CDRIVER-4548 Support `ENVIRONMENT:azure` for `MONGODB-OIDC`. #2166

kevinAlbs · 2025-10-31T15:31:53Z

Summary

Support ENVIRONMENT:azure for MONGODB-OIDC.

Extend mcd-azure.h to support Azure IMDS requests for OIDC. This internal header previously only supported Azure IMDS requests to Azure Key Vault for In-Use Encryption.
Add a percent encoding utility to encode the token resource string.

Patch build: https://spruce.mongodb.com/version/6904afbc379d3a0007e1ac83

Testing

Evergreen testing is described in the drivers-evergreen-tools README.md. Testing follows a similar pattern to the testazurekms-task: build test-libmongoc on an Evergreen host, create a remote Azure VM with a matching OS, copy the binary, run the test.

oidc-compile-azure.sh includes a temporary workaround to install UV (as was done in #2163).

Support a custom token resource, optional timeout, and optional client_id.

And move check that both env+user callbacks are not set from auth to cache (to simplify).

The tasks already define their `run_on`.

.evergreen/scripts/oidc-azure-compile.sh

.evergreen/scripts/oidc-azure-test.sh

src/libmongoc/src/mongoc/mcd-azure.h

src/libmongoc/src/mongoc/mongoc-oidc-env.c

src/libmongoc/src/mongoc/mcd-azure.c

src/libmongoc/src/mongoc/mongoc-oidc-env.c

src/libmongoc/src/mongoc/mongoc-oidc-cache.c

To avoid backslashes with multi-line commands.

Ninja uses parallel by default.

Working directory is set by Evergreen task

Already set at the project level.

Saves a small amount of clean-up if topology creation fails before.

eramongodb

Minor feedback remaining; otherwise, LGTM.

eramongodb · 2025-11-13T18:44:11Z

.evergreen/scripts/oidc-azure-compile.sh

+tar -czf test-libmongoc.tar.gz "${files[@]}"
+echo "Creating test-libmongoc tarball ... end"
+
+cat <<EOT > oidc-remote-test-expansion.yml


Suggested change

cat <<EOT > oidc-remote-test-expansion.yml

cat <<EOT >oidc-remote-test-expansion.yml

Formatting.

eramongodb · 2025-11-13T18:44:39Z

.evergreen/config_generator/components/oidc.py

+                bash_exec(
+                    command_type=EvgCommandType.SETUP,
+                    include_expansions_in_env=['AWS_ACCESS_KEY_ID', 'AWS_SECRET_ACCESS_KEY', 'AWS_SESSION_TOKEN'],
+                    env={"AZUREOIDC_VMNAME_PREFIX": "CDRIVER"},


Suggested change

env={"AZUREOIDC_VMNAME_PREFIX": "CDRIVER"},

env={'AZUREOIDC_VMNAME_PREFIX': 'CDRIVER'},

Formatting.

Formatted file with Ruff formatter.

eramongodb · 2025-11-13T18:44:50Z

.evergreen/config_generator/components/oidc.py

+                bash_exec(
+                    command_type=EvgCommandType.SETUP,
+                    script='./drivers-evergreen-tools/.evergreen/auth_oidc/azure/delete-vm.sh',
+                )


Suggested change

)

),

Formatting.

eramongodb · 2025-11-13T18:50:01Z

src/libmongoc/src/mongoc/mongoc-oidc-env.c

+      const mlib_duration remaining = mlib_duration((*timeout_us, us), minus, (bson_get_monotonic_time(), us));
+      timer = mlib_expires_after(remaining);


Suggested change

const mlib_duration remaining = mlib_duration((*timeout_us, us), minus, (bson_get_monotonic_time(), us));

timer = mlib_expires_after(remaining);

timer = mlib_expires_at((mlib_time_point){.time_since_monotonic_start = mlib_duration(*timeout_us, us)});

timeout_us is a time point (in microseconds). bson_get_monotonic_time() calls mlib_now(). I do not think there is a need to go through a duration computation before calling mlib_expires_after() (which calls mlib_now() again).

Note: internal code need not follow public API documentation's instructions to compare against bson_get_monotonic_time().

Good point. Added comment above call to mongoc_oidc_callback_params_set_timeout that bson_get_monotonic_time() calls mlib_now().

connorsmacd

LGTM aside from nitpicks.

connorsmacd · 2025-11-13T19:06:56Z

src/libmongoc/src/mongoc/mongoc-util.c

+   for (char const *i = (char *)str; *i; i++) {
+      if (needs_percent_encoding((unsigned char)*i)) {
+         encoded_len += 3u;


Suggested change

for (char const *i = (char *)str; *i; i++) {

if (needs_percent_encoding((unsigned char)*i)) {

encoded_len += 3u;

static const size_t percent_encoded_char_len = 3u;

for (char const *i = (char *)str; *i; i++) {

if (needs_percent_encoding((unsigned char)*i)) {

encoded_len += percent_encoded_char_len;

Suggest using a constant here since the meaning of 3u wasn't immediately obvious to me.

connorsmacd · 2025-11-13T19:07:25Z

src/libmongoc/src/mongoc/mongoc-util.c

+         int req = bson_snprintf(o, 4, "%%%02X", (unsigned char)*i);
+         // Expect no truncation.
+         BSON_ASSERT(req == 3);
+         o += 3u;


