diff options
Diffstat (limited to 'jstests/auth')
| -rw-r--r-- | jstests/auth/authz_cache_on_system_modification.js | 30 | ||||
| -rw-r--r-- | jstests/auth/builtin_roles.js | 1 | ||||
| -rw-r--r-- | jstests/auth/cluster_monitor_role_find_system_sessions.js | 37 | ||||
| -rw-r--r-- | jstests/auth/keyfile_auth_ensure_correct_username_change.js | 73 | ||||
| -rw-r--r-- | jstests/auth/renameRestrictedCollections.js | 5 | ||||
| -rw-r--r-- | jstests/auth/rename_encrypted_collection.js | 129 | ||||
| -rw-r--r-- | jstests/auth/rename_system_buckets_collection.js | 128 | ||||
| -rw-r--r-- | jstests/auth/restore_role_create_collection_via_apply_ops.js | 61 | ||||
| -rw-r--r-- | jstests/auth/system_buckets_invalid_nss.js | 21 |
9 files changed, 13 insertions, 472 deletions
diff --git a/jstests/auth/authz_cache_on_system_modification.js b/jstests/auth/authz_cache_on_system_modification.js index 65c49951853..23473cd0d01 100644 --- a/jstests/auth/authz_cache_on_system_modification.js +++ b/jstests/auth/authz_cache_on_system_modification.js @@ -7,6 +7,7 @@ const conn = MongoRunner.runMongod({auth: ''}); let db = conn.getDB('admin'); +const authzErrorCode = 13; // creates a root user assert.commandWorked(db.runCommand({createUser: 'root', pwd: 'pwd', roles: ['__system']}), @@ -45,32 +46,23 @@ db.logout(); assert(db.auth('custom', 'pwd')); assert.commandFailedWithCode( db.runCommand({insert: "admin.test", documents: [{woo: "mar"}]}), - ErrorCodes.Unauthorized, + authzErrorCode, "Privileges retained after modification to system.roles collections"); db.logout(); })(); -// tests that a user cannot rename the system.users collection. +// tests that a user does not retain their privileges after the system.users colleciton is modified (function testModifySystemUsersCollection() { - jsTestLog("Testing that a user cannot rename the system.users collection"); + jsTestLog("Testing authz cache invalidation on system.users collection modification"); assert(db.auth('root', 'pwd')); - - assert.commandFailedWithCode( - db.runCommand({renameCollection: 'admin.system.users', to: 'foo.system.users'}), - ErrorCodes.IllegalOperation, - "Renaming the system.users collection should not be allowed"); - assert.commandFailedWithCode( - db.runCommand({renameCollection: 'foo.system.users', to: 'admin.system.users'}), - ErrorCodes.IllegalOperation, - "Renaming the system.users collection should not be allowed"); - assert.commandFailedWithCode( - db.runCommand({renameCollection: 'admin.system.users', to: 'admin.system.foo'}), - ErrorCodes.IllegalOperation, - "Renaming the system.users collection should not be allowed"); + assert.commandWorked(db.createCollection("scratch", {}), + "Collection not created with root user"); + assert.commandWorked(db.runCommand({renameCollection: 'admin.system.users', to: 'admin.foo'}), + "System collection could not be renamed with root user"); assert.commandFailedWithCode( - db.runCommand({renameCollection: 'admin.system.foo', to: 'admin.system.users'}), - ErrorCodes.IllegalOperation, - "Renaming the system.users collection should not be allowed"); + db.runCommand({renameCollection: 'admin.scratch', to: 'admin.system.users'}), + authzErrorCode, + "User cache not invalidated after modification to system collection"); db.logout(); })(); diff --git a/jstests/auth/builtin_roles.js b/jstests/auth/builtin_roles.js index 354bd69c67a..67590b1c606 100644 --- a/jstests/auth/builtin_roles.js +++ b/jstests/auth/builtin_roles.js @@ -64,7 +64,6 @@ function runTest(mongo) { 'killCursors', 'listCollections', 'listIndexes', - 'listSearchIndexes', 'planCacheRead' ]; const kAdminReadPrivs = [ diff --git a/jstests/auth/cluster_monitor_role_find_system_sessions.js b/jstests/auth/cluster_monitor_role_find_system_sessions.js deleted file mode 100644 index 19087a81f83..00000000000 --- a/jstests/auth/cluster_monitor_role_find_system_sessions.js +++ /dev/null @@ -1,37 +0,0 @@ -// Verify that the clusterMonitor role can access