commandWorked(admin.runCommand({createUser: "user5", pwd: "user", roles: []}));
    assert.commandWorked(admin.runCommand({updateUser: "user5", authenticationRestrictions: []}));
    assert(!Object.keys(admin.system.users.findOne({user: "user5"}))
                .includes("authenticationRestrictions"));
    assert.commandWorked(admin.runCommand(
        {updateUser: "user5", authenticationRestrictions: [{clientSource: ["127.0.0.1"]}]}));
    assert(Object.keys(admin.system.users.findOne({user: "user5"}))
               .includes("authenticationRestrictions"));
    assert.commandWorked(admin.runCommand({updateUser: "user5", authenticationRestrictions: []}));
    assert(!Object.keys(admin.system.users.findOne({user: "user5"}))
                .includes("authenticationRestrictions"));

    print(
        "When a client updates a user's authenticationRestrictions to be null or undefined, the operation fails");
    assert.commandWorked(admin.runCommand(
        {updateUser: "user5", authenticationRestrictions: [{clientSource: ["127.0.0.1"]}]}));
    assert(Object.keys(admin.system.users.findOne({user: "user5"}))
               .includes("authenticationRestrictions"));
    assert.commandFailed(admin.runCommand({updateUser: "user5", authenticationRestrictions: null}));
    assert(Object.keys(admin.system.users.findOne({user: "user5"}))
               .includes("authenticationRestrictions"));
    assert.commandFailed(
        admin.runCommand({updateUser: "user5", authenticationRestrictions: undefined}));
    assert(Object.keys(admin.system.users.findOne({user: "user5"}))
               .includes("authenticationRestrictions"));

    print(
        "When a client creates users, it may use clientSource and serverAddress authenticationRestrictions");
    assert.commandWorked(admin.runCommand({
        createUser: "user6",
        pwd: "user",
        roles: [],
        authenticationRestrictions: [{clientSource: ["127.0.0.1"]}]
    }));
    assert.commandWorked(admin.runCommand({
        createUser: "user7",
        pwd: "user",
        roles: [],
        authenticationRestrictions: [{serverAddress: ["127.0.0.1"]}]
    }));
    assert.commandWorked(admin.runCommand({
        createUser: "user8",
        pwd: "user",
        roles: [],
        authenticationRestrictions: [{clientSource: ["127.0.0.1"], serverAddress: ["127.0.0.1"]}]
    }));
    assert.commandWorked(admin.runCommand({
        createUser: "user9",
        pwd: "user",
        roles: [],
        authenticationRestrictions: [{clientSource: ["127.0.0.1"]}, {serverAddress: ["127.0.0.1"]}]
    }));
    assert.commandFailed(admin.runCommand({
        createUser: "user10",
        pwd: "user",
        roles: [],
        authenticationRestrictions: [{invalidRestriction: ["127.0.0.1"]}]
    }));

    print("=== Localhost access tests");

    print(
        "When a client on the loopback authenticates to a user with {clientSource: \"127.0.0.1\"}, it will succeed");
    assert(db.auth("user6", "user"));

    print(
        "When a client on the loopback authenticates to a user with {serverAddress: \"127.0.0.1\"}, it will succeed");
    assert(db.auth("user7", "user"));

    print(
        "When a client on the loopback authenticates to a user with {clientSource: \"127.0.0.1\", serverAddress: \"127.0.0.1\"}, it will succeed");
    assert(db.auth("user8", "user"));

    print("=== Remote access tests");
    print(
        "When a client on the external interface authenticates to a user with {clientSource: \"127.0.0.1\"}, it will fail");
    assert(!externalDb.auth("user6", "user"));

    print(
        "When a client on the external interface authenticates to a user with {serverAddress: \"127.0.0.1\"}, it will fail");
    assert(!externalDb.auth("user7", "user"));

    print(
        "When a client on the external interface authenticates to a user with {clientSource: \"127.0.0.1\", serverAddress: \"127.0.0.1\"}, it will fail");
    assert(!externalDb.auth("user8", "user"));

    print("=== Invalidation tests");
    print(
        "When a client removes all authenticationRestrictions from a user, authentication will succeed");
    assert.commandWorked(admin.runCommand({
        createUser: "user11",
        pwd: "user",
        roles: [],
        authenticationRestrictions: [{clientSource: ["127.0.0.1"], serverAddress: ["127.0.0.1"]}]
    }));
    assert(!externalDb.auth("user11", "user"));
    assert.commandWorked(admin.runCommand({updateUser: "user11", authenticationRestrictions: []}));
    assert(externalDb.auth("user11", "user"));

    print(
        "When a client sets authenticationRestrictions on a user, authorization privileges are revoked");
    assert.commandWorked(admin.runCommand(
        {createUser: "user12", pwd: "user", roles: [{role: "readWrite", db: "test"}]}));

    assert(db.auth("user12", "user"));
    assert.commandWorked(db.getSiblingDB("test").runCommand({find: "foo", batchSize: 0}));

    sleepUntilUserDataPropagated();
    assert(eventualDb.auth("user12", "user"));
    assert.commandWorked(eventualDb.getSiblingDB("test").runCommand({find: "foo", batchSize: 0}));

    assert.commandWorked(admin.runCommand(
        {updateUser: "user12", authenticationRestrictions: [{clientSource: ["192.0.2.0"]}]}));

    assert.commandFailed(db.getSiblingDB("test").runCommand({find: "foo", batchSize: 0}));

    sleepUntilUserDataRefreshed();
    assert.commandFailed(eventualDb.getSiblingDB("test").runCommand({find: "foo", batchSize: 0}));
}

print("Testing standalone");
var conn = MongoRunner.runMongod({bind_ip_all: "", auth: ""});
testConnection(conn, conn, function() {}, function() {});
MongoRunner.stopMongod(conn);

var keyfile = "jstests/libs/key1";

print("Testing replicaset");
var rst = new ReplSetTest(
    {name: 'testset', nodes: 2, nodeOptions: {bind_ip_all: "", auth: ""}, keyFile: keyfile});
var nodes = rst.startSet();
rst.initiate();
rst.awaitSecondaryNodes();
var awaitReplication = function() {
    authutil.asCluster(nodes, "jstests/libs/key1", function() {
        rst.awaitReplication();
    });
};

testConnection(rst.getPrimary(), rst.getSecondary(), awaitReplication, awaitReplication);
rst.stopSet();

print("Testing sharded cluster");
// TODO: Remove 'shardAsReplicaSet: false' when SERVER-32672 is fixed.
var st = new ShardingTest({
    mongos: 2,
    config: 3,
    shard: 1,
    keyFile: keyfile,
    other: {
        mongosOptions: {bind_ip_all: "", auth: null},
        configOptions: {auth: null},
        shardOptions: {auth: null},
        shardAsReplicaSet: false
    }
});
testConnection(st.s0,
               st.s1,
               function() {},
               function() {
                   sleep(40 * 1000);  // Wait for mongos user cache invalidation
               });
st.stop();
}());