mongo/jstests/auth/security_token.js

// Test passing security token with op messages.
// @tags: [requires_replication, requires_sharding]

import {runCommandWithSecurityToken} from "jstests/libs/multitenancy_utils.js";
import {ReplSetTest} from "jstests/libs/replsettest.js";

const tenantID = ObjectId();
const kLogLevelForToken = 5;
const kAcceptedSecurityTokenID = 5838100;
const kLogoutMessageID = 6161506;
const kStaleAuthenticationMessageID = 6161507;
const kVTSKey = 'secret';
const isSecurityTokenEnabled = TestData.setParameters.featureFlagSecurityToken;

function assertNoTokensProcessedYet(conn) {
    assert.eq(false,
              checkLog.checkContainsOnceJson(conn, kAcceptedSecurityTokenID, {}),
              'Unexpected security token has been processed');
}

function makeToken(user, db, secret = kVTSKey) {
    const authUser = {user: user, db: db, tenant: tenantID};
    const token = _createSecurityToken(authUser, secret);
    jsTest.log('Using security token: ' + tojson(token));
    return token;
}

function runTest(conn, multitenancyEnabled, rst = undefined) {
    const admin = conn.getDB('admin');

    // Must be authenticated as a user with read/write privileges on non-normal collections, since
    // we are accessing system.users for another tenant.
    assert.commandWorked(admin.runCommand({createUser: 'admin', pwd: 'pwd', roles: ['__system']}));
    assert(admin.auth('admin', 'pwd'));
    // Make a less-privileged base user.
    assert.commandWorked(
        admin.runCommand({createUser: 'baseuser', pwd: 'pwd', roles: ['readWriteAnyDatabase']}));

    const baseConn = new Mongo(conn.host);
    const baseAdmin = baseConn.getDB('admin');
    assert(baseAdmin.auth('baseuser', 'pwd'));

    // Create a tenant-local user.
    const createUserCmd = {createUser: 'user1', pwd: 'pwd', roles: ['readWriteAnyDatabase']};
    const unsignedToken = _createTenantToken({tenant: tenantID});
    if (multitenancyEnabled) {
        assert.commandWorked(runCommandWithSecurityToken(unsignedToken, admin, createUserCmd));

        // Confirm the user exists on the tenant authz collection only, and not the global
        // collection.
        assert.eq(admin.system.users.count({user: 'user1'}),
                  0,
                  'user1 should not exist on global users collection');

        const countUserCmd = {count: "system.users", query: {user: 'user1'}};

        // Count again using unsigned tenant token.
        const usersCountToken =
            assert.commandWorked(runCommandWithSecurityToken(unsignedToken, admin, countUserCmd));
        assert.eq(usersCountToken.n, 1, 'user1 should exist on tenant users collection');

        // Users without `useTenant` should not be able to use unsigned tenant tokens.
        assert.commandFailed(runCommandWithSecurityToken(unsignedToken, baseAdmin, countUserCmd));
    } else {
        assert.commandFailedWithCode(runCommandWithSecurityToken(unsignedToken, admin, {ping: 1}),
                                     ErrorCodes.Unauthorized);
    }

    if (rst) {
        rst.awaitReplication();
    }

    // Dial up the logging to watch for tenant ID being processed.
    const originalLogLevel =
        assert.commandWorked(admin.setLogLevel(kLogLevelForToken)).was.verbosity;

    const tokenConn = new Mongo(conn.host);
    const tokenDB = tokenConn.getDB('admin');

    // Basic OP_MSG command.
    tokenConn._setSecurityToken('');
    assert.commandWorked(tokenDB.runCommand({ping: 1}));
    assertNoTokensProcessedYet(conn);

    // Test that no token equates to unauthenticated.
    assert.commandFailed(tokenDB.runCommand({features: 1}));

    if (multitenancyEnabled && isSecurityTokenEnabled) {
        // Passing a security token with unknown fields will fail at the client
        // while trying to construct a signed security token.
        const kIDLMissingRequiredField = 40414;
        tokenConn._setSecurityToken('e30.e30.deadbeefcafe');  // b64u('{}') === 'e30'
        assert.commandFailedWithCode(tokenDB.runCommand({ping: 1}), kIDLMissingRequiredField);
        assertNoTokensProcessedYet(conn);