config.system.sessions - -(function() { -'use strict'; - -function runTestAs(conn, role) { - const admin = conn.getDB('admin'); - const config = conn.getDB('config'); - - assert(admin.auth('admin', 'admin')); - const user = role + 'User'; - assert.commandWorked(admin.runCommand({createUser: user, pwd: 'pwd', roles: [role]})); - admin.logout(); - - assert(admin.auth(user, 'pwd')); - jsTest.log('Acting as user with the ' + role + ' role'); - jsTest.log(assert.commandWorked(admin.runCommand({connectionStatus: 1, showPrivileges: 1}))); - - assert.commandWorked(config.runCommand({collStats: 'system.sessions'})); - assert.commandFailedWithCode(config.runCommand({collStats: 'system.version'}), - ErrorCodes.Unauthorized); - admin.logout(); -} - -function runTest(conn) { - const admin = conn.getDB('admin'); - const config = conn.getDB('config'); - assert.commandWorked( - admin.runCommand({createUser: 'admin', pwd: 'admin', roles: ['__system']})); - - runTestAs(conn, 'clusterMonitor'); -} - -const standalone = MongoRunner.runMongod({auth: ''}); -runTest(standalone); -MongoRunner.stopMongod(standalone); -})(); diff --git a/jstests/auth/keyfile_auth_ensure_correct_username_change.js b/jstests/auth/keyfile_auth_ensure_correct_username_change.js deleted file mode 100644 index a57333ad8d8..00000000000 --- a/jstests/auth/keyfile_auth_ensure_correct_username_change.js +++ /dev/null @@ -1,73 +0,0 @@ -(function() { -'use strict'; - -load("jstests/libs/log.js"); // For findMatchingLogLine. - -function assertLog(mongo, shouldExist) { - const profileLevelDB = mongo.getDB("keyfile_auth_ensure_correct_username_change"); - const globalLog = assert.commandWorked(profileLevelDB.adminCommand({getLog: 'global'})); - const fieldMatcher = {msg: "Different user name was supplied to saslSupportedMechs"}; - - if (shouldExist) { - assert( - findMatchingLogLine(globalLog.log, fieldMatcher), - "Did not find log line concerning \"Different user name was supplied to saslSupportedMechs\" when we expected to."); - } else { - assert.eq( - null, - findMatchingLogLine(globalLog.log, fieldMatcher), - "Unexpectedly found log line concerning \"Different user name was supplied to saslSupportedMechs\"."); - } -} - -// Switching from __system to another user should result in a warning. -function runSaslSupportedMechsDiffUserTest() { - const mongo = MongoRunner.runMongod({auth: "", keyFile: "jstests/libs/key1"}); - const admin = mongo.getDB("admin"); - - admin.createUser({user: 'user', pwd: 'pass', roles: jsTest.adminUserRoles}); - - // The username should be set to __system@local here because of the saslSupportedMechs field.. - assert.commandWorked(admin.runCommand({ - hello: 1, - saslSupportedMechs: "local.__system", - })); - - // During this authentication, the username should be set to user@admin. - assert(admin.auth({user: 'user', pwd: 'pass', mechanism: 'SCRAM-SHA-256'})); - - // We expect to see a log detailing that the username changed during authentication. - assertLog(mongo, true /* shouldExist */); - - MongoRunner.stopMongod(mongo); -} - -// Authenticating directly as __system without saslSupportedMechs should not result in a log. -function runSystemDirectAuthTest() { - const mongo = MongoRunner.runMongod({auth: "", keyFile: "jstests/libs/key1"}); - const local = mongo.getDB("local"); - assert(local.auth({user: '__system', pwd: 'foopdedoop'})); - - // We don't expect to see a log detailing that the username changed during authentication. - assertLog(mongo, false /* shouldExist */); - - MongoRunner.stopMongod(mongo); -} - -// Authenticating directly as user@admin should not result in a username switch warning. -function runRegularUserDirectAuthTest() { - const mongo = MongoRunner.runMongod({auth: "", keyFile: "jstests/libs/key1"}); - const admin = mongo.getDB("admin"); - - admin.createUser({user: 'user', pwd: 'pass', roles: jsTest.adminUserRoles}); - assert(admin.auth({user: 'user', pwd: 'pass'})); - - // We don't expect to see a