Suggested change

o += 3u;

o += percent_encoded_char_len;

Suggested in review. Not automatically added by Ruff.

kevinAlbs added 10 commits October 30, 2025 15:54

add mcd_get_microseconds

73a9caa

add mongoc_percent_encode

a031652

extend mcd-azure.h

f848d34

Support a custom token resource, optional timeout, and optional client_id.

add (failing) prose tests 5.1 and 5.2

373d1d0

implement mongoc_oidc_env_fn_azure

95df9b4

apply OIDC environment callback

df70d96

And move check that both env+user callbacks are not set from auth to cache (to simplify).

test more bad configuration cases

435ec48

support unified tests with Azure OIDC

d525dfe

add Evergreen tests

7e7678c

remove unnecessary run_on

4499785

The tasks already define their `run_on`.

kevinAlbs requested review from eramongodb and mdb-ad October 31, 2025 17:27

kevinAlbs marked this pull request as ready for review October 31, 2025 17:27

kevinAlbs requested a review from a team as a code owner October 31, 2025 17:27

kevinAlbs requested review from connorsmacd and removed request for mdb-ad November 10, 2025 14:30

eramongodb requested changes Nov 10, 2025

View reviewed changes

kevinAlbs added 11 commits November 11, 2025 08:13

use bash arrays

465f6e8

To avoid backslashes with multi-line commands.

remove unnecessary --parallel

b5c446e

Ninja uses parallel by default.

remove unnecessary cd

f12e802

Working directory is set by Evergreen task

use -l for consistency with run-tests.sh

5c7edae

remove unnecessary 1 hour setup group timeout

90d62f8

Already set at the project level.

add BSON_UNUSED(use_pool_void);

dddaad4

remove unnecessary assertion

847a80f

apply URI to OIDC cache later

e90adf6

Saves a small amount of clean-up if topology creation fails before.

use const pointers

5059177

use tmp_bson to simplify test code

6f4867e

use mlib_duration for timeout argument

2e24796

kevinAlbs mentioned this pull request Nov 11, 2025

CDRIVER-6151 replaced mcd-time.h with mlib utilities #2168

Merged

prefer mlib utilities

58fb40a

clarify cause of error when failing to get token

7382b6a

kevinAlbs requested a review from eramongodb November 12, 2025 16:05

accept an mlib_timer in mcd_azure_access_token_from_imds

7f82240

eramongodb approved these changes Nov 13, 2025

View reviewed changes

connorsmacd approved these changes Nov 13, 2025

View reviewed changes

kevinAlbs added 7 commits November 13, 2025 14:50

format oidc-azure-compile.sh

6bb4c9d

format oidc.py with Ruff formatter

7cc4ecc

avoid calling mlib_now() twice

b7b7cec

declare constant for percent encoded length

612a8dc

Merge branch 'master' into azure.rebased.C4489

dc4c5e2

replace calls of mcd_get_microseconds with mlib_microseconds_count

2600bb2

format: add comma

7f9f633

Suggested in review. Not automatically added by Ruff.

kevinAlbs merged commit e35f024 into mongodb:master Nov 14, 2025
1 of 2 checks passed

	cat <<EOT > oidc-remote-test-expansion.yml
	cat <<EOT >oidc-remote-test-expansion.yml

	env={"AZUREOIDC_VMNAME_PREFIX": "CDRIVER"},
	env={'AZUREOIDC_VMNAME_PREFIX': 'CDRIVER'},

		const mlib_duration remaining = mlib_duration((*timeout_us, us), minus, (bson_get_monotonic_time(), us));
		timer = mlib_expires_after(remaining);

	const mlib_duration remaining = mlib_duration((*timeout_us, us), minus, (bson_get_monotonic_time(), us));
	timer = mlib_expires_after(remaining);
	timer = mlib_expires_at((mlib_time_point){.time_since_monotonic_start = mlib_duration(*timeout_us, us)});

CDRIVER-4548 Support ENVIRONMENT:azure for MONGODB-OIDC. #2166

CDRIVER-4548 Support ENVIRONMENT:azure for MONGODB-OIDC. #2166

Conversation

kevinAlbs commented Oct 31, 2025

Summary

Testing

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

eramongodb left a comment

Choose a reason for hiding this comment

Uh oh!

eramongodb Nov 13, 2025

Choose a reason for hiding this comment

Uh oh!

eramongodb Nov 13, 2025

Choose a reason for hiding this comment

Uh oh!

kevinAlbs Nov 13, 2025

Choose a reason for hiding this comment

Uh oh!

eramongodb Nov 13, 2025

Choose a reason for hiding this comment

Uh oh!

eramongodb Nov 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kevinAlbs Nov 13, 2025

Choose a reason for hiding this comment

Uh oh!

connorsmacd left a comment

Choose a reason for hiding this comment

Uh oh!

connorsmacd Nov 13, 2025

Choose a reason for hiding this comment

Uh oh!

connorsmacd Nov 13, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

CDRIVER-4548 Support `ENVIRONMENT:azure` for `MONGODB-OIDC`. #2166

CDRIVER-4548 Support `ENVIRONMENT:azure` for `MONGODB-OIDC`. #2166

eramongodb Nov 13, 2025 •

edited

Loading