        // Passing a valid looking security token signed with the wrong secret should also fail.
        tokenConn._setSecurityToken(makeToken('user1', 'admin', 'haxx'));
        assert.commandFailedWithCode(tokenDB.runCommand({ping: 1}), ErrorCodes.Unauthorized);
        assertNoTokensProcessedYet(conn);

        const token = makeToken('user1', 'admin');
        tokenConn._setSecurityToken(token);

        // Basic use.
        assert.commandWorked(tokenDB.runCommand({features: 1}));

        // Connection status, verify that the user/role info is returned without serializing tenant.
        const authInfo = assert.commandWorked(tokenDB.runCommand({connectionStatus: 1})).authInfo;
        jsTest.log(authInfo);
        assert.eq(authInfo.authenticatedUsers.length, 1);
        assert(0 === bsonWoCompare(authInfo.authenticatedUsers[0], {user: 'user1', db: 'admin'}));
        assert.eq(authInfo.authenticatedUserRoles.length, 1);
        assert(0 ===
               bsonWoCompare(authInfo.authenticatedUserRoles[0],
                             {role: 'readWriteAnyDatabase', db: 'admin'}));

        // Look for "Accepted Security Token" message with explicit tenant logging.
        const expect = {token: token};
        jsTest.log('Checking for: ' + tojson(expect));
        checkLog.containsJson(conn, kAcceptedSecurityTokenID, expect, 'Security Token not logged');

        // Negative test, logMessage requires logMessage privilege on cluster (not granted)
        assert.commandFailed(tokenDB.runCommand({logMessage: 'This is a test'}));

        assert.commandWorked(tokenConn.getDB('test').coll1.insert({x: 1}));

        const log = checkLog.getGlobalLog(conn).map((l) => JSON.parse(l));

        // We successfully dispatched 3 commands as a token auth'd user.
        // The failed command did not dispatch because they are forbidden in multitenancy.
        // We should see three post-operation logout events.
        const logoutMessages = log.filter((l) => (l.id === kLogoutMessageID));
        assert.eq(logoutMessages.length,
                  3,
                  'Unexpected number of logout messages: ' + tojson(logoutMessages));

        // None of those authorization sessions should remain active into their next requests.
        const staleMessages = log.filter((l) => (l.id === kStaleAuthenticationMessageID));
        assert.eq(
            staleMessages.length, 0, 'Unexpected stale authentications: ' + tojson(staleMessages));
    } else {
        assert.commandWorked(
            admin.runCommand({createUser: 'user1', pwd: 'pwd', roles: ['readWriteAnyDatabase']}));
        // Attempting to pass a valid looking security token will fail if not enabled.
        assert.commandFailed(tokenDB.runCommand({features: 1}));
    }

    // Restore logging and conn token before shutting down.
    assert.commandWorked(admin.setLogLevel(originalLogLevel));
}

function runTests(enabled) {
    const opts = {
        auth: '',
        setParameter: {
            multitenancySupport: enabled,
            testOnlyValidatedTenancyScopeKey: kVTSKey,
        },
    };
    {
        const standalone = MongoRunner.runMongod(opts);
        assert(standalone !== null, "MongoD failed to start");
        runTest(standalone, enabled);
        MongoRunner.stopMongod(standalone);
    }

    {
        const rst = new ReplSetTest({nodes: 2, nodeOptions: opts});
        rst.startSet({keyFile: 'jstests/libs/key1'});
        rst.initiate();
        runTest(rst.getPrimary(), enabled, rst);
        rst.stopSet();
    }
    // Do not test sharding since mongos must have an authenticated connection to
    // all mongod nodes, and this conflicts with proxying tokens which we'll be
    // performing in mongoq.
}

runTests(true);
runTests(false);