log detailing that the username changed during authentication. - assertLog(mongo, false /* shouldExist */); - MongoRunner.stopMongod(mongo); -} - -runSaslSupportedMechsDiffUserTest(); -runSystemDirectAuthTest(); -runRegularUserDirectAuthTest(); -})(); diff --git a/jstests/auth/renameRestrictedCollections.js b/jstests/auth/renameRestrictedCollections.js index d54a0aec3eb..4d487d38d08 100644 --- a/jstests/auth/renameRestrictedCollections.js +++ b/jstests/auth/renameRestrictedCollections.js @@ -109,10 +109,9 @@ adminDB.logout(); // Test renaming system.users collection with __system assert(adminDB.auth('rootier', 'password')); -jsTestLog("Test that with __system you CANNOT rename to/from system.users"); +jsTestLog("Test that with __system you CAN rename to/from system.users"); res = adminDB.system.users.renameCollection("users", true); -assert.eq(0, res.ok, tojson(res)); -assert.eq(ErrorCodes.IllegalOperation, res.code); +assert.eq(1, res.ok, tojson(res)); // At this point, all the user documents are gone, so further activity may be unauthorized, // depending on cluster configuration. So, this is the end of the test. diff --git a/jstests/auth/rename_encrypted_collection.js b/jstests/auth/rename_encrypted_collection.js deleted file mode 100644 index 76b01f9e62d..00000000000 --- a/jstests/auth/rename_encrypted_collection.js +++ /dev/null @@ -1,129 +0,0 @@ -/** - * Verify renaming to/from a collection with encrypted fields is disallowed depending on the users - * privileges - * - * @tags: [ - * requires_fcv_61, - * ] - */ -load("jstests/fle2/libs/encrypted_client_util.js"); - -(function() { -'use strict'; - -function runTestWithAuth(conn, allowsRename, verifyFunction) { - const db = conn.getDB("test"); - const srcDbName = 'rename_encrypted_collection_src_db'; - const tgtDbName = 'rename_encrypted_collection_tgt_db'; - const dbSrc = db.getSiblingDB(srcDbName); - const dbTgt = db.getSiblingDB(tgtDbName); - - dbSrc.encrypted.drop(); - dbTgt.encrypted.drop(); - - const sampleEncryptedFields = { - "fields": [ - { - "path": "firstName", - "keyId": UUID("11d58b8a-0c6c-4d69-a0bd-70c6d9befae9"), - "bsonType": "string", - "queries": {"queryType": "equality"} - }, - ] - }; - - const srcEncryptedErrmsg = "Cannot rename an encrypted collection"; - const tgtEncryptedErrmsg = "Cannot rename to an existing encrypted collection"; - - const adminDB = conn.getDB("admin"); - - assert.commandWorked( - dbSrc.createCollection("encrypted", {encryptedFields: sampleEncryptedFields})); - assert.commandWorked(dbSrc.createCollection("unencrypted")); - - assert.commandWorked( - dbTgt.createCollection("encrypted", {encryptedFields: sampleEncryptedFields})); - - jsTestLog("Test renaming encrypted collection to another namespace is prohibited"); - verifyFunction( - dbSrc.adminCommand({renameCollection: dbSrc + ".encrypted", to: dbSrc + ".renamed"}), - "Renaming an encrypted collection within same DB passed", - srcEncryptedErrmsg); - - if (!allowsRename) { - verifyFunction(dbSrc.adminCommand( - {renameCollection: dbSrc + ".encrypted", to: dbTgt + ".unencrypted"}), - "Renaming an encrypted collection between DBs passed", - srcEncryptedErrmsg); - } - - jsTestLog("Test renaming unencrypted collection to an encrypted namespace is prohibited"); - verifyFunction( - dbSrc.adminCommand( - {renameCollection: dbSrc + ".unencrypted", to: dbSrc + ".encrypted", dropTarget: true}), - "Renaming to an encrypted collection within same DB passed", - tgtEncryptedErrmsg); - - if (!allowsRename) { - verifyFunction(dbSrc.adminCommand({ - renameCollection: dbSrc + ".unencrypted", - to: dbTgt + ".encrypted", - dropTarget: true - }), - "Renaming to an encrypted collection between DBs passed", - tgtEncryptedErrmsg); - } -} - -function runTest(conn) { - const adminDB = conn.getDB("admin"); - - // Create the admin user. - assert.commandWorked(adminDB.runCommand({createUser: "admin", pwd: "admin", roles: ["root"]})); - assert.eq(1, adminDB.auth("admin", "admin")); - - // Create