Update upstream source from tag 'upstream/6.0.0'master

Update to upstream version '6.0.0'
with Debian dir 5604a80ec1c96ca76f25f40d78e6ef855abec322

1 files changed, 17 insertions, 33 deletions

diff --git a/src/mongo/db/auth/authentication_session.cpp b/src/mongo/db/auth/authentication_session.cpp
index 97ae7654d01..30d6f74fc31 100644
--- a/src/mongo/db/auth/authentication_session.cpp
+++ b/src/mongo/db/auth/authentication_session.cpp
@@ -40,35 +40,21 @@ namespace mongo {
 namespace {
 constexpr auto kDiagnosticLogLevel = 3;
 
-Status crossVerifyUserNames(const UserName& oldUser,
-                            const UserName& newUser,
-                            const bool isMechX509) noexcept {
+Status crossVerifyUserNames(const UserName& oldUser, const UserName& newUser) noexcept {
     if (oldUser.empty()) {
         return Status::OK();
     }
 
-    // There are some special cases around __system where a switch in the username is acceptable.
-    if (oldUser.getUser() == "__system") {
-        // If the new user is on $external and X.509 auth is being used, then any username is
-        // allowed.
-        if (newUser.getDB() == "$external" && isMechX509) {
-            return Status::OK();
-        }
-    }
-
-    // Allow a switch from an empty user on admin to __system@local if enableTestCommands is true.
-    // This is needed for auth passthrough suites on mongos.
-    if (getTestCommandsEnabled() && oldUser.getUser().empty() && oldUser.getDB() == "admin" &&
-        newUser.getUser() == "__system" && newUser.getDB() == "local") {
-        return Status::OK();
-    }
+    if (!getTestCommandsEnabled()) {
+        // Authenticating the __system@local user to the admin database on mongos is required
+        // by the auth passthrough test suite, hence we forgive this set of errors in testing.
 
-    // Barring special cases, both the database and the username must be the same.
-    if (oldUser.getDB() != newUser.getDB()) {
-        return {
-            ErrorCodes::ProtocolError,
-            str::stream() << "Attempt to switch database target during SASL authentication from "
-                          << oldUser << " to " << newUser};
+        if (oldUser.getDB() != newUser.getDB()) {
+            return {ErrorCodes::ProtocolError,
+                    str::stream()
+                        << "Attempt to switch database target during SASL authentication from "
+                        << oldUser << " to " << newUser};
+        }
     }
 
     if (oldUser.getUser().empty() || newUser.getUser().empty()) {
@@ -215,9 +201,8 @@ void AuthenticationSession::setMechanismName(StringData mechanismName) {
     }
 }
 
-void AuthenticationSession::_verifyUserNameFromSaslSupportedMechanisms(const UserName& userName,
-                                                                       const bool isMechX509) {
-    if (auto status = crossVerifyUserNames(_ssmUserName, userName, isMechX509); !status.isOK()) {
+void AuthenticationSession::_verifyUserNameFromSaslSupportedMechanisms(const UserName& userName) {
+    if (auto status = crossVerifyUserNames(_ssmUserName, userName); !status.isOK()) {
         LOGV2(5286202,
               "Different user name was supplied to saslSupportedMechs",
               "error"_attr = status);
@@ -239,20 +224,20 @@ void AuthenticationSession::setUserNameForSaslSupportedMechanisms(UserName userN
                 "Set user name for session",
                 "userName"_attr = userName,
                 "oldName"_attr = _userName);
-    _verifyUserNameFromSaslSupportedMechanisms(userName, false /* isMechX509 */);
+    _verifyUserNameFromSaslSupportedMechanisms(userName);
 
     _ssmUserName = userName;
 }
 
-void AuthenticationSession::updateUserName(UserName userName, bool isMechX509) {
+void AuthenticationSession::updateUserName(UserName userName) {
     LOGV2_DEBUG(5286203,
                 kDiagnosticLogLevel,
                 "Updating user name for session",
                 "userName"_attr = userName,
                 "oldName"_attr = _userName);
 
-    _verifyUserNameFromSaslSupportedMechanisms(userName, isMechX509);
-    uassertStatusOK(crossVerifyUserNames(_userName, userName, isMechX509));
+    _verifyUserNameFromSaslSupportedMechanisms(userName);
+    uassertStatusOK(crossVerifyUserNames(_userName, userName));
     _userName = userName;
 }
 
@@ -287,8 +272,7 @@ void AuthenticationSession::_finish() {
         if (_mech->isClusterMember()) {
             setAsClusterMember();
         }
-        updateUserName({_mech->getPrincipalName(), _mech->getAuthenticationDatabase()},
-                       _mechName == auth::kMechanismMongoX509);
+        updateUserName({_mech->getPrincipalName(), _mech->getAuthenticationDatabase()});
     }
 }