Skip to content

Commit 61c6690

Browse files
smortexsmortex
authored
Merge pull request voxpupuli#643 from poloz-lab/scram_sha_256_limited_support
2 parents 45d9bf4 + 18e6c8a commit 61c6690

File tree

8 files changed

+90
-21
lines changed

8 files changed

+90
-21
lines changed

‎.fixtures.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
fixtures:
22
repositories:
3-
"stdlib": "git://github.com/puppetlabs/puppetlabs-stdlib.git"
4-
"apt": "git://github.com/puppetlabs/puppetlabs-apt.git"
3+
"stdlib": "https://github.com/puppetlabs/puppetlabs-stdlib.git"
4+
"apt": "https://github.com/puppetlabs/puppetlabs-apt.git"
55
"systemd": "https://github.com/voxpupuli/puppet-systemd.git"
66
"zypprepo": "https://github.com/voxpupuli/puppet-zypprepo.git"
77
yumrepo_core:

‎README.md

+21
Original file line numberDiff line numberDiff line change
@@ -561,6 +561,16 @@ Administrator user name
561561
##### `admin_password`
562562
Administrator user password
563563

564+
##### `admin_auth_mechanism`
565+
Administrator authentication mechanism.
566+
scram_sha_256 password synchronization verification is not supported.
567+
Default: 'scram_sha_1'
568+
569+
##### `admin_update_password`
570+
Update password.
571+
Used with SCRAM-SHA-256 because password verification is not supported.
572+
Default: false
573+
564574
##### `admin_roles`
565575
Administrator user roles
566576

@@ -648,6 +658,17 @@ For more information please refer to [MongoDB Authentication Process](http://doc
648658
##### `password`
649659
Plain-text user password (will be hashed)
650660

661+
##### `auth_mechanism`
662+
Authentication mechanism.
663+
Can be either 'scram_sha_1' or 'scram_sha_256'.
664+
scram_sha_256 password synchronization verification is not supported.
665+
Default: 'scram_sha_1'
666+
667+
##### `update_password`
668+
Update password.
669+
Used with SCRAM-SHA-256 because password verification is not supported.
670+
Default: false
671+
651672
##### `roles`
652673
Array with user roles as string.
653674
Roles will be granted to user's database if no alternative database is explicitly defined.

‎lib/puppet/provider/mongodb_user/mongodb.rb

+16-4
Original file line numberDiff line numberDiff line change
@@ -53,17 +53,25 @@ def create
5353

5454
command = {
5555
createUser: @resource[:username],
56-
pwd: password_hash,
5756
customData: {
5857
createdBy: "Puppet Mongodb_user['#{@resource[:name]}']"
5958
},
6059
roles: role_hashes(@resource[:roles], @resource[:database]),
61-
digestPassword: false
6260
}
6361

6462
if mongo_4? || mongo_5?
65-
# SCRAM-SHA-256 requires digestPassword to be true.
66-
command[:mechanisms] = ['SCRAM-SHA-1']
63+
if @resource[:auth_mechanism] == :scram_sha_256
64+
command[:mechanisms] = ['SCRAM-SHA-256']
65+
command[:pwd] = @resource[:password]
66+
command[:digestPassword] = true
67+
else
68+
command[:mechanisms] = ['SCRAM-SHA-1']
69+
command[:pwd] = password_hash
70+
command[:digestPassword] = false
71+
end
72+
else
73+
command[:pwd] = password_hash
74+
command[:digestPassword] = false
6775
end
6876

6977
mongo_eval("db.runCommand(#{command.to_json})", @resource[:database])
@@ -112,6 +120,10 @@ def password=(value)
112120
digestPassword: true
113121
}
114122

123+
if mongo_4? || mongo_5?
124+
command[:mechanisms] = @resource[:auth_mechanism] == :scram_sha_256 ? ['SCRAM-SHA-256'] : ['SCRAM-SHA-1']
125+
end
126+
115127
mongo_eval("db.runCommand(#{command.to_json})", @resource[:database])
116128
end
117129
end

‎lib/puppet/type/mongodb_user.rb

+16-1
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ def to_s?(value)
5353
end
5454

5555
newproperty(:password_hash) do
56-
desc 'The password hash of the user. Use mongodb_password() for creating hash. Only available on MongoDB 3.0 and later.'
56+
desc 'The password hash of the user. Use mongodb_password() for creating hash. Only available on MongoDB 3.0 and later. SCRAM-SHA-256 authentication mechanism is not supported.'
5757
defaultto do
5858
if @resource[:password].nil?
5959
raise Puppet::Error, "Property 'password_hash' must be set. Use mongodb_password() for creating hash." if provider.database == :absent
@@ -90,10 +90,23 @@ def to_s?(_value = @is)
9090
end
9191

9292
def insync?(_is)
93+
return !@resource[:update_password] if @resource[:auth_mechanism] == :scram_sha_256
94+
9395
should_to_s == to_s?
9496
end
9597
end
9698

99+
newparam(:auth_mechanism) do
100+
desc 'Authentication mechanism. Password verification is not supported with SCRAM-SHA-256.'
101+
defaultto :scram_sha_1
102+
newvalues(:scram_sha_256, :scram_sha_1)
103+
end
104+
105+
newparam(:update_password, boolean: true) do
106+
desc 'Update password. Used with SCRAM-SHA-256 because password verification is not supported.'
107+
defaultto false
108+
end
109+
97110
newproperty(:scram_credentials) do
98111
desc 'The SCRAM-SHA-1 credentials of a user. These are read only and change when password or password_hash changes.'
99112
end
@@ -115,6 +128,8 @@ def insync?(_is)
115128
err("Either 'password_hash' or 'password' should be provided")
116129
elsif !self[:password_hash].nil? && !self[:password].nil?
117130
err("Only one of 'password_hash' or 'password' should be provided")
131+
elsif !self[:password_hash].nil? && self[:auth_mechanism] == :scram_sha_256
132+
err("'password_hash' is not supported with SCRAM-SHA-256 authentication mechanism")
118133
end
119134
if should(:scram_credentials)
120135
raise("The parameter 'scram_credentials' is read-only and cannot be changed")