a low priv user - assert.commandWorked(adminDB.runCommand( - {createUser: "lowpriv", pwd: "lowpriv", roles: ["readWriteAnyDatabase"]})); - - // Run tests with a user that has restore/backup role and verify they can rename - runTestWithAuth(conn, true, (cmdObj, assertMsg, errorMsg) => { - assert.commandWorked(cmdObj, assertMsg); - }); - adminDB.logout(); - - assert.eq(1, adminDB.auth("lowpriv", "lowpriv")); - - // Run tests with a user that does not have restore/backup and verify the rename fails - runTestWithAuth(conn, false, (cmd, assertMsg, errorMsg) => { - let res = assert.commandFailedWithCode(cmd, ErrorCodes.IllegalOperation, assertMsg); - assert.eq(res.errmsg, errorMsg); - }); -} - -jsTestLog("ReplicaSet: Testing fle2 collection rename"); -{ - const rst = new ReplSetTest({nodes: 1}); - rst.startSet({auth: "", keyFile: 'jstests/libs/key1'}); - - rst.initiate(); - rst.awaitReplication(); - runTest(rst.getPrimary(), rst.getPrimary()); - rst.stopSet(); -} - -jsTestLog("Sharding: Testing fle2 collection rename"); -{ - const st = new ShardingTest({ - shards: 1, - mongos: 1, - config: 1, - keyFile: "jstests/libs/key1", - other: {shardOptions: {auth: ""}} - }); - - runTest(st.s); - - st.stop(); -} -}()); diff --git a/jstests/auth/rename_system_buckets_collection.js b/jstests/auth/rename_system_buckets_collection.js deleted file mode 100644 index 2a6fa9cfe3e..00000000000 --- a/jstests/auth/rename_system_buckets_collection.js +++ /dev/null @@ -1,128 +0,0 @@ -// Tests renaming the system.buckets collection. -(function() { -"use strict"; - -// Set up the test database. -const dbName = "test"; -const collName = "mongosync.tmp.UUID123"; -const bucketsCollName = `system.buckets.${collName}`; -const targetBucketsCollName = "system.buckets.manual"; - -function renameBucketsCollection(adminDB, username, shouldSucceed) { - // Create collection under admin user - assert.eq(1, adminDB.auth("admin", "admin")); - - const testDB = adminDB.getSiblingDB(dbName); - - testDB[bucketsCollName].drop(); - testDB[targetBucketsCollName].drop(); - - assert.commandWorked( - testDB.createCollection(bucketsCollName, {timeseries: {timeField: "time"}})); - adminDB.logout(); - - // Try rename with test users - jsTestLog("Testing system.buckets renaming with username: " + username); - assert(adminDB.auth(username, 'password')); - - // No privilege grants the ability to rename a system.buckets collection to a non-bucket - // namespace. - assert.commandFailed(testDB.adminCommand({ - renameCollection: `${testDB}.${bucketsCollName}`, - to: `${testDB}.${collName}`, - dropTarget: false - })); - - const res = testDB.adminCommand({ - renameCollection: `${testDB}.${bucketsCollName}`, - to: `${testDB}.${targetBucketsCollName}`, - dropTarget: true - }); - - assert.eq((shouldSucceed) ? 1 : 0, - res.ok, - "Rename collection failed or succeeded unexpectedly:" + tojson(res)); - - adminDB.logout(); -} - -function runTest(conn) { - const adminDB = conn.getDB("admin"); - - // Create the admin user. - adminDB.createUser({user: 'admin', pwd: 'admin', roles: ['root']}); - assert.eq(1, adminDB.auth("admin", "admin")); - - // Create roles with ability to rename system.buckets collections. - adminDB.createRole({ - role: "renameBucketsOnly", - privileges: [{ - resource: {db: '', system_buckets: ''}, - actions: [ - "createIndex", - "dropCollection", - "find", - "insert", - ] - }], - roles: [] - }); - - // Create test users. - adminDB.createUser( - {user: 'userAdmin', pwd: 'password', roles: ['userAdminAnyDatabase', 'renameBucketsOnly']}); - - // Create read and write users. - adminDB.createUser({ - user: 'readWriteAdmin', - pwd: 'password', - roles: ['readWriteAnyDatabase', 'renameBucketsOnly'] - }); - - // Create strong users. - adminDB.createUser({user: 'restore', pwd: 'password', roles: ['restore', 'renameBucketsOnly']}); - adminDB.createUser({user: 'root', pwd: 'password', roles: ['root', 'renameBucketsOnly']}); - adminDB.createUser( - {user: 