DOCSP-38861 - OIDC

source/includes/authentication/azure-envs-connection-string.py

@@ -0,0 +1,17 @@
+from pymongo import MongoClient
+from azure.identity import DefaultAzureCredential
+from pymongo.auth_oidc import OIDCCallback, OIDCCallbackContext, OIDCCallbackResult
+
+# define callback, properties, URI, and MongoClient
+audience = "<percent-encoded application or service that the OIDC access token is intended for>"
+client_id = "<Azure identity client ID>"
+class MyCallback(OIDCCallback):
+    def fetch(self, context: OIDCCallbackContext) -> OIDCCallbackResult:
+        credential = DefaultAzureCredential(managed_identity_client_id=client_id)
+        token = credential.get_token(f"{audience}/.default").token
+        return OIDCCallbackResult(access_token=token) 
+properties = {"OIDC_CALLBACK": MyCallback()}
+uri = ("mongodb://<hostname>:<port>/?"
+       "&authMechanism=MONGODB-OIDC"
+       "&authMechanismProperties=properties")
+client = MongoClient(uri)

source/includes/authentication/azure-envs-mongoclient.py

@@ -0,0 +1,18 @@
+from pymongo import MongoClient
+from azure.identity import DefaultAzureCredential
+from pymongo.auth_oidc import OIDCCallback, OIDCCallbackContext, OIDCCallbackResult
+
+# define callback, properties, and MongoClient
+audience = "<percent-encoded application or service that the OIDC access token is intended for>"
+client_id = "<Azure identity client ID>"
+class MyCallback(OIDCCallback):
+    def fetch(self, context: OIDCCallbackContext) -> OIDCCallbackResult:
+        credential = DefaultAzureCredential(managed_identity_client_id=client_id)
+        token = credential.get_token(f"{audience}/.default").token
+        return OIDCCallbackResult(access_token=token) 
+properties = {"OIDC_CALLBACK": MyCallback()}
+client = MongoClient(
+   "mongodb://<hostname>:<port>",
+   authMechanism="MONGODB-OIDC",
+   authMechanismProperties=properties,
+)

source/includes/authentication/azure-imds-connection-string.py

@@ -0,0 +1,9 @@
+from pymongo import MongoClient
+
+# define properties, URI, and MongoClient
+properties = {"ENVIRONMENT": "azure", "TOKEN_RESOURCE": "<audience>"}
+uri = ("mongodb://<hostname>:<port>/?"
+       "username=<Azure identity client ID>"
+       "&authMechanism=MONGODB-OIDC"
+       "&authMechanismProperties=properties")
+client = MongoClient(uri)

source/includes/authentication/azure-imds-mongoclient.py

@@ -0,0 +1,10 @@
+from pymongo import MongoClient
+
+# define properties and MongoClient
+properties = {"ENVIRONMENT": "azure", "TOKEN_RESOURCE": "<audience>"}
+client = MongoClient(
+    "mongodb://<hostname>:<port>",
+    username="<Azure identity client ID>",
+    authMechanism="MONGODB-OIDC",
+    authMechanismProperties=properties,
+)

source/includes/authentication/gcp-gke-connection-string.py

@@ -0,0 +1,14 @@
+from pymongo import MongoClient
+from pymongo.auth_oidc import OIDCCallback, OIDCCallbackContext, OIDCCallbackResult
+
+# define callback, properties, URI, and MongoClient
+class MyCallback(OIDCCallback):
+    def fetch(self, context: OIDCCallbackContext) -> OIDCCallbackResult:
+        with open("/var/run/secrets/kubernetes.io/serviceaccount/token") as fid:
+            token = fid.read()
+        return OIDCCallbackResult(access_token=token)
+properties = {"OIDC_CALLBACK": MyCallback()}
+uri = ("mongodb://<hostname>:<port>/?"
+       "&authMechanism=MONGODB-OIDC"
+       "&authMechanismProperties=properties")
+client = MongoClient(uri)

source/includes/authentication/gcp-gke-mongoclient.py

@@ -0,0 +1,15 @@
+from pymongo import MongoClient
+from pymongo.auth_oidc import OIDCCallback, OIDCCallbackContext, OIDCCallbackResult
+
+# define callback, properties, and MongoClient
+class MyCallback(OIDCCallback):
+    def fetch(self, context: OIDCCallbackContext) -> OIDCCallbackResult:
+        with open("/var/run/secrets/kubernetes.io/serviceaccount/token") as fid:
+            token = fid.read()
+        return OIDCCallbackResult(access_token=token)
+properties = {"OIDC_CALLBACK": MyCallback()}
+client = MongoClient(
+   "mongodb://<hostname>:<port>",
+   authMechanism="MONGODB-OIDC",
+   authMechanismProperties=properties,
+)

source/includes/authentication/gcp-imds-connection-string.py

@@ -0,0 +1,9 @@
+from pymongo import MongoClient
+
+# define properties, URI, and MongoClient
+properties = {"ENVIRONMENT": "gcp", "TOKEN_RESOURCE": "<audience>"}
+uri = ("mongodb://<hostname>:<port>/?"
+       "username=<GCP identity client ID>"
+       "&authMechanism=MONGODB-OIDC"
+       "&authMechanismProperties=properties")
+client = MongoClient(uri)

source/includes/authentication/gcp-imds-mongoclient.py

@@ -0,0 +1,10 @@
+from pymongo import MongoClient
+
+# define properties and MongoClient
+properties = {"ENVIRONMENT": "gcp", "TOKEN_RESOURCE": "<audience>"}
+client = MongoClient(
+   "mongodb://<hostname>:<port>",
+   username="<GCP identity client ID>",
+   authMechanism="MONGODB-OIDC",
+   authMechanismProperties=properties,
+)

source/security.txt

@@ -358,7 +358,7 @@ Unix
          client = pymongo.MongoClient(uri)
 
 To learn more about authenticating with Kerberos, see
-:ref:`pymongo-kerberos` in the Authentication guide.
+:ref:`pymongo-kerberos` in the Enterprise Authentication guide.
 
 Windows
 ~~~~~~~
@@ -393,7 +393,7 @@ Windows
                client = pymongo.MongoClient(uri)
 
 To learn more about authenticating with Kerberos, see
-:ref:`pymongo-kerberos` in the Authentication guide.
+:ref:`pymongo-kerberos` in the Enterprise Authentication guide.
 
 PLAIN SASL
 ----------
@@ -426,4 +426,95 @@ PLAIN SASL
          client = pymongo.MongoClient(uri)
 
 To learn more about authenticating with PLAIN SASL, see
-:ref:`pymongo-sasl` in the Authentication guide.
+:ref:`pymongo-sasl` in the Enterprise Authentication guide.
+
+MONGODB-OIDC
+------------
+
+Azure IMDS
+~~~~~~~~~~
+
+.. tabs::
+
+   .. tab:: MongoClient
+      :tabid: mongoclient
+
+      .. literalinclude:: /includes/authentication/azure-imds-mongoclient.py
+            :language: python
+            :copyable: true
+
+   .. tab:: Connection String
+      :tabid: connectionstring
+
+      .. literalinclude:: /includes/authentication/azure-imds-connection-string.py
+            :language: python
+            :copyable: true
+
+To learn more about authenticating with OIDC, see
+:ref:`pymongo-mongodb-oidc-azure-imds` in the Authentication guide.
+
+GCP IMDS
+~~~~~~~~
+
+.. tabs::
+
+   .. tab:: MongoClient
+      :tabid: mongoclient
+
+      .. literalinclude:: /includes/authentication/gcp-imds-mongoclient.py
+            :language: python
+            :copyable: true
+
+   .. tab:: Connection String
+      :tabid: connectionstring
+
+      .. literalinclude:: /includes/authentication/gcp-imds-connection-string.py
+            :language: python
+            :copyable: true
+
+To learn more about authenticating with OIDC, see
+:ref:`pymongo-mongodb-oidc-gcp-imds` in the Authentication guide.
+
+Other Azure Environments
+~~~~~~~~~~~~~~~~~~~~~~~~
+
+.. tabs::
+
+   .. tab:: MongoClient
+      :tabid: mongoclient
+
+      .. literalinclude:: /includes/authentication/azure-envs-mongoclient.py
+            :language: python
+            :copyable: true
+
+   .. tab:: Connection String
+      :tabid: connectionstring
+
+      .. literalinclude:: /includes/authentication/azure-envs-connection-string.py
+            :language: python
+            :copyable: true
+
+To learn more about authenticating with OIDC, see
+:ref:`pymongo-mongodb-oidc-azure-envs` in the Authentication guide.
+
+GCP GKE
+~~~~~~~
+
+.. tabs::
+
+   .. tab:: MongoClient
+      :tabid: mongoclient
+
+      .. literalinclude:: /includes/authentication/gcp-gke-mongoclient.py
+            :language: python
+            :copyable: true
+
+   .. tab:: Connection String
+      :tabid: connectionstring
+
+      .. literalinclude:: /includes/authentication/gcp-gke-connection-string.py
+            :language: python
+            :copyable: true
+
+To learn more about authenticating with OIDC, see
+:ref:`pymongo-mongodb-oidc-gcp-gke` in the Authentication guide.