‎manifests/db.pp

+26-10
Original file line numberDiff line numberDiff line change
@@ -5,19 +5,23 @@
55
# == Parameters
66
#
77
# user - Database username.
8+
# auth_mechanism - Authentication mechanism. scram_sha_256 password verification is not supported. Defaults to 'scram_sha_1'.
89
# db_name - Database name. Defaults to $name.
910
# password_hash - Hashed password. Hex encoded md5 hash of "$username:mongo:$password".
1011
# password - Plain text user password. This is UNSAFE, use 'password_hash' instead.
1112
# roles (default: ['dbAdmin']) - array with user roles.
1213
# tries (default: 10) - The maximum amount of two second tries to wait MongoDB startup.
14+
# update_password (default: false) - Force an update of the password when scram_sha_256 is used.
1315
#
1416
define mongodb::db (
1517
String $user,
16-
String $db_name = $name,
17-
Optional[Variant[String[1], Sensitive[String[1]]]] $password_hash = undef,
18-
Optional[Variant[String[1], Sensitive[String[1]]]] $password = undef,
19-
Array[String] $roles = ['dbAdmin'],
20-
Integer[0] $tries = 10,
18+
Enum['scram_sha_1', 'scram_sha_256'] $auth_mechanism = 'scram_sha_1',
19+
String $db_name = $name,
20+
Optional[Variant[String[1], Sensitive[String[1]]]] $password_hash = undef,
21+
Optional[Variant[String[1], Sensitive[String[1]]]] $password = undef,
22+
Array[String] $roles = ['dbAdmin'],
23+
Integer[0] $tries = 10,
24+
Boolean $update_password = false,
2125
) {
2226
unless $facts['mongodb_is_master'] == 'false' { # lint:ignore:quoted_booleans
2327
mongodb_database { $db_name:
@@ -35,12 +39,24 @@
3539
fail("Parameter 'password_hash' or 'password' should be provided to mongodb::db.")
3640
}
3741

42+
if $auth_mechanism == 'scram_sha_256' {
43+
$password_config = {
44+
password => $password,
45+
update_password => $update_password,
46+
}
47+
} else {
48+
$password_config = {
49+
password_hash => $hash,
50+
}
51+
}
52+
3853
mongodb_user { "User ${user} on db ${db_name}":
39-
ensure => present,
40-
password_hash => $hash,
41-
username => $user,
42-
database => $db_name,
43-
roles => $roles,
54+
ensure => present,
55+
username => $user,
56+
database => $db_name,
57+
roles => $roles,
58+
auth_mechanism => $auth_mechanism,
59+
* => $password_config,
4460
}
4561
}
4662
}

‎manifests/params.pp

+1
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
$restart = true
1212
$create_admin = false
1313
$admin_username = 'admin'
14+
$admin_auth_mechanism = 'scram_sha_1'
1415
$admin_roles = [
1516
'userAdmin', 'readWrite', 'dbAdmin', 'dbAdminAnyDatabase', 'readAnyDatabase',
1617
'readWriteAnyDatabase', 'userAdminAnyDatabase', 'clusterAdmin',

‎manifests/server.pp

+7-3
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,8 @@
7676
Boolean $create_admin = $mongodb::params::create_admin,
7777
String $admin_username = $mongodb::params::admin_username,
7878
Optional[Variant[String, Sensitive[String]]] $admin_password = undef,
79+
Enum['scram_sha_1', 'scram_sha_256'] $admin_auth_mechanism = $mongodb::params::admin_auth_mechanism,
80+
Boolean $admin_update_password = false,
7981
Boolean $handle_creds = $mongodb::params::handle_creds,
8082
Boolean $store_creds = $mongodb::params::store_creds,
8183
Array $admin_roles = $mongodb::params::admin_roles,
@@ -105,9 +107,11 @@
105107
}
106108
if $create_admin and ($service_ensure == 'running' or $service_ensure == true) {
107109
mongodb::db { 'admin':
108-
user => $admin_username,
109-
password => $admin_password_unsensitive,
110-
roles => $admin_roles,
110+
user => $admin_username,
111+
auth_mechanism => $admin_auth_mechanism,
112+
password => $admin_password_unsensitive,
113+
roles => $admin_roles,
114+
update_password => $admin_update_password,
111115
}
112116

113117
# Make sure it runs before other DB creation

‎spec/unit/puppet/provider/mongodb_user/mongodb_spec.rb

+1-1
Original file line numberDiff line numberDiff line change
@@ -54,9 +54,9 @@
5454
cmd_json = <<-EOS.gsub(%r{^\s*}, '').gsub(%r{$\n}, '')
5555
{
5656
"createUser":"new_user",
57-
"pwd":"pass",
5857
"customData":{"createdBy":"Puppet Mongodb_user['new_user']"},
5958
"roles":[{"role":"role1","db":"new_database"},{"role":"role2","db":"other_database"}],
59+
"pwd":"pass",
6060
"digestPassword":false
6161
}
6262
EOS

0 commit comments

Comments
 (0)