'rootier', pwd: 'password', roles: ['__system', 'renameBucketsOnly']}); - adminDB.createUser( - {user: 'reader', pwd: 'password', roles: ['readAnyDatabase', 'renameBucketsOnly']}); - - adminDB.logout(); - - // Expect renaming system.buckets collection to succeed. - renameBucketsCollection(adminDB, 'restore', true); - renameBucketsCollection(adminDB, 'root', true); - renameBucketsCollection(adminDB, 'rootier', true); - - // Second test case should fail for user with inadequate role. - renameBucketsCollection(adminDB, 'reader', false); - renameBucketsCollection(adminDB, 'readWriteAdmin', false); - renameBucketsCollection(adminDB, 'userAdmin', false); -} - -jsTestLog("ReplicaSet: Testing rename timeseries collection"); -{ - const rst = new ReplSetTest({nodes: 1, auth: "", keyFile: 'jstests/libs/key1'}); - rst.startSet(); - - rst.initiate(); - rst.awaitReplication(); - runTest(rst.getPrimary()); - rst.stopSet(); -} - -jsTestLog("Sharding: Testing rename timeseries collection"); -{ - const st = new ShardingTest({ - shards: 1, - mongos: 1, - config: 1, - keyFile: "jstests/libs/key1", - other: {shardOptions: {auth: ""}} - }); - - runTest(st.s); - - st.stop(); -} -})(); diff --git a/jstests/auth/restore_role_create_collection_via_apply_ops.js b/jstests/auth/restore_role_create_collection_via_apply_ops.js deleted file mode 100644 index be30be7db47..00000000000 --- a/jstests/auth/restore_role_create_collection_via_apply_ops.js +++ /dev/null @@ -1,61 +0,0 @@ -// Verify that mongorestore can create a collection via applyOps - -(function() { -'use strict'; - -function makeCreateOp(collName, uuid = undefined) { - const op = { - op: 'c', - ns: 'test.$cmd', - o: { - create: collName, - idIndex: { - key: {_id: 1}, - v: 2, - name: "_id_", - ns: "test." + collName, - }, - }, - }; - if (uuid) { - op.ui = uuid; - } - return op; -} - -function assertHasCollection(db, collName, expectUUID = undefined) { - const colls = db.getCollectionInfos({name: collName}); - assert.eq(colls.length, 1, colls); - if (expectUUID !== undefined) { - assert.eq(colls[0].info.uuid, expectUUID, colls); - } -} - -function runTest(conn) { - const admin = conn.getDB('admin'); - const test = conn.getDB('test'); - assert.commandWorked(admin.runCommand({createUser: 'admin', pwd: 'admin', roles: ['root']})); - assert(admin.auth('admin', 'admin')); - - assert.commandWorked( - admin.runCommand({createUser: 'restore1', pwd: 'pwd', roles: ['restore']})); - admin.logout(); - - assert(admin.auth('restore1', 'pwd')); - - // Simple create collection op. - assert.commandWorked(admin.runCommand({applyOps: [makeCreateOp('test1')]})); - assertHasCollection(test, 'test1'); - - // Create collection with UUID. - const kSpecificUUID = UUID(); - assert.commandWorked(admin.runCommand({applyOps: [makeCreateOp('test2', kSpecificUUID)]})); - assertHasCollection(test, 'test2', kSpecificUUID); - - admin.logout(); -} - -const standalone = MongoRunner.runMongod({auth: ''}); -runTest(standalone); -MongoRunner.stopMongod(standalone); -})();
\ No newline at end of file diff --git a/jstests/auth/system_buckets_invalid_nss.js b/jstests/auth/system_buckets_invalid_nss.js deleted file mode 100644 index dd182c48584..00000000000 --- a/jstests/auth/system_buckets_invalid_nss.js +++ /dev/null @@ -1,21 +0,0 @@ -// Validate that *.system.buckets.system.buckets.* is an invalid namespace - -(function() { -"use strict"; - -function runTest(conn) { - const admin = conn.getDB('admin'); - assert.commandWorked(admin.runCommand({createUser: 'admin', pwd: 'admin', roles: ['root']})); - - assert.commandFailedWithCode(admin.system.buckets.system.buckets.foo.insert({x: 1}), - [ErrorCodes.Unauthorized]); - - assert(admin.auth('admin', 'admin')); - assert.commandFailedWithCode(admin.system.buckets.system.buckets.foo.insert({x: 1}), - [ErrorCodes.InvalidNamespace]); -} - -const mongod = MongoRunner.runMongod({auth: ''}); -runTest(mongod); -MongoRunner.stopMongod(mongod); -}()); |