Skip to content
This repository was archived by the owner on Feb 4, 2022. It is now read-only.

Commit 808ab21

Browse files
committed
fix(sspi): correct auth process for SSPI
The SSPI auth process should have been the same as GSSAPI, but it instead initialized and transitioned kerberos _after_ an initial connect to the client. Starting with MongoDB 4.0, this simply will not work anymore, and needs to be corrected. NODE-1479
1 parent d00b1ab commit 808ab21

File tree

1 file changed

+47
-85
lines changed

1 file changed

+47
-85
lines changed

lib/auth/sspi.js

Lines changed: 47 additions & 85 deletions
Original file line numberDiff line numberDiff line change
@@ -108,7 +108,7 @@ SSPI.prototype.auth = function(server, connections, db, username, password, opti
108108
}
109109
};
110110

111-
var SSIPAuthenticate = function(
111+
function SSIPAuthenticate(
112112
self,
113113
username,
114114
password,
@@ -118,112 +118,74 @@ var SSIPAuthenticate = function(
118118
options,
119119
callback
120120
) {
121-
// Build Authentication command to send to MongoDB
122-
var command = {
123-
saslStart: 1,
124-
mechanism: 'GSSAPI',
125-
payload: '',
126-
autoAuthorize: 1
127-
};
128-
129-
// Create authenticator
130-
var mongo_auth_process = new MongoAuthProcess(
121+
const authProcess = new MongoAuthProcess(
131122
connection.host,
132123
connection.port,
133124
gssapiServiceName,
134125
options
135126
);
136127

137-
// Execute first sasl step
138-
server(
139-
connection,
140-
new Query(self.bson, '$external.$cmd', command, {
128+
function authCommand(command, authCb) {
129+
const query = new Query(self.bson, '$external.$cmd', command, {
141130
numberToSkip: 0,
142131
numberToReturn: 1
143-
}),
144-
function(err, r) {
132+
});
133+
134+
server(connection, query, authCb);
135+
}
136+
137+
authProcess.init(username, password, err => {
138+
if (err) return callback(err, false);
139+
140+
authProcess.transition('', (err, payload) => {
145141
if (err) return callback(err, false);
146-
var doc = r.result;
147142

148-
mongo_auth_process.init(username, password, function(err) {
149-
if (err) return callback(err);
143+
const command = {
144+
saslStart: 1,
145+
mechanism: 'GSSAPI',
146+
payload,
147+
autoAuthorize: 1
148+
};
150149

151-
mongo_auth_process.transition(doc.payload, function(err, payload) {
152-
if (err) return callback(err);
150+
authCommand(command, (err, result) => {
151+
if (err) return callback(err, false);
152+
const doc = result.result;
153153

154-
// Perform the next step against mongod
155-
var command = {
154+
authProcess.transition(doc.payload, (err, payload) => {
155+
if (err) return callback(err, false);
156+
const command = {
156157
saslContinue: 1,
157158
conversationId: doc.conversationId,
158-
payload: payload
159+
payload
159160
};
160161

161-
// Execute the command
162-
server(
163-
connection,
164-
new Query(self.bson, '$external.$cmd', command, {
165-
numberToSkip: 0,
166-
numberToReturn: 1
167-
}),
168-
function(err, r) {
169-
if (err) return callback(err, false);
170-
var doc = r.result;
171-
172-
mongo_auth_process.transition(doc.payload, function(err, payload) {
173-
if (err) return callback(err);
162+
authCommand(command, (err, result) => {
163+
if (err) return callback(err, false);
164+
const doc = result.result;
174165

175-
// Perform the next step against mongod
176-
var command = {
177-
saslContinue: 1,
178-
conversationId: doc.conversationId,
179-
payload: payload
180-
};
181-
182-
// Execute the command
183-
server(
184-
connection,
185-
new Query(self.bson, '$external.$cmd', command, {
186-
numberToSkip: 0,
187-
numberToReturn: 1
188-
}),
189-
function(err, r) {
190-
if (err) return callback(err, false);
191-
var doc = r.result;
192-
193-
mongo_auth_process.transition(doc.payload, function(err, payload) {
194-
// Perform the next step against mongod
195-
var command = {
196-
saslContinue: 1,
197-
conversationId: doc.conversationId,
198-
payload: payload
199-
};
166+
authProcess.transition(doc.payload, (err, payload) => {
167+
if (err) return callback(err, false);
168+
const command = {
169+
saslContinue: 1,
170+
conversationId: doc.conversationId,
171+
payload
172+
};
200173

201-
// Execute the command
202-
server(
203-
connection,
204-
new Query(self.bson, '$external.$cmd', command, {
205-
numberToSkip: 0,
206-
numberToReturn: 1
207-
}),
208-
function(err, r) {
209-
if (err) return callback(err, false);
210-
var doc = r.result;
174+
authCommand(command, (err, response) => {
175+
if (err) return callback(err, false);
211176

212-
if (doc.done) return callback(null, true);
213-
callback(new Error('Authentication failed'), false);
214-
}
215-
);
216-
});
217-
}
218-
);
177+
authProcess.transition(null, err => {
178+
if (err) return callback(err, null);
179+
callback(null, response);
180+
});
219181
});
220-
}
221-
);
182+
});
183+
});
222184
});
223185
});
224-
}
225-
);
226-
};
186+
});
187+
});
188+
}
227189

228190
// Add to store only if it does not exist
229191
var addAuthSession = function(authStore, session) {

0 commit comments

Comments